100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 810
Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. The chosen correction is: Use explicit route tags, prefix filtering, and redistribution boundaries to block feedback loops. Which additional predeployment check is most relevant?
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Validate default-route behavior and NSSA translation roles during staged cutover.
- Verify route preference at more than one internal router before completing migration.
- Diagram route origins and inspect tags at each redistribution handoff.
Explanation
Correct Answer
D:Diagram route origins and inspect tags at each redistribution handoff. This protects the intended outcome: Bidirectional test prefixes appear once with predictable origin and no repeated reimport after failover.
Incorrect Answers
A:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It is not the primary safeguard for this rollout.
Question 811
A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. The chosen correction is: Preserve a supported link and endpoint power/wake capability along the intended WoL packet delivery path. Which additional predeployment check is most relevant?
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Validate device power negotiation and high-priority endpoint allocations before production.
- Validate cabling and spanning-tree domain boundaries before exempting any port.
- Test BIOS/NIC settings, VLAN boundaries and security policy before opening directed broadcasts.
Explanation
Correct Answer
D:Test BIOS/NIC settings, VLAN boundaries and security policy before opening directed broadcasts. This protects the intended outcome: Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
Incorrect Answers
A:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It is not the primary safeguard for this rollout.
Question 812
An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. The chosen correction is: Select an appropriate private APN, outbound-initiated overlay, or routable-address service depending on carrier capabilities. Which additional predeployment check is most relevant?
- Test management and control outages independently with application probes.
- Record SLA impact and safe return criteria before enabling automatic restoration.
- Trace encryption and tenant isolation needs at the service layer before activating capacity.
- Validate SIM/APN addressing and tunnel establishment from each cellular provider.
Explanation
Correct Answer
D:Validate SIM/APN addressing and tunnel establishment from each cellular provider. This protects the intended outcome: The branch establishes the required controlled overlay sessions without depending on unsupported unsolicited inbound access.
Incorrect Answers
A:That precaution belongs to another scenario: A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It is not the primary safeguard for this rollout.
Question 813
An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. The chosen correction is: Establish an explicit QoS trust boundary that remarks or rejects unauthorized markings at ingress. Which additional predeployment check is most relevant?
- Select policing rate and burst parameters using representative traffic rather than averages alone.
- Test packets at the provider demarcation and review contractual class limits.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Validate upstream provider remarking and exception devices such as managed IP phones.
Explanation
Correct Answer
D:Validate upstream provider remarking and exception devices such as managed IP phones. This protects the intended outcome: Guest traffic uses its approved classes without consuming the premium real-time queue.
Incorrect Answers
A:That precaution belongs to another scenario: A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
Question 814
A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. The chosen correction is: Use the supported gNMI service transported over gRPC with device capability and identity verification. Which additional predeployment check is most relevant?
- Inspect response media type, payload and authorization scopes before accepting writes.
- Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions.
- Verify candidate/running datastore support and rollback-on-error capabilities before edits.
- Validate encoding negotiation and representative samples before broad deployment.
Explanation
Correct Answer
B:Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions. This protects the intended outcome: The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target.
Incorrect Answers
A:That precaution belongs to another scenario: A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A telemetry receiver supports gRPC but cannot decode the device's gNMI JSON_IETF path data and classifies every update as malformed. It is not the primary safeguard for this rollout.
Question 815
A branch OSPF adjacency across a pseudowire drops after interface network type changes, even though both neighbors are reachable by ping. The chosen correction is: Align compatible OSPF network type, timers, authentication and neighbor discovery model for that link. Which additional predeployment check is most relevant?
- Verify whether the pseudowire presents broadcast or point-to-point semantics before reconfiguration.
- Audit reachable service prefixes and router roles before enabling area restrictions.
- Confirm end-to-end payload MTU and vendor hardware support before making both sides match.
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
Explanation
Correct Answer
A:Verify whether the pseudowire presents broadcast or point-to-point semantics before reconfiguration. This protects the intended outcome: Both peers reach FULL and maintain the expected DR or point-to-point behavior.
Incorrect Answers
B:That precaution belongs to another scenario: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
Question 816
A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. The chosen correction is: Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary. Which additional predeployment check is most relevant?
- Confirm route leaking and firewall context capacity before moving the border.
- Measure control-plane convergence and endpoint mapping age under a controlled node failure.
- Check fault-domain separation and latency constraints before removing redundant paths.
- Verify underlay IGP and fabric VRF configuration as separate acceptance tests.
Explanation
Correct Answer
A:Confirm route leaking and firewall context capacity before moving the border. This protects the intended outcome: External routes and flows remain segmented by approved virtual network.
Incorrect Answers
B:That precaution belongs to another scenario: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Multiple campus cores are connected in a full mesh, creating expensive adjacency and troubleshooting overhead. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. It is not the primary safeguard for this rollout.
Question 817
A branch uses a shaper on voice and bulk traffic together, and the business assumes shaping guarantees that voice always transmits first. The chosen correction is: Pair shaping with explicit class-based queuing and suitable real-time priority policy. Which additional predeployment check is most relevant?
- Validate queue allocation and the actual contracted CIR during saturation tests.
- Include control, default, and scavenger classes when totaling reserved bandwidth.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Verify provider remarking, class limits and contracted service levels before rollout.
Explanation
Correct Answer
A:Validate queue allocation and the actual contracted CIR during saturation tests. This protects the intended outcome: Under congestion, voice receives its intended service while total egress stays within the shaped rate.
Incorrect Answers
B:That precaution belongs to another scenario: A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It is not the primary safeguard for this rollout.
Question 818
Several data centers need high-capacity optical transport over metropolitan dark fiber without converting each tenant VLAN to an IP tunnel. The chosen correction is: Evaluate DWDM wavelength services with optics, reach, dispersion and protection appropriate to the fiber plant. Which additional predeployment check is most relevant?
- Monitor data caps, power and radio signal as part of backup readiness.
- Test provider MTU, loop prevention and circuit failover before cutover.
- Review line-system compatibility, service channels and redundancy before selecting wavelengths.
- Trace the full data path and perform local edge failover testing before approval.
Explanation
Correct Answer
C:Review line-system compatibility, service channels and redundancy before selecting wavelengths. This protects the intended outcome: Protected optical channels carry authorized client services with measured bit-error and failover performance.
Incorrect Answers
A:That precaution belongs to another scenario: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the primary safeguard for this rollout.
Question 819
A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. The chosen correction is: Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior. Which additional predeployment check is most relevant?
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
Explanation
Correct Answer
A:Review platform compatibility and perform a maintenance-window failover test before promising hitless service. This protects the intended outcome: Gateway traffic survives a controlled supervisor transition within the approved outage budget.
Incorrect Answers
B:That precaution belongs to another scenario: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
Question 820
A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. The chosen correction is: Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area. Which additional predeployment check is most relevant?
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
- Audit reachable service prefixes and router roles before enabling area restrictions.
- Diagram route origins and inspect tags at each redistribution handoff.
- Validate default-route behavior and NSSA translation roles during staged cutover.
Explanation
Correct Answer
D:Validate default-route behavior and NSSA translation roles during staged cutover. This protects the intended outcome: Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
Incorrect Answers
A:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
