100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 870
IP phones and cameras are scheduled for a new closet, but PoE budget is calculated only from the switch's total port count. The chosen correction is: Calculate worst-case powered-device class demand, switch power supply budget, and redundancy headroom. Which additional predeployment check is most relevant?
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
- Test BIOS/NIC settings, VLAN boundaries and security policy before opening directed broadcasts.
- Validate device power negotiation and high-priority endpoint allocations before production.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
Explanation
Correct Answer
C:Validate device power negotiation and high-priority endpoint allocations before production. This protects the intended outcome: All approved powered endpoints boot under full load and stay powered after one permitted PSU failure.
Incorrect Answers
A:That precaution belongs to another scenario: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It is not the primary safeguard for this rollout.
Question 871
New routers have valid IP addresses but IS-IS peers in separate areas never form a level-1 adjacency. The chosen correction is: Align IS-IS area addresses for L1 neighbor formation or use supported level-2 adjacency where the topology requires interarea routing. Which additional predeployment check is most relevant?
- Check overload and attached-bit behavior before modifying L1/L2 roles.
- Test bidirectional traffic and confirm no inadvertent ECMP over low-capacity links.
- Audit DHCP and static address assignments prior to moving the site to its routed block.
- Verify NET addressing and adjacency level settings on both ends.
Explanation
Correct Answer
D:Verify NET addressing and adjacency level settings on both ends. This protects the intended outcome: The intended adjacency comes up at the correct level and interarea destinations remain reachable.
Incorrect Answers
A:That precaution belongs to another scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A network uses IS-IS with dual distribution routers and wants predictable traffic away from a low-bandwidth backup path. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It is not the primary safeguard for this rollout.
Question 872
Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. The chosen correction is: Provide independent telemetry or out-of-band access appropriate to site criticality and budget. Which additional predeployment check is most relevant?
- Verify receiver IGMP version and source authorization before activating SSM.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Test the OOB path and escalation workflow periodically.
- Estimate collector volume and sample rates before enabling streams.
Explanation
Correct Answer
C:Test the OOB path and escalation workflow periodically. This protects the intended outcome: A WAN outage still produces actionable diagnostics and authorized operator access.
Incorrect Answers
A:That precaution belongs to another scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the primary safeguard for this rollout.
Question 873
A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. The chosen correction is: Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required. Which additional predeployment check is most relevant?
- Test provider MTU, loop prevention and circuit failover before cutover.
- Verify source/receiver topology, platform multicast support and traffic volume.
- Verify encapsulation overhead, security associations, and multicast reachability separately.
- Test both accepted routes and explicitly denied spoke-to-spoke paths.
Explanation
Correct Answer
C:Verify encapsulation overhead, security associations, and multicast reachability separately. This protects the intended outcome: Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled.
Incorrect Answers
A:That precaution belongs to another scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. It is not the primary safeguard for this rollout.
Question 874
A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. The chosen correction is: Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership. Which additional predeployment check is most relevant?
- Confirm the chosen leaf supports on-change and implement appropriate event deduplication.
- Calculate device and collector resource impact for chosen telemetry frequency.
- Detect device capability and model revision before applying vendor-specific settings.
- Validate module namespace and device-supported YANG library before generating requests.
Explanation
Correct Answer
D:Validate module namespace and device-supported YANG library before generating requests. This protects the intended outcome: Schema registry entries identify the correct module namespace and revisions for each controller operation.
Incorrect Answers
A:That precaution belongs to another scenario: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the primary safeguard for this rollout.
Question 875
Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. The chosen correction is: Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames. Which additional predeployment check is most relevant?
- Compare the approved software matrix and intended fabric site design before onboarding.
- Verify underlay IGP and fabric VRF configuration as separate acceptance tests.
- Validate 802.1X/MAB, identity propagation and policy logs during roaming tests.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
Explanation
Correct Answer
D:Test the smallest interswitch path and supported MTU settings before fabric activation. This protects the intended outcome: Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
Incorrect Answers
A:That precaution belongs to another scenario: A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It is not the primary safeguard for this rollout.
Question 876
A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. The chosen correction is: Use local preference or another AS-wide BGP policy rather than relying on locally significant weight. Which additional predeployment check is most relevant?
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Use topology-table evidence and controlled link-failure testing to validate backup eligibility.
- Diagram route origins and inspect tags at each redistribution handoff.
- Verify route preference at more than one internal router before completing migration.
Explanation
Correct Answer
D:Verify route preference at more than one internal router before completing migration. This protects the intended outcome: The intended exit preference propagates across internal BGP speakers.
Incorrect Answers
A:That precaution belongs to another scenario: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the primary safeguard for this rollout.
Question 877
A network team manually builds static IPsec tunnels between every SD-WAN edge even though centralized overlay policy is available. The chosen correction is: Use the SD-WAN control-plane and key distribution capabilities appropriate to the supported solution. Which additional predeployment check is most relevant?
- Document centralized policy exceptions and maintain a tested device-identity revocation process.
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Model expected site growth and redundancy before choosing hub/spoke or regional topology.
- Validate key server reachability, group membership and the underlying trusted WAN model.
Explanation
Correct Answer
A:Document centralized policy exceptions and maintain a tested device-identity revocation process. This protects the intended outcome: Authorized overlay tunnels form between intended peers without manually maintained full-mesh IKE policy.
Incorrect Answers
B:That precaution belongs to another scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A WAN edge has hundreds of VPN prefixes and growing TLOC paths; an all-to-all overlay approaches its platform session capacity. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It is not the primary safeguard for this rollout.
Question 878
A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. The chosen correction is: Remap backup traffic to a less-preferred class and protect media queues for their intended applications. Which additional predeployment check is most relevant?
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Test packets at the provider demarcation and review contractual class limits.
- Document permitted DSCP translations and validate the provider's supported class values.
- Estimate collector volume and sample rates before enabling streams.
Explanation
Correct Answer
A:Coordinate DSCP mapping at the interconnect and verify markings on both sides. This protects the intended outcome: Backup operations continue at lower priority without violating interactive video quality.
Incorrect Answers
B:That precaution belongs to another scenario: A WAN provider accepts only three traffic classes but headquarters configures eight local DSCP queues and assumes all survive the handoff. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A provider's remote OOB management path is only 2 Mbps, while the network team sends continuous uncompressed telemetry streams at 5 Mbps. It is not the primary safeguard for this rollout.
Question 879
Two intercampus routers redistribute OSPF and EIGRP in both directions, making route origin hard to track. The chosen correction is: Apply selective redistribution, tagging and route filtering at clearly defined protocol boundaries. Which additional predeployment check is most relevant?
- Simulate failure and steady-state route selection before changing handoff metrics.
- Test the two failure modes independently before granting acceptance.
- Define origin-tag conventions and verify both redistribution devices during failover.
- Test BFD timer scale and false-positive sensitivity under peak control-plane load.
Explanation
Correct Answer
C:Define origin-tag conventions and verify both redistribution devices during failover. This protects the intended outcome: A representative prefix crosses the boundary once and retains deterministic return routing.
Incorrect Answers
A:That precaution belongs to another scenario: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Campus routers detect a fiber break only after long OSPF dead timers, missing a strict voice recovery target. It is not the primary safeguard for this rollout.
Question 880
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. The chosen correction is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation. Which additional predeployment check is most relevant?
- Check overload and attached-bit behavior before modifying L1/L2 roles.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Test withdrawal of the default and preserve the required local and internal routes.
Explanation
Correct Answer
B:Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites. This protects the intended outcome: Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
Incorrect Answers
A:That precaution belongs to another scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the primary safeguard for this rollout.
C:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
D:That precaution belongs to another scenario: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
