100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 890
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
- Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior.
Explanation
Correct Answers
B:Rogue DHCP offers from access ports are dropped while authorized client leases succeed. This is the observable acceptance check for the change.
C:Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries. This applies directly to the reported network-design requirement.
D:Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Review platform compatibility and perform a maintenance-window failover test before promising hitless service”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
E:This offered choice, “Gateway traffic survives a controlled supervisor transition within the approved outage budget”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
F:This offered choice, “Choose a supported redundant supervisor or logical chassis abstraction with explicitly documented switchover behavior”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
Question 891
Headquarters supports IPv4 but users now require IPv6 applications without losing legacy IPv4 services. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Native IPv4 and IPv6 traffic reaches only approved services and each family has working operations telemetry.
- IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
- Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records.
- Deploy tested dual stack where both address families, DNS, routing and access controls are supported end to end.
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
Explanation
Correct Answers
A:Native IPv4 and IPv6 traffic reaches only approved services and each family has working operations telemetry. This is the observable acceptance check for the change.
D:Deploy tested dual stack where both address families, DNS, routing and access controls are supported end to end. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “IPv6 connections to protected applications are blocked or allowed consistently with approved policy”, addresses a separate concern. That answer belongs to this other scenario: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It does not establish the necessary change in this case.
C:This offered choice, “Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records”, addresses a separate concern. That answer belongs to this other scenario: A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. It does not establish the necessary change in this case.
E:This offered choice, “Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary”, addresses a separate concern. That answer belongs to this other scenario: A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. It does not establish the necessary change in this case.
Question 892
A NETCONF client edits a shared candidate configuration while another orchestrator is modifying the same device. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Each authorized transaction commits its intended changes without mixing concurrent candidates.
- Query capability/model support and document fallback sampling per platform.
- Test lock ownership, timeout and cleanup behavior before automation at scale.
- Select subscription modes according to the actual leaf and device support, using periodic for counters when necessary.
- Use supported NETCONF locks, edit-config validation and controlled commit workflow to serialize sensitive changes.
- The receiver obtains the expected measurement updates for every required signal.
Explanation
Correct Answers
A:Each authorized transaction commits its intended changes without mixing concurrent candidates. This is the observable acceptance check for the change.
C:Test lock ownership, timeout and cleanup behavior before automation at scale. This applies directly to the reported network-design requirement.
E:Use supported NETCONF locks, edit-config validation and controlled commit workflow to serialize sensitive changes. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Query capability/model support and document fallback sampling per platform”, addresses a separate concern. This statement relates to a different requirement: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not address the condition described here.
D:This offered choice, “Select subscription modes according to the actual leaf and device support, using periodic for counters when necessary”, addresses a separate concern. This statement relates to a different requirement: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not address the condition described here.
F:This offered choice, “The receiver obtains the expected measurement updates for every required signal”, addresses a separate concern. This statement relates to a different requirement: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not address the condition described here.
Question 893
Branches will be migrated from static internet VPNs to SD-WAN customer edges but the design omits transport isolation and overlay security. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
- Sites establish secure control sessions and authorized data-plane tunnels for their assigned service segments.
- Select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs.
- Each branch exchanges only authorized VPN routes while the provider backbone transports traffic without L2 extension.
- Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing.
Explanation
Correct Answers
B:Sites establish secure control sessions and authorized data-plane tunnels for their assigned service segments. This is the observable acceptance check for the change.
C:Select supported WAN edge platforms and onboard them with correctly separated transport and service VPNs. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Design redundant supported key servers and registration/rekey recovery for the group encryption domain”, addresses a separate concern. That answer belongs to this other scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not establish the necessary change in this case.
D:This offered choice, “Each branch exchanges only authorized VPN routes while the provider backbone transports traffic without L2 extension”, addresses a separate concern. That answer belongs to this other scenario: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It does not establish the necessary change in this case.
E:This offered choice, “Choose a provider MPLS Layer 3 VPN with appropriate VRF route-target isolation and customer-to-provider routing”, addresses a separate concern. That answer belongs to this other scenario: A customer needs private route separation for 12 branches over a shared provider backbone, not a single Ethernet broadcast domain. It does not establish the necessary change in this case.
Question 894
A team expects multicast traffic to traverse a shared tree forever even though its design requests shortest-path switching. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Multiple authorized sources reach receiver sets through the designed bidirectional shared tree.
- Validate platform and routing support, DF election and true application traffic pattern.
- Capture (*,G) and (S,G) state at different phases of receiver joins.
- Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement.
- Receiver forwarding follows the intended tree state after source discovery and any supported SPT transition.
- Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly.
Explanation
Correct Answers
C:Capture (*,G) and (S,G) state at different phases of receiver joins. This applies directly to the reported network-design requirement.
E:Receiver forwarding follows the intended tree state after source discovery and any supported SPT transition. This is the observable acceptance check for the change.
F:Distinguish RP-rooted shared trees from source-specific shortest-path trees and design switch behavior accordingly. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Multiple authorized sources reach receiver sets through the designed bidirectional shared tree”, addresses a separate concern. This statement relates to a different requirement: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not address the condition described here.
B:This offered choice, “Validate platform and routing support, DF election and true application traffic pattern”, addresses a separate concern. This statement relates to a different requirement: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not address the condition described here.
D:This offered choice, “Evaluate bidirectional PIM for appropriate many-to-many traffic patterns and RP placement”, addresses a separate concern. This statement relates to a different requirement: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It does not address the condition described here.
Question 895
A merger requires two administrative BGP regions to appear as one external AS while reducing iBGP mesh size internally. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
- Design redundant BGP route reflectors with consistent cluster IDs and reflector-client relationships.
- Route reflector clients learn authorized prefixes without maintaining a full mesh of all client sessions.
- External peers see the intended confederation identifier while internal sub-AS sessions provide approved reachability.
- Evaluate an appropriately designed BGP confederation with documented member-AS and external peer behavior.
Explanation
Correct Answers
D:External peers see the intended confederation identifier while internal sub-AS sessions provide approved reachability. This is the observable acceptance check for the change.
E:Evaluate an appropriately designed BGP confederation with documented member-AS and external peer behavior. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation”, addresses a separate concern. This alternative would address or test another scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It does not establish the required change and evidence for this case.
B:This offered choice, “Design redundant BGP route reflectors with consistent cluster IDs and reflector-client relationships”, addresses a separate concern. That answer belongs to this other scenario: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It does not establish the necessary change in this case.
C:This offered choice, “Route reflector clients learn authorized prefixes without maintaining a full mesh of all client sessions”, addresses a separate concern. That answer belongs to this other scenario: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It does not establish the necessary change in this case.
Question 896
An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
- Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
- The rogue bridge cannot become campus root and protected access interfaces enter their intended security state.
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
- Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
Explanation
Correct Answers
A:Separate endpoint ports from legitimate bridged connections when applying BPDU policies. This applies directly to the reported network-design requirement.
C:The rogue bridge cannot become campus root and protected access interfaces enter their intended security state. This is the observable acceptance check for the change.
D:Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked”, addresses a separate concern. This statement relates to a different requirement: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not address the condition described here.
E:This offered choice, “Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile”, addresses a separate concern. This statement relates to a different requirement: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not address the condition described here.
F:This offered choice, “Consider IP phones, virtual machines and MAC mobility before selecting the maximum”, addresses a separate concern. This statement relates to a different requirement: A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. It does not address the condition described here.
Question 897
Two business units share one management VLAN with unrestricted access to each other's routers. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- An emergency administrator maintains workable session latency while backup transfer runs.
- Extend consistent class scheduling to each actual bottleneck along the end-to-end path.
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- Give critical management/control traffic an appropriate protected class and regulate bulk backup load.
- Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
Explanation
Correct Answers
C:Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries. This applies directly to the reported network-design requirement.
E:Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “An emergency administrator maintains workable session latency while backup transfer runs”, addresses a separate concern. That answer belongs to this other scenario: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: A campus designs priority queues only on the access switch but ignores a congested upstream WAN edge. It does not establish the necessary change in this case.
D:This offered choice, “Give critical management/control traffic an appropriate protected class and regulate bulk backup load”, addresses a separate concern. That answer belongs to this other scenario: A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. It does not establish the necessary change in this case.
Question 898
A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Large application sessions succeed with correct effective packet sizing over each approved transport.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
- Evaluate GET VPN where supported for group encryption over a trusted routable provider network.
- Validate key server reachability, group membership and the underlying trusted WAN model.
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Child SAs establish for the matching traffic selectors and permitted applications pass.
Explanation
Correct Answers
A:Large application sessions succeed with correct effective packet sizing over each approved transport. This is the observable acceptance check for the change.
B:Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path. This is the corrective design for the stated topology.
E:Measure path MTU over primary and backup carriers before setting MSS limits. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Evaluate GET VPN where supported for group encryption over a trusted routable provider network”, addresses a separate concern. This statement relates to a different requirement: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It does not address the condition described here.
D:This offered choice, “Validate key server reachability, group membership and the underlying trusted WAN model”, addresses a separate concern. This statement relates to a different requirement: An organization needs any-to-any group-encrypted private WAN traffic but the new design proposes a traditional hub-and-spoke IPsec overlay with hub hairpins. It does not address the condition described here.
F:This statement relates to a different requirement: Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. It does not address the condition described here.
Question 899
Two acquired companies both use 172.16.0.0/12; an immediate core merge would expose identical destination prefixes. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.
- Use a hierarchical IS-IS L1/L2 design and summarization at supported area boundaries where it fits topology.
- Both tenants resolve overlapping addresses within their own routing tables while approved intercompany services remain reachable.
- Preserve separate VRFs and apply a scoped, documented translation or renumbering design at the interconnect boundary.
- After repairing the link, LSP churn falls and traffic reconverges on stable intended paths.
Explanation
Correct Answers
C:Both tenants resolve overlapping addresses within their own routing tables while approved intercompany services remain reachable. This is the observable acceptance check for the change.
D:Preserve separate VRFs and apply a scoped, documented translation or renumbering design at the interconnect boundary. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: A large enterprise wants to contain detailed IS-IS prefixes within buildings while preserving intercampus reachability. It does not establish the necessary change in this case.
E:This offered choice, “After repairing the link, LSP churn falls and traffic reconverges on stable intended paths”, addresses a separate concern. That answer belongs to this other scenario: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It does not establish the necessary change in this case.
Question 900
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Changes to one tenant's routes do not leak or alter the other's forwarding state.
- Validate management and service reachability for each VRF separately.
- Both failure exercises satisfy the documented outage budget without skipping required policy checks.
- Test the two failure modes independently before granting acceptance.
- Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
- Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
Explanation
Correct Answers
C:Both failure exercises satisfy the documented outage budget without skipping required policy checks. This is the observable acceptance check for the change.
D:Test the two failure modes independently before granting acceptance. This applies directly to the reported network-design requirement.
E:Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Changes to one tenant's routes do not leak or alter the other's forwarding state”, addresses a separate concern. This statement relates to a different requirement: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not address the condition described here.
B:This offered choice, “Validate management and service reachability for each VRF separately”, addresses a separate concern. This statement relates to a different requirement: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not address the condition described here.
F:This offered choice, “Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints”, addresses a separate concern. This statement relates to a different requirement: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
