100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 700
A campus wants deterministic STP roots but all switches retain default bridge priorities. The chosen correction is: Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets. Which additional predeployment check is most relevant?
- Define explicit allowed prefixes and monitored deny counters before deployment.
- Verify root identity for every relevant VLAN or MST instance rather than one sample VLAN.
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
- Test removal of each default and ensure existing internal routes stay reachable.
Explanation
Correct Answer
B:Verify root identity for every relevant VLAN or MST instance rather than one sample VLAN. This protects the intended outcome: Root bridge elections and forwarding paths match the documented campus topology.
Incorrect Answers
A:That precaution belongs to another scenario: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It is not the primary safeguard for this rollout.
Question 701
An edge router receives a full BGP table where the security policy allows only the provider's approved default. The chosen correction is: Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards. Which additional predeployment check is most relevant?
- Test withdrawal of the default and preserve the required local and internal routes.
- Validate route-reflector originator/cluster-loop prevention and redundant peer reachability.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answer
A:Test withdrawal of the default and preserve the required local and internal routes. This protects the intended outcome: The accepted RIB contains the permitted default and no unintended provider prefixes.
Incorrect Answers
B:That precaution belongs to another scenario: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It is not the primary safeguard for this rollout.
Question 702
A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. The chosen correction is: Align SSM membership to include the desired (S,G) source/group relationship. Which additional predeployment check is most relevant?
- Validate allowed source/group tuples and reflection resource limits before activation.
- Confirm upstream source paths and verify PIM neighbors on every routed segment.
- Exercise both link failure and restoration while monitoring (S,G) and (*,G) entries.
- Verify receiver IGMP version and source authorization before activating SSM.
Explanation
Correct Answer
D:Verify receiver IGMP version and source authorization before activating SSM. This protects the intended outcome: The receiver sends a source-specific join and obtains only the authorized stream.
Incorrect Answers
A:That precaution belongs to another scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the primary safeguard for this rollout.
Question 703
A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. The chosen correction is: Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics. Which additional predeployment check is most relevant?
- Measure aggregation accuracy after downsampling before changing alert thresholds.
- Confirm the chosen leaf supports on-change and implement appropriate event deduplication.
- Query capability/model support and document fallback sampling per platform.
- Calculate device and collector resource impact for chosen telemetry frequency.
Explanation
Correct Answer
A:Measure aggregation accuracy after downsampling before changing alert thresholds. This protects the intended outcome: Data volumes fall while five-minute trend accuracy still meets planning requirements.
Incorrect Answers
B:That precaution belongs to another scenario: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It is not the primary safeguard for this rollout.
Question 704
HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. The chosen correction is: Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection. Which additional predeployment check is most relevant?
- Test master election with both links present and under a single-failure condition.
- Verify protocol-specific graceful-restart restrictions rather than assuming universal hitlessness.
- Validate tracking thresholds and the backup's independent upstream path with a controlled failure.
- Capacity-test a complete single-router failure, not only normal steady-state load.
Explanation
Correct Answer
C:Validate tracking thresholds and the backup's independent upstream path with a controlled failure. This protects the intended outcome: Uplink failure triggers the intended gateway takeover and remote application sessions recover.
Incorrect Answers
A:That precaution belongs to another scenario: Two campus VRRP gateways both claim master after their shared advertisement path is partitioned, and clients receive inconsistent ARP responses. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. It is not the primary safeguard for this rollout.
Question 705
A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. The chosen correction is: Apply topology or centralized control policy at the appropriate site/VPN scope. Which additional predeployment check is most relevant?
- Test both accepted routes and explicitly denied spoke-to-spoke paths.
- Measure real failover link capacity and decide which applications must be deprioritized.
- Verify encapsulation overhead, security associations, and multicast reachability separately.
- Validate key server reachability, group membership and the underlying trusted WAN model.
Explanation
Correct Answer
A:Test both accepted routes and explicitly denied spoke-to-spoke paths. This protects the intended outcome: Finance sites reach only designated hubs while approved other segments preserve their intended paths.
Incorrect Answers
B:That precaution belongs to another scenario: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
Question 706
A hospital campus uses policy-based routing shortcuts for every building but ordinary routing still lacks resilient interbuilding reachability. The chosen correction is: Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions. Which additional predeployment check is most relevant?
- Map exceptional applications and their return paths before removing legacy rules.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
Explanation
Correct Answer
A:Map exceptional applications and their return paths before removing legacy rules. This protects the intended outcome: Regular traffic retains resilient routed reachability without depending on per-building PBR hacks.
Incorrect Answers
B:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the primary safeguard for this rollout.
Question 707
A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. The chosen correction is: Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design. Which additional predeployment check is most relevant?
- Model preferred and backup routes with tags and test failure behavior before enabling both ASBRs.
- Check metric mapping and tagging consistently at both redistribution routers.
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
- Prefer durable backbone topology repair over making virtual links a permanent substitute for good design.
Explanation
Correct Answer
D:Prefer durable backbone topology repair over making virtual links a permanent substitute for good design. This protects the intended outcome: All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
Incorrect Answers
A:That precaution belongs to another scenario: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
Question 708
A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. The chosen correction is: Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract. Which additional predeployment check is most relevant?
- Account for encapsulation overhead and QoS scheduler interaction when calculating the shaper rate.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Estimate collector volume and sample rates before enabling streams.
- Check allowable latency and buffer sizes so shaping does not create unbounded queue delay.
Explanation
Correct Answer
A:Account for encapsulation overhead and QoS scheduler interaction when calculating the shaper rate. This protects the intended outcome: Measured traffic conforms to the allowed profile and application packet loss decreases under load.
Incorrect Answers
B:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. It is not the primary safeguard for this rollout.
Question 709
A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. The chosen correction is: Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN. Which additional predeployment check is most relevant?
- Test provider MTU, loop prevention and circuit failover before cutover.
- Verify source/receiver topology, platform multicast support and traffic volume.
- Verify encapsulation overhead, security associations, and multicast reachability separately.
- Measure path MTU over primary and backup carriers before setting MSS limits.
Explanation
Correct Answer
B:Verify source/receiver topology, platform multicast support and traffic volume. This protects the intended outcome: Only authorized multicast receivers on selected sites receive the required production feed.
Incorrect Answers
A:That precaution belongs to another scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the primary safeguard for this rollout.
Question 710
In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. The chosen correction is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks. Which additional predeployment check is most relevant?
- Confirm route leaking and firewall context capacity before moving the border.
- Verify underlay IGP and fabric VRF configuration as separate acceptance tests.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
Explanation
Correct Answer
B:Verify underlay IGP and fabric VRF configuration as separate acceptance tests. This protects the intended outcome: Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
Incorrect Answers
A:That precaution belongs to another scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
