Cisco 300-420 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 300-420 Premium Bundle
$79.97
$59.98

300-420 Premium Bundle

  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

300-420 Premium Bundle

Cisco 300-420 Premium Bundle
  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 300-420 Practice Test 61

Question 600

A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. Which specific risk makes the uncorrected design unacceptable?

  1. A plain stub area does not permit the branch ASBR to originate type-5 externals there.
  2. A flat oversized OSPF domain creates unnecessary SPF recalculation and troubleshooting complexity.
  3. Bidirectional uncontrolled redistribution can create routing loops and unstable metric selection.
  4. Overrestricting area LSAs can remove routes that essential services depend on.

Explanation

Correct Answer

A:

The supported design response is to evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.

Incorrect Answers

B:

That hazard arises in a separate case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It is not the failure mode evidenced here.

Question 601

A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. Which specific risk makes the uncorrected design unacceptable?

  1. Ignoring MTU discrepancy can mask forwarding issues even if adjacency is forced.
  2. Excessively aggressive detection can cause false adjacency resets and route churn.
  3. Reusing an on-link prefix across routed interfaces breaks the intended IPv6 neighbor and subnet boundaries.
  4. Mismatched OSPF authentication can split routing neighborhoods.

Explanation

Correct Answer

D:

The supported design response is to apply compatible supported OSPF authentication with coordinated keys and rollover on both ends.

Incorrect Answers

A:

That hazard arises in a separate case: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It is not the failure mode evidenced here.

Question 602

A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. Which specific risk makes the uncorrected design unacceptable?

  1. Unfiltered shared-service imports can expose sensitive infrastructure interfaces.
  2. Deploying source-specific trees for every sender may increase multicast state unnecessarily.
  3. Depending exclusively on the failed WAN for troubleshooting hides root-cause evidence.
  4. Undifferentiated traffic can starve management and prolong outages.

Explanation

Correct Answer

A:

The supported design response is to constrain route leaking to the precise management service endpoints and permitted directions.

Incorrect Answers

B:

That hazard arises in a separate case: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It is not the failure mode evidenced here.

Question 603

A financial application needs multicast delivery across SDA sites, but all validation has covered unicast endpoint maps only. Which specific risk makes the uncorrected design unacceptable?

  1. Flattening multiple VNs into one handoff can allow unauthorized cross-tenant access.
  2. Unicast fabric reachability does not prove multicast distribution or replication.
  3. Stretching a broad guest broadcast domain enlarges the fault and attack surface.
  4. An IP transit that removes fabric encapsulation may not automatically extend fabric segmentation end to end.

Explanation

Correct Answer

B:

The supported design response is to design supported multicast replication and routed multicast services across the intended fabric transit.

Incorrect Answers

A:

That hazard arises in a separate case: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the failure mode evidenced here.

Question 604

A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. Which specific risk makes the uncorrected design unacceptable?

  1. A bandwidth-reduced failover can starve latency-sensitive applications.
  2. Treating the L2 circuit as automatic routing leaves customer networks disconnected.
  3. Overlay encryption overhead can create an otherwise invisible PMTUD blackhole.
  4. Unrestricted any-to-any reachability can violate inspection and data-flow requirements.

Explanation

Correct Answer

A:

The supported design response is to define a backup-class QoS and application admission design appropriate to smaller available bandwidth.

Incorrect Answers

B:

That hazard arises in a separate case: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It is not the failure mode evidenced here.

Question 605

A security operations service needs authoritative interface state changes, not a dashboard that replays stale telemetry after collector failure. Which specific risk makes the uncorrected design unacceptable?

  1. Oversampling can consume bandwidth and CPU without improving the use case.
  2. Slow polling can delay detection of a short outage or configuration change.
  3. On-change-only publication may leave gaps for regular utilization trend analysis.
  4. Stale or out-of-order records can lead to incorrect incident decisions.

Explanation

Correct Answer

D:

The supported design response is to design timestamped telemetry with source identification and collector reconnection/backfill policy as supported.

Incorrect Answers

A:

That hazard arises in a separate case: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the failure mode evidenced here.

Question 606

A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. Which specific risk makes the uncorrected design unacceptable?

  1. Allowing a nontransit branch to act as a query/transit path increases instability and query scope.
  2. Weight affects only the local router and can leave other iBGP speakers choosing different exits.
  3. Assuming every higher-metric neighbor is a feasible successor can lead to unexpected reconvergence.
  4. Logical redundancy on the same physical uplink does not remove the single point of failure.

Explanation

Correct Answer

C:

The supported design response is to plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.

Incorrect Answers

A:

That hazard arises in a separate case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. It is not the failure mode evidenced here.

Question 607

A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. Which specific risk makes the uncorrected design unacceptable?

  1. Graceful restart only works when the adjacent topology and features support the required helper behavior.
  2. Confusing LISP control messages with user traffic hides broken data-plane paths.
  3. A single control-plane mapping node can delay or prevent endpoint reachability during outages.
  4. Flattening multiple VNs into one handoff can allow unauthorized cross-tenant access.

Explanation

Correct Answer

C:

The supported design response is to plan redundant supported fabric control-plane nodes with resilient underlay reachability.

Incorrect Answers

A:

That hazard arises in a separate case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the failure mode evidenced here.

Question 608

Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. Which specific risk makes the uncorrected design unacceptable?

  1. An L3VPN service does not automatically carry customer Ethernet broadcasts as one switched segment.
  2. A routed tunnel alone cannot guarantee transparent Layer 2 service semantics.
  3. Unverified VLAN translation or drop behavior can isolate services or leak adjacent VLANs.
  4. Using a flat transparent Ethernet VPN can expand broadcast and spanning-tree risk unnecessarily.

Explanation

Correct Answer

C:

The supported design response is to align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.

Incorrect Answers

A:

That hazard arises in a separate case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It is not the failure mode evidenced here.

B:

That hazard arises in a separate case: Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the failure mode evidenced here.

Question 609

A SaaS contact center requires both 200-ms maximum application response and clear separation of media and control classes. Which specific risk makes the uncorrected design unacceptable?

  1. Blind group reuse can collide with other services and expose traffic unintentionally.
  2. Treating all application packets as one class can hide mixed delay sensitivity.
  3. Oversized strict priority can starve lower-priority traffic and still harm voice.
  4. Mislabeling bulk traffic as EF causes priority-queue congestion and unfairness.

Explanation

Correct Answer

B:

The supported design response is to map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop.

Incorrect Answers

A:

That hazard arises in a separate case: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the failure mode evidenced here.

Question 610

A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. Which specific risk makes the uncorrected design unacceptable?

  1. IPv4 link-local source and destination addresses are not intended for ordinary intersite routing.
  2. A single best-path advertisement can conceal viable alternatives during failures.
  3. Allowing a nontransit branch to act as a query/transit path increases instability and query scope.
  4. A flat oversized OSPF domain creates unnecessary SPF recalculation and troubleshooting complexity.

Explanation

Correct Answer

A:

The supported design response is to use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.

Incorrect Answers

B:

That hazard arises in a separate case: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It is not the failure mode evidenced here.

C:

That hazard arises in a separate case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the failure mode evidenced here.

D:

That hazard arises in a separate case: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the failure mode evidenced here.

Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.