100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 680
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. The chosen correction is: Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions. Which additional predeployment check is most relevant?
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Validate management and service reachability for each VRF separately.
- Test the two failure modes independently before granting acceptance.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
Explanation
Correct Answer
C:Test the two failure modes independently before granting acceptance. This protects the intended outcome: Both failure exercises satisfy the documented outage budget without skipping required policy checks.
Incorrect Answers
A:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
Question 681
SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. The chosen correction is: Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship. Which additional predeployment check is most relevant?
- Trace encryption and tenant isolation needs at the service layer before activating capacity.
- Check certificates, site IDs, controller sessions and OMP timers before changing underlay routes.
- Test partial-provider outages and hold-down behavior to prevent flapping.
- Trace the full data path and perform local edge failover testing before approval.
Explanation
Correct Answer
B:Check certificates, site IDs, controller sessions and OMP timers before changing underlay routes. This protects the intended outcome: Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable.
Incorrect Answers
A:That precaution belongs to another scenario: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the primary safeguard for this rollout.
Question 682
An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. The chosen correction is: Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies. Which additional predeployment check is most relevant?
- Examine cloud service limits, BGP policy and regional diversity before committing to circuits.
- Test lock ownership, timeout and cleanup behavior before automation at scale.
- Map shared responsibility and data residency requirements at each boundary.
- Detect device capability and model revision before applying vendor-specific settings.
Explanation
Correct Answer
C:Map shared responsibility and data residency requirements at each boundary. This protects the intended outcome: Approved burst workloads operate across the private and public boundaries without unrestricted network trust.
Incorrect Answers
A:That precaution belongs to another scenario: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the primary safeguard for this rollout.
Question 683
A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. The chosen correction is: Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior. Which additional predeployment check is most relevant?
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Account for encapsulation overhead and QoS scheduler interaction when calculating the shaper rate.
- Check allowable latency and buffer sizes so shaping does not create unbounded queue delay.
- Verify backup throughput and overhead during real failover testing.
Explanation
Correct Answer
C:Check allowable latency and buffer sizes so shaping does not create unbounded queue delay. This protects the intended outcome: Burst traffic drains within a controlled rate envelope with fewer avoidable losses.
Incorrect Answers
A:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. It is not the primary safeguard for this rollout.
Question 684
A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. The chosen correction is: Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile. Which additional predeployment check is most relevant?
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Map application dependency and physical service connections before relocating devices.
- Validate device power negotiation and high-priority endpoint allocations before production.
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
Explanation
Correct Answer
A:Consider IP phones, virtual machines and MAC mobility before selecting the maximum. This protects the intended outcome: Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
Incorrect Answers
B:That precaution belongs to another scenario: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the primary safeguard for this rollout.
Question 685
IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. The chosen correction is: Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS. Which additional predeployment check is most relevant?
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
- Check metric mapping and tagging consistently at both redistribution routers.
- Prefer durable backbone topology repair over making virtual links a permanent substitute for good design.
- Validate BFD support, timer negotiation and control-plane capacity on each neighbor pair.
Explanation
Correct Answer
B:Check metric mapping and tagging consistently at both redistribution routers. This protects the intended outcome: Allowed external routes appear without reentering their origin routing domain on an alternate border.
Incorrect Answers
A:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. It is not the primary safeguard for this rollout.
Question 686
A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. The chosen correction is: Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy. Which additional predeployment check is most relevant?
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Capacity-test a complete single-router failure, not only normal steady-state load.
- Validate tracking thresholds and the backup's independent upstream path with a controlled failure.
Explanation
Correct Answer
C:Capacity-test a complete single-router failure, not only normal steady-state load. This protects the intended outcome: Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages.
Incorrect Answers
A:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It is not the primary safeguard for this rollout.
Question 687
Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. The chosen correction is: Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly. Which additional predeployment check is most relevant?
- Review route reachability and summary boundaries before introducing stub behavior.
- Confirm end-to-end payload MTU and vendor hardware support before making both sides match.
- Stage keys and document overlap windows before activation.
- Baseline LSP refresh, interface errors, and failover events before tightening detection timers.
Explanation
Correct Answer
B:Confirm end-to-end payload MTU and vendor hardware support before making both sides match. This protects the intended outcome: The neighbors reach FULL and application packets traverse without fragmentation problems.
Incorrect Answers
A:That precaution belongs to another scenario: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It is not the primary safeguard for this rollout.
Question 688
Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. The chosen correction is: Standardize classification and remarking policy across all controlled network trust boundaries. Which additional predeployment check is most relevant?
- Verify classification with application telemetry and manage encrypted-traffic visibility constraints.
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Document permitted DSCP translations and validate the provider's supported class values.
Explanation
Correct Answer
D:Document permitted DSCP translations and validate the provider's supported class values. This protects the intended outcome: Packet captures across both sites show correct class markings before and after provider handoff.
Incorrect Answers
A:That precaution belongs to another scenario: A branch QoS policy matches all TCP 443 traffic as video, including large software downloads. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
Question 689
A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. The chosen correction is: Align the signed device identity, organization name and controller trust requirements for supported secure onboarding. Which additional predeployment check is most relevant?
- Trace the full data path and perform local edge failover testing before approval.
- Validate serial authorization and certificate lifecycle before production onboarding.
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
- Check overlapping subnets and security policy at both ends before broadening selectors.
Explanation
Correct Answer
B:Validate serial authorization and certificate lifecycle before production onboarding. This protects the intended outcome: The device authenticates and forms approved control sessions with the SD-WAN fabric.
Incorrect Answers
A:That precaution belongs to another scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It is not the primary safeguard for this rollout.
Question 690
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. The chosen correction is: Tune BFD intervals and session scale to supported hardware and realistic detection requirements. Which additional predeployment check is most relevant?
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Baseline platform BFD resource consumption and event rates before decreasing timers.
- Validate tracking thresholds and the backup's independent upstream path with a controlled failure.
- Verify intersite MTU, transit control plane and shared-services boundaries.
Explanation
Correct Answer
B:Baseline platform BFD resource consumption and event rates before decreasing timers. This protects the intended outcome: True failures are found promptly while healthy links no longer reset under ordinary control-plane load.
Incorrect Answers
A:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
