100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 880
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. The chosen correction is: Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation. Which additional predeployment check is most relevant?
- Check overload and attached-bit behavior before modifying L1/L2 roles.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Test withdrawal of the default and preserve the required local and internal routes.
Explanation
Correct Answer
B:Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites. This protects the intended outcome: Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
Incorrect Answers
A:That precaution belongs to another scenario: A service provider backbone runs IS-IS level-1 only across multiple areas, and distant branch routers cannot obtain interarea routes. It is not the primary safeguard for this rollout.
C:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
D:That precaution belongs to another scenario: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the primary safeguard for this rollout.
Question 881
Two BGP route reflectors share a cluster ID incorrectly with another independent cluster and some legitimate reflected updates disappear. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Intended client routes propagate without being discarded by false cluster-loop detection.
- Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
Explanation
Correct Answers
B:Intended client routes propagate without being discarded by false cluster-loop detection. This is the observable acceptance check for the change.
C:Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not establish the necessary change in this case.
D:This offered choice, “All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits”, addresses a separate concern. This alternative would address or test another scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the required change and evidence for this case.
E:This offered choice, “Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation”, addresses a separate concern. This alternative would address or test another scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the required change and evidence for this case.
Question 882
A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Detect device capability and model revision before applying vendor-specific settings.
- Use the supported gNMI service transported over gRPC with device capability and identity verification.
- A readback of the exact resource confirms only the intended configuration changed.
- Inspect response media type, payload and authorization scopes before accepting writes.
- The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target.
- Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success.
Explanation
Correct Answers
C:A readback of the exact resource confirms only the intended configuration changed. This is the observable acceptance check for the change.
D:Inspect response media type, payload and authorization scopes before accepting writes. This applies directly to the reported network-design requirement.
F:Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success. This is the corrective design for the stated topology.
Incorrect Answers
A:This statement relates to a different requirement: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It does not address the condition described here.
B:This offered choice, “Use the supported gNMI service transported over gRPC with device capability and identity verification”, addresses a separate concern. This statement relates to a different requirement: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It does not address the condition described here.
E:This offered choice, “The client negotiates capabilities and receives model-based Get/Subscribe responses from the intended target”, addresses a separate concern. This statement relates to a different requirement: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It does not address the condition described here.
Question 883
A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
- Application sessions remain stable through short intermittent primary path disturbances.
- During a controlled primary outage, the cellular path carries the approved critical application classes.
- Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.
- Validate backup access, overlay establishment and route activation under simulated primary loss.
Explanation
Correct Answers
A:Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing. This applies directly to the reported network-design requirement.
C:During a controlled primary outage, the cellular path carries the approved critical application classes. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Application sessions remain stable through short intermittent primary path disturbances”, addresses a separate concern. That answer belongs to this other scenario: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It does not establish the necessary change in this case.
D:This offered choice, “Introduce deliberate recovery policy or dampening to prevent repeated unstable failback”, addresses a separate concern. That answer belongs to this other scenario: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It does not establish the necessary change in this case.
Question 884
An enterprise stretches 200 VLANs end-to-end through many buildings and one STP event triggers campus-wide reconvergence. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- An access-switch failure affects only its intended local domain rather than propagating broad STP churn.
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
- Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit.
- Inventory workloads that truly need Layer 2 adjacency before moving VLAN gateways.
- Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
- Test the full supported transit profile rather than relying on basic IP ping success.
Explanation
Correct Answers
A:An access-switch failure affects only its intended local domain rather than propagating broad STP churn. This is the observable acceptance check for the change.
C:Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit. This is the corrective design for the stated topology.
D:Inventory workloads that truly need Layer 2 adjacency before moving VLAN gateways. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Intersite overlay flows survive the engineered path and meet their measured size and latency limits”, addresses a separate concern. This statement relates to a different requirement: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not address the condition described here.
E:This offered choice, “Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints”, addresses a separate concern. This statement relates to a different requirement: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not address the condition described here.
F:This offered choice, “Test the full supported transit profile rather than relying on basic IP ping success”, addresses a separate concern. This statement relates to a different requirement: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not address the condition described here.
Question 885
Network automation can push config to all devices because its management subnet is allowed everywhere despite a read-only reporting requirement. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Give reporting and change tools separate scoped management identities, roles, and network paths.
- Multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
- Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
- Monitoring reads succeed but change commands from the reporting service are denied.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
Explanation
Correct Answers
A:Give reporting and change tools separate scoped management identities, roles, and network paths. This applies directly to the reported network-design requirement.
D:Monitoring reads succeed but change commands from the reporting service are denied. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Multiple authorized sources reach receiver sets through the designed bidirectional shared tree”, addresses a separate concern. That answer belongs to this other scenario: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not establish the necessary change in this case.
C:This offered choice, “Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement”, addresses a separate concern. That answer belongs to this other scenario: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not establish the necessary change in this case.
E:This offered choice, “Provide independent telemetry or out-of-band access appropriate to site criticality and budget”, addresses a separate concern. That answer belongs to this other scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not establish the necessary change in this case.
Question 886
An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
- Model preferred and backup routes with tags and test failure behavior before enabling both ASBRs.
- Prefer durable backbone topology repair over making virtual links a permanent substitute for good design.
- All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
- The prefix exits through the intended ASBR and remains loop-free on failover.
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
Explanation
Correct Answers
A:Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements. This is the corrective design for the stated topology.
B:Model preferred and backup routes with tags and test failure behavior before enabling both ASBRs. This applies directly to the reported network-design requirement.
E:The prefix exits through the intended ASBR and remains loop-free on failover. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Prefer durable backbone topology repair over making virtual links a permanent substitute for good design”, addresses a separate concern. This statement relates to a different requirement: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not address the condition described here.
D:This offered choice, “All ABRs maintain backbone reachability and interarea routes converge through the intended topology”, addresses a separate concern. This statement relates to a different requirement: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not address the condition described here.
F:This offered choice, “Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design”, addresses a separate concern. This statement relates to a different requirement: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not address the condition described here.
Question 887
A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
- Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- The fabric edge is inventoried, assigned its intended role, and passes overlay endpoint traffic tests.
Explanation
Correct Answers
A:Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites. This applies directly to the reported network-design requirement.
E:The fabric edge is inventoried, assigned its intended role, and passes overlay endpoint traffic tests. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes”, addresses a separate concern. That answer belongs to this other scenario: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It does not establish the necessary change in this case.
D:This offered choice, “Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames”, addresses a separate concern. That answer belongs to this other scenario: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not establish the necessary change in this case.
Question 888
A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
- Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract.
- Only authorized operators can connect to device management while public services remain available.
- Ensure monitoring and certificate renewal still function inside the isolated management context.
- End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
- Verify provider remarking, class limits and contracted service levels before rollout.
Explanation
Correct Answers
B:Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract. This is the corrective design for the stated topology.
E:End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment. This is the observable acceptance check for the change.
F:Verify provider remarking, class limits and contracted service levels before rollout. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy”, addresses a separate concern. This statement relates to a different requirement: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It does not address the condition described here.
C:This offered choice, “Only authorized operators can connect to device management while public services remain available”, addresses a separate concern. This statement relates to a different requirement: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It does not address the condition described here.
D:This offered choice, “Ensure monitoring and certificate renewal still function inside the isolated management context”, addresses a separate concern. This statement relates to a different requirement: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It does not address the condition described here.
Question 889
Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition.
- Require physical route and carrier diversity, including demarcation and access-path audits.
- Application flows survive permitted egress changes without stateful-firewall drops.
- A controlled failure of either carrier access route leaves required service operational on the independent path.
- Design multihoming with explicit path symmetry or state-sharing controls and validate both directions.
Explanation
Correct Answers
C:Application flows survive permitted egress changes without stateful-firewall drops. This is the observable acceptance check for the change.
E:Design multihoming with explicit path symmetry or state-sharing controls and validate both directions. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Align the service's supported VLAN encapsulation and mapping with the carrier's EVC definition”, addresses a separate concern. That answer belongs to this other scenario: Two enterprise buildings use separate Metro Ethernet UNI ports, yet their operators assume the provider will preserve any configured customer VLAN ID. It does not establish the necessary change in this case.
B:This offered choice, “Require physical route and carrier diversity, including demarcation and access-path audits”, addresses a separate concern. That answer belongs to this other scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It does not establish the necessary change in this case.
D:This offered choice, “A controlled failure of either carrier access route leaves required service operational on the independent path”, addresses a separate concern. That answer belongs to this other scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It does not establish the necessary change in this case.
Question 890
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
Explanation
Correct Answers
B:Rogue DHCP offers from access ports are dropped while authorized client leases succeed. This is the observable acceptance check for the change.
C:Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries. This applies directly to the reported network-design requirement.
D:Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Review platform compatibility and perform a maintenance-window failover test before promising hitless service”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
E:This offered choice, “Gateway traffic survives a controlled supervisor transition within the approved outage budget”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
F:This offered choice, “Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
