Cisco 300-420 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 300-420 Premium Bundle
$79.97
$59.98

300-420 Premium Bundle

  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

300-420 Premium Bundle

Cisco 300-420 Premium Bundle
  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 300-420 Practice Test 60

Question 590

Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. Which specific risk makes the uncorrected design unacceptable?

  1. Bidirectional uncontrolled redistribution can create routing loops and unstable metric selection.
  2. A plain stub area does not permit the branch ASBR to originate type-5 externals there.
  3. Weight affects only the local router and can leave other iBGP speakers choosing different exits.
  4. Allowing a nontransit branch to act as a query/transit path increases instability and query scope.

Explanation

Correct Answer

A:

The supported design response is to use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops.

Incorrect Answers

B:

That hazard arises in a separate case: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the failure mode evidenced here.

Question 591

A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. Which specific risk makes the uncorrected design unacceptable?

  1. Oversubscribed PoE can shut off critical phones or cameras during high load.
  2. WoL fails if the NIC has no standby power or the magic packet cannot reach the sleeping endpoint.
  3. Blanket removal of protection opens the entire access tier to rogue STP peers.
  4. All-trusted DHCP snooping provides no protection against rogue lease servers.

Explanation

Correct Answer

B:

The supported design response is to preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path.

Incorrect Answers

A:

That hazard arises in a separate case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the failure mode evidenced here.

Question 592

An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. Which specific risk makes the uncorrected design unacceptable?

  1. Carrier-grade NAT can break designs that rely on arbitrary inbound connections.
  2. Optical wavelength separation alone does not define all end-to-end L3 security policy.
  3. Aggressive failback causes session churn and repeated route convergence.
  4. Confusing the management plane with the forwarding plane creates false failover assumptions.

Explanation

Correct Answer

A:

The supported design response is to select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities.

Incorrect Answers

B:

That hazard arises in a separate case: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. It is not the failure mode evidenced here.

Question 593

An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. Which specific risk makes the uncorrected design unacceptable?

  1. QoS on one hop cannot undo queueing loss caused at a later bottleneck.
  2. IGMP membership alone is insufficient for multicast delivery across routed hops.
  3. Missing mappings can collapse important traffic into best effort without warning.
  4. Trusting arbitrary edge markings lets endpoints bypass the intended QoS policy.

Explanation

Correct Answer

D:

The supported design response is to establish an explicit QoS trust boundary that remarks or rejects unauthorized markings at ingress.

Incorrect Answers

A:

That hazard arises in a separate case: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. It is not the failure mode evidenced here.

Question 594

A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. Which specific risk makes the uncorrected design unacceptable?

  1. Relying on one vendor-native path can break portability across the managed estate.
  2. gNMI is not simply an HTTP REST path and requires compatible service endpoints.
  3. Treating NETCONF as generic REST can skip locking and commit safeguards.
  4. A wrong service-model label can create gaps in incident response and patch ownership.

Explanation

Correct Answer

B:

The supported design response is to use the supported gNMI service transported over gRPC with device capability and identity verification.

Incorrect Answers

A:

That hazard arises in a separate case: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. It is not the failure mode evidenced here.

Question 595

A branch OSPF adjacency across a pseudowire drops after interface network type changes, even though both neighbors are reachable by ping. Which specific risk makes the uncorrected design unacceptable?

  1. Ignoring MTU discrepancy can mask forwarding issues even if adjacency is forced.
  2. Overrestricting area LSAs can remove routes that essential services depend on.
  3. Mismatched adjacency settings can prevent neighboring despite IP reachability.
  4. A flat oversized OSPF domain creates unnecessary SPF recalculation and troubleshooting complexity.

Explanation

Correct Answer

C:

The supported design response is to align compatible OSPF network type, timers, authentication and neighbor discovery model for that link.

Incorrect Answers

A:

That hazard arises in a separate case: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the failure mode evidenced here.

Question 596

A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. Which specific risk makes the uncorrected design unacceptable?

  1. Stretching a broad guest broadcast domain enlarges the fault and attack surface.
  2. Mixing endpoint prefixes into underlay undermines fabric mobility and segmentation design.
  3. A single control-plane mapping node can delay or prevent endpoint reachability during outages.
  4. Flattening multiple VNs into one handoff can allow unauthorized cross-tenant access.

Explanation

Correct Answer

D:

The supported design response is to design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.

Incorrect Answers

A:

That hazard arises in a separate case: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It is not the failure mode evidenced here.

Question 597

A branch uses a shaper on voice and bulk traffic together, and the business assumes shaping guarantees that voice always transmits first. Which specific risk makes the uncorrected design unacceptable?

  1. Local markings do not force an external provider to honor enterprise QoS policy.
  2. Mislabeling bulk traffic as EF causes priority-queue congestion and unfairness.
  3. Impossible aggregate guarantees lead to unexpected arbitration or configuration rejection.
  4. Shaping sets a rate envelope but does not by itself rank the packets in an output queue.

Explanation

Correct Answer

D:

The supported design response is to pair shaping with explicit class-based queuing and suitable real-time priority policy.

Incorrect Answers

A:

That hazard arises in a separate case: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. It is not the failure mode evidenced here.

Question 598

Several data centers need high-capacity optical transport over metropolitan dark fiber without converting each tenant VLAN to an IP tunnel. Which specific risk makes the uncorrected design unacceptable?

  1. Plain GRE or unencrypted transport does not meet confidentiality requirements.
  2. Backup connectivity not tested end to end can be unusable when needed.
  3. Controller redundancy cannot replace failed local edge hardware or access transport.
  4. Raw fiber availability does not guarantee transceiver reach or optical loss budget.

Explanation

Correct Answer

D:

The supported design response is to evaluate DWDM wavelength services with optics, reach, dispersion and protection appropriate to the fiber plant.

Incorrect Answers

A:

That hazard arises in a separate case: A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the failure mode evidenced here.

Question 599

A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. Which specific risk makes the uncorrected design unacceptable?

  1. Assuming all STP redundant paths can actively forward leads to incorrect bandwidth capacity planning.
  2. A configured backup switch cannot take over traffic directed at a failed physical gateway address.
  3. All-trusted DHCP snooping provides no protection against rogue lease servers.
  4. Redundancy claims may not match actual hardware or software failover behavior.

Explanation

Correct Answer

D:

The supported design response is to choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.

Incorrect Answers

A:

That hazard arises in a separate case: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the failure mode evidenced here.

Question 600

A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. Which specific risk makes the uncorrected design unacceptable?

  1. A plain stub area does not permit the branch ASBR to originate type-5 externals there.
  2. A flat oversized OSPF domain creates unnecessary SPF recalculation and troubleshooting complexity.
  3. Bidirectional uncontrolled redistribution can create routing loops and unstable metric selection.
  4. Overrestricting area LSAs can remove routes that essential services depend on.

Explanation

Correct Answer

A:

The supported design response is to evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.

Incorrect Answers

B:

That hazard arises in a separate case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It is not the failure mode evidenced here.

Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.