100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 70
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Which design change most directly addresses the stated requirement?
- Preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path.
- Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
Explanation
Correct Answer
D:The design is validated when the authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
Incorrect Answers
A:That option concerns a separate design case: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. The relevant control here is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
B:That option concerns a separate design case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The relevant control here is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
C:That option concerns a separate design case: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The relevant control here is: Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
Question 71
A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. Which design change most directly addresses the stated requirement?
- Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion.
- Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
- Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths.
Explanation
Correct Answer
C:The design is validated when authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
Incorrect Answers
A:That option concerns a separate design case: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. The relevant control here is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
B:That option concerns a separate design case: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. The relevant control here is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
D:That option concerns a separate design case: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. The relevant control here is: Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
Question 72
A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. Which design change most directly addresses the stated requirement?
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture.
- Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
- Use a periodic telemetry subscription at a measured cadence suitable for trending and capacity planning.
Explanation
Correct Answer
C:The design is validated when an approved RESTCONF PATCH changes only the intended interface fields and a GET verifies effective state.
Incorrect Answers
A:That option concerns a separate design case: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. The relevant control here is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
B:That option concerns a separate design case: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. The relevant control here is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
D:That option concerns a separate design case: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. The relevant control here is: Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
Question 73
Several PIM-SM sites use a single RP placed across a high-latency WAN and suffer slow source registration after provider reconvergence. Which design change most directly addresses the stated requirement?
- Standardize classification and remarking policy across all controlled network trust boundaries.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
- Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
Explanation
Correct Answer
C:The design is validated when local receiver joins and new-source registrations recover within target SLA during WAN failure.
Incorrect Answers
A:That option concerns a separate design case: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. The relevant control here is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
B:That option concerns a separate design case: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The relevant control here is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
D:That option concerns a separate design case: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. The relevant control here is: Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
Question 74
A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. Which design change most directly addresses the stated requirement?
- Require physical route and carrier diversity, including demarcation and access-path audits.
- Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries.
- Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
- Design distinct supported transport interfaces and TLOC colors with centralized path policy.
Explanation
Correct Answer
A:The design is validated when a controlled failure of either carrier access route leaves required service operational on the independent path.
Incorrect Answers
B:That option concerns a separate design case: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. The relevant control here is: Require physical route and carrier diversity, including demarcation and access-path audits.
C:That option concerns a separate design case: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. The relevant control here is: Require physical route and carrier diversity, including demarcation and access-path audits.
D:That option concerns a separate design case: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. The relevant control here is: Require physical route and carrier diversity, including demarcation and access-path audits.
Question 75
Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. Which design change most directly addresses the stated requirement?
- Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
Explanation
Correct Answer
C:The design is validated when a moved endpoint retains its intended policy and access to only approved destinations.
Incorrect Answers
A:That option concerns a separate design case: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The relevant control here is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
B:That option concerns a separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The relevant control here is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
D:That option concerns a separate design case: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. The relevant control here is: Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
Question 76
An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. Which design change most directly addresses the stated requirement?
- Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings.
- Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Explanation
Correct Answer
B:The design is validated when iPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks.
Incorrect Answers
A:That option concerns a separate design case: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. The relevant control here is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
C:That option concerns a separate design case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. The relevant control here is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
D:This alternative is aimed at a different design constraint: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. The relevant control for this case is: Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
Question 77
A campus carries multicast across dual uplinks and incorrectly assumes that equal-cost unicast routes guarantee both incoming multicast paths are valid. Which design change most directly addresses the stated requirement?
- Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
- Verify the designated RPF path used for each multicast source and align routed topology as needed.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
Explanation
Correct Answer
B:The design is validated when legitimate multicast traffic arrives on the expected upstream interface without duplicates.
Incorrect Answers
A:That option concerns a separate design case: Video and voice both use one strict-priority queue, causing voice jitter when video surges. The relevant control here is: Verify the designated RPF path used for each multicast source and align routed topology as needed.
C:That option concerns a separate design case: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. The relevant control here is: Verify the designated RPF path used for each multicast source and align routed topology as needed.
D:That option concerns a separate design case: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. The relevant control here is: Verify the designated RPF path used for each multicast source and align routed topology as needed.
Question 78
Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. Which design change most directly addresses the stated requirement?
- Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers.
- Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
- Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
Explanation
Correct Answer
D:The design is validated when child SAs establish for the matching traffic selectors and permitted applications pass.
Incorrect Answers
A:That option concerns a separate design case: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. The relevant control here is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
B:That option concerns a separate design case: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. The relevant control here is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
C:That option concerns a separate design case: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. The relevant control here is: Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
Question 79
A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. Which design change most directly addresses the stated requirement?
- Provide independent power infrastructure for each redundant network node and validate dual-path resilience.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
- Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
- Choose a validated loop-free logical bundle or routed-access topology if active-active use is required.
Explanation
Correct Answer
C:The design is validated when clients discover approved printers across subnets without carrying all broadcasts between buildings.
Incorrect Answers
A:That option concerns a separate design case: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. The relevant control here is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
B:That option concerns a separate design case: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. The relevant control here is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
D:That option concerns a separate design case: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. The relevant control here is: Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
Question 80
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. Which design change most directly addresses the stated requirement?
- Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Explanation
Correct Answer
D:The design is validated when all advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
Incorrect Answers
A:That option concerns a separate design case: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. The relevant control here is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
B:That option concerns a separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. The relevant control here is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
C:That option concerns a separate design case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. The relevant control here is: Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests