100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 450
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Which specific risk makes the uncorrected design unacceptable?
- All-trusted DHCP snooping provides no protection against rogue lease servers.
- Redundancy claims may not match actual hardware or software failover behavior.
- Undersized PoE causes reduced AP capabilities or unstable power negotiation.
- A cross-chassis bundle unsupported by the platforms can loop or suspend traffic.
Explanation
Correct Answer
A:The supported design response is to trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Incorrect Answers
B:That hazard arises in a separate case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the failure mode evidenced here.
Question 451
Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. Which specific risk makes the uncorrected design unacceptable?
- Dual stack on one site does not transform a single-stack external client automatically.
- Simply assigning IPv6 addresses without routing and security parity can leave unprotected or unreachable paths.
- IPv4 literals and protocols lacking compatible translation can bypass or break a NAT64/DNS64 design.
- Partial address-family migration can unintentionally create weaker security on the new path.
Explanation
Correct Answer
B:The supported design response is to deploy tested dual stack where both address families, DNS, routing and access controls are supported end to end.
Incorrect Answers
A:That hazard arises in a separate case: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It is not the failure mode evidenced here.
Question 452
A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. Which specific risk makes the uncorrected design unacceptable?
- Treating NETCONF as generic REST can skip locking and commit safeguards.
- Assuming all leaves support event publication can create silent observability gaps.
- Concurrent uncoordinated writes can overwrite policy or cause inconsistent device state.
- Treating hybrid connectivity as one trust domain can expose sensitive private systems.
Explanation
Correct Answer
C:The supported design response is to use supported NETCONF locks, edit-config validation and controlled commit workflow to serialize sensitive changes.
Incorrect Answers
A:That hazard arises in a separate case: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It is not the failure mode evidenced here.
Question 453
Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. Which specific risk makes the uncorrected design unacceptable?
- Relying on one group key server can block onboarding or later rekeys.
- A WAN edge connected to the internet is not automatically part of a secure managed SD-WAN fabric.
- Unverified VLAN translation or drop behavior can isolate services or leak adjacent VLANs.
- Using a flat transparent Ethernet VPN can expand broadcast and spanning-tree risk unnecessarily.
Explanation
Correct Answer
B:The supported design response is to select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs.
Incorrect Answers
A:That hazard arises in a separate case: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the failure mode evidenced here.
Question 454
A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. Which specific risk makes the uncorrected design unacceptable?
- Deploying source-specific trees for every sender may increase multicast state unnecessarily.
- Confusing shared-tree and source-tree roles can obscure unexpected bandwidth use.
- Oversubscribing management access can make fault recovery slower than the original outage.
- IGMP membership alone is insufficient for multicast delivery across routed hops.
Explanation
Correct Answer
B:The supported design response is to distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly.
Incorrect Answers
A:That hazard arises in a separate case: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the failure mode evidenced here.
Question 455
A merger requires two administrative BGP regions to appear as one external AS while reducing iBGP mesh size internally. Which specific risk makes the uncorrected design unacceptable?
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- Poor reflector placement or single-reflector dependency can hide routes and amplify outages.
- Assuming parallel sessions alone implies BGP load sharing hides the default single-best-path behavior.
- Misdesigned confederation boundaries can leak internal member-AS details or break route propagation.
Explanation
Correct Answer
D:The supported design response is to evaluate an appropriately designed BGP confederation with documented member-AS and external peer behavior.
Incorrect Answers
A:That hazard relates to another condition: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the direct risk evidenced by this case.
B:That hazard arises in a separate case: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A campus border is configured with two equal-cost external BGP paths but only one is installed for traffic forwarding. It is not the failure mode evidenced here.
Question 456
An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. Which specific risk makes the uncorrected design unacceptable?
- Port-only classification can lose segmentation during mobility.
- Oversubscribed PoE can shut off critical phones or cameras during high load.
- A missing or overbroad MAC limit creates unauthorized layer-2 expansion.
- Untrusted STP control traffic can hijack the root or create forwarding instability.
Explanation
Correct Answer
D:The supported design response is to use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
Incorrect Answers
A:That hazard arises in a separate case: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the failure mode evidenced here.
Question 457
Two business units share one management VLAN with unrestricted access to each other's routers. Which specific risk makes the uncorrected design unacceptable?
- QoS on one hop cannot undo queueing loss caused at a later bottleneck.
- Undifferentiated traffic can starve management and prolong outages.
- Depending exclusively on the failed WAN for troubleshooting hides root-cause evidence.
- A flat shared management network allows lateral movement and overbroad privilege.
Explanation
Correct Answer
D:The supported design response is to segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
Incorrect Answers
A:That hazard arises in a separate case: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the failure mode evidenced here.
Question 458
A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. Which specific risk makes the uncorrected design unacceptable?
- A successful IKE SA alone does not prove that data-plane IPsec policy matches.
- Hub-and-spoke encryption can force avoidable tromboning and reduce availability.
- Overlay encryption overhead can create an otherwise invisible PMTUD blackhole.
- Hand-configuring every edge pair undermines scalable centralized policy and error control.
Explanation
Correct Answer
C:The supported design response is to plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
Incorrect Answers
A:That hazard arises in a separate case: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It is not the failure mode evidenced here.
Question 459
Two acquired companies both use 172.16.0.0/12; an immediate core merge would expose identical destination prefixes. Which specific risk makes the uncorrected design unacceptable?
- Flooding every detail through the entire IS-IS domain increases churn and operational complexity.
- Aggressive detection without addressing physical instability can amplify control-plane churn.
- Merging overlapping routes into a global table can create unpredictable forwarding and security exposure.
- Dual stack on one site does not transform a single-stack external client automatically.
Explanation
Correct Answer
C:The supported design response is to preserve separate VRFs and apply a scoped, documented translation or renumbering design at the interconnect boundary.
Incorrect Answers
A:That hazard arises in a separate case: A large enterprise wants to contain detailed IS-IS prefixes within buildings while preserving intercampus reachability. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It is not the failure mode evidenced here.
Question 460
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Which specific risk makes the uncorrected design unacceptable?
- Shared chassis does not automatically imply network-plane isolation without route-policy controls.
- Simple link aggregation does not guarantee hitless supervisor or software maintenance.
- Redundancy claims may not match actual hardware or software failover behavior.
- Assuming all STP redundant paths can actively forward leads to incorrect bandwidth capacity planning.
Explanation
Correct Answer
B:The supported design response is to select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
Incorrect Answers
A:That hazard arises in a separate case: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests