100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 790
An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. The chosen correction is: Select a scalable IPv6-capable routing design with convergence and security matched to the enterprise topology. Which additional predeployment check is most relevant?
- Confirm address-family features and topology scale on all participating platforms.
- Validate the summarization envelope against a current prefix inventory and discard-route behavior.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
Explanation
Correct Answer
A:Confirm address-family features and topology scale on all participating platforms. This protects the intended outcome: IPv6 next-hop changes recover after a tested uplink failure without manual reconfiguration.
Incorrect Answers
B:That precaution belongs to another scenario: An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
D:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
Question 791
A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. The chosen correction is: Apply route filtering at intercampus boundaries to accept only explicitly authorized prefixes. Which additional predeployment check is most relevant?
- Map application dependency and physical service connections before relocating devices.
- Validate shared-services next-hop and return-path symmetry before enabling route leaking.
- Verify root identity for every relevant VLAN or MST instance rather than one sample VLAN.
- Define explicit allowed prefixes and monitored deny counters before deployment.
Explanation
Correct Answer
D:Define explicit allowed prefixes and monitored deny counters before deployment. This protects the intended outcome: The unintended default is absent from production campus RIBs while valid branch summaries propagate.
Incorrect Answers
A:That precaution belongs to another scenario: A campus topology places critical services behind one regional core switch despite redundant uplinks elsewhere. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Two tenants use 10.0.0.0/8 addressing and share the same campus core but require separate routing and firewall policies. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus wants deterministic STP roots but all switches retain default bridge priorities. It is not the primary safeguard for this rollout.
Question 792
A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. The chosen correction is: Plan scalable overlay topology and path policy based on actual edge session, route and encryption resource limits. Which additional predeployment check is most relevant?
- Verify encapsulation overhead, security associations, and multicast reachability separately.
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
- Model expected site growth and redundancy before choosing hub/spoke or regional topology.
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
Explanation
Correct Answer
C:Model expected site growth and redundancy before choosing hub/spoke or regional topology. This protects the intended outcome: Route/session counts stay within supported platform bounds and new branches join without control-plane exhaustion.
Incorrect Answers
A:That precaution belongs to another scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It is not the primary safeguard for this rollout.
Question 793
A hospital asks for guaranteed per-flow service across 300 branches and considers IntServ RSVP state on every core router. The chosen correction is: Compare IntServ reservation scalability with a DiffServ class-based design that better matches the enterprise scale. Which additional predeployment check is most relevant?
- Secure the OOB path and verify its separate power and access transport.
- Ensure monitoring and certificate renewal still function inside the isolated management context.
- Quantify simultaneous flows and confirm end-to-end provider QoS contracts before selecting a model.
- Exercise both link failure and restoration while monitoring (S,G) and (*,G) entries.
Explanation
Correct Answer
C:Quantify simultaneous flows and confirm end-to-end provider QoS contracts before selecting a model. This protects the intended outcome: The chosen design meets critical-flow service expectations without unsupportable per-flow state on core devices.
Incorrect Answers
A:That precaution belongs to another scenario: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It is not the primary safeguard for this rollout.
Question 794
An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. The chosen correction is: Use supported on-change telemetry for the interface state leaf where device and model support it. Which additional predeployment check is most relevant?
- Measure aggregation accuracy after downsampling before changing alert thresholds.
- Confirm the chosen leaf supports on-change and implement appropriate event deduplication.
- Validate module namespace and device-supported YANG library before generating requests.
- Calculate device and collector resource impact for chosen telemetry frequency.
Explanation
Correct Answer
B:Confirm the chosen leaf supports on-change and implement appropriate event deduplication. This protects the intended outcome: A controlled status change reaches the collector promptly without waiting for the next periodic poll.
Incorrect Answers
A:That precaution belongs to another scenario: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It is not the primary safeguard for this rollout.
Question 795
An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. The chosen correction is: Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites. Which additional predeployment check is most relevant?
- Verify intersite MTU, transit control plane and shared-services boundaries.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Compare model-specific power requirements with cable loss and redundant supply capacity.
- Confirm multicast, wireless, and mobility requirements before retiring stretched VLANs.
Explanation
Correct Answer
A:Verify intersite MTU, transit control plane and shared-services boundaries. This protects the intended outcome: Approved intersite traffic carries the expected segmentation context without undesired leakage.
Incorrect Answers
B:That precaution belongs to another scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A wireless access-point refresh increases PoE needs above the available 802.3at class on older switches. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It is not the primary safeguard for this rollout.
Question 796
A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. The chosen correction is: Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers. Which additional predeployment check is most relevant?
- Set sensible headroom and operational alerting so normal growth does not cause unnecessary shutdown.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
- Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks.
- Check protocol payloads, bidirectional addressing and security logs before deployment.
Explanation
Correct Answer
C:Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks. This protects the intended outcome: IPv6 NLRI appears only in the authorized address-family tables with validated next-hop reachability.
Incorrect Answers
A:That precaution belongs to another scenario: A company accepts routes from a newly merged BGP AS without maximum-prefix limits, and the peer mistakenly sends hundreds of thousands of prefixes. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It is not the primary safeguard for this rollout.
Question 797
A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. The chosen correction is: Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement. Which additional predeployment check is most relevant?
- Verify receiver IGMP version and source authorization before activating SSM.
- Confirm upstream source paths and verify PIM neighbors on every routed segment.
- Capture (*,G) and (S,G) state at different phases of receiver joins.
- Validate platform and routing support, DF election and true application traffic pattern.
Explanation
Correct Answer
D:Validate platform and routing support, DF election and true application traffic pattern. This protects the intended outcome: Multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
Incorrect Answers
A:That precaution belongs to another scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. It is not the primary safeguard for this rollout.
Question 798
Two industrial sites require transparent delivery of a small set of Ethernet services and reject routing between their private LANs. The chosen correction is: Evaluate an appropriately isolated L2VPN or pseudowire with defined loop, bandwidth and MTU constraints. Which additional predeployment check is most relevant?
- Limit the extended broadcast domain and verify provider OAM and failover.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
- Validate the true need for L2 extension and the risk of spanning a failure domain between facilities.
- Validate key server reachability, group membership and the underlying trusted WAN model.
Explanation
Correct Answer
A:Limit the extended broadcast domain and verify provider OAM and failover. This protects the intended outcome: Approved Ethernet frames reach the remote service endpoint while unrelated VLANs remain excluded.
Incorrect Answers
B:That precaution belongs to another scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
Question 799
A sensitive engineering VLAN needs to deny lateral guest traffic within one switched segment; existing router ACLs do not inspect intra-VLAN frames. The chosen correction is: Evaluate an appropriate VLAN access map or supported intra-segment security mechanism. Which additional predeployment check is most relevant?
- Confirm multicast, wireless, and mobility requirements before retiring stretched VLANs.
- Document the region digest and validate VLAN ownership on every participating device.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Verify the actual platform VACL matching behavior and necessary permit statements.
Explanation
Correct Answer
D:Verify the actual platform VACL matching behavior and necessary permit statements. This protects the intended outcome: Test traffic between unauthorized hosts in the VLAN is denied while approved flows continue.
Incorrect Answers
A:That precaution belongs to another scenario: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the primary safeguard for this rollout.
Question 800
A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. The chosen correction is: Filter or scope external default advertisements to the authorized EIGRP distribution boundaries. Which additional predeployment check is most relevant?
- Trace route origin and affected prefix reachability before removing the advertisement.
- Verify the resulting advertised-route set from the partner-facing perspective.
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answer
A:Trace route origin and affected prefix reachability before removing the advertisement. This protects the intended outcome: Only intended branches learn the approved default source and backup behavior.
Incorrect Answers
B:That precaution belongs to another scenario: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It is not the primary safeguard for this rollout.
D:This offered choice, “Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
