100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 780
A port used only for workstations undergoes lengthy spanning-tree transitions whenever a client reconnects. The chosen correction is: Apply a supported edge/PortFast designation only to validated endpoint-facing interfaces. Which additional predeployment check is most relevant?
- Validate device power negotiation and high-priority endpoint allocations before production.
- Combine edge behavior with BPDU protection and verify which interfaces can attach network devices.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
Explanation
Correct Answer
B:Combine edge behavior with BPDU protection and verify which interfaces can attach network devices. This protects the intended outcome: Client ports forward promptly while bridged uplinks still receive normal loop protection.
Incorrect Answers
A:That precaution belongs to another scenario: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
Question 781
The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. The chosen correction is: Validate reconvergence of multicast RPF and join/prune state after unicast routing changes. Which additional predeployment check is most relevant?
- Verify receiver IGMP version and source authorization before activating SSM.
- Confirm upstream source paths and verify PIM neighbors on every routed segment.
- Exercise both link failure and restoration while monitoring (S,G) and (*,G) entries.
- Validate source reachability and PIM state before changing multicast policy.
Explanation
Correct Answer
C:Exercise both link failure and restoration while monitoring (S,G) and (*,G) entries. This protects the intended outcome: Multicast forwarding resumes on the newly valid upstream with no persistent duplicates.
Incorrect Answers
A:That precaution belongs to another scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It is not the primary safeguard for this rollout.
Question 782
A company accepts routes from a newly merged BGP AS without maximum-prefix limits, and the peer mistakenly sends hundreds of thousands of prefixes. The chosen correction is: Apply route filtering and appropriate max-prefix safeguards proportional to approved expected routes. Which additional predeployment check is most relevant?
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Set sensible headroom and operational alerting so normal growth does not cause unnecessary shutdown.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks.
Explanation
Correct Answer
B:Set sensible headroom and operational alerting so normal growth does not cause unnecessary shutdown. This protects the intended outcome: The peer can exchange authorized reachability without exhausting edge memory during an erroneous advertisement surge.
Incorrect Answers
A:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the primary safeguard for this rollout.
Question 783
A voice application has a 120-ms latency budget, but SD-WAN traffic follows the cheapest internet path despite BFD reporting 220-ms delay. The chosen correction is: Define SLA-aware application routing with measured loss, latency and jitter and intended tunnel fallback policy. Which additional predeployment check is most relevant?
- Validate encryption domains, anti-replay, MTU, NAT-T and rekey behavior before failover testing.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
- Confirm identity, DNS, filtering and branch service-chaining requirements before activating breakout.
- Measure actual tunnel performance and understand what happens when no path meets SLA.
Explanation
Correct Answer
D:Measure actual tunnel performance and understand what happens when no path meets SLA. This protects the intended outcome: Voice traffic uses an eligible lower-latency transport while other applications retain their separate routing requirements.
Incorrect Answers
A:That precaution belongs to another scenario: A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A retail design directs all cloud SaaS traffic through headquarters even though local internet breakout is allowed and latency is poor. It is not the primary safeguard for this rollout.
Question 784
A telemetry receiver supports gRPC but cannot decode the device's gNMI JSON_IETF path data and classifies every update as malformed. The chosen correction is: Align gNMI encoding and model path interpretation with supported YANG JSON_IETF semantics. Which additional predeployment check is most relevant?
- Validate encoding negotiation and representative samples before broad deployment.
- Baseline byte rates, memory and packet loss before enabling subscriptions on all devices.
- Measure aggregation accuracy after downsampling before changing alert thresholds.
- Verify actual model revision, device support and data-type semantics rather than assuming every OpenConfig path exists.
Explanation
Correct Answer
A:Validate encoding negotiation and representative samples before broad deployment. This protects the intended outcome: Subscription updates decode into typed intended metrics and preserve their source paths.
Incorrect Answers
B:That precaution belongs to another scenario: A fleet telemetry design streams all available operational leaves every second over a constrained management link. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the primary safeguard for this rollout.
D:This offered choice, “Verify actual model revision, device support and data-type semantics rather than assuming every OpenConfig path exists”, addresses a separate concern. That option relates to this separate design case: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It does not answer the current requirement.
Question 785
A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. The chosen correction is: Separate service attachment across independent core fault domains and validate downstream convergence. Which additional predeployment check is most relevant?
- Map application dependency and physical service connections before relocating devices.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Define explicit allowed prefixes and monitored deny counters before deployment.
Explanation
Correct Answer
A:Map application dependency and physical service connections before relocating devices. This protects the intended outcome: A core-device failure leaves required services available through the alternate attachment.
Incorrect Answers
B:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It is not the primary safeguard for this rollout.
Question 786
A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. The chosen correction is: Assign distinct /64 prefixes per routed IPv6 segment from a hierarchical site allocation. Which additional predeployment check is most relevant?
- Stage keys and document overlap windows before activation.
- Audit DHCP and static address assignments prior to moving the site to its routed block.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
- Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks.
Explanation
Correct Answer
C:Reserve a contiguous per-site allocation and validate all router advertisements during cutover. This protects the intended outcome: Neighbor discovery and SLAAC operate independently on both VLANs with no on-link ambiguity.
Incorrect Answers
A:That precaution belongs to another scenario: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the primary safeguard for this rollout.
Question 787
Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. The chosen correction is: Use a validated stack/virtual chassis/MEC design or independent routed uplinks according to supported platform capabilities. Which additional predeployment check is most relevant?
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Map chassis, power, supervisors, and uplink fate sharing before approving the design.
- Validate software and licensing support, peer links, and split-brain safeguards before deployment.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
Explanation
Correct Answer
C:Validate software and licensing support, peer links, and split-brain safeguards before deployment. This protects the intended outcome: Both access links forward as designed and a chassis failure retains authorized connectivity.
Incorrect Answers
A:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
Question 788
A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The chosen correction is: Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling. Which additional predeployment check is most relevant?
- Confirm upstream source paths and verify PIM neighbors on every routed segment.
- Validate source reachability and PIM state before changing multicast policy.
- Exercise both link failure and restoration while monitoring (S,G) and (*,G) entries.
- Validate classification at trust boundaries and prevent starvation of essential nonvoice traffic.
Explanation
Correct Answer
A:Confirm upstream source paths and verify PIM neighbors on every routed segment. This protects the intended outcome: Intended receivers across the routed boundary receive the source stream.
Incorrect Answers
B:That precaution belongs to another scenario: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the primary safeguard for this rollout.
D:This offered choice, “Validate classification at trust boundaries and prevent starvation of essential nonvoice traffic”, addresses a separate concern. That option relates to this separate design case: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. It does not answer the current requirement.
Question 789
A single-homed retail branch can tolerate a four-hour outage but the proposal adds expensive dual-carrier fiber without a business case. The chosen correction is: Match WAN redundancy and repair targets to measured business availability needs and budget. Which additional predeployment check is most relevant?
- Obtain documented path diversity evidence rather than relying on separate provider names.
- Document application RTO and circuit lead times before choosing topology.
- Trace the full data path and perform local edge failover testing before approval.
- Record SLA impact and safe return criteria before enabling automatic restoration.
Explanation
Correct Answer
B:Document application RTO and circuit lead times before choosing topology. This protects the intended outcome: The chosen design meets the approved recovery target at a justified life-cycle cost.
Incorrect Answers
A:That precaution belongs to another scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It is not the primary safeguard for this rollout.
Question 790
An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. The chosen correction is: Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology. Which additional predeployment check is most relevant?
- Confirm address-family features and topology scale on all participating platforms.
- Validate the summarization envelope against a current prefix inventory and discard-route behavior.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
Explanation
Correct Answer
A:Confirm address-family features and topology scale on all participating platforms. This protects the intended outcome: IPv6 next-hop changes recover after a tested uplink failure without manual reconfiguration.
Incorrect Answers
B:That precaution belongs to another scenario: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
D:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
