100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 670
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The chosen correction is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted. Which additional predeployment check is most relevant?
- Validate cabling and spanning-tree domain boundaries before exempting any port.
- Validate software and licensing support, peer links, and split-brain safeguards before deployment.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
Explanation
Correct Answer
D:Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries. This protects the intended outcome: Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
Incorrect Answers
A:That precaution belongs to another scenario: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
Question 671
Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. The chosen correction is: Deploy tested dual stack where both address families, DNS, routing and access controls are supported end to end. Which additional predeployment check is most relevant?
- Test both A and AAAA record resolution from representative client networks.
- Check protocol payloads, bidirectional addressing and security logs before deployment.
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
- Validate firewall policies and monitoring for both families before removing any transition dependency.
Explanation
Correct Answer
D:Validate firewall policies and monitoring for both families before removing any transition dependency. This protects the intended outcome: Native IPv4 and IPv6 traffic reaches only approved services and each family has working operations telemetry.
Incorrect Answers
A:That precaution belongs to another scenario: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the primary safeguard for this rollout.
Question 672
A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. The chosen correction is: Use supported NETCONF locks, edit-config validation and controlled commit workflow to serialize sensitive changes. Which additional predeployment check is most relevant?
- Map shared responsibility and data residency requirements at each boundary.
- Verify candidate/running datastore support and rollback-on-error capabilities before edits.
- Test lock ownership, timeout and cleanup behavior before automation at scale.
- Query capability/model support and document fallback sampling per platform.
Explanation
Correct Answer
C:Test lock ownership, timeout and cleanup behavior before automation at scale. This protects the intended outcome: Each authorized transaction commits its intended changes without mixing concurrent candidates.
Incorrect Answers
A:That precaution belongs to another scenario: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It is not the primary safeguard for this rollout.
Question 673
Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. The chosen correction is: Select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs. Which additional predeployment check is most relevant?
- Test key-server redundancy and key-lifetime rollover before production.
- Stage certificates, device identity, and centralized policy before moving production routes.
- Verify customer route limits, route-target import/export and CE-PE failover.
- Verify UNI/ENNI behavior and available MTU across the provider boundary.
Explanation
Correct Answer
B:Stage certificates, device identity, and centralized policy before moving production routes. This protects the intended outcome: Sites establish secure control sessions and authorized data-plane tunnels for their assigned service segments.
Incorrect Answers
A:That precaution belongs to another scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. It is not the primary safeguard for this rollout.
Question 674
A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. The chosen correction is: Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly. Which additional predeployment check is most relevant?
- Capture (*,G) and (S,G) state at different phases of receiver joins.
- Confirm upstream source paths and verify PIM neighbors on every routed segment.
- Estimate collector volume and sample rates before enabling streams.
- Validate platform and routing support, DF election and true application traffic pattern.
Explanation
Correct Answer
A:Capture (*,G) and (S,G) state at different phases of receiver joins. This protects the intended outcome: Receiver forwarding follows the intended tree state after source discovery and any supported SPT transition.
Incorrect Answers
B:That precaution belongs to another scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It is not the primary safeguard for this rollout.
Question 675
A merger requires two administrative BGP regions to appear as one external AS while reducing iBGP mesh size internally. The chosen correction is: Evaluate an appropriately designed BGP confederation with documented member-AS and external peer behavior. Which additional predeployment check is most relevant?
- Coordinate migration of neighbors, AS-path handling and route policies at every confederation border.
- Validate route-reflector originator/cluster-loop prevention and redundant peer reachability.
- Verify the resulting advertised-route set from the partner-facing perspective.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
Explanation
Correct Answer
A:Coordinate migration of neighbors, AS-path handling and route policies at every confederation border. This protects the intended outcome: External peers see the intended confederation identifier while internal sub-AS sessions provide approved reachability.
Incorrect Answers
B:That precaution belongs to another scenario: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It is not the primary safeguard for this rollout.
D:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
Question 676
An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. The chosen correction is: Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks. Which additional predeployment check is most relevant?
- Validate cabling and spanning-tree domain boundaries before exempting any port.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
- Validate 802.1X/MAB, identity propagation and policy logs during roaming tests.
Explanation
Correct Answer
C:Separate endpoint ports from legitimate bridged connections when applying BPDU policies. This protects the intended outcome: The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
Incorrect Answers
A:That precaution belongs to another scenario: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It is not the primary safeguard for this rollout.
Question 677
Two business units share one management VLAN with unrestricted access to each other's routers. The chosen correction is: Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries. Which additional predeployment check is most relevant?
- Ensure monitoring and certificate renewal still function inside the isolated management context.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Test congestion on the smallest management path and verify control-plane rate limits.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
Explanation
Correct Answer
B:Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths. This protects the intended outcome: Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
Incorrect Answers
A:That precaution belongs to another scenario: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
Question 678
A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The chosen correction is: Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path. Which additional predeployment check is most relevant?
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
- Validate key server reachability, group membership and the underlying trusted WAN model.
- Check overlapping subnets and security policy at both ends before broadening selectors.
Explanation
Correct Answer
A:Measure path MTU over primary and backup carriers before setting MSS limits. This protects the intended outcome: Large application sessions succeed with correct effective packet sizing over each approved transport.
Incorrect Answers
B:That precaution belongs to another scenario: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It is not the primary safeguard for this rollout.
Question 679
Two acquired companies both use 172.16.0.0/12; an immediate core merge would expose identical destination prefixes. The chosen correction is: Preserve separate VRFs and apply a scoped, documented translation or renumbering design at the interconnect boundary. Which additional predeployment check is most relevant?
- Baseline LSP refresh, interface errors, and failover events before tightening detection timers.
- Check metric mapping and tagging consistently at both redistribution routers.
- Confirm end-to-end payload MTU and vendor hardware support before making both sides match.
- Map overlapping applications and the dependency on translated addresses before integrating routing domains.
Explanation
Correct Answer
D:Map overlapping applications and the dependency on translated addresses before integrating routing domains. This protects the intended outcome: Both tenants resolve overlapping addresses within their own routing tables while approved intercompany services remain reachable.
Incorrect Answers
A:That precaution belongs to another scenario: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the primary safeguard for this rollout.
Question 680
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. The chosen correction is: Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions. Which additional predeployment check is most relevant?
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Validate management and service reachability for each VRF separately.
- Test the two failure modes independently before granting acceptance.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
Explanation
Correct Answer
C:Test the two failure modes independently before granting acceptance. This protects the intended outcome: Both failure exercises satisfy the documented outage budget without skipping required policy checks.
Incorrect Answers
A:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
