100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 560
A port used only for workstations undergoes lengthy spanning-tree transitions whenever a client reconnects. Which specific risk makes the uncorrected design unacceptable?
- Oversubscribed PoE can shut off critical phones or cameras during high load.
- A missing or overbroad MAC limit creates unauthorized layer-2 expansion.
- All-trusted DHCP snooping provides no protection against rogue lease servers.
- Broad edge designation on switch-to-switch trunks can create loops during topology changes.
Explanation
Correct Answer
D:The supported design response is to apply a supported edge/PortFast designation only to validated endpoint-facing interfaces.
Incorrect Answers
A:That hazard arises in a separate case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the failure mode evidenced here.
Question 561
The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. Which specific risk makes the uncorrected design unacceptable?
- Stale multicast control state can prolong an outage after unicast reachability returns.
- IGMP membership alone is insufficient for multicast delivery across routed hops.
- Ignoring RPF can permit multicast loops or duplicate unwanted traffic.
- A group-only join is insufficient for typical SSM delivery.
Explanation
Correct Answer
A:The supported design response is to validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
Incorrect Answers
B:That hazard arises in a separate case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the failure mode evidenced here.
Question 562
A company accepts routes from a newly merged BGP AS without maximum-prefix limits, and the peer mistakenly sends hundreds of thousands of prefixes. Which specific risk makes the uncorrected design unacceptable?
- Assuming every higher-metric neighbor is a feasible successor can lead to unexpected reconvergence.
- Transport IPv6 alone does not automatically exchange IPv6 unicast routes.
- Unbounded received routes can destabilize the edge router control plane.
- AS-path prepending never guarantees that every external AS selects the intended ingress.
Explanation
Correct Answer
C:The supported design response is to apply route filtering and appropriate max-prefix safeguards proportional to approved expected routes.
Incorrect Answers
A:That hazard arises in a separate case: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the failure mode evidenced here.
Question 563
A voice application has a 120-ms latency budget, but SD-WAN traffic follows the cheapest internet path despite BFD reporting 220-ms delay. Which specific risk makes the uncorrected design unacceptable?
- A bandwidth-reduced failover can starve latency-sensitive applications.
- Cost-only transport selection can violate real-time service SLAs.
- Centralized hairpin routing can add avoidable delay and overload headquarters links.
- Overlay encryption overhead can create an otherwise invisible PMTUD blackhole.
Explanation
Correct Answer
B:The supported design response is to define SLA-aware application routing with measured loss, latency and jitter and intended tunnel fallback policy.
Incorrect Answers
A:That hazard arises in a separate case: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A retail design directs all cloud SaaS traffic through headquarters even though local internet breakout is allowed and latency is poor. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the failure mode evidenced here.
Question 564
A telemetry receiver supports gRPC but cannot decode the device's gNMI JSON_IETF path data and classifies every update as malformed. Which specific risk makes the uncorrected design unacceptable?
- Oversampling can consume bandwidth and CPU without improving the use case.
- Assuming all leaves support event publication can create silent observability gaps.
- Incorrect model classification can produce malformed payloads or unsupported paths.
- A transport connection alone does not prove compatible telemetry encoding.
Explanation
Correct Answer
D:The supported design response is to align gNMI encoding and model path interpretation with supported YANG JSON_IETF semantics.
Incorrect Answers
A:That hazard arises in a separate case: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It is not the failure mode evidenced here.
Question 565
A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. Which specific risk makes the uncorrected design unacceptable?
- A missing or overbroad MAC limit creates unauthorized layer-2 expansion.
- Link redundancy cannot compensate for a single service attachment device.
- Uncontrolled branch defaults can redirect enterprise traffic to an untrusted lab.
- Assuming all STP redundant paths can actively forward leads to incorrect bandwidth capacity planning.
Explanation
Correct Answer
B:The supported design response is to separate service attachment across independent core fault domains and validate downstream convergence.
Incorrect Answers
A:That hazard arises in a separate case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the failure mode evidenced here.
Question 566
A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. Which specific risk makes the uncorrected design unacceptable?
- Mismatched OSPF authentication can split routing neighborhoods.
- Reusing an on-link prefix across routed interfaces breaks the intended IPv6 neighbor and subnet boundaries.
- Flooding every detail through the entire IS-IS domain increases churn and operational complexity.
- Transport IPv6 alone does not automatically exchange IPv6 unicast routes.
Explanation
Correct Answer
B:The supported design response is to assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation.
Incorrect Answers
A:That hazard arises in a separate case: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A large enterprise wants to contain detailed IS-IS prefixes within buildings while preserving intercampus reachability. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the failure mode evidenced here.
Question 567
Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. Which specific risk makes the uncorrected design unacceptable?
- Independently bridging every redundant cable can cause STP blocking or accidental loops.
- Redundancy claims may not match actual hardware or software failover behavior.
- All-trusted DHCP snooping provides no protection against rogue lease servers.
- A cross-chassis bundle unsupported by the platforms can loop or suspend traffic.
Explanation
Correct Answer
D:The supported design response is to use a validated stack/virtual chassis/MEC design or independent routed uplinks according to supported platform capabilities.
Incorrect Answers
A:That hazard arises in a separate case: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the failure mode evidenced here.
Question 568
A source sends multicast through one router but users join from another site and no multicast routing is configured between them. Which specific risk makes the uncorrected design unacceptable?
- Ignoring RPF can permit multicast loops or duplicate unwanted traffic.
- Stale multicast control state can prolong an outage after unicast reachability returns.
- IGMP membership alone is insufficient for multicast delivery across routed hops.
- Marking packets alone does not guarantee queue service under oversubscription.
Explanation
Correct Answer
C:The supported design response is to establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
Incorrect Answers
A:That hazard arises in a separate case: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the failure mode evidenced here.
D:This offered choice, “Marking packets alone does not guarantee queue service under oversubscription”, addresses a separate concern. That option relates to this separate design case: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. It does not answer the current requirement.
Question 569
A single-homed retail branch can tolerate a four-hour outage but the proposal adds expensive dual-carrier fiber without a business case. Which specific risk makes the uncorrected design unacceptable?
- Backup connectivity not tested end to end can be unusable when needed.
- Nominally separate providers can share a single physical failure domain.
- Aggressive failback causes session churn and repeated route convergence.
- Overengineering transport can waste cost without improving required service outcomes.
Explanation
Correct Answer
D:The supported design response is to match WAN redundancy and repair targets to measured business availability needs and budget.
Incorrect Answers
A:That hazard arises in a separate case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It is not the failure mode evidenced here.
Question 570
An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. Which specific risk makes the uncorrected design unacceptable?
- Hand-maintained IPv6 routes can blackhole traffic when redundant paths change.
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- AS-path prepending never guarantees that every external AS selects the intended ingress.
- An overbroad summary can attract traffic for destinations that are not actually reachable through the summarizing router.
Explanation
Correct Answer
A:The supported design response is to select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology.
Incorrect Answers
B:That hazard relates to another condition: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the direct risk evidenced by this case.
C:That hazard arises in a separate case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests