100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 730
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. The chosen correction is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere. Which additional predeployment check is most relevant?
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Test BIOS/NIC settings, VLAN boundaries and security policy before opening directed broadcasts.
- Validate cabling and spanning-tree domain boundaries before exempting any port.
Explanation
Correct Answer
D:Validate cabling and spanning-tree domain boundaries before exempting any port. This protects the intended outcome: The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
Incorrect Answers
A:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It is not the primary safeguard for this rollout.
Question 731
A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. The chosen correction is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary. Which additional predeployment check is most relevant?
- Check protocol payloads, bidirectional addressing and security logs before deployment.
- Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links.
Explanation
Correct Answer
A:Check protocol payloads, bidirectional addressing and security logs before deployment. This protects the intended outcome: Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
Incorrect Answers
B:That precaution belongs to another scenario: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. It is not the primary safeguard for this rollout.
Question 732
A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. The chosen correction is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations. Which additional predeployment check is most relevant?
- Measure aggregation accuracy after downsampling before changing alert thresholds.
- Calculate device and collector resource impact for chosen telemetry frequency.
- Confirm HTTP authentication, model paths, ETags and expected status-code handling.
- Tune frequency to the collector capacity and device resource budget.
Explanation
Correct Answer
C:Confirm HTTP authentication, model paths, ETags and expected status-code handling. This protects the intended outcome: An approved RESTCONF PATCH changes only the intended interface fields and a GET verifies effective state.
Incorrect Answers
A:That precaution belongs to another scenario: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the primary safeguard for this rollout.
Question 733
Several PIM-SM sites use a single RP placed across a high-latency WAN and suffer slow source registration after provider reconvergence. The chosen correction is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency. Which additional predeployment check is most relevant?
- Document permitted DSCP translations and validate the provider's supported class values.
- Consider site-local RP domains and interdomain source discovery needs before redesign.
- Test the OOB path and escalation workflow periodically.
- Test RP reachability, register and join behavior under single-node failure.
Explanation
Correct Answer
B:Consider site-local RP domains and interdomain source discovery needs before redesign. This protects the intended outcome: Local receiver joins and new-source registrations recover within target SLA during WAN failure.
Incorrect Answers
A:That precaution belongs to another scenario: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A PIM-SM domain has active receivers but no working rendezvous-point reachability for new source registration. It is not the primary safeguard for this rollout.
Question 734
A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. The chosen correction is: Require physical route and carrier diversity, including demarcation and access-path audits. Which additional predeployment check is most relevant?
- Test session establishment and failover with real application traffic, not ICMP alone.
- Obtain documented path diversity evidence rather than relying on separate provider names.
- Agree route ownership, policy and acceptance tests with both providers.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
Explanation
Correct Answer
B:Obtain documented path diversity evidence rather than relying on separate provider names. This protects the intended outcome: A controlled failure of either carrier access route leaves required service operational on the independent path.
Incorrect Answers
A:That precaution belongs to another scenario: Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It is not the primary safeguard for this rollout.
Question 735
Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. The chosen correction is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration. Which additional predeployment check is most relevant?
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
- Validate 802.1X/MAB, identity propagation and policy logs during roaming tests.
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
- Compare the approved software matrix and intended fabric site design before onboarding.
Explanation
Correct Answer
B:Validate 802.1X/MAB, identity propagation and policy logs during roaming tests. This protects the intended outcome: A moved endpoint retains its intended policy and access to only approved destinations.
Incorrect Answers
A:That precaution belongs to another scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. It is not the primary safeguard for this rollout.
Question 736
An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. The chosen correction is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed. Which additional predeployment check is most relevant?
- Test route withdrawal and actual traffic forwarding, not just neighbor state.
- Test withdrawal of the default and preserve the required local and internal routes.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Confirm tunnel endpoints, encryption requirements and path MTU before production.
Explanation
Correct Answer
D:Confirm tunnel endpoints, encryption requirements and path MTU before production. This protects the intended outcome: IPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks.
Incorrect Answers
A:That precaution belongs to another scenario: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the primary safeguard for this rollout.
C:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
Question 737
A campus carries multicast across dual uplinks and incorrectly assumes that equal-cost unicast routes guarantee both incoming multicast paths are valid. The chosen correction is: Verify the designated RPF path used for each multicast source and align routed topology as needed. Which additional predeployment check is most relevant?
- Verify receiver IGMP version and source authorization before activating SSM.
- Size the priority class and verify congestion behavior with realistic mixes.
- Test source-specific RPF and failover changes at every branch router.
- Exercise both link failure and restoration while monitoring (S,G) and (*,G) entries.
Explanation
Correct Answer
C:Test source-specific RPF and failover changes at every branch router. This protects the intended outcome: Legitimate multicast traffic arrives on the expected upstream interface without duplicates.
Incorrect Answers
A:That precaution belongs to another scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the primary safeguard for this rollout.
Question 738
Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. The chosen correction is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes. Which additional predeployment check is most relevant?
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Check overlapping subnets and security policy at both ends before broadening selectors.
- Test partial-provider outages and hold-down behavior to prevent flapping.
- Validate serial authorization and certificate lifecycle before production onboarding.
Explanation
Correct Answer
B:Check overlapping subnets and security policy at both ends before broadening selectors. This protects the intended outcome: Child SAs establish for the matching traffic selectors and permitted applications pass.
Incorrect Answers
A:That precaution belongs to another scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. It is not the primary safeguard for this rollout.
Question 739
A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. The chosen correction is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative. Which additional predeployment check is most relevant?
- Audit rack power and upstream physical paths before accepting a two-device availability claim.
- Verify platform multi-chassis capability and fate sharing before bundling cross-chassis links.
- Confirm multicast, wireless, and mobility requirements before retiring stretched VLANs.
- Validate applications requiring nonroutable discovery before enabling targeted relays.
Explanation
Correct Answer
D:Validate applications requiring nonroutable discovery before enabling targeted relays. This protects the intended outcome: Clients discover approved printers across subnets without carrying all broadcasts between buildings.
Incorrect Answers
A:That precaution belongs to another scenario: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It is not the primary safeguard for this rollout.
Question 740
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The chosen correction is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation. Which additional predeployment check is most relevant?
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
- Confirm tunnel endpoints, encryption requirements and path MTU before production.
- Check overload and attached-bit behavior before modifying L1/L2 roles.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
Explanation
Correct Answer
D:Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements. This protects the intended outcome: All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
Incorrect Answers
A:That precaution belongs to another scenario: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
