100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 840
A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. The chosen correction is: Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs. Which additional predeployment check is most relevant?
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Confirm path diversity at reflectors and ensure no unintended loops or excess table growth.
- Review route reachability and summary boundaries before introducing stub behavior.
Explanation
Correct Answer
A:Validate advertised stub route classes and redundancy if the branch has multiple uplinks. This protects the intended outcome: Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Incorrect Answers
B:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It is not the primary safeguard for this rollout.
Question 841
A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. The chosen correction is: Align advertised costs and path policy with available bandwidth and acceptable backup behavior. Which additional predeployment check is most relevant?
- Validate software and licensing support, peer links, and split-brain safeguards before deployment.
- Map chassis, power, supervisors, and uplink fate sharing before approving the design.
- Document the region digest and validate VLAN ownership on every participating device.
- Use link utilization and application SLA data before tuning routing metrics.
Explanation
Correct Answer
D:Use link utilization and application SLA data before tuning routing metrics. This protects the intended outcome: Normal flow distribution avoids congesting the slow backhaul and failover still reaches the destination.
Incorrect Answers
A:That precaution belongs to another scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It is not the primary safeguard for this rollout.
Question 842
A design team wants fast OSPF failure detection on long-running optical links without dropping stable adjacencies during occasional control-plane delay. The chosen correction is: Evaluate BFD and appropriate OSPF timers with a realistic detection budget and hardware scale. Which additional predeployment check is most relevant?
- Stage keys and document overlap windows before activation.
- Check metric mapping and tagging consistently at both redistribution routers.
- Validate BFD support, timer negotiation and control-plane capacity on each neighbor pair.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
Explanation
Correct Answer
C:Validate BFD support, timer negotiation and control-plane capacity on each neighbor pair. This protects the intended outcome: A genuine path failure is detected within the target interval while benign load does not flap sessions.
Incorrect Answers
A:That precaution belongs to another scenario: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
Question 843
Remote branch routers are managed using the same public internet IP address that exposes a user web service. The chosen correction is: Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy. Which additional predeployment check is most relevant?
- Ensure monitoring and certificate renewal still function inside the isolated management context.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Verify provider remarking, class limits and contracted service levels before rollout.
- Validate allowed source/group tuples and reflection resource limits before activation.
Explanation
Correct Answer
A:Ensure monitoring and certificate renewal still function inside the isolated management context. This protects the intended outcome: Only authorized operators can connect to device management while public services remain available.
Incorrect Answers
B:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. It is not the primary safeguard for this rollout.
Question 844
A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. The chosen correction is: Classify the hosted runtime as PaaS and document the application versus platform operations boundary. Which additional predeployment check is most relevant?
- Tune frequency to the collector capacity and device resource budget.
- Validate the service contract's supported runtime and data-management obligations.
- Verify candidate/running datastore support and rollback-on-error capabilities before edits.
- Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions.
Explanation
Correct Answer
B:Validate the service contract's supported runtime and data-management obligations. This protects the intended outcome: Deployment responsibilities correctly assign code and app security to the customer while platform maintenance follows provider terms.
Incorrect Answers
A:That precaution belongs to another scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It is not the primary safeguard for this rollout.
Question 845
A site-to-site tunnel must protect financial payload confidentiality and integrity across the public internet. The chosen correction is: Choose a supported IPsec design with appropriate IKE authentication, encryption proposals and key rotation. Which additional predeployment check is most relevant?
- Check peer and platform multicast over IPsec capabilities and route recursion.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
- Measure actual tunnel performance and understand what happens when no path meets SLA.
- Validate encryption domains, anti-replay, MTU, NAT-T and rekey behavior before failover testing.
Explanation
Correct Answer
D:Validate encryption domains, anti-replay, MTU, NAT-T and rekey behavior before failover testing. This protects the intended outcome: Protected traffic crosses an established security association and is unreadable on the public underlay.
Incorrect Answers
A:That precaution belongs to another scenario: An enterprise replaces a point-to-point GRE tunnel with raw IPsec ESP and expects dynamic multicast routing hellos to work unchanged. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A voice application has a 120-ms latency budget, but SD-WAN traffic follows the cheapest internet path despite BFD reporting 220-ms delay. It is not the primary safeguard for this rollout.
Question 846
A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. The chosen correction is: Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions. Which additional predeployment check is most relevant?
- Test both A and AAAA record resolution from representative client networks.
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
- Validate firewall policies and monitoring for both families before removing any transition dependency.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answer
B:Inventory application dependencies and DNS behavior before choosing the translation mechanism. This protects the intended outcome: The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
Incorrect Answers
A:That precaution belongs to another scenario: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. It is not the primary safeguard for this rollout.
D:This offered choice, “Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 847
Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. The chosen correction is: Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress. Which additional predeployment check is most relevant?
- Verify each summarized site's actual forwarding path before suppressing specifics.
- Model application flow matrix and provider link costs before adding shortcuts.
- Measure control-plane convergence and endpoint mapping age under a controlled node failure.
- Test removal of each default and ensure existing internal routes stay reachable.
Explanation
Correct Answer
A:Verify each summarized site's actual forwarding path before suppressing specifics. This protects the intended outcome: Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border.
Incorrect Answers
B:That precaution belongs to another scenario: Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It is not the primary safeguard for this rollout.
Question 848
An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. The chosen correction is: Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations. Which additional predeployment check is most relevant?
- Validate serial authorization and certificate lifecycle before production onboarding.
- Verify per-VPN OMP routes, firewall rules and destination reachability during staging.
- Trace the full data path and perform local edge failover testing before approval.
- Measure real failover link capacity and decide which applications must be deprioritized.
Explanation
Correct Answer
B:Verify per-VPN OMP routes, firewall rules and destination reachability during staging. This protects the intended outcome: Guest prefixes and traffic stay isolated from production routes and data tunnels.
Incorrect Answers
A:That precaution belongs to another scenario: A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. It is not the primary safeguard for this rollout.
Question 849
A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. The chosen correction is: Map internal DSCP classes onto the provider-supported service groups explicitly and consistently. Which additional predeployment check is most relevant?
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Test packets at the provider demarcation and review contractual class limits.
- Validate upstream provider remarking and exception devices such as managed IP phones.
Explanation
Correct Answer
C:Test packets at the provider demarcation and review contractual class limits. This protects the intended outcome: Each business traffic class receives the agreed provider class and treatment across the WAN.
Incorrect Answers
A:That precaution belongs to another scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An enterprise WAN receives DSCP values from untrusted guest clients and propagates them unchanged into privileged queues. It is not the primary safeguard for this rollout.
Question 850
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. The chosen correction is: Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference. Which additional predeployment check is most relevant?
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
- Test withdrawal of the default and preserve the required local and internal routes.
- Confirm local preference propagation and check business-specific exception prefixes.
Explanation
Correct Answer
D:Confirm local preference propagation and check business-specific exception prefixes. This protects the intended outcome: Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible.
Incorrect Answers
A:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
B:That precaution belongs to another scenario: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
