100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 710
In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. The chosen correction is: Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks. Which additional predeployment check is most relevant?
- Confirm route leaking and firewall context capacity before moving the border.
- Verify underlay IGP and fabric VRF configuration as separate acceptance tests.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
Explanation
Correct Answer
B:Verify underlay IGP and fabric VRF configuration as separate acceptance tests. This protects the intended outcome: Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
Incorrect Answers
A:That precaution belongs to another scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It is not the primary safeguard for this rollout.
Question 711
An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. The chosen correction is: Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope. Which additional predeployment check is most relevant?
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Check metric mapping and tagging consistently at both redistribution routers.
- Prefer durable backbone topology repair over making virtual links a permanent substitute for good design.
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
Explanation
Correct Answer
D:Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound. This protects the intended outcome: Local access failures generate bounded LSDB changes without disrupting unrelated branches.
Incorrect Answers
A:That precaution belongs to another scenario: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It is not the primary safeguard for this rollout.
Question 712
Video and voice both use one strict-priority queue, causing voice jitter when video surges. The chosen correction is: Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees. Which additional predeployment check is most relevant?
- Size the priority class and verify congestion behavior with realistic mixes.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Validate classification at trust boundaries and prevent starvation of essential nonvoice traffic.
Explanation
Correct Answer
A:Size the priority class and verify congestion behavior with realistic mixes. This protects the intended outcome: Voice delay stays within SLA during video bursts while other classes retain scheduled service.
Incorrect Answers
B:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. It is not the primary safeguard for this rollout.
Question 713
A 5,000-user branch rollout wants direct SaaS breakout through local cloud on-ramp but all DNS still resolves clients to the distant headquarters proxy region. The chosen correction is: Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning. Which additional predeployment check is most relevant?
- Review the contract's actual management boundary rather than the marketing name.
- Test application latency and policy continuity from representative branches.
- Verify actual model revision, device support and data-type semantics rather than assuming every OpenConfig path exists.
- Inspect response media type, payload and authorization scopes before accepting writes.
Explanation
Correct Answer
B:Test application latency and policy continuity from representative branches. This protects the intended outcome: SaaS sessions use an approved closer path while security controls and logging remain effective.
Incorrect Answers
A:That precaution belongs to another scenario: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. It is not the primary safeguard for this rollout.
Question 714
A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. The chosen correction is: Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring. Which additional predeployment check is most relevant?
- Verify source/receiver topology, platform multicast support and traffic volume.
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
- Verify encapsulation overhead, security associations, and multicast reachability separately.
- Test provider MTU, loop prevention and circuit failover before cutover.
Explanation
Correct Answer
D:Test provider MTU, loop prevention and circuit failover before cutover. This protects the intended outcome: Enterprise routers form intended routing neighbors over the circuit while provider internals remain hidden.
Incorrect Answers
A:That precaution belongs to another scenario: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It is not the primary safeguard for this rollout.
Question 715
A design team treats NSR and NSF as synonyms and assumes route preservation when the only Routing Processor crashes. The chosen correction is: Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles. Which additional predeployment check is most relevant?
- Validate hash entropy and elephant-flow effects before sizing links.
- Check platform high availability mode and which routing protocols support the planned behavior.
- Verify map resolution and fabric edge RLOC reachability independently.
- Test the full supported transit profile rather than relying on basic IP ping success.
Explanation
Correct Answer
B:Check platform high availability mode and which routing protocols support the planned behavior. This protects the intended outcome: A standby control plane takes over or forwarding is preserved according to the selected capability's documented scope.
Incorrect Answers
A:That precaution belongs to another scenario: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It is not the primary safeguard for this rollout.
Question 716
A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. The chosen correction is: Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records. Which additional predeployment check is most relevant?
- Validate firewall policies and monitoring for both families before removing any transition dependency.
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
- Test both A and AAAA record resolution from representative client networks.
Explanation
Correct Answer
D:Test both A and AAAA record resolution from representative client networks. This protects the intended outcome: IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
Incorrect Answers
A:That precaution belongs to another scenario: Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the primary safeguard for this rollout.
Question 717
An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. The chosen correction is: Evaluate controlled multicast service reflection or translation with explicit source/group mappings. Which additional predeployment check is most relevant?
- Confirm all clients and intermediate devices support the required SSM join model.
- Validate allowed source/group tuples and reflection resource limits before activation.
- Ensure monitoring and certificate renewal still function inside the isolated management context.
- Verify receiver IGMP version and source authorization before activating SSM.
Explanation
Correct Answer
B:Validate allowed source/group tuples and reflection resource limits before activation. This protects the intended outcome: Intended receivers obtain the translated stream while unrelated multicast groups remain separate.
Incorrect Answers
A:That precaution belongs to another scenario: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the primary safeguard for this rollout.
Question 718
A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. The chosen correction is: Introduce deliberate recovery policy or dampening to prevent repeated unstable failback. Which additional predeployment check is most relevant?
- Monitor data caps, power and radio signal as part of backup readiness.
- Validate SIM/APN addressing and tunnel establishment from each cellular provider.
- Record SLA impact and safe return criteria before enabling automatic restoration.
- Conduct site-specific signal and application testing rather than assuming headline cellular bandwidth.
Explanation
Correct Answer
C:Record SLA impact and safe return criteria before enabling automatic restoration. This protects the intended outcome: Application sessions remain stable through short intermittent primary path disturbances.
Incorrect Answers
A:That precaution belongs to another scenario: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. It is not the primary safeguard for this rollout.
Question 719
Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. The chosen correction is: Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover. Which additional predeployment check is most relevant?
- Model application flow matrix and provider link costs before adding shortcuts.
- Verify fabric-specific multicast capability and receiver joins on all relevant boundaries.
- Test removal of each default and ensure existing internal routes stay reachable.
- Verify each summarized site's actual forwarding path before suppressing specifics.
Explanation
Correct Answer
A:Model application flow matrix and provider link costs before adding shortcuts. This protects the intended outcome: Site-to-site voice follows a lower-latency approved route while hub failure leaves planned alternate reachability.
Incorrect Answers
B:That precaution belongs to another scenario: A financial application needs multicast delivery across SDA sites, but all validation has covered unicast endpoint maps only. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. It is not the primary safeguard for this rollout.
Question 720
An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. The chosen correction is: Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms. Which additional predeployment check is most relevant?
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Review route reachability and summary boundaries before introducing stub behavior.
- Confirm path diversity at reflectors and ensure no unintended loops or excess table growth.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
Explanation
Correct Answer
C:Confirm path diversity at reflectors and ensure no unintended loops or excess table growth. This protects the intended outcome: Clients retain enough independent eligible paths to support the agreed failover policy.
Incorrect Answers
A:That precaution belongs to another scenario: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
