100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 470
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. Which specific risk makes the uncorrected design unacceptable?
- An IP transit that removes fabric encapsulation may not automatically extend fabric segmentation end to end.
- All-trusted DHCP snooping provides no protection against rogue lease servers.
- Unsupported session/timer combinations can cause avoidable routing churn.
- FHRP ownership without upstream awareness can blackhole traffic through the active router.
Explanation
Correct Answer
C:The supported design response is to tune BFD intervals and session scale to supported hardware and realistic detection requirements.
Incorrect Answers
A:That hazard arises in a separate case: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It is not the failure mode evidenced here.
Question 471
A regional site uses EIGRP neighbors with mismatched autonomous system numbers despite matching IP subnet and authentication. Which specific risk makes the uncorrected design unacceptable?
- IPv4 literals and protocols lacking compatible translation can bypass or break a NAT64/DNS64 design.
- An inaccurate summary can attract traffic to an unreachable branch subnet.
- Ignoring MTU discrepancy can mask forwarding issues even if adjacency is forced.
- Misaligned routing domains keep adjacent sites disconnected even when physical links work.
Explanation
Correct Answer
D:The supported design response is to align the intended EIGRP AS and verify the relevant interface network and authentication settings.
Incorrect Answers
A:That hazard arises in a separate case: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the failure mode evidenced here.
Question 472
Two independent PIM-SM domains each use local rendezvous points but remote sources must be discovered across the domains. Which specific risk makes the uncorrected design unacceptable?
- Unconnected RP domains do not automatically share all active multicast sources.
- A flat shared management network allows lateral movement and overbroad privilege.
- ASM rendezvous-point dependencies can add unneeded complexity for known-source services.
- RP failure or inconsistent RP mapping can interrupt source discovery.
Explanation
Correct Answer
A:The supported design response is to evaluate supported MSDP-based source active exchange or a modern supported interdomain design.
Incorrect Answers
B:That hazard arises in a separate case: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A PIM-SM domain has active receivers but no working rendezvous-point reachability for new source registration. It is not the failure mode evidenced here.
Question 473
A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. Which specific risk makes the uncorrected design unacceptable?
- Unverified VLAN translation or drop behavior can isolate services or leak adjacent VLANs.
- Hub-and-spoke encryption can force avoidable tromboning and reduce availability.
- Using a flat transparent Ethernet VPN can expand broadcast and spanning-tree risk unnecessarily.
- Assuming MPLS forwarding by itself provides encryption or security policy can leave confidentiality gaps.
Explanation
Correct Answer
C:The supported design response is to choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
Incorrect Answers
A:That hazard arises in a separate case: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. It is not the failure mode evidenced here.
Question 474
A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. Which specific risk makes the uncorrected design unacceptable?
- Regex CLI scraping can be brittle and unstructured compared with a supported model-driven API.
- Stale or out-of-order records can lead to incorrect incident decisions.
- A transport connection alone does not prove compatible telemetry encoding.
- Misclassifying IaaS as SaaS can leave guest systems unpatched and unowned.
Explanation
Correct Answer
D:The supported design response is to classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
Incorrect Answers
A:That hazard arises in a separate case: A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A security operations service needs authoritative interface state changes, not a dashboard that replays stale telemetry after collector failure. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A telemetry receiver supports gRPC but cannot decode the device's gNMI JSON_IETF path data and classifies every update as malformed. It is not the failure mode evidenced here.
Question 475
A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. Which specific risk makes the uncorrected design unacceptable?
- Summarizing unrelated reachability behind one router can blackhole traffic.
- Uncontrolled branch defaults can redirect enterprise traffic to an untrusted lab.
- A stray default can override security inspection or create blackholes.
- Accidental root election at an access switch can force suboptimal or unstable Layer 2 forwarding.
Explanation
Correct Answer
C:The supported design response is to explicitly control default route origination and conditional advertisements at authorized borders.
Incorrect Answers
A:That hazard arises in a separate case: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A campus wants deterministic STP roots but all switches retain default bridge priorities. It is not the failure mode evidenced here.
Question 476
An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. Which specific risk makes the uncorrected design unacceptable?
- Ignoring overload can select a router that has not populated a usable forwarding table.
- Merging overlapping routes into a global table can create unpredictable forwarding and security exposure.
- Aggressive detection without addressing physical instability can amplify control-plane churn.
- Ignoring MTU discrepancy can mask forwarding issues even if adjacency is forced.
Explanation
Correct Answer
C:The supported design response is to use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
Incorrect Answers
A:That hazard arises in a separate case: The IS-IS backbone has a router in overload state after reboot and operators mistake it for an ordinary forwarding transit. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: Two acquired companies both use 172.16.0.0/12; an immediate core merge would expose identical destination prefixes. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the failure mode evidenced here.
Question 477
A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. Which specific risk makes the uncorrected design unacceptable?
- Stale multicast control state can prolong an outage after unicast reachability returns.
- IGMP membership alone is insufficient for multicast delivery across routed hops.
- Ignoring RPF can permit multicast loops or duplicate unwanted traffic.
- In-band-only management is unavailable when the network it depends on fails.
Explanation
Correct Answer
C:The supported design response is to verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
Incorrect Answers
A:That hazard arises in a separate case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It is not the failure mode evidenced here.
Question 478
Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. Which specific risk makes the uncorrected design unacceptable?
- An untested 5G link may lack usable signal, throughput or operational independence in an actual incident.
- Backup connectivity not tested end to end can be unusable when needed.
- Aggressive failback causes session churn and repeated route convergence.
- Raw fiber availability does not guarantee transceiver reach or optical loss budget.
Explanation
Correct Answer
B:The supported design response is to validate backup access, overlay establishment and route activation under simulated primary loss.
Incorrect Answers
A:That hazard arises in a separate case: A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Several data centers need high-capacity optical transport over metropolitan dark fiber without converting each tenant VLAN to an IP tunnel. It is not the failure mode evidenced here.
Question 479
A company assigns IPv6 /127 links between routers but a proposed monitoring tool treats each link as a /64 SLAAC user LAN. Which specific risk makes the uncorrected design unacceptable?
- Aggressive detection without addressing physical instability can amplify control-plane churn.
- IPv4 link-local source and destination addresses are not intended for ordinary intersite routing.
- Conflating point-to-point and host LAN prefix roles can break address assignment or subnet expectations.
- AS-path prepending never guarantees that every external AS selects the intended ingress.
Explanation
Correct Answer
C:The supported design response is to keep /127 point-to-point addressing for supported router links and use separate /64 allocations for conventional endpoint segments.
Incorrect Answers
A:That hazard arises in a separate case: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the failure mode evidenced here.
Question 480
A campus wants deterministic STP roots but all switches retain default bridge priorities. Which specific risk makes the uncorrected design unacceptable?
- A stray default can override security inspection or create blackholes.
- A configured backup switch cannot take over traffic directed at a failed physical gateway address.
- Accidental root election at an access switch can force suboptimal or unstable Layer 2 forwarding.
- Uncontrolled branch defaults can redirect enterprise traffic to an untrusted lab.
Explanation
Correct Answer
C:The supported design response is to place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
Incorrect Answers
A:That hazard arises in a separate case: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests