100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 460
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Which specific risk makes the uncorrected design unacceptable?
- Shared chassis does not automatically imply network-plane isolation without route-policy controls.
- Simple link aggregation does not guarantee hitless supervisor or software maintenance.
- Redundancy claims may not match actual hardware or software failover behavior.
- Assuming all STP redundant paths can actively forward leads to incorrect bandwidth capacity planning.
Explanation
Correct Answer
B:The supported design response is to select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
Incorrect Answers
A:That hazard arises in a separate case: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the failure mode evidenced here.
Question 461
SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. Which specific risk makes the uncorrected design unacceptable?
- A WAN edge connected to the internet is not automatically part of a secure managed SD-WAN fabric.
- Controller redundancy cannot replace failed local edge hardware or access transport.
- Carrier-grade NAT can break designs that rely on arbitrary inbound connections.
- Reaching the orchestration node does not prove control-plane policy exchange.
Explanation
Correct Answer
D:The supported design response is to distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
Incorrect Answers
A:That hazard arises in a separate case: Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It is not the failure mode evidenced here.
Question 462
An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. Which specific risk makes the uncorrected design unacceptable?
- Concurrent uncoordinated writes can overwrite policy or cause inconsistent device state.
- Treating hybrid connectivity as one trust domain can expose sensitive private systems.
- A single private cloud link without redundancy still constitutes a critical failure dependency.
- Local WAN transport without suitable DNS/inspection design can fail to improve user experience.
Explanation
Correct Answer
B:The supported design response is to classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
Incorrect Answers
A:That hazard arises in a separate case: A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A 5,000-user branch rollout wants direct SaaS breakout through local cloud on-ramp but all DNS still resolves clients to the distant headquarters proxy region. It is not the failure mode evidenced here.
Question 463
A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. Which specific risk makes the uncorrected design unacceptable?
- Sending at LAN speed into a slower provider service causes avoidable tail drops.
- Mislabeling bulk traffic as EF causes priority-queue congestion and unfairness.
- A primary-link shaper on a much smaller backup can trigger major provider drops.
- Policing and shaping are not interchangeable; excess policing traffic is typically discarded or remarked.
Explanation
Correct Answer
D:The supported design response is to replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
Incorrect Answers
A:That hazard arises in a separate case: A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. It is not the failure mode evidenced here.
Question 464
A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. Which specific risk makes the uncorrected design unacceptable?
- Link redundancy cannot compensate for a single service attachment device.
- Untrusted STP control traffic can hijack the root or create forwarding instability.
- A missing or overbroad MAC limit creates unauthorized layer-2 expansion.
- Oversubscribed PoE can shut off critical phones or cameras during high load.
Explanation
Correct Answer
C:The supported design response is to apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
Incorrect Answers
A:That hazard arises in a separate case: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the failure mode evidenced here.
Question 465
IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. Which specific risk makes the uncorrected design unacceptable?
- Bidirectional uncontrolled redistribution can feed prefixes back and create loops.
- Excessively aggressive detection can cause false adjacency resets and route churn.
- A partitioned backbone prevents predictable interarea LSA propagation.
- A flat oversized OSPF domain creates unnecessary SPF recalculation and troubleshooting complexity.
Explanation
Correct Answer
A:The supported design response is to use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
Incorrect Answers
B:That hazard arises in a separate case: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the failure mode evidenced here.
Question 466
A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. Which specific risk makes the uncorrected design unacceptable?
- FHRP ownership without upstream awareness can blackhole traffic through the active router.
- Arbitrary VLAN load splitting can overload the surviving device and create asymmetry.
- Assuming all STP redundant paths can actively forward leads to incorrect bandwidth capacity planning.
- Redundancy claims may not match actual hardware or software failover behavior.
Explanation
Correct Answer
B:The supported design response is to intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
Incorrect Answers
A:That hazard arises in a separate case: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the failure mode evidenced here.
Question 467
Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. Which specific risk makes the uncorrected design unacceptable?
- Aggressive detection without addressing physical instability can amplify control-plane churn.
- Mismatched OSPF authentication can split routing neighborhoods.
- Unbounded EIGRP queries across slow or unstable WAN paths can delay convergence and trigger SIA events.
- Ignoring MTU discrepancy can mask forwarding issues even if adjacency is forced.
Explanation
Correct Answer
D:The supported design response is to align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
Incorrect Answers
A:That hazard arises in a separate case: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It is not the failure mode evidenced here.
Question 468
Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. Which specific risk makes the uncorrected design unacceptable?
- Inconsistent marking can defeat intended congestion treatment even when queues are configured.
- Misclassified bulk transfers consume scarce premium queue budget.
- Oversized strict priority can starve lower-priority traffic and still harm voice.
- Trusting arbitrary edge markings lets endpoints bypass the intended QoS policy.
Explanation
Correct Answer
A:The supported design response is to standardize classification and remarking policy across all controlled network trust boundaries.
Incorrect Answers
B:That hazard arises in a separate case: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. It is not the failure mode evidenced here.
Question 469
A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. Which specific risk makes the uncorrected design unacceptable?
- A routeable IP transport alone does not authenticate a WAN edge into the overlay.
- Treating the L2 circuit as automatic routing leaves customer networks disconnected.
- Misassigned segment identifiers can bypass intended enterprise isolation.
- A successful IKE SA alone does not prove that data-plane IPsec policy matches.
Explanation
Correct Answer
A:The supported design response is to align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
Incorrect Answers
B:That hazard arises in a separate case: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It is not the failure mode evidenced here.
Question 470
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. Which specific risk makes the uncorrected design unacceptable?
- An IP transit that removes fabric encapsulation may not automatically extend fabric segmentation end to end.
- All-trusted DHCP snooping provides no protection against rogue lease servers.
- Unsupported session/timer combinations can cause avoidable routing churn.
- FHRP ownership without upstream awareness can blackhole traffic through the active router.
Explanation
Correct Answer
C:The supported design response is to tune BFD intervals and session scale to supported hardware and realistic detection requirements.
Incorrect Answers
A:That hazard arises in a separate case: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests