100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 860
A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. The chosen correction is: Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints. Which additional predeployment check is most relevant?
- Validate hash entropy and elephant-flow effects before sizing links.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Validate WLC and AP fabric roles against platform support and target mobility scope.
- Verify map resolution and fabric edge RLOC reachability independently.
Explanation
Correct Answer
B:Test the full supported transit profile rather than relying on basic IP ping success. This protects the intended outcome: Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
Incorrect Answers
A:That precaution belongs to another scenario: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A fabric site needs a guest wireless SSID without extending the guest Layer 2 domain across the whole enterprise. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. It is not the primary safeguard for this rollout.
Question 861
An acquisition introduces 172.16.0.0/12 internal networks but the network must hide finance VLAN prefixes from the partner site. The chosen correction is: Use targeted route distribution policy and VRF containment for sensitive prefixes. Which additional predeployment check is most relevant?
- Confirm multicast, wireless, and mobility requirements before retiring stretched VLANs.
- Document the region digest and validate VLAN ownership on every participating device.
- Verify the actual platform VACL matching behavior and necessary permit statements.
- Test denied paths from the partner side in addition to reviewing advertised routes.
Explanation
Correct Answer
D:Test denied paths from the partner side in addition to reviewing advertised routes. This protects the intended outcome: Partner routing tables contain only the approved shared-services routes.
Incorrect Answers
A:That precaution belongs to another scenario: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A new MST campus region accidentally has a different VLAN-to-instance mapping on one distribution switch. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A sensitive engineering VLAN needs to deny lateral guest traffic within one switched segment; existing router ACLs do not inspect intra-VLAN frames. It is not the primary safeguard for this rollout.
Question 862
A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. The chosen correction is: Extend consistent class scheduling to each actual bottleneck along the end-to-end path. Which additional predeployment check is most relevant?
- Confirm IGMP snooping querier placement and membership timeouts before changing PIM topology.
- Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Prevent uncontrolled high-rate management flows from abusing the protected class.
Explanation
Correct Answer
B:Map every potential bottleneck and avoid unnecessary policy complexity on uncongested links. This protects the intended outcome: Delay-sensitive traffic receives scheduled treatment at both campus and WAN congestion points.
Incorrect Answers
A:That precaution belongs to another scenario: A multicast network has active PIM neighbors but one edge switch suppresses IGMP reports after an access-layer topology change. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus QoS policy gives low priority to routing keepalives and network monitoring, and routing adjacencies flap during congestion. It is not the primary safeguard for this rollout.
Question 863
An automation team expects NETCONF transactions over SSH to behave like stateless HTTP GET calls with no session or lock semantics. The chosen correction is: Design NETCONF operations around capabilities, RPCs, datastores and transactional edit/commit behavior where supported. Which additional predeployment check is most relevant?
- Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions.
- Test lock ownership, timeout and cleanup behavior before automation at scale.
- Validate the service contract's supported runtime and data-management obligations.
- Verify candidate/running datastore support and rollback-on-error capabilities before edits.
Explanation
Correct Answer
D:Verify candidate/running datastore support and rollback-on-error capabilities before edits. This protects the intended outcome: Approved configuration changes use the negotiated datastore and produce attributable RPC replies.
Incorrect Answers
A:That precaution belongs to another scenario: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A development team consumes a managed runtime that deploys application code without administering underlying servers and calls it raw IaaS. It is not the primary safeguard for this rollout.
Question 864
A global company uses the old terms vSmart, vManage and vBond in documentation but assigns control and management functions to the wrong products. The chosen correction is: Map Cisco SD-WAN Controller, Manager and Validator functions to their actual roles, including legacy labels. Which additional predeployment check is most relevant?
- Agree route ownership, policy and acceptance tests with both providers.
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Inspect provider conduit, POP and edge-router fate sharing before crediting path diversity.
- Validate diagrams against the deployed software generation and actual control sessions.
Explanation
Correct Answer
D:Validate diagrams against the deployed software generation and actual control sessions. This protects the intended outcome: Operations diagrams identify correct components for onboarding, OMP routes and policy distribution.
Incorrect Answers
A:That precaution belongs to another scenario: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A hospital uses one leased WAN circuit for critical access, but its architecture report calls the site highly available because it has two LAN switches. It is not the primary safeguard for this rollout.
Question 865
An EIGRP deployment relies on a single aggregation router and an outage cuts off all downstream branches. The chosen correction is: Introduce an independently reachable redundant aggregation path with planned metrics and bounded query behavior. Which additional predeployment check is most relevant?
- Compare the aggregation with the live branch prefix inventory and EIGRP summary discard behavior.
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Verify upstream fate sharing and convergence on a controlled aggregation outage.
Explanation
Correct Answer
D:Verify upstream fate sharing and convergence on a controlled aggregation outage. This protects the intended outcome: Branch routes remain reachable through the surviving aggregation router after failure.
Incorrect Answers
A:That precaution belongs to another scenario: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
Question 866
A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. The chosen correction is: Design an appropriate level-2 backbone with level-1/level-2 routers at area boundaries. Which additional predeployment check is most relevant?
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Verify NET addressing and adjacency level settings on both ends.
- Check overload and attached-bit behavior before modifying L1/L2 roles.
Explanation
Correct Answer
D:Check overload and attached-bit behavior before modifying L1/L2 roles. This protects the intended outcome: Route reachability between distant IS-IS areas is present through level-2 adjacencies.
Incorrect Answers
A:That precaution belongs to another scenario: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It is not the primary safeguard for this rollout.
B:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
C:That precaution belongs to another scenario: New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. It is not the primary safeguard for this rollout.
Question 867
A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. The chosen correction is: Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints. Which additional predeployment check is most relevant?
- Test the two failure modes independently before granting acceptance.
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Validate management and service reachability for each VRF separately.
- Verify platform multi-chassis capability and fate sharing before bundling cross-chassis links.
Explanation
Correct Answer
C:Validate management and service reachability for each VRF separately. This protects the intended outcome: Changes to one tenant's routes do not leak or alter the other's forwarding state.
Incorrect Answers
A:That precaution belongs to another scenario: A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It is not the primary safeguard for this rollout.
Question 868
A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. The chosen correction is: Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints. Which additional predeployment check is most relevant?
- Validate classification at trust boundaries and prevent starvation of essential nonvoice traffic.
- Include control, default, and scavenger classes when totaling reserved bandwidth.
- Verify backup throughput and overhead during real failover testing.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
Explanation
Correct Answer
B:Include control, default, and scavenger classes when totaling reserved bandwidth. This protects the intended outcome: All essential classes receive their planned treatment without violating actual egress capacity.
Incorrect Answers
A:That precaution belongs to another scenario: A regional WAN prioritizes voice using a DiffServ marking but provides no scheduler preference on its congested egress link. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A 20-Mbps backup link replaces a 200-Mbps primary WAN but the shaper keeps its 200-Mbps limit after failover. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It is not the primary safeguard for this rollout.
Question 869
GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. The chosen correction is: Design redundant supported key servers and registration/rekey recovery for the group encryption domain. Which additional predeployment check is most relevant?
- Compare BFD-derived observations with production application performance before selecting thresholds.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
- Stage certificates, device identity, and centralized policy before moving production routes.
- Test key-server redundancy and key-lifetime rollover before production.
Explanation
Correct Answer
D:Test key-server redundancy and key-lifetime rollover before production. This protects the intended outcome: Surviving key servers provide policies and secure data traffic remains operational through maintenance.
Incorrect Answers
A:That precaution belongs to another scenario: A video conference SD-WAN policy accepts tunnels with 1% packet loss but ignores sustained jitter above application tolerance. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. It is not the primary safeguard for this rollout.
Question 870
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The chosen correction is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom. Which additional predeployment check is most relevant?
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
- Test BIOS/NIC settings, VLAN boundaries and security policy before opening directed broadcasts.
- Validate device power negotiation and high-priority endpoint allocations before production.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
Explanation
Correct Answer
C:Validate device power negotiation and high-priority endpoint allocations before production. This protects the intended outcome: All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
Incorrect Answers
A:That precaution belongs to another scenario: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
