100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 800
A branch engineer redistributes a static default route into EIGRP and advertises it to every site, overriding the intended hub defaults. The chosen correction is: Filter or scope external default advertisements to the authorized EIGRP distribution boundaries. Which additional predeployment check is most relevant?
- Trace route origin and affected prefix reachability before removing the advertisement.
- Verify the resulting advertised-route set from the partner-facing perspective.
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answer
A:Trace route origin and affected prefix reachability before removing the advertisement. This protects the intended outcome: Only intended branches learn the approved default source and backup behavior.
Incorrect Answers
B:That precaution belongs to another scenario: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It is not the primary safeguard for this rollout.
D:This offered choice, “Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 801
A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. The chosen correction is: Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable. Which additional predeployment check is most relevant?
- Validate module namespace and device-supported YANG library before generating requests.
- Tune frequency to the collector capacity and device resource budget.
- Calculate device and collector resource impact for chosen telemetry frequency.
- Verify actual model revision, device support and data-type semantics rather than assuming every OpenConfig path exists.
Explanation
Correct Answer
D:Verify actual model revision, device support and data-type semantics rather than assuming every OpenConfig path exists. This protects the intended outcome: The collector reads comparable interface fields from Cisco and non-Cisco devices using supported model paths.
Incorrect Answers
A:That precaution belongs to another scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It is not the primary safeguard for this rollout.
Question 802
A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. The chosen correction is: Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking. Which additional predeployment check is most relevant?
- Validate 802.1X/MAB, identity propagation and policy logs during roaming tests.
- Verify platform multi-chassis capability and fate sharing before bundling cross-chassis links.
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
Explanation
Correct Answer
C:Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address. This protects the intended outcome: Clients retain gateway reachability after either distribution switch fails.
Incorrect Answers
A:That precaution belongs to another scenario: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
Question 803
An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. The chosen correction is: Evaluate GET VPN where supported for group encryption over a trusted routable provider network. Which additional predeployment check is most relevant?
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Verify customer route limits, route-target import/export and CE-PE failover.
- Validate key server reachability, group membership and the underlying trusted WAN model.
- Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security.
Explanation
Correct Answer
C:Validate key server reachability, group membership and the underlying trusted WAN model. This protects the intended outcome: Approved endpoints encrypt traffic while retaining the provider's intended any-to-any routing paths.
Incorrect Answers
A:That precaution belongs to another scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. It is not the primary safeguard for this rollout.
Question 804
An enterprise uses hundreds of IPv4 /24s and proposes a single /16 summary although several component /24s are outside its administrative control. The chosen correction is: Advertise only summaries that fully cover owned reachable allocations; retain required exceptions or more-specifics at redistribution boundaries. Which additional predeployment check is most relevant?
- Verify upstream fate sharing and convergence on a controlled aggregation outage.
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Confirm address-family features and topology scale on all participating platforms.
- Validate the summarization envelope against a current prefix inventory and discard-route behavior.
Explanation
Correct Answer
D:Validate the summarization envelope against a current prefix inventory and discard-route behavior. This protects the intended outcome: Remote forwarding toward the summary reaches all included owned networks and does not hijack unrelated space.
Incorrect Answers
A:That precaution belongs to another scenario: An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An IPv6 deployment uses static gateways rather than a dynamic protocol across several redundant campus links. It is not the primary safeguard for this rollout.
Question 805
A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. The chosen correction is: Evaluate Source-Specific Multicast using supported IGMPv3/MLDv2 and PIM-SSM where available. Which additional predeployment check is most relevant?
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Confirm all clients and intermediate devices support the required SSM join model.
- Validate allowed source/group tuples and reflection resource limits before activation.
- Assess RP and MSDP scaling and supported migration alternatives before deployment.
Explanation
Correct Answer
B:Confirm all clients and intermediate devices support the required SSM join model. This protects the intended outcome: Authorized receivers join named sources and receive streams without relying on RP registration.
Incorrect Answers
A:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two independent PIM-SM domains each use local rendezvous points but remote sources must be discovered across the domains. It is not the primary safeguard for this rollout.
Question 806
A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. The chosen correction is: Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings. Which additional predeployment check is most relevant?
- Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links.
- Verify the resulting advertised-route set from the partner-facing perspective.
- Confirm tunnel endpoints, encryption requirements and path MTU before production.
- Test route withdrawal and actual traffic forwarding, not just neighbor state.
Explanation
Correct Answer
D:Test route withdrawal and actual traffic forwarding, not just neighbor state. This protects the intended outcome: Failure of the primary underlay forces traffic to a tested eligible secondary path within the service objective.
Incorrect Answers
A:That precaution belongs to another scenario: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It is not the primary safeguard for this rollout.
Question 807
Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. The chosen correction is: Choose a validated loop-free logical bundle or routed-access topology if active-active use is required. Which additional predeployment check is most relevant?
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Verify platform multi-chassis capability and fate sharing before bundling cross-chassis links.
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
Explanation
Correct Answer
C:Verify platform multi-chassis capability and fate sharing before bundling cross-chassis links. This protects the intended outcome: Permitted uplinks forward under normal operation and converge cleanly on individual link loss.
Incorrect Answers
A:That precaution belongs to another scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
Question 808
A video conference SD-WAN policy accepts tunnels with 1% packet loss but ignores sustained jitter above application tolerance. The chosen correction is: Include latency, jitter and loss thresholds appropriate to the application class. Which additional predeployment check is most relevant?
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
- Compare BFD-derived observations with production application performance before selecting thresholds.
- Test both accepted routes and explicitly denied spoke-to-spoke paths.
- Test key-server redundancy and key-lifetime rollover before production.
Explanation
Correct Answer
B:Compare BFD-derived observations with production application performance before selecting thresholds. This protects the intended outcome: Selected tunnels meet the approved performance envelope during representative conference traffic.
Incorrect Answers
A:That precaution belongs to another scenario: A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It is not the primary safeguard for this rollout.
Question 809
A design team calculates voice QoS bandwidth solely from codec payload bit rate and ignores RTP, IP and tunnel overhead. The chosen correction is: Size admission and queue bandwidth using packetization and encapsulation overhead plus concurrent-call estimates. Which additional predeployment check is most relevant?
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Validate packet sizes and call concurrency under primary and backup transport.
- Measure token-bucket behavior and provider burst tolerance before tightening thresholds.
- Size the priority class and verify congestion behavior with realistic mixes.
Explanation
Correct Answer
B:Validate packet sizes and call concurrency under primary and backup transport. This protects the intended outcome: Measured WAN utilization supports peak approved call volume without exceeding the voice service budget.
Incorrect Answers
A:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the primary safeguard for this rollout.
Question 810
Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. The chosen correction is: Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops. Which additional predeployment check is most relevant?
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Verify route preference at more than one internal router before completing migration.
- Diagram route origins and inspect tags at each redistribution handoff.
Explanation
Correct Answer
D:Diagram route origins and inspect tags at each redistribution handoff. This protects the intended outcome: Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
Incorrect Answers
A:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
