100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 770
A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. The chosen correction is: Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop. Which additional predeployment check is most relevant?
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Capacity-test a complete single-router failure, not only normal steady-state load.
- Verify platform multi-chassis capability and fate sharing before bundling cross-chassis links.
Explanation
Correct Answer
B:Validate LACP partner system IDs and split-brain protection for the chosen solution. This protects the intended outcome: Both paths carry approved traffic and a member failure has no broad STP reconvergence.
Incorrect Answers
A:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It is not the primary safeguard for this rollout.
Question 771
A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. The chosen correction is: Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion. Which additional predeployment check is most relevant?
- Check protocol payloads, bidirectional addressing and security logs before deployment.
- Set sensible headroom and operational alerting so normal growth does not cause unnecessary shutdown.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
Explanation
Correct Answer
C:Coordinate with provider route policy and monitor diverse external vantage points. This protects the intended outcome: Observed inbound paths trend toward ISP B from representative external monitors without assuming universal control.
Incorrect Answers
A:That precaution belongs to another scenario: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A company accepts routes from a newly merged BGP AS without maximum-prefix limits, and the peer mistakenly sends hundreds of thousands of prefixes. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
Question 772
Two DMVPN spokes can reach the hub but never build a direct shortcut after new spoke routes are learned. The chosen correction is: Align DMVPN phase/design, NHRP mappings and redirect/shortcut behavior with the intended topology. Which additional predeployment check is most relevant?
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
- Validate key server reachability, group membership and the underlying trusted WAN model.
- Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security.
- Test NAT, authentication and both spoke failure paths before enabling shortcuts broadly.
Explanation
Correct Answer
D:Test NAT, authentication and both spoke failure paths before enabling shortcuts broadly. This protects the intended outcome: Traffic flows through the permitted direct spoke tunnel where expected while hub fallback still works.
Incorrect Answers
A:That precaution belongs to another scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. It is not the primary safeguard for this rollout.
Question 773
An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. The chosen correction is: Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture. Which additional predeployment check is most relevant?
- Confirm the chosen leaf supports on-change and implement appropriate event deduplication.
- Baseline byte rates, memory and packet loss before enabling subscriptions on all devices.
- Validate module namespace and device-supported YANG library before generating requests.
- Calculate device and collector resource impact for chosen telemetry frequency.
Explanation
Correct Answer
D:Calculate device and collector resource impact for chosen telemetry frequency. This protects the intended outcome: Collector time series captures the brief spikes with timestamped relevant YANG measurements.
Incorrect Answers
A:That precaution belongs to another scenario: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A fleet telemetry design streams all available operational leaves every second over a constrained management link. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It is not the primary safeguard for this rollout.
Question 774
A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. The chosen correction is: Protect essential routing/control traffic within bounded QoS classes at actual bottlenecks. Which additional predeployment check is most relevant?
- Verify classification with application telemetry and manage encrypted-traffic visibility constraints.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Verify traffic profile and congestion points before adjusting class percentages.
- Prevent uncontrolled high-rate management flows from abusing the protected class.
Explanation
Correct Answer
D:Prevent uncontrolled high-rate management flows from abusing the protected class. This protects the intended outcome: Control-plane adjacencies and monitoring remain stable during representative congestion.
Incorrect Answers
A:That precaution belongs to another scenario: A branch QoS policy matches all TCP 443 traffic as video, including large software downloads. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A branch policy gives every queue an equal share although its database synchronization is delaying emergency call signaling. It is not the primary safeguard for this rollout.
Question 775
A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. The chosen correction is: Design supported fabric wireless segmentation with dedicated VNs/SGTs and appropriate wireless control integration. Which additional predeployment check is most relevant?
- Verify intersite MTU, transit control plane and shared-services boundaries.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Compare model-specific power requirements with cable loss and redundant supply capacity.
Explanation
Correct Answer
C:Validate WLC and AP fabric roles against platform support and target mobility scope. This protects the intended outcome: Guest clients roam as designed and cannot access restricted enterprise segments.
Incorrect Answers
A:That precaution belongs to another scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. It is not the primary safeguard for this rollout.
Question 776
A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. The chosen correction is: Design redundant BGP route reflectors with consistent cluster IDs and reflector-client relationships. Which additional predeployment check is most relevant?
- Validate route-reflector originator/cluster-loop prevention and redundant peer reachability.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Coordinate migration of neighbors, AS-path handling and route policies at every confederation border.
- Test withdrawal of the default and preserve the required local and internal routes.
Explanation
Correct Answer
A:Validate route-reflector originator/cluster-loop prevention and redundant peer reachability. This protects the intended outcome: Route reflector clients learn authorized prefixes without maintaining a full mesh of all client sessions.
Incorrect Answers
B:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A merger requires two administrative BGP regions to appear as one external AS while reducing iBGP mesh size internally. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the primary safeguard for this rollout.
Question 777
A retail design directs all cloud SaaS traffic through headquarters even though local internet breakout is allowed and latency is poor. The chosen correction is: Evaluate policy-controlled local internet breakout with appropriate security inspection and application path measurement. Which additional predeployment check is most relevant?
- Confirm identity, DNS, filtering and branch service-chaining requirements before activating breakout.
- Measure actual tunnel performance and understand what happens when no path meets SLA.
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
- Validate carrier availability, diversity and any tagged VLAN handoff requirements.
Explanation
Correct Answer
A:Confirm identity, DNS, filtering and branch service-chaining requirements before activating breakout. This protects the intended outcome: Approved SaaS sessions use the closer permitted breakout and remain governed by the security policy.
Incorrect Answers
B:That precaution belongs to another scenario: A voice application has a 120-ms latency budget, but SD-WAN traffic follows the cheapest internet path despite BFD reporting 220-ms delay. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A city campus needs a 10-Gbps local metro interconnect with SLA and carrier demarcation, but the proposed design assumes standard broadband internet guarantees. It is not the primary safeguard for this rollout.
Question 778
A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. The chosen correction is: Combine trusted traffic classification and marking with a suitable egress priority queue and bandwidth admission design. Which additional predeployment check is most relevant?
- Verify backup throughput and overhead during real failover testing.
- Validate classification at trust boundaries and prevent starvation of essential nonvoice traffic.
- Include control, default, and scavenger classes when totaling reserved bandwidth.
- Size the priority class and verify congestion behavior with realistic mixes.
Explanation
Correct Answer
B:Validate classification at trust boundaries and prevent starvation of essential nonvoice traffic. This protects the intended outcome: Voice latency and packet loss stay within the approved limit during controlled WAN congestion.
Incorrect Answers
A:That precaution belongs to another scenario: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the primary safeguard for this rollout.
Question 779
The IS-IS backbone has a router in overload state after reboot and operators mistake it for an ordinary forwarding transit. The chosen correction is: Honor the IS-IS overload-bit signaling and restore normal transit eligibility only when routing readiness is confirmed. Which additional predeployment check is most relevant?
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Verify reachability to the node's own prefixes and avoid permanent isolation after recovery.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Baseline LSP refresh, interface errors, and failover events before tightening detection timers.
Explanation
Correct Answer
B:Verify reachability to the node's own prefixes and avoid permanent isolation after recovery. This protects the intended outcome: Other routers avoid using the overloaded node as unintended transit until it is ready.
Incorrect Answers
A:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It is not the primary safeguard for this rollout.
Question 780
A port used only for workstations undergoes lengthy spanning-tree transitions whenever a client reconnects. The chosen correction is: Apply a supported edge/PortFast designation only to validated endpoint-facing interfaces. Which additional predeployment check is most relevant?
- Validate device power negotiation and high-priority endpoint allocations before production.
- Combine edge behavior with BPDU protection and verify which interfaces can attach network devices.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
Explanation
Correct Answer
B:Combine edge behavior with BPDU protection and verify which interfaces can attach network devices. This protects the intended outcome: Client ports forward promptly while bridged uplinks still receive normal loop protection.
Incorrect Answers
A:That precaution belongs to another scenario: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
