100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 720
An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. The chosen correction is: Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms. Which additional predeployment check is most relevant?
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Review route reachability and summary boundaries before introducing stub behavior.
- Confirm path diversity at reflectors and ensure no unintended loops or excess table growth.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
Explanation
Correct Answer
C:Confirm path diversity at reflectors and ensure no unintended loops or excess table growth. This protects the intended outcome: Clients retain enough independent eligible paths to support the agreed failover policy.
Incorrect Answers
A:That precaution belongs to another scenario: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
Question 721
A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. The chosen correction is: Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries. Which additional predeployment check is most relevant?
- Test key-server redundancy and key-lifetime rollover before production.
- Test session establishment and failover with real application traffic, not ICMP alone.
- Agree route ownership, policy and acceptance tests with both providers.
- Obtain documented path diversity evidence rather than relying on separate provider names.
Explanation
Correct Answer
C:Agree route ownership, policy and acceptance tests with both providers. This protects the intended outcome: Approved site prefixes propagate across the interconnect while unrelated customer VPN routes remain isolated.
Incorrect Answers
A:That precaution belongs to another scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It is not the primary safeguard for this rollout.
Question 722
Two tenants use 10.0.0.0/8 addressing and share the same campus core but require separate routing and firewall policies. The chosen correction is: Use VRF-based routing separation with explicitly controlled route leaking for shared services. Which additional predeployment check is most relevant?
- Validate shared-services next-hop and return-path symmetry before enabling route leaking.
- Define explicit allowed prefixes and monitored deny counters before deployment.
- Audit rack power and upstream physical paths before accepting a two-device availability claim.
- Map application dependency and physical service connections before relocating devices.
Explanation
Correct Answer
A:Validate shared-services next-hop and return-path symmetry before enabling route leaking. This protects the intended outcome: Duplicate prefixes coexist in isolated tables and cross-tenant routes appear only where authorized.
Incorrect Answers
B:That precaution belongs to another scenario: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It is not the primary safeguard for this rollout.
Question 723
A script writes `ietf-interfaces` fields to a platform supporting only a different module revision and receives an unknown-element error. The chosen correction is: Negotiate supported YANG model names/revisions and update payload paths accordingly. Which additional predeployment check is most relevant?
- Verify actual model revision, device support and data-type semantics rather than assuming every OpenConfig path exists.
- Query capability/model support and document fallback sampling per platform.
- Validate the module-set and datastore capabilities before a fleetwide write.
- Detect device capability and model revision before applying vendor-specific settings.
Explanation
Correct Answer
C:Validate the module-set and datastore capabilities before a fleetwide write. This protects the intended outcome: The device accepts the schema-valid request and exposes the expected operational result.
Incorrect Answers
A:That precaution belongs to another scenario: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the primary safeguard for this rollout.
Question 724
A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. The chosen correction is: Remove or constrain the summary when it attracts traffic to networks not reachable through the campus boundary. Which additional predeployment check is most relevant?
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Trace route origin and affected prefix reachability before removing the advertisement.
- Verify the resulting advertised-route set from the partner-facing perspective.
Explanation
Correct Answer
A:Compare active specifics with the aggregate and identify valid exception routes before withdrawal. This protects the intended outcome: Branch routers no longer send packets for the retired /24 into a blackhole created by the former summary.
Incorrect Answers
B:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It is not the primary safeguard for this rollout.
Question 725
A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. The chosen correction is: Give critical management/control traffic an appropriate protected class and regulate bulk backup load. Which additional predeployment check is most relevant?
- Estimate collector volume and sample rates before enabling streams.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Test congestion on the smallest management path and verify control-plane rate limits.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
Explanation
Correct Answer
C:Test congestion on the smallest management path and verify control-plane rate limits. This protects the intended outcome: An emergency administrator maintains workable session latency while backup transfer runs.
Incorrect Answers
A:That precaution belongs to another scenario: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
Question 726
Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. The chosen correction is: Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components. Which additional predeployment check is most relevant?
- Verify upstream fate sharing and convergence on a controlled aggregation outage.
- Compare the aggregation with the live branch prefix inventory and EIGRP summary discard behavior.
- Model preferred and backup routes with tags and test failure behavior before enabling both ASBRs.
- Check the AS number, K values, and authentication compatibility on both peers.
Explanation
Correct Answer
B:Compare the aggregation with the live branch prefix inventory and EIGRP summary discard behavior. This protects the intended outcome: The hub forwards only to reachable site prefixes or intentionally documented summary ranges.
Incorrect Answers
A:That precaution belongs to another scenario: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A regional site uses EIGRP neighbors with mismatched autonomous system numbers despite matching IP subnet and authentication. It is not the primary safeguard for this rollout.
Question 727
An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. The chosen correction is: Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding. Which additional predeployment check is most relevant?
- Verify map resolution and fabric edge RLOC reachability independently.
- Measure control-plane convergence and endpoint mapping age under a controlled node failure.
- Verify protocol-specific graceful-restart restrictions rather than assuming universal hitlessness.
- Map chassis, power, supervisors, and uplink fate sharing before approving the design.
Explanation
Correct Answer
A:Verify map resolution and fabric edge RLOC reachability independently. This protects the intended outcome: Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges.
Incorrect Answers
B:That precaution belongs to another scenario: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It is not the primary safeguard for this rollout.
Question 728
An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. The chosen correction is: Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers. Which additional predeployment check is most relevant?
- Test partial-provider outages and hold-down behavior to prevent flapping.
- Monitor data caps, power and radio signal as part of backup readiness.
- Trace the full data path and perform local edge failover testing before approval.
- Check certificates, site IDs, controller sessions and OMP timers before changing underlay routes.
Explanation
Correct Answer
A:Test partial-provider outages and hold-down behavior to prevent flapping. This protects the intended outcome: The branch switches to the secondary circuit within the required service recovery interval.
Incorrect Answers
B:That precaution belongs to another scenario: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. It is not the primary safeguard for this rollout.
Question 729
A campus has out-of-band console servers but all consoles depend on the production AAA server reachable only over the failed production network. The chosen correction is: Design OOB authentication and recovery with an approved bounded fallback independent of production paths. Which additional predeployment check is most relevant?
- Validate source reachability and PIM state before changing multicast policy.
- Test the OOB path and escalation workflow periodically.
- Test break-glass use and preserve security event audit after connectivity returns.
- Secure the OOB path and verify its separate power and access transport.
Explanation
Correct Answer
C:Test break-glass use and preserve security event audit after connectivity returns. This protects the intended outcome: Authorized emergency operators can administer devices when primary campus routing and AAA are down.
Incorrect Answers
A:That precaution belongs to another scenario: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It is not the primary safeguard for this rollout.
Question 730
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. The chosen correction is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere. Which additional predeployment check is most relevant?
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Test BIOS/NIC settings, VLAN boundaries and security policy before opening directed broadcasts.
- Validate cabling and spanning-tree domain boundaries before exempting any port.
Explanation
Correct Answer
D:Validate cabling and spanning-tree domain boundaries before exempting any port. This protects the intended outcome: The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
Incorrect Answers
A:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
