100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 40
A campus wants deterministic STP roots but all switches retain default bridge priorities. Which design change most directly addresses the stated requirement?
- Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes.
Explanation
Correct Answer
A:The design is validated when root bridge elections and forwarding paths match the documented campus topology.
Incorrect Answers
B:That option concerns a separate design case: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. The relevant control here is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
C:That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
D:That option concerns a separate design case: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. The relevant control here is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
Question 41
An edge router receives a full BGP table where the security policy allows only the provider's approved default. Which design change most directly addresses the stated requirement?
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Design redundant BGP route reflectors with consistent cluster IDs and reflector-client relationships.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
Explanation
Correct Answer
D:The design is validated when the accepted RIB contains the permitted default and no unintended provider prefixes.
Incorrect Answers
A:That option concerns a separate design case: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. The relevant control here is: Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
B:That option concerns a separate design case: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. The relevant control here is: Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
C:That option concerns a separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. The relevant control here is: Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
Question 42
A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. Which design change most directly addresses the stated requirement?
- Evaluate controlled multicast service reflection or translation with explicit source/group mappings.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Align SSM membership to include the desired (S,G) source/group relationship.
- Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
Explanation
Correct Answer
C:The design is validated when the receiver sends a source-specific join and obtains only the authorized stream.
Incorrect Answers
A:That option concerns a separate design case: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. The relevant control here is: Align SSM membership to include the desired (S,G) source/group relationship.
B:That option concerns a separate design case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The relevant control here is: Align SSM membership to include the desired (S,G) source/group relationship.
D:That option concerns a separate design case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. The relevant control here is: Align SSM membership to include the desired (S,G) source/group relationship.
Question 43
A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. Which design change most directly addresses the stated requirement?
- Use supported on-change telemetry for the interface state leaf where device and model support it.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture.
- Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
Explanation
Correct Answer
D:The design is validated when data volumes fall while five-minute trend accuracy still meets planning requirements.
Incorrect Answers
A:That option concerns a separate design case: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. The relevant control here is: Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
B:That option concerns a separate design case: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. The relevant control here is: Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
C:That option concerns a separate design case: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. The relevant control here is: Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
Question 44
HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. Which design change most directly addresses the stated requirement?
- Correct VRRP group identity, priorities, advertisement reachability, and L2 path consistency.
- Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
- Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
Explanation
Correct Answer
B:The design is validated when uplink failure triggers the intended gateway takeover and remote application sessions recover.
Incorrect Answers
A:That option concerns a separate design case: Two campus VRRP gateways both claim master after their shared advertisement path is partitioned, and clients receive inconsistent ARP responses. The relevant control here is: Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
C:That option concerns a separate design case: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. The relevant control here is: Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
D:That option concerns a separate design case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. The relevant control here is: Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
Question 45
A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. Which design change most directly addresses the stated requirement?
- Apply topology or centralized control policy at the appropriate site/VPN scope.
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
- Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
Explanation
Correct Answer
A:The design is validated when finance sites reach only designated hubs while approved other segments preserve their intended paths.
Incorrect Answers
B:That option concerns a separate design case: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. The relevant control here is: Apply topology or centralized control policy at the appropriate site/VPN scope.
C:That option concerns a separate design case: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. The relevant control here is: Apply topology or centralized control policy at the appropriate site/VPN scope.
D:That option concerns a separate design case: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. The relevant control here is: Apply topology or centralized control policy at the appropriate site/VPN scope.
Question 46
A hospital campus uses policy-based routing shortcuts for every building but ordinary routing still lacks resilient interbuilding reachability. Which design change most directly addresses the stated requirement?
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
- Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions.
Explanation
Correct Answer
D:The design is validated when regular traffic retains resilient routed reachability without depending on per-building PBR hacks.
Incorrect Answers
A:That option concerns a separate design case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The relevant control here is: Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions.
B:That option concerns a separate design case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. The relevant control here is: Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions.
C:That option concerns a separate design case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. The relevant control here is: Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions.
Question 47
A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. Which design change most directly addresses the stated requirement?
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
- Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
Explanation
Correct Answer
A:The design is validated when all ABRs maintain backbone reachability and interarea routes converge through the intended topology.
Incorrect Answers
B:That option concerns a separate design case: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. The relevant control here is: Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
C:That option concerns a separate design case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. The relevant control here is: Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
D:That option concerns a separate design case: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. The relevant control here is: Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
Question 48
A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. Which design change most directly addresses the stated requirement?
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
- Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
- Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
Explanation
Correct Answer
C:The design is validated when measured traffic conforms to the allowed profile and application packet loss decreases under load.
Incorrect Answers
A:That option concerns a separate design case: Two business units share one management VLAN with unrestricted access to each other's routers. The relevant control here is: Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
B:That option concerns a separate design case: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. The relevant control here is: Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
D:That option concerns a separate design case: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. The relevant control here is: Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
Question 49
A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. Which design change most directly addresses the stated requirement?
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
- Design control/management resilience separately from WAN edge data-plane forwarding.
- Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
Explanation
Correct Answer
C:The design is validated when only authorized multicast receivers on selected sites receive the required production feed.
Incorrect Answers
A:That option concerns a separate design case: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. The relevant control here is: Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
B:That option concerns a separate design case: A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. The relevant control here is: Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
D:That option concerns a separate design case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The relevant control here is: Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
Question 50
In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. Which design change most directly addresses the stated requirement?
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.
- Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
Explanation
Correct Answer
C:The design is validated when underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
Incorrect Answers
A:That option concerns a separate design case: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. The relevant control here is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
B:That option concerns a separate design case: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. The relevant control here is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
D:That option concerns a separate design case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The relevant control here is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
