100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 850
A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. The chosen correction is: Use an appropriate local-preference policy inside the enterprise AS to set outbound exit preference. Which additional predeployment check is most relevant?
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
- Test withdrawal of the default and preserve the required local and internal routes.
- Confirm local preference propagation and check business-specific exception prefixes.
Explanation
Correct Answer
D:Confirm local preference propagation and check business-specific exception prefixes. This protects the intended outcome: Internal BGP best-path selection prefers ISP A where the intended routes are otherwise eligible.
Incorrect Answers
A:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
B:That precaution belongs to another scenario: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the primary safeguard for this rollout.
Question 851
A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. The chosen correction is: Evaluate physical fault domains and provide independent power, links, and control-plane recovery within the chosen abstraction. Which additional predeployment check is most relevant?
- Verify map resolution and fabric edge RLOC reachability independently.
- Verify protocol-specific graceful-restart restrictions rather than assuming universal hitlessness.
- Map chassis, power, supervisors, and uplink fate sharing before approving the design.
- Validate software and licensing support, peer links, and split-brain safeguards before deployment.
Explanation
Correct Answer
C:Map chassis, power, supervisors, and uplink fate sharing before approving the design. This protects the intended outcome: A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies.
Incorrect Answers
A:That precaution belongs to another scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the primary safeguard for this rollout.
Question 852
A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. The chosen correction is: Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing. Which additional predeployment check is most relevant?
- Examine cloud service limits, BGP policy and regional diversity before committing to circuits.
- Map shared responsibility and data residency requirements at each boundary.
- Detect device capability and model revision before applying vendor-specific settings.
- Tune frequency to the collector capacity and device resource budget.
Explanation
Correct Answer
A:Examine cloud service limits, BGP policy and regional diversity before committing to circuits. This protects the intended outcome: Authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
Incorrect Answers
B:That precaution belongs to another scenario: An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A support dashboard needs regular CPU and interface-rate samples even when values remain unchanged. It is not the primary safeguard for this rollout.
Question 853
A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. The chosen correction is: Rate-limit or aggregate nonessential management streams and preserve bandwidth for emergency control sessions. Which additional predeployment check is most relevant?
- Estimate collector volume and sample rates before enabling streams.
- Test congestion on the smallest management path and verify control-plane rate limits.
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Test the OOB path and escalation workflow periodically.
Explanation
Correct Answer
A:Estimate collector volume and sample rates before enabling streams. This protects the intended outcome: Telemetry remains within service capacity and operators can still reach consoles under load.
Incorrect Answers
B:That precaution belongs to another scenario: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It is not the primary safeguard for this rollout.
Question 854
A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. The chosen correction is: Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy. Which additional predeployment check is most relevant?
- Add separate encryption where the threat model requires it and verify provider SLA.
- Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security.
- Validate the true need for L2 extension and the risk of spanning a failure domain between facilities.
- Verify customer route limits, route-target import/export and CE-PE failover.
Explanation
Correct Answer
A:Add separate encryption where the threat model requires it and verify provider SLA. This protects the intended outcome: Authorized branch prefixes appear within the appropriate VPN and survive a PE failure as contracted.
Incorrect Answers
B:That precaution belongs to another scenario: A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two hospitals need their existing Ethernet VLANs extended across a provider circuit but their engineers incorrectly request a routed L3VPN. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It is not the primary safeguard for this rollout.
Question 855
Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. The chosen correction is: Evaluate supported BFD-based fault detection and matching IGP convergence policy for the routed adjacency. Which additional predeployment check is most relevant?
- Test BFD timer scale and false-positive sensitivity under peak control-plane load.
- Simulate failure and steady-state route selection before changing handoff metrics.
- Model application flow matrix and provider link costs before adding shortcuts.
- Define origin-tag conventions and verify both redistribution devices during failover.
Explanation
Correct Answer
A:Test BFD timer scale and false-positive sensitivity under peak control-plane load. This protects the intended outcome: A failed path is withdrawn quickly enough that active voice sessions remain within the specified interruption budget.
Incorrect Answers
B:That precaution belongs to another scenario: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. It is not the primary safeguard for this rollout.
Question 856
A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. The chosen correction is: Set consistent IS-IS link metrics reflecting intended primary and backup capacity and verify resulting shortest paths. Which additional predeployment check is most relevant?
- Keep IPv4 and IPv6 export/import policies separately reviewed to prevent route leaks.
- Coordinate with provider route policy and monitor diverse external vantage points.
- Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answer
C:Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links. This protects the intended outcome: Normal forwarding prefers the main path while failover selects the backup when primary reachability disappears.
Incorrect Answers
A:That precaution belongs to another scenario: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It is not the primary safeguard for this rollout.
D:This offered choice, “Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites”, addresses a separate concern. That option relates to this separate design case: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not answer the current requirement.
Question 857
A multisite SD-WAN deployment uses one manager for configuration and assumes manager reachability is necessary for every packet of user data. The chosen correction is: Design control/management resilience separately from WAN edge data-plane forwarding. Which additional predeployment check is most relevant?
- Validate SIM/APN addressing and tunnel establishment from each cellular provider.
- Verify source/receiver topology, platform multicast support and traffic volume.
- Trace encryption and tenant isolation needs at the service layer before activating capacity.
- Test management and control outages independently with application probes.
Explanation
Correct Answer
D:Test management and control outages independently with application probes. This protects the intended outcome: Existing permitted edge-to-edge tunnels continue carrying traffic across a management-plane interruption where supported.
Incorrect Answers
A:That precaution belongs to another scenario: An industrial site uses 4G LTE as primary WAN, and its routing team assumes public inbound addresses remain reachable through carrier-grade NAT. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It is not the primary safeguard for this rollout.
Question 858
A branch policy gives every queue an equal share although its database synchronization is delaying emergency call signaling. The chosen correction is: Allocate queue scheduling according to measured application criticality and minimum bandwidth needs. Which additional predeployment check is most relevant?
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Prevent uncontrolled high-rate management flows from abusing the protected class.
- Verify traffic profile and congestion points before adjusting class percentages.
Explanation
Correct Answer
D:Verify traffic profile and congestion points before adjusting class percentages. This protects the intended outcome: Critical signaling and voice meet their performance targets while bulk sync proceeds on its class.
Incorrect Answers
A:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. It is not the primary safeguard for this rollout.
Question 859
A network peers eBGP over a loopback with multiple routed hops and assumes a directly connected neighbor model. The chosen correction is: Use a supported eBGP multihop design with reachable loopback endpoints and suitable TTL/security policy. Which additional predeployment check is most relevant?
- Audit DHCP and static address assignments prior to moving the site to its routed block.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
- Constrain the allowed peer endpoints, authentication and control-plane ACLs.
- Stage keys and document overlap windows before activation.
Explanation
Correct Answer
C:Constrain the allowed peer endpoints, authentication and control-plane ACLs. This protects the intended outcome: The eBGP session establishes over the routed path and routes remain reachable during a single underlay link failure.
Incorrect Answers
A:That precaution belongs to another scenario: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A security design requires authenticating OSPF control packets on shared routed links, but only one neighbor has authentication enabled. It is not the primary safeguard for this rollout.
Question 860
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. The chosen correction is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints. Which additional predeployment check is most relevant?
- Validate hash entropy and elephant-flow effects before sizing links.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Verify map resolution and fabric edge RLOC reachability independently.
Explanation
Correct Answer
B:Test the full supported transit profile rather than relying on basic IP ping success. This protects the intended outcome: Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Incorrect Answers
A:That precaution belongs to another scenario: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
