Cisco 300-420 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 300-420 Premium Bundle
$79.97
$59.98

300-420 Premium Bundle

  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

300-420 Premium Bundle

Cisco 300-420 Premium Bundle
  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 300-420 Practice Test 6

Question 50

In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. Which design change most directly addresses the stated requirement?

  1. Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
  2. Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.
  3. Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
  4. Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.

Explanation

Correct Answer

C:

The design is validated when underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.

Incorrect Answers

A:

That option concerns a separate design case: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. The relevant control here is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.

B:

That option concerns a separate design case: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. The relevant control here is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.

D:

That option concerns a separate design case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The relevant control here is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.

Question 51

An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. Which design change most directly addresses the stated requirement?

  1. Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
  2. Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
  3. Choose the appropriate stub-area variant or redesign to preserve required interarea summaries.
  4. Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.

Explanation

Correct Answer

D:

The design is validated when local access failures generate bounded LSDB changes without disrupting unrelated branches.

Incorrect Answers

A:

That option concerns a separate design case: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. The relevant control here is: Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.

B:

That option concerns a separate design case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The relevant control here is: Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.

C:

That option concerns a separate design case: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. The relevant control here is: Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.

Question 52

Video and voice both use one strict-priority queue, causing voice jitter when video surges. Which design change most directly addresses the stated requirement?

  1. Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
  2. Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
  3. Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
  4. Use validated application classification or more precise traffic identity instead of assuming TCP port 443 defines one service.

Explanation

Correct Answer

B:

The design is validated when voice delay stays within SLA during video bursts while other classes retain scheduled service.

Incorrect Answers

A:

That option concerns a separate design case: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. The relevant control here is: Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.

C:

That option concerns a separate design case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. The relevant control here is: Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.

D:

That option concerns a separate design case: A branch QoS policy matches all TCP 443 traffic as video, including large software downloads. The relevant control here is: Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.

Question 53

A 5,000-user branch rollout wants direct SaaS breakout through local cloud on-ramp but all DNS still resolves clients to the distant headquarters proxy region. Which design change most directly addresses the stated requirement?

  1. Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
  2. Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning.
  3. Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
  4. Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable.

Explanation

Correct Answer

B:

The design is validated when saaS sessions use an approved closer path while security controls and logging remain effective.

Incorrect Answers

A:

That option concerns a separate design case: A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. The relevant control here is: Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning.

C:

That option concerns a separate design case: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. The relevant control here is: Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning.

D:

That option concerns a separate design case: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. The relevant control here is: Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning.

Question 54

A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. Which design change most directly addresses the stated requirement?

  1. Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
  2. Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
  3. Apply topology or centralized control policy at the appropriate site/VPN scope.
  4. Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints.

Explanation

Correct Answer

A:

The design is validated when enterprise routers form intended routing neighbors over the circuit while provider internals remain hidden.

Incorrect Answers

B:

That option concerns a separate design case: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. The relevant control here is: Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.

C:

That option concerns a separate design case: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. The relevant control here is: Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.

D:

That option concerns a separate design case: Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. The relevant control here is: Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.

Question 55

A design team treats NSR and NSF as synonyms and assumes route preservation when the only Routing Processor crashes. Which design change most directly addresses the stated requirement?

  1. Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles.
  2. Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
  3. Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
  4. Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance.

Explanation

Correct Answer

A:

The design is validated when a standby control plane takes over or forwarding is preserved according to the selected capability's documented scope.

Incorrect Answers

B:

That option concerns a separate design case: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. The relevant control here is: Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles.

C:

That option concerns a separate design case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. The relevant control here is: Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles.

D:

That option concerns a separate design case: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. The relevant control here is: Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles.

Question 56

A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. Which design change most directly addresses the stated requirement?

  1. Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records.
  2. Deploy tested dual stack where both address families, DNS, routing and access controls are supported end to end.
  3. Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
  4. Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.

Explanation

Correct Answer

A:

The design is validated when iPv6 connections to protected applications are blocked or allowed consistently with approved policy.

Incorrect Answers

B:

That option concerns a separate design case: Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. The relevant control here is: Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records.

C:

That option concerns a separate design case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. The relevant control here is: Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records.

D:

That option concerns a separate design case: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. The relevant control here is: Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records.

Question 57

An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. Which design change most directly addresses the stated requirement?

  1. Evaluate Source-Specific Multicast using supported IGMPv3/MLDv2 and PIM-SSM where available.
  2. Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
  3. Align SSM membership to include the desired (S,G) source/group relationship.
  4. Evaluate controlled multicast service reflection or translation with explicit source/group mappings.

Explanation

Correct Answer

D:

The design is validated when intended receivers obtain the translated stream while unrelated multicast groups remain separate.

Incorrect Answers

A:

That option concerns a separate design case: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. The relevant control here is: Evaluate controlled multicast service reflection or translation with explicit source/group mappings.

B:

That option concerns a separate design case: Remote branch routers are managed using the same public internet IP address that exposes a user web service. The relevant control here is: Evaluate controlled multicast service reflection or translation with explicit source/group mappings.

C:

That option concerns a separate design case: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. The relevant control here is: Evaluate controlled multicast service reflection or translation with explicit source/group mappings.

Question 58

A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. Which design change most directly addresses the stated requirement?

  1. Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.
  2. Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
  3. Validate backup access, overlay establishment and route activation under simulated primary loss.
  4. Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities.

Explanation

Correct Answer

A:

The design is validated when application sessions remain stable through short intermittent primary path disturbances.

Incorrect Answers

B:

That option concerns a separate design case: A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. The relevant control here is: Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.

C:

That option concerns a separate design case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. The relevant control here is: Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.

D:

That option concerns a separate design case: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. The relevant control here is: Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.

Question 59

Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. Which design change most directly addresses the stated requirement?

  1. Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress.
  2. Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover.
  3. Explicitly control default route origination and conditional advertisements at authorized borders.
  4. Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.

Explanation

Correct Answer

B:

The design is validated when site-to-site voice follows a lower-latency approved route while hub failure leaves planned alternate reachability.

Incorrect Answers

A:

That option concerns a separate design case: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. The relevant control here is: Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover.

C:

That option concerns a separate design case: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. The relevant control here is: Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover.

D:

That option concerns a separate design case: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. The relevant control here is: Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover.

Question 60

An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. Which design change most directly addresses the stated requirement?

  1. Remove or constrain the summary when it attracts traffic to networks not reachable through the campus boundary.
  2. Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
  3. Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.
  4. Apply EIGRP summarization, stub boundaries, and reliable connectivity to limit query scope.

Explanation

Correct Answer

C:

The design is validated when clients retain enough independent eligible paths to support the agreed failover policy.

Incorrect Answers

A:

That option concerns a separate design case: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. The relevant control here is: Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.

B:

That option concerns a separate design case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The relevant control here is: Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.

D:

That option concerns a separate design case: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. The relevant control here is: Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.

Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.