100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 740
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The chosen correction is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation. Which additional predeployment check is most relevant?
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
- Confirm tunnel endpoints, encryption requirements and path MTU before production.
- Check overload and attached-bit behavior before modifying L1/L2 roles.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
Explanation
Correct Answer
D:Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements. This protects the intended outcome: All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
Incorrect Answers
A:That precaution belongs to another scenario: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the primary safeguard for this rollout.
Question 741
A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The chosen correction is: Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer. Which additional predeployment check is most relevant?
- Confirm multicast, wireless, and mobility requirements before retiring stretched VLANs.
- Document the region digest and validate VLAN ownership on every participating device.
- Verify intersite MTU, transit control plane and shared-services boundaries.
- Audit rack power and upstream physical paths before accepting a two-device availability claim.
Explanation
Correct Answer
A:Confirm multicast, wireless, and mobility requirements before retiring stretched VLANs. This protects the intended outcome: Both routed uplinks forward to the rest of campus and a link failure reroutes traffic without a campus STP event.
Incorrect Answers
B:That precaution belongs to another scenario: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It is not the primary safeguard for this rollout.
Question 742
A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. The chosen correction is: Evaluate a DMVPN hub/spoke design using NHRP registration and supported dynamic shortcut behavior. Which additional predeployment check is most relevant?
- Add separate encryption where the threat model requires it and verify provider SLA.
- Validate key server reachability, group membership and the underlying trusted WAN model.
- Test NAT, authentication and both spoke failure paths before enabling shortcuts broadly.
- Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security.
Explanation
Correct Answer
D:Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security. This protects the intended outcome: Approved spoke-to-spoke traffic forms an appropriate direct overlay path after registration.
Incorrect Answers
A:That precaution belongs to another scenario: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two DMVPN spokes can reach the hub but never build a direct shortcut after new spoke routes are learned. It is not the primary safeguard for this rollout.
Question 743
An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. The chosen correction is: Engineer a policer with an appropriate burst tolerance and separate real-time queue protection. Which additional predeployment check is most relevant?
- Include control, default, and scavenger classes when totaling reserved bandwidth.
- Select policing rate and burst parameters using representative traffic rather than averages alone.
- Measure token-bucket behavior and provider burst tolerance before tightening thresholds.
- Validate packet sizes and call concurrency under primary and backup transport.
Explanation
Correct Answer
C:Measure token-bucket behavior and provider burst tolerance before tightening thresholds. This protects the intended outcome: Excess guest bursts are contained while voice packet-delay variation remains acceptable.
Incorrect Answers
A:That precaution belongs to another scenario: A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A design team calculates voice QoS bandwidth solely from codec payload bit rate and ignores RTP, IP and tunnel overhead. It is not the primary safeguard for this rollout.
Question 744
A large enterprise wants to contain detailed IS-IS prefixes within buildings while preserving intercampus reachability. The chosen correction is: Use a hierarchical IS-IS L1/L2 design and summarization at supported area boundaries where it fits topology. Which additional predeployment check is most relevant?
- Verify route preference at more than one internal router before completing migration.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Confirm summary ownership and any discontiguous prefixes to avoid unwanted blackholes.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
Explanation
Correct Answer
C:Confirm summary ownership and any discontiguous prefixes to avoid unwanted blackholes. This protects the intended outcome: Building-specific churn stays within the intended area while intercampus summaries remain available.
Incorrect Answers
A:That precaution belongs to another scenario: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It is not the primary safeguard for this rollout.
Question 745
A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. The chosen correction is: Use an appropriate Cisco native YANG model for supported platform-specific configuration. Which additional predeployment check is most relevant?
- Tune frequency to the collector capacity and device resource budget.
- Validate module namespace and device-supported YANG library before generating requests.
- Detect device capability and model revision before applying vendor-specific settings.
- Examine cloud service limits, BGP policy and regional diversity before committing to circuits.
Explanation
Correct Answer
C:Detect device capability and model revision before applying vendor-specific settings. This protects the intended outcome: The controller successfully reads and writes only the supported wireless policy nodes on target devices.
Incorrect Answers
A:That precaution belongs to another scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It is not the primary safeguard for this rollout.
Question 746
A site cutover retains a withdrawn /24 under an unchanged /20 campus summary and traffic follows an obsolete transit path. The chosen correction is: Update summary ownership and ensure discarded or absent specifics cannot mask the retired destination. Which additional predeployment check is most relevant?
- Use link utilization and application SLA data before tuning routing metrics.
- Audit the specific-prefix RIB/FIB at source and destination before moving the aggregate.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
- Test the full supported transit profile rather than relying on basic IP ping success.
Explanation
Correct Answer
B:Audit the specific-prefix RIB/FIB at source and destination before moving the aggregate. This protects the intended outcome: Probes to live destinations follow correct routes while the decommissioned /24 is no longer misdirected.
Incorrect Answers
A:That precaution belongs to another scenario: A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It is not the primary safeguard for this rollout.
Question 747
A data-center team assigns the same loopback IPv4 address to two route reflectors for convenience but also uses it as unique BGP router identifiers. The chosen correction is: Give each route reflector a stable unique loopback/router ID and advertise reachability through the IGP. Which additional predeployment check is most relevant?
- Coordinate peer configurations and prefix reachability before changing established session endpoints.
- Verify upstream fate sharing and convergence on a controlled aggregation outage.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Audit DHCP and static address assignments prior to moving the site to its routed block.
Explanation
Correct Answer
A:Coordinate peer configurations and prefix reachability before changing established session endpoints. This protects the intended outcome: Both reflectors establish independent sessions and logs identify each peer without duplicate router IDs.
Incorrect Answers
B:That precaution belongs to another scenario: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the primary safeguard for this rollout.
Question 748
A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. The chosen correction is: Police untrusted guest ingress traffic to an appropriate rate and violation action at the policy boundary. Which additional predeployment check is most relevant?
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Measure token-bucket behavior and provider burst tolerance before tightening thresholds.
- Review both route advertisements and actual access-policy decisions.
- Select policing rate and burst parameters using representative traffic rather than averages alone.
Explanation
Correct Answer
D:Select policing rate and burst parameters using representative traffic rather than averages alone. This protects the intended outcome: Guest over-limit traffic is dropped or remarked as specified while protected applications maintain quality.
Incorrect Answers
A:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. It is not the primary safeguard for this rollout.
Question 749
An enterprise replaces a point-to-point GRE tunnel with raw IPsec ESP and expects dynamic multicast routing hellos to work unchanged. The chosen correction is: Select a tunnel mechanism or supported IPsec profile that carries required multicast/routing traffic. Which additional predeployment check is most relevant?
- Validate encryption domains, anti-replay, MTU, NAT-T and rekey behavior before failover testing.
- Test provider MTU, loop prevention and circuit failover before cutover.
- Check peer and platform multicast over IPsec capabilities and route recursion.
- Validate key server reachability, group membership and the underlying trusted WAN model.
Explanation
Correct Answer
C:Check peer and platform multicast over IPsec capabilities and route recursion. This protects the intended outcome: Routed adjacency and encapsulated application flows operate through the secure tunnel.
Incorrect Answers
A:That precaution belongs to another scenario: A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
Question 750
A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. The chosen correction is: Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance. Which additional predeployment check is most relevant?
- Verify map resolution and fabric edge RLOC reachability independently.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Simulate failure and steady-state route selection before changing handoff metrics.
- Validate hash entropy and elephant-flow effects before sizing links.
Explanation
Correct Answer
D:Validate hash entropy and elephant-flow effects before sizing links. This protects the intended outcome: Representative flows distribute across eligible next hops while a single ordered flow remains stable.
Incorrect Answers
A:That precaution belongs to another scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
