Cisco 300-420 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 300-420 Premium Bundle
$79.97
$59.98

300-420 Premium Bundle

  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

300-420 Premium Bundle

Cisco 300-420 Premium Bundle
  • Premium File: 416 Questions & Answers. Last update: Nov 9, 2026
  • Training Course: 75 Video Lectures
  • Study Guide: 812 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 300-420 Practice Test 8

Question 70

An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Which design change most directly addresses the stated requirement?

  1. Preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path.
  2. Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
  3. Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
  4. Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.

Explanation

Correct Answer

D:

The design is validated when the authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.

Incorrect Answers

A:

That option concerns a separate design case: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. The relevant control here is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.

B:

That option concerns a separate design case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The relevant control here is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.

C:

That option concerns a separate design case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The relevant control here is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.

Question 71

A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. Which design change most directly addresses the stated requirement?

  1. Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion.
  2. Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
  3. Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
  4. Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.

Explanation

Correct Answer

C:

The design is validated when authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.

Incorrect Answers

A:

That option concerns a separate design case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. The relevant control here is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.

B:

That option concerns a separate design case: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. The relevant control here is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.

D:

That option concerns a separate design case: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. The relevant control here is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.

Question 72

A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. Which design change most directly addresses the stated requirement?

  1. Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
  2. Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture.
  3. Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
  4. Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning.

Explanation

Correct Answer

C:

The design is validated when an approved RESTCONF PATCH changes only the intended interface fields and a GET verifies effective state.

Incorrect Answers

A:

That option concerns a separate design case: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. The relevant control here is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.

B:

That option concerns a separate design case: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. The relevant control here is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.

D:

That option concerns a separate design case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. The relevant control here is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.

Question 73

Several PIM-SM sites use a single RP placed across a high-latency WAN and suffer slow source registration after provider reconvergence. Which design change most directly addresses the stated requirement?

  1. Standardize classification and remarking policy across all controlled network trust boundaries.
  2. Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
  3. Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
  4. Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.

Explanation

Correct Answer

C:

The design is validated when local receiver joins and new-source registrations recover within target SLA during WAN failure.

Incorrect Answers

A:

That option concerns a separate design case: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. The relevant control here is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.

B:

That option concerns a separate design case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The relevant control here is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.

D:

That option concerns a separate design case: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. The relevant control here is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.

Question 74

A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. Which design change most directly addresses the stated requirement?

  1. Require physical route and carrier diversity, including demarcation and access-path audits.
  2. Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries.
  3. Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
  4. Design distinct supported transport interfaces and TLOC colors with centralized path policy.

Explanation

Correct Answer

A:

The design is validated when a controlled failure of either carrier access route leaves required service operational on the independent path.

Incorrect Answers

B:

That option concerns a separate design case: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. The relevant control here is: Require physical route and carrier diversity, including demarcation and access-path audits.

C:

That option concerns a separate design case: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. The relevant control here is: Require physical route and carrier diversity, including demarcation and access-path audits.

D:

That option concerns a separate design case: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. The relevant control here is: Require physical route and carrier diversity, including demarcation and access-path audits.

Question 75

Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. Which design change most directly addresses the stated requirement?

  1. Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
  2. Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
  3. Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
  4. Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.

Explanation

Correct Answer

C:

The design is validated when a moved endpoint retains its intended policy and access to only approved destinations.

Incorrect Answers

A:

That option concerns a separate design case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The relevant control here is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.

B:

That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.

D:

That option concerns a separate design case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. The relevant control here is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.

Question 76

An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. Which design change most directly addresses the stated requirement?

  1. Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings.
  2. Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
  3. Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
  4. Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.

Explanation

Correct Answer

B:

The design is validated when iPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks.

Incorrect Answers

A:

That option concerns a separate design case: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. The relevant control here is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.

C:

That option concerns a separate design case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. The relevant control here is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.

D:

This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.

Question 77

A campus carries multicast across dual uplinks and incorrectly assumes that equal-cost unicast routes guarantee both incoming multicast paths are valid. Which design change most directly addresses the stated requirement?

  1. Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
  2. Verify the designated RPF path used for each multicast source and align routed topology as needed.
  3. Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
  4. Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.

Explanation

Correct Answer

B:

The design is validated when legitimate multicast traffic arrives on the expected upstream interface without duplicates.

Incorrect Answers

A:

That option concerns a separate design case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. The relevant control here is: Verify the designated RPF path used for each multicast source and align routed topology as needed.

C:

That option concerns a separate design case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The relevant control here is: Verify the designated RPF path used for each multicast source and align routed topology as needed.

D:

That option concerns a separate design case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. The relevant control here is: Verify the designated RPF path used for each multicast source and align routed topology as needed.

Question 78

Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. Which design change most directly addresses the stated requirement?

  1. Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers.
  2. Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
  3. Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
  4. Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.

Explanation

Correct Answer

D:

The design is validated when child SAs establish for the matching traffic selectors and permitted applications pass.

Incorrect Answers

A:

That option concerns a separate design case: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. The relevant control here is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.

B:

That option concerns a separate design case: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. The relevant control here is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.

C:

That option concerns a separate design case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The relevant control here is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.

Question 79

A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. Which design change most directly addresses the stated requirement?

  1. Provide independent power infrastructure for each redundant network node and validate dual-path resilience.
  2. Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
  3. Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
  4. Choose a validated loop-free logical bundle or routed-access topology if active-active use is required.

Explanation

Correct Answer

C:

The design is validated when clients discover approved printers across subnets without carrying all broadcasts between buildings.

Incorrect Answers

A:

That option concerns a separate design case: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. The relevant control here is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.

B:

That option concerns a separate design case: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The relevant control here is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.

D:

That option concerns a separate design case: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. The relevant control here is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.

Question 80

A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. Which design change most directly addresses the stated requirement?

  1. Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
  2. Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
  3. Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
  4. Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.

Explanation

Correct Answer

D:

The design is validated when all advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.

Incorrect Answers

A:

That option concerns a separate design case: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. The relevant control here is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.

B:

That option concerns a separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. The relevant control here is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.

C:

That option concerns a separate design case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. The relevant control here is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.

Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.