100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 630
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. Which specific risk makes the uncorrected design unacceptable?
- Unbounded import can consume resources and expose unexpected paths.
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- IPv4 literals and protocols lacking compatible translation can bypass or break a NAT64/DNS64 design.
- Confusing MED with local preference can leave internal outbound traffic on the wrong transit.
Explanation
Correct Answer
D:The supported design response is to use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference.
Incorrect Answers
A:That hazard arises in a separate case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the failure mode evidenced here.
B:That hazard relates to another condition: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the direct risk evidenced by this case.
C:That hazard arises in a separate case: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the failure mode evidenced here.
Question 631
A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. Which specific risk makes the uncorrected design unacceptable?
- Graceful restart only works when the adjacent topology and features support the required helper behavior.
- Shared control-plane or backplane faults can defeat assumed physical redundancy.
- MST region mismatch can create boundary behavior and unexpected spanning-tree paths.
- A cross-chassis bundle unsupported by the platforms can loop or suspend traffic.
Explanation
Correct Answer
B:The supported design response is to evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction.
Incorrect Answers
A:That hazard arises in a separate case: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the failure mode evidenced here.
Question 632
A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. Which specific risk makes the uncorrected design unacceptable?
- Generic models cannot be assumed to expose every proprietary feature.
- Treating hybrid connectivity as one trust domain can expose sensitive private systems.
- A single private cloud link without redundancy still constitutes a critical failure dependency.
- On-change-only publication may leave gaps for regular utilization trend analysis.
Explanation
Correct Answer
C:The supported design response is to evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
Incorrect Answers
A:That hazard arises in a separate case: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the failure mode evidenced here.
Question 633
A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. Which specific risk makes the uncorrected design unacceptable?
- Confusing shared-tree and source-tree roles can obscure unexpected bandwidth use.
- Oversubscribing management access can make fault recovery slower than the original outage.
- Misclassified bulk transfers consume scarce premium queue budget.
- Depending exclusively on the failed WAN for troubleshooting hides root-cause evidence.
Explanation
Correct Answer
B:The supported design response is to rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions.
Incorrect Answers
A:That hazard arises in a separate case: A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the failure mode evidenced here.
Question 634
A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. Which specific risk makes the uncorrected design unacceptable?
- Assuming MPLS forwarding by itself provides encryption or security policy can leave confidentiality gaps.
- An L3VPN service does not automatically carry customer Ethernet broadcasts as one switched segment.
- Static hub-only GRE tunnels scale poorly for dynamic multi-spoke reachability.
- Using a flat transparent Ethernet VPN can expand broadcast and spanning-tree risk unnecessarily.
Explanation
Correct Answer
A:The supported design response is to select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
Incorrect Answers
B:That hazard arises in a separate case: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the failure mode evidenced here.
Question 635
Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. Which specific risk makes the uncorrected design unacceptable?
- Hub-only paths add avoidable tromboning and concentrate a single failure domain.
- Route feedback and metric reclassification can create loops or instability.
- Overlapping domain redistribution without clear ownership causes asymmetric paths and unnecessary delay.
- OSPF timers alone may detect loss too slowly for the service-level objective.
Explanation
Correct Answer
D:The supported design response is to evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency.
Incorrect Answers
A:That hazard arises in a separate case: Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It is not the failure mode evidenced here.
Question 636
A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. Which specific risk makes the uncorrected design unacceptable?
- AS-path prepending never guarantees that every external AS selects the intended ingress.
- Mismatched metrics can create unexpected asymmetry or congestion.
- A logically Established session does not guarantee forwarding to its remote next hop.
- Dual stack on one site does not transform a single-stack external client automatically.
Explanation
Correct Answer
B:The supported design response is to set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
Incorrect Answers
A:That hazard arises in a separate case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It is not the failure mode evidenced here.
Question 637
A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. Which specific risk makes the uncorrected design unacceptable?
- Confusing the management plane with the forwarding plane creates false failover assumptions.
- Unicast tunnel liveness does not prove multicast overlay distribution.
- Optical wavelength separation alone does not define all end-to-end L3 security policy.
- Carrier-grade NAT can break designs that rely on arbitrary inbound connections.
Explanation
Correct Answer
A:The supported design response is to design control/management resilience separately from WAN edge data-plane forwarding.
Incorrect Answers
B:That hazard arises in a separate case: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It is not the failure mode evidenced here.
Question 638
A branch policy gives every queue an equal share although its database synchronization is delaying emergency call signaling. Which specific risk makes the uncorrected design unacceptable?
- Broad port-only classification lets bulk encrypted traffic overrun sensitive queues.
- Equal queue bandwidth does not reflect differing application tolerance to loss and delay.
- Treating network control messages as ordinary bulk data can cause false path failures.
- Mislabeling bulk traffic as EF causes priority-queue congestion and unfairness.
Explanation
Correct Answer
B:The supported design response is to allocate queue scheduling according to measured application criticality and minimum bandwidth needs.
Incorrect Answers
A:That hazard arises in a separate case: A branch QoS policy matches all TCP 443 traffic as video, including large software downloads. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the failure mode evidenced here.
Question 639
A network peers eBGP over a loopback with multiple routed hops and assumes a directly connected neighbor model. Which specific risk makes the uncorrected design unacceptable?
- A partitioned backbone prevents predictable interarea LSA propagation.
- Default eBGP neighbor reachability assumptions can prevent establishing multihop sessions.
- IPv4 link-local source and destination addresses are not intended for ordinary intersite routing.
- Mismatched OSPF authentication can split routing neighborhoods.
Explanation
Correct Answer
B:The supported design response is to use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy.
Incorrect Answers
A:That hazard arises in a separate case: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the failure mode evidenced here.
Question 640
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. Which specific risk makes the uncorrected design unacceptable?
- An IP transit that removes fabric encapsulation may not automatically extend fabric segmentation end to end.
- Stretching a broad guest broadcast domain enlarges the fault and attack surface.
- Unvalidated WAN MTU/latency can silently fail tunneled endpoint traffic.
- Confusing LISP control messages with user traffic hides broken data-plane paths.
Explanation
Correct Answer
C:The supported design response is to evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
Incorrect Answers
A:That hazard arises in a separate case: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests