100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 510
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Which specific risk makes the uncorrected design unacceptable?
- WoL fails if the NIC has no standby power or the magic packet cannot reach the sleeping endpoint.
- Blanket removal of protection opens the entire access tier to rogue STP peers.
- A missing or overbroad MAC limit creates unauthorized layer-2 expansion.
- Oversubscribed PoE can shut off critical phones or cameras during high load.
Explanation
Correct Answer
B:The supported design response is to reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
Incorrect Answers
A:That hazard arises in a separate case: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the failure mode evidenced here.
Question 511
A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. Which specific risk makes the uncorrected design unacceptable?
- AS-path prepending never guarantees that every external AS selects the intended ingress.
- Dual stack on one site does not transform a single-stack external client automatically.
- Mismatched metrics can create unexpected asymmetry or congestion.
- Transport IPv6 alone does not automatically exchange IPv6 unicast routes.
Explanation
Correct Answer
B:The supported design response is to design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
Incorrect Answers
A:That hazard arises in a separate case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the failure mode evidenced here.
Question 512
A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. Which specific risk makes the uncorrected design unacceptable?
- On-change-only publication may leave gaps for regular utilization trend analysis.
- Slow periodic polling can miss short-lived congestion incidents.
- Regex CLI scraping can be brittle and unstructured compared with a supported model-driven API.
- Oversampling can consume bandwidth and CPU without improving the use case.
Explanation
Correct Answer
C:The supported design response is to evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
Incorrect Answers
A:That hazard arises in a separate case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the failure mode evidenced here.
Question 513
Several PIM-SM sites use a single RP placed across a high-latency WAN and suffer slow source registration after provider reconvergence. Which specific risk makes the uncorrected design unacceptable?
- RP failure or inconsistent RP mapping can interrupt source discovery.
- Inconsistent marking can defeat intended congestion treatment even when queues are configured.
- Depending exclusively on the failed WAN for troubleshooting hides root-cause evidence.
- A distant single RP creates a broad control-plane dependency.
Explanation
Correct Answer
D:The supported design response is to review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
Incorrect Answers
A:That hazard arises in a separate case: A PIM-SM domain has active receivers but no working rendezvous-point reachability for new source registration. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the failure mode evidenced here.
Question 514
A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. Which specific risk makes the uncorrected design unacceptable?
- Incorrect transport labels or reachability can keep one TLOC out of service.
- Multihoming can create asymmetric routing that breaks stateful services.
- Misapplied route targets or broad redistribution can leak routes across tenants.
- Nominally separate providers can share a single physical failure domain.
Explanation
Correct Answer
D:The supported design response is to require physical route and carrier diversity, including demarcation and access-path audits.
Incorrect Answers
A:That hazard arises in a separate case: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It is not the failure mode evidenced here.
Question 515
Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. Which specific risk makes the uncorrected design unacceptable?
- Oversubscribed PoE can shut off critical phones or cameras during high load.
- Untrusted STP control traffic can hijack the root or create forwarding instability.
- A configured backup switch cannot take over traffic directed at a failed physical gateway address.
- Port-only classification can lose segmentation during mobility.
Explanation
Correct Answer
D:The supported design response is to design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
Incorrect Answers
A:That hazard arises in a separate case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the failure mode evidenced here.
Question 516
An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. Which specific risk makes the uncorrected design unacceptable?
- Unbounded import can consume resources and expose unexpected paths.
- A logically Established session does not guarantee forwarding to its remote next hop.
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- Tunnel encapsulation overhead and underlay failure can create hard-to-diagnose IPv6 outages.
Explanation
Correct Answer
D:The supported design response is to evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
Incorrect Answers
A:That hazard arises in a separate case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It is not the failure mode evidenced here.
C:That hazard relates to another condition: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the direct risk evidenced by this case.
Question 517
A campus carries multicast across dual uplinks and incorrectly assumes that equal-cost unicast routes guarantee both incoming multicast paths are valid. Which specific risk makes the uncorrected design unacceptable?
- A group-only join is insufficient for typical SSM delivery.
- Stale multicast control state can prolong an outage after unicast reachability returns.
- Oversized strict priority can starve lower-priority traffic and still harm voice.
- Multicast RPF selection may not match assumptions about generic ECMP load splitting.
Explanation
Correct Answer
D:The supported design response is to verify the designated RPF path used for each multicast source and align routed topology as needed.
Incorrect Answers
A:That hazard arises in a separate case: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the failure mode evidenced here.
Question 518
Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. Which specific risk makes the uncorrected design unacceptable?
- A successful IKE SA alone does not prove that data-plane IPsec policy matches.
- A transport change can break protocols not carried by the selected tunnel mode.
- Misassigned segment identifiers can bypass intended enterprise isolation.
- Overlay encryption overhead can create an otherwise invisible PMTUD blackhole.
Explanation
Correct Answer
A:The supported design response is to align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
Incorrect Answers
B:That hazard arises in a separate case: An enterprise replaces a point-to-point GRE tunnel with raw IPsec ESP and expects dynamic multicast routing hellos to work unchanged. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the failure mode evidenced here.
Question 519
A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. Which specific risk makes the uncorrected design unacceptable?
- A cross-chassis bundle unsupported by the platforms can loop or suspend traffic.
- Independently bridging every redundant cable can cause STP blocking or accidental loops.
- Shared power dependencies nullify assumed device redundancy.
- Extending Layer 2 to solve discovery increases loop and broadcast risk.
Explanation
Correct Answer
D:The supported design response is to keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
Incorrect Answers
A:That hazard arises in a separate case: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It is not the failure mode evidenced here.
Question 520
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. Which specific risk makes the uncorrected design unacceptable?
- Overlapping site prefixes can cause ambiguous reachability and route leaks between branches.
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- A topology without level-2 interarea connectivity prevents the required interarea reachability.
- Tunnel encapsulation overhead and underlay failure can create hard-to-diagnose IPv6 outages.
Explanation
Correct Answer
B:The supported design response is to subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Incorrect Answers
A:That hazard arises in a separate case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests