100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 820
A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. The chosen correction is: Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area. Which additional predeployment check is most relevant?
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
- Audit reachable service prefixes and router roles before enabling area restrictions.
- Diagram route origins and inspect tags at each redistribution handoff.
- Validate default-route behavior and NSSA translation roles during staged cutover.
Explanation
Correct Answer
D:Validate default-route behavior and NSSA translation roles during staged cutover. This protects the intended outcome: Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
Incorrect Answers
A:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A branch OSPF design selects a totally stubby area but an application requires type-3 interarea routes rather than only the default. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the primary safeguard for this rollout.
Question 821
A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. The chosen correction is: Apply compatible supported OSPF authentication with coordinated keys and rollover on both ends. Which additional predeployment check is most relevant?
- Validate BFD support, timer negotiation and control-plane capacity on each neighbor pair.
- Stage keys and document overlap windows before activation.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
- Confirm end-to-end payload MTU and vendor hardware support before making both sides match.
Explanation
Correct Answer
B:Stage keys and document overlap windows before activation. This protects the intended outcome: OSPF adjacencies establish only between intended authenticated peers and survive planned key changes.
Incorrect Answers
A:That precaution belongs to another scenario: A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. It is not the primary safeguard for this rollout.
Question 822
A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. The chosen correction is: Constrain route leaking to the precise management service endpoints and permitted directions. Which additional predeployment check is most relevant?
- Review both route advertisements and actual access-policy decisions.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Test the OOB path and escalation workflow periodically.
- Validate platform and routing support, DF election and true application traffic pattern.
Explanation
Correct Answer
A:Review both route advertisements and actual access-policy decisions. This protects the intended outcome: Guest routing tables contain no unauthorized management loopback routes.
Incorrect Answers
B:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It is not the primary safeguard for this rollout.
Question 823
A financial application needs multicast delivery across SDA sites, but all validation has covered unicast endpoint maps only. The chosen correction is: Design supported multicast replication and routed multicast services across the intended fabric transit. Which additional predeployment check is most relevant?
- Verify intersite MTU, transit control plane and shared-services boundaries.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Verify fabric-specific multicast capability and receiver joins on all relevant boundaries.
- Confirm route leaking and firewall context capacity before moving the border.
Explanation
Correct Answer
C:Verify fabric-specific multicast capability and receiver joins on all relevant boundaries. This protects the intended outcome: Authorized multicast receivers obtain packets while uninvolved VNs and sites remain isolated.
Incorrect Answers
A:That precaution belongs to another scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the primary safeguard for this rollout.
Question 824
A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. The chosen correction is: Define a backup-class QoS and application admission design appropriate to smaller available bandwidth. Which additional predeployment check is most relevant?
- Verify encapsulation overhead, security associations, and multicast reachability separately.
- Measure real failover link capacity and decide which applications must be deprioritized.
- Test both accepted routes and explicitly denied spoke-to-spoke paths.
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
Explanation
Correct Answer
B:Measure real failover link capacity and decide which applications must be deprioritized. This protects the intended outcome: Voice sessions remain inside the approved quality budget over the constrained backup link.
Incorrect Answers
A:That precaution belongs to another scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It is not the primary safeguard for this rollout.
Question 825
A security operations service needs authoritative interface state changes, not a dashboard that replays stale telemetry after collector failure. The chosen correction is: Design timestamped telemetry with source identification and collector reconnection/backfill policy as supported. Which additional predeployment check is most relevant?
- Tune frequency to the collector capacity and device resource budget.
- Measure aggregation accuracy after downsampling before changing alert thresholds.
- Validate time synchronization and retention windows at both device and collector.
- Confirm the chosen leaf supports on-change and implement appropriate event deduplication.
Explanation
Correct Answer
C:Validate time synchronization and retention windows at both device and collector. This protects the intended outcome: A controlled interface-down event arrives with correct device identity and event ordering after reconnection.
Incorrect Answers
A:That precaution belongs to another scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It is not the primary safeguard for this rollout.
Question 826
A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. The chosen correction is: Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks. Which additional predeployment check is most relevant?
- Coordinate with provider route policy and monitor diverse external vantage points.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Verify route preference at more than one internal router before completing migration.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
Explanation
Correct Answer
D:Use topology-table evidence and controlled link-failure testing to validate backup eligibility. This protects the intended outcome: The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
Incorrect Answers
A:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It is not the primary safeguard for this rollout.
Question 827
A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. The chosen correction is: Plan redundant supported fabric control-plane nodes with resilient underlay reachability. Which additional predeployment check is most relevant?
- Measure control-plane convergence and endpoint mapping age under a controlled node failure.
- Confirm route leaking and firewall context capacity before moving the border.
- Verify protocol-specific graceful-restart restrictions rather than assuming universal hitlessness.
- Verify map resolution and fabric edge RLOC reachability independently.
Explanation
Correct Answer
A:Measure control-plane convergence and endpoint mapping age under a controlled node failure. This protects the intended outcome: Endpoint moves are learned through the surviving control-plane node and authorized traffic resumes.
Incorrect Answers
B:That precaution belongs to another scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the primary safeguard for this rollout.
Question 828
Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. The chosen correction is: Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition. Which additional predeployment check is most relevant?
- Verify customer route limits, route-target import/export and CE-PE failover.
- Stage certificates, device identity, and centralized policy before moving production routes.
- Validate the true need for L2 extension and the risk of spanning a failure domain between facilities.
- Verify UNI/ENNI behavior and available MTU across the provider boundary.
Explanation
Correct Answer
D:Verify UNI/ENNI behavior and available MTU across the provider boundary. This protects the intended outcome: Expected tagged traffic traverses the authorized EVC and unrelated tags are isolated.
Incorrect Answers
A:That precaution belongs to another scenario: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It is not the primary safeguard for this rollout.
Question 829
A SaaS contact center requires both 200-ms maximum application response and clear separation of media and control classes. The chosen correction is: Map actual application traffic to appropriate DiffServ classes and engineering budget across each congested hop. Which additional predeployment check is most relevant?
- Size the priority class and verify congestion behavior with realistic mixes.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Confirm all clients and intermediate devices support the required SSM join model.
- Use real service telemetry to validate classification, not static port assumptions alone.
Explanation
Correct Answer
D:Use real service telemetry to validate classification, not static port assumptions alone. This protects the intended outcome: End-to-end probes confirm intended latency and drop treatment for each business-critical class.
Incorrect Answers
A:That precaution belongs to another scenario: Video and voice both use one strict-priority queue, causing voice jitter when video surges. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A 10,000-receiver IPTV deployment requires one-to-many traffic from known sources but still uses RP discovery for each stream. It is not the primary safeguard for this rollout.
Question 830
A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. The chosen correction is: Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication. Which additional predeployment check is most relevant?
- Audit DHCP and static address assignments prior to moving the site to its routed block.
- Confirm path diversity at reflectors and ensure no unintended loops or excess table growth.
- Identify appropriate ABR locations and verify that existing prefix aggregation is topologically sound.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
Explanation
Correct Answer
A:Audit DHCP and static address assignments prior to moving the site to its routed block. This protects the intended outcome: Clients reach the headquarters destination over the routed path using the approved office prefix.
Incorrect Answers
B:That precaution belongs to another scenario: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
