100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 900
A new campus design requires maintaining service during both one uplink failure and one planned software upgrade. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Changes to one tenant's routes do not leak or alter the other's forwarding state.
- Validate management and service reachability for each VRF separately.
- Both failure exercises satisfy the documented outage budget without skipping required policy checks.
- Test the two failure modes independently before granting acceptance.
- Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions.
- Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints.
Explanation
Correct Answers
C:Both failure exercises satisfy the documented outage budget without skipping required policy checks. This is the observable acceptance check for the change.
D:Test the two failure modes independently before granting acceptance. This applies directly to the reported network-design requirement.
E:Select supported redundancy mechanisms that separately address link failure and control-plane maintenance transitions. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Changes to one tenant's routes do not leak or alter the other's forwarding state”, addresses a separate concern. This statement relates to a different requirement: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not address the condition described here.
B:This offered choice, “Validate management and service reachability for each VRF separately”, addresses a separate concern. This statement relates to a different requirement: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not address the condition described here.
F:This offered choice, “Design separate VRFs and policy boundaries aligned to each tenant's compliance constraints”, addresses a separate concern. This statement relates to a different requirement: A public safety campus requires independent operations from a corporate tenant even when both use the same distribution hardware. It does not address the condition described here.
Question 901
SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The branch switches to the secondary circuit within the required service recovery interval.
- Separate optical multiplexing requirements from routing or Ethernet tenant segmentation carried over the wavelengths.
- Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers.
- Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
- Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable.
Explanation
Correct Answers
D:Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship. This applies directly to the reported network-design requirement.
E:Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “The branch switches to the secondary circuit within the required service recovery interval”, addresses a separate concern. That answer belongs to this other scenario: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. It does not establish the necessary change in this case.
B:This offered choice, “Separate optical multiplexing requirements from routing or Ethernet tenant segmentation carried over the wavelengths”, addresses a separate concern. That answer belongs to this other scenario: A WAN team assumes DWDM wavelength multiplexing itself supplies packet-level route isolation between tenants. It does not establish the necessary change in this case.
C:This offered choice, “Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers”, addresses a separate concern. That answer belongs to this other scenario: An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. It does not establish the necessary change in this case.
Question 902
An organization hosts workloads in its owned private cloud and bursts selected approved applications to a public cloud while declaring this exclusively private deployment. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Map shared responsibility and data residency requirements at each boundary.
- Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
- Examine cloud service limits, BGP policy and regional diversity before committing to circuits.
- Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies.
- Authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
- Approved burst workloads operate across the private and public boundaries without unrestricted network trust.
Explanation
Correct Answers
A:Map shared responsibility and data residency requirements at each boundary. This applies directly to the reported network-design requirement.
D:Classify the combined arrangement as hybrid cloud and design controlled identity, routing, and data movement policies. This is the corrective design for the stated topology.
F:Approved burst workloads operate across the private and public boundaries without unrestricted network trust. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing”, addresses a separate concern. This statement relates to a different requirement: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not address the condition described here.
C:This offered choice, “Examine cloud service limits, BGP policy and regional diversity before committing to circuits”, addresses a separate concern. This statement relates to a different requirement: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not address the condition described here.
E:This offered choice, “Authorized cloud prefixes are reachable over intended private paths after one interconnect fails”, addresses a separate concern. This statement relates to a different requirement: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not address the condition described here.
Question 903
A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Measured traffic conforms to the allowed profile and application packet loss decreases under load.
- Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
- Burst traffic drains within a controlled rate envelope with fewer avoidable losses.
- Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
Explanation
Correct Answers
B:Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior. This applies directly to the reported network-design requirement.
C:Burst traffic drains within a controlled rate envelope with fewer avoidable losses. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Measured traffic conforms to the allowed profile and application packet loss decreases under load”, addresses a separate concern. That answer belongs to this other scenario: A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. It does not establish the necessary change in this case.
D:This offered choice, “Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract”, addresses a separate concern. That answer belongs to this other scenario: A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not establish the necessary change in this case.
Question 904
A guest workstation port can learn hundreds of source MAC addresses because an unmanaged mini-switch is connected behind it. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Separate endpoint ports from legitimate bridged connections when applying BPDU policies.
- Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile.
- Consider IP phones, virtual machines and MAC mobility before selecting the maximum.
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
- Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
Explanation
Correct Answers
B:Apply supported port-security limits and violation behavior aligned to the legitimate endpoint profile. This is the corrective design for the stated topology.
C:Consider IP phones, virtual machines and MAC mobility before selecting the maximum. This applies directly to the reported network-design requirement.
E:Only the approved number of endpoint identities can use the port while rogue downstream devices are blocked. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Separate endpoint ports from legitimate bridged connections when applying BPDU policies”, addresses a separate concern. This statement relates to a different requirement: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not address the condition described here.
D:This offered choice, “Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks”, addresses a separate concern. This statement relates to a different requirement: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not address the condition described here.
F:This offered choice, “Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking”, addresses a separate concern. That option relates to this separate design case: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not answer the current requirement.
Question 905
IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Allowed external routes appear without reentering their origin routing domain on an alternate border.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
- Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
Explanation
Correct Answers
B:Allowed external routes appear without reentering their origin routing domain on an alternate border. This is the observable acceptance check for the change.
E:Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not establish the necessary change in this case.
C:This offered choice, “Local access failures generate bounded LSDB changes without disrupting unrelated branches”, addresses a separate concern. That answer belongs to this other scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not establish the necessary change in this case.
D:This offered choice, “Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope”, addresses a separate concern. That answer belongs to this other scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not establish the necessary change in this case.
Question 906
A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop.
- Capacity-test a complete single-router failure, not only normal steady-state load.
- Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages.
- Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
- Validate LACP partner system IDs and split-brain protection for the chosen solution.
- Gateway traffic survives a controlled supervisor transition within the approved outage budget.
Explanation
Correct Answers
B:Capacity-test a complete single-router failure, not only normal steady-state load. This applies directly to the reported network-design requirement.
C:Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages. This is the observable acceptance check for the change.
D:Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Use a supported multi-chassis EtherChannel or routed-access design to make redundancy active without a spanning-tree loop”, addresses a separate concern. This statement relates to a different requirement: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It does not address the condition described here.
E:This offered choice, “Validate LACP partner system IDs and split-brain protection for the chosen solution”, addresses a separate concern. This statement relates to a different requirement: A campus design requires both distribution uplinks active but the chosen topology uses classic STP on all Layer 2 connections. It does not address the condition described here.
F:This offered choice, “Gateway traffic survives a controlled supervisor transition within the approved outage budget”, addresses a separate concern. This statement relates to a different requirement: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It does not address the condition described here.
Question 907
Two OSPF neighbors on a routed core link are stuck in EXSTART/EXCHANGE and one endpoint uses an incompatible MTU. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Apply EIGRP summarization, stub boundaries, and reliable connectivity to limit query scope.
- The neighbors reach FULL and application packets traverse without fragmentation problems.
- Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly.
- Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault.
- After repairing the link, LSP churn falls and traffic reconverges on stable intended paths.
Explanation
Correct Answers
B:The neighbors reach FULL and application packets traverse without fragmentation problems. This is the observable acceptance check for the change.
C:Align supported interface MTU and OSPF adjacency parameters rather than suppressing the mismatch blindly. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: An EIGRP core has routes stuck active after one WAN path fails and queries spread into many remote sites. It does not establish the necessary change in this case.
D:This offered choice, “Use appropriate convergence design, link health remediation, and scoped metric or fast-failure detection without masking a physical fault”, addresses a separate concern. That answer belongs to this other scenario: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It does not establish the necessary change in this case.
E:This offered choice, “After repairing the link, LSP churn falls and traffic reconverges on stable intended paths”, addresses a separate concern. That answer belongs to this other scenario: An IS-IS backbone suffers topology oscillation because a marginal core link repeatedly flaps. It does not establish the necessary change in this case.
Question 908
Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Remap backup traffic to a less-preferred class and protect media queues for their intended applications.
- Backup operations continue at lower priority without violating interactive video quality.
- Standardize classification and remarking policy across all controlled network trust boundaries.
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Document permitted DSCP translations and validate the provider's supported class values.
- Packet captures across both sites show correct class markings before and after provider handoff.
Explanation
Correct Answers
C:Standardize classification and remarking policy across all controlled network trust boundaries. This is the corrective design for the stated topology.
E:Document permitted DSCP translations and validate the provider's supported class values. This applies directly to the reported network-design requirement.
F:Packet captures across both sites show correct class markings before and after provider handoff. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Remap backup traffic to a less-preferred class and protect media queues for their intended applications”, addresses a separate concern. This statement relates to a different requirement: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not address the condition described here.
B:This offered choice, “Backup operations continue at lower priority without violating interactive video quality”, addresses a separate concern. This statement relates to a different requirement: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not address the condition described here.
D:This offered choice, “Coordinate DSCP mapping at the interconnect and verify markings on both sides”, addresses a separate concern. This statement relates to a different requirement: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It does not address the condition described here.
Question 909
A new WAN edge receives a bootstrap but its control connections fail because the certificate trust chain and organization name differ. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Align the signed device identity, organization name and controller trust requirements for supported secure onboarding.
- Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations.
- The device authenticates and forms approved control sessions with the SD-WAN fabric.
- Provide independent edge and transport paths when required; treat controller redundancy as a separate failure domain.
- Guest prefixes and traffic stay isolated from production routes and data tunnels.
Explanation
Correct Answers
A:Align the signed device identity, organization name and controller trust requirements for supported secure onboarding. This applies directly to the reported network-design requirement.
C:The device authenticates and forms approved control sessions with the SD-WAN fabric. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Separate service VPNs/segments and apply centralized policy matching approved guest and corporate destinations”, addresses a separate concern. That answer belongs to this other scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: A new SD-WAN site has a single edge appliance and single underlay yet is approved as redundant because controllers run in different data centers. It does not establish the necessary change in this case.
E:This offered choice, “Guest prefixes and traffic stay isolated from production routes and data tunnels”, addresses a separate concern. That answer belongs to this other scenario: An SD-WAN fabric routes guest traffic into the production VPN because a new edge reused the corporate service VPN identifier. It does not establish the necessary change in this case.
Question 910
A campus configures very aggressive BFD intervals on thousands of routed links and then sees intermittent neighbor flaps at peak CPU. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Tune BFD intervals and session scale to supported hardware and realistic detection requirements.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
- Baseline platform BFD resource consumption and event rates before decreasing timers.
- True failures are found promptly while healthy links no longer reset under ordinary control-plane load.
Explanation
Correct Answers
A:Tune BFD intervals and session scale to supported hardware and realistic detection requirements. This is the corrective design for the stated topology.
E:Baseline platform BFD resource consumption and event rates before decreasing timers. This applies directly to the reported network-design requirement.
F:True failures are found promptly while healthy links no longer reset under ordinary control-plane load. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
C:This statement relates to a different requirement: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not address the condition described here.
D:This offered choice, “Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
