100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 650
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. Which specific risk makes the uncorrected design unacceptable?
- Untrusted STP control traffic can hijack the root or create forwarding instability.
- A missing or overbroad MAC limit creates unauthorized layer-2 expansion.
- Oversubscribed PoE can shut off critical phones or cameras during high load.
- Blanket removal of protection opens the entire access tier to rogue STP peers.
Explanation
Correct Answer
C:The supported design response is to calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
Incorrect Answers
A:That hazard arises in a separate case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It is not the failure mode evidenced here.
Question 651
New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. Which specific risk makes the uncorrected design unacceptable?
- A topology without level-2 interarea connectivity prevents the required interarea reachability.
- Assuming L1 adjacency across mismatched areas can leave parts of the fabric partitioned.
- IPv4 link-local source and destination addresses are not intended for ordinary intersite routing.
- Bidirectional uncontrolled redistribution can feed prefixes back and create loops.
Explanation
Correct Answer
B:The supported design response is to align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing.
Incorrect Answers
A:That hazard arises in a separate case: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It is not the failure mode evidenced here.
Question 652
Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. Which specific risk makes the uncorrected design unacceptable?
- Oversubscribing management access can make fault recovery slower than the original outage.
- A primary-link shaper on a much smaller backup can trigger major provider drops.
- Depending exclusively on the failed WAN for troubleshooting hides root-cause evidence.
- A group-only join is insufficient for typical SSM delivery.
Explanation
Correct Answer
C:The supported design response is to provide independent telemetry or out-of-band access appropriate to site criticality and budget.
Incorrect Answers
A:That hazard arises in a separate case: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the failure mode evidenced here.
Question 653
A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. Which specific risk makes the uncorrected design unacceptable?
- Treating the L2 circuit as automatic routing leaves customer networks disconnected.
- Unrestricted any-to-any reachability can violate inspection and data-flow requirements.
- Assuming GRE tunnels inherently encrypt traffic can expose sensitive payloads.
- Unicast tunnel liveness does not prove multicast overlay distribution.
Explanation
Correct Answer
C:The supported design response is to use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
Incorrect Answers
A:That hazard arises in a separate case: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It is not the failure mode evidenced here.
Question 654
A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. Which specific risk makes the uncorrected design unacceptable?
- Generic models cannot be assumed to expose every proprietary feature.
- Incorrect model classification can produce malformed payloads or unsupported paths.
- Slow polling can delay detection of a short outage or configuration change.
- On-change-only publication may leave gaps for regular utilization trend analysis.
Explanation
Correct Answer
B:The supported design response is to distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
Incorrect Answers
A:That hazard arises in a separate case: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the failure mode evidenced here.
Question 655
Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. Which specific risk makes the uncorrected design unacceptable?
- Confusing LISP control messages with user traffic hides broken data-plane paths.
- Insufficient underlay MTU breaks overlay traffic even when basic pings work.
- Reachable loopback does not prove correct fabric onboarding or policy provisioning.
- Mixing endpoint prefixes into underlay undermines fabric mobility and segmentation design.
Explanation
Correct Answer
B:The supported design response is to size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
Incorrect Answers
A:That hazard arises in a separate case: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. It is not the failure mode evidenced here.
Question 656
A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. Which specific risk makes the uncorrected design unacceptable?
- Weight affects only the local router and can leave other iBGP speakers choosing different exits.
- Bidirectional uncontrolled redistribution can create routing loops and unstable metric selection.
- Unbounded import can consume resources and expose unexpected paths.
- Allowing a nontransit branch to act as a query/transit path increases instability and query scope.
Explanation
Correct Answer
A:The supported design response is to use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
Incorrect Answers
B:That hazard arises in a separate case: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the failure mode evidenced here.
Question 657
A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. Which specific risk makes the uncorrected design unacceptable?
- Overlay encryption overhead can create an otherwise invisible PMTUD blackhole.
- Unbounded full-mesh tunnels can consume memory and crypto resources as site count grows.
- Hub-and-spoke encryption can force avoidable tromboning and reduce availability.
- Hand-configuring every edge pair undermines scalable centralized policy and error control.
Explanation
Correct Answer
D:The supported design response is to use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution.
Incorrect Answers
A:That hazard arises in a separate case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the failure mode evidenced here.
Question 658
A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. Which specific risk makes the uncorrected design unacceptable?
- Oversubscribing management access can make fault recovery slower than the original outage.
- Misclassified bulk transfers consume scarce premium queue budget.
- Local markings do not force an external provider to honor enterprise QoS policy.
- Inconsistent marking can defeat intended congestion treatment even when queues are configured.
Explanation
Correct Answer
B:The supported design response is to remap backup traffic to a less-preferred class and protect media queues for their intended applications.
Incorrect Answers
A:That hazard arises in a separate case: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It is not the failure mode evidenced here.
Question 659
Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. Which specific risk makes the uncorrected design unacceptable?
- Simple link aggregation does not guarantee hitless supervisor or software maintenance.
- Overlapping domain redistribution without clear ownership causes asymmetric paths and unnecessary delay.
- OSPF timers alone may detect loss too slowly for the service-level objective.
- Route feedback and metric reclassification can create loops or instability.
Explanation
Correct Answer
D:The supported design response is to apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries.
Incorrect Answers
A:That hazard arises in a separate case: A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. It is not the failure mode evidenced here.
B:That hazard arises in a separate case: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It is not the failure mode evidenced here.
C:That hazard arises in a separate case: Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. It is not the failure mode evidenced here.
Question 660
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. Which specific risk makes the uncorrected design unacceptable?
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- Tunnel encapsulation overhead and underlay failure can create hard-to-diagnose IPv6 outages.
- Overlapping site prefixes can cause ambiguous reachability and route leaks between branches.
- Unbounded import can consume resources and expose unexpected paths.
Explanation
Correct Answer
C:The supported design response is to allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Incorrect Answers
A:That hazard relates to another condition: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the direct risk evidenced by this case.
B:That hazard arises in a separate case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the failure mode evidenced here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests