100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 920
A campus wants deterministic STP roots but all switches retain default bridge priorities. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets.
- Root bridge elections and forwarding paths match the documented campus topology.
- Clients retain gateway reachability after either distribution switch fails.
- Verify root identity for every relevant VLAN or MST instance rather than one sample VLAN.
- Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address.
Explanation
Correct Answers
B:Place primary and secondary STP root roles at the appropriate distribution devices for the planned VLAN sets. This is the corrective design for the stated topology.
C:Root bridge elections and forwarding paths match the documented campus topology. This is the observable acceptance check for the change.
E:Verify root identity for every relevant VLAN or MST instance rather than one sample VLAN. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking”, addresses a separate concern. This statement relates to a different requirement: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not address the condition described here.
D:This offered choice, “Clients retain gateway reachability after either distribution switch fails”, addresses a separate concern. This statement relates to a different requirement: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not address the condition described here.
F:This offered choice, “Verify VLAN membership, upstream reachability and failure ownership before activating the virtual address”, addresses a separate concern. This statement relates to a different requirement: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not address the condition described here.
Question 921
An edge router receives a full BGP table where the security policy allows only the provider's approved default. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The accepted RIB contains the permitted default and no unintended provider prefixes.
- Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards.
- The intended exit preference propagates across internal BGP speakers.
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Design redundant BGP route reflectors with consistent cluster IDs and reflector-client relationships.
Explanation
Correct Answers
A:The accepted RIB contains the permitted default and no unintended provider prefixes. This is the observable acceptance check for the change.
B:Filter inbound BGP announcements using an explicit default-only prefix policy and appropriate session safeguards. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “The intended exit preference propagates across internal BGP speakers”, addresses a separate concern. That answer belongs to this other scenario: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It does not establish the necessary change in this case.
D:This offered choice, “Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks”, addresses a separate concern. That answer belongs to this other scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It does not establish the necessary change in this case.
E:This offered choice, “Design redundant BGP route reflectors with consistent cluster IDs and reflector-client relationships”, addresses a separate concern. That answer belongs to this other scenario: A network with 80 iBGP routers becomes difficult to operate because every router forms a full mesh of peer sessions. It does not establish the necessary change in this case.
Question 922
A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Verify receiver IGMP version and source authorization before activating SSM.
- The receiver sends a source-specific join and obtains only the authorized stream.
- Intended receivers across the routed boundary receive the source stream.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Align SSM membership to include the desired (S,G) source/group relationship.
- Confirm upstream source paths and verify PIM neighbors on every routed segment.
Explanation
Correct Answers
A:Verify receiver IGMP version and source authorization before activating SSM. This applies directly to the reported network-design requirement.
B:The receiver sends a source-specific join and obtains only the authorized stream. This is the observable acceptance check for the change.
E:Align SSM membership to include the desired (S,G) source/group relationship. This is the corrective design for the stated topology.
Incorrect Answers
C:This offered choice, “Intended receivers across the routed boundary receive the source stream”, addresses a separate concern. This statement relates to a different requirement: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not address the condition described here.
D:This offered choice, “Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling”, addresses a separate concern. This statement relates to a different requirement: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not address the condition described here.
F:This offered choice, “Confirm upstream source paths and verify PIM neighbors on every routed segment”, addresses a separate concern. This statement relates to a different requirement: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not address the condition described here.
Question 923
A global WAN telemetry system publishes a complete 10,000-interface snapshot every 100 ms although the target is only five-minute capacity planning. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- A controlled status change reaches the collector promptly without waiting for the next periodic poll.
- Data volumes fall while five-minute trend accuracy still meets planning requirements.
- Use supported on-change telemetry for the interface state leaf where device and model support it.
- Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture.
- Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics.
Explanation
Correct Answers
B:Data volumes fall while five-minute trend accuracy still meets planning requirements. This is the observable acceptance check for the change.
E:Increase the periodic interval and narrow the subscribed paths to the needed capacity metrics. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “A controlled status change reaches the collector promptly without waiting for the next periodic poll”, addresses a separate concern. That answer belongs to this other scenario: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It does not establish the necessary change in this case.
C:This offered choice, “Use supported on-change telemetry for the interface state leaf where device and model support it”, addresses a separate concern. That answer belongs to this other scenario: An alerting system needs immediate notice of interface administrative status changes but only polls every five minutes. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It does not establish the necessary change in this case.
Question 924
HSRP gateways remain reachable locally after their active router loses the only routed upstream uplink. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection.
- Validate tracking thresholds and the backup's independent upstream path with a controlled failure.
- Capacity-test a complete single-router failure, not only normal steady-state load.
- Uplink failure triggers the intended gateway takeover and remote application sessions recover.
- Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy.
- Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages.
Explanation
Correct Answers
A:Add supported object or route tracking so upstream reachability can influence HSRP active gateway selection. This is the corrective design for the stated topology.
B:Validate tracking thresholds and the backup's independent upstream path with a controlled failure. This applies directly to the reported network-design requirement.
D:Uplink failure triggers the intended gateway takeover and remote application sessions recover. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Capacity-test a complete single-router failure, not only normal steady-state load”, addresses a separate concern. This statement relates to a different requirement: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. It does not address the condition described here.
E:This offered choice, “Intentionally distribute primary FHRP roles across VLAN groups while preserving corresponding upstream capacity and failover policy”, addresses a separate concern. This statement relates to a different requirement: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. It does not address the condition described here.
F:This offered choice, “Both routers carry planned VLAN traffic in steady state and provide gateway redundancy during outages”, addresses a separate concern. This statement relates to a different requirement: A campus with several hundred VLANs uses one active HSRP gateway for all VLANs while another distribution router remains mostly idle. It does not address the condition described here.
Question 925
A network wants a hub-and-spoke topology for finance traffic but allows any-to-any policy for all service VPNs. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Apply topology or centralized control policy at the appropriate site/VPN scope.
- Surviving key servers provide policies and secure data traffic remains operational through maintenance.
- Define a backup-class QoS and application admission design appropriate to smaller available bandwidth.
- Finance sites reach only designated hubs while approved other segments preserve their intended paths.
- Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
Explanation
Correct Answers
A:Apply topology or centralized control policy at the appropriate site/VPN scope. This applies directly to the reported network-design requirement.
D:Finance sites reach only designated hubs while approved other segments preserve their intended paths. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Surviving key servers provide policies and secure data traffic remains operational through maintenance”, addresses a separate concern. That answer belongs to this other scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. It does not establish the necessary change in this case.
E:This offered choice, “Design redundant supported key servers and registration/rekey recovery for the group encryption domain”, addresses a separate concern. That answer belongs to this other scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not establish the necessary change in this case.
Question 926
A hospital campus uses policy-based routing shortcuts for every building but ordinary routing still lacks resilient interbuilding reachability. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Map exceptional applications and their return paths before removing legacy rules.
- Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
- Regular traffic retains resilient routed reachability without depending on per-building PBR hacks.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Explanation
Correct Answers
A:Map exceptional applications and their return paths before removing legacy rules. This applies directly to the reported network-design requirement.
B:Build a coherent Layer 3 topology first, then use narrow policy routing only for genuine exceptions. This is the corrective design for the stated topology.
E:Regular traffic retains resilient routed reachability without depending on per-building PBR hacks. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
D:This offered choice, “Rogue DHCP offers from access ports are dropped while authorized client leases succeed”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
F:This offered choice, “Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
Question 927
A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- All ABRs maintain backbone reachability and interarea routes converge through the intended topology.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Use controlled redistribution policy with route tags and a defined protocol boundary between OSPF and IS-IS.
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
Explanation
Correct Answers
A:All ABRs maintain backbone reachability and interarea routes converge through the intended topology. This is the observable acceptance check for the change.
C:Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Local access failures generate bounded LSDB changes without disrupting unrelated branches”, addresses a separate concern. That answer belongs to this other scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: IS-IS adjacencies form between distribution switches, but all internal prefixes are redistributed from OSPF without loop prevention. It does not establish the necessary change in this case.
E:This offered choice, “Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope”, addresses a separate concern. That answer belongs to this other scenario: An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. It does not establish the necessary change in this case.
Question 928
A 1-Gbps campus uplink feeds a 100-Mbps WAN access circuit and packets drop in unpredictable bursts at the provider policer. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Burst traffic drains within a controlled rate envelope with fewer avoidable losses.
- Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior.
- Measured traffic conforms to the allowed profile and application packet loss decreases under load.
- Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract.
- Check allowable latency and buffer sizes so shaping does not create unbounded queue delay.
- Account for encapsulation overhead and QoS scheduler interaction when calculating the shaper rate.
Explanation
Correct Answers
C:Measured traffic conforms to the allowed profile and application packet loss decreases under load. This is the observable acceptance check for the change.
D:Apply appropriate egress shaping near the WAN handoff to control offered rate and bursts within the contract. This is the corrective design for the stated topology.
F:Account for encapsulation overhead and QoS scheduler interaction when calculating the shaper rate. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Burst traffic drains within a controlled rate envelope with fewer avoidable losses”, addresses a separate concern. This statement relates to a different requirement: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. It does not address the condition described here.
B:This offered choice, “Replace or complement the policer with traffic shaping when buffering and smoothing are the intended behavior”, addresses a separate concern. This statement relates to a different requirement: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. It does not address the condition described here.
E:This offered choice, “Check allowable latency and buffer sizes so shaping does not create unbounded queue delay”, addresses a separate concern. This statement relates to a different requirement: A design asks to smooth backup traffic to a slow WAN circuit but deploys a policer that simply drops excess packets. It does not address the condition described here.
Question 929
A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Only authorized multicast receivers on selected sites receive the required production feed.
- Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN.
- Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled.
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
Explanation
Correct Answers
A:Only authorized multicast receivers on selected sites receive the required production feed. This is the observable acceptance check for the change.
B:Select supported multicast design and replication behavior for the deployed SD-WAN platform and service VPN. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled”, addresses a separate concern. That answer belongs to this other scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It does not establish the necessary change in this case.
D:This offered choice, “Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required”, addresses a separate concern. That answer belongs to this other scenario: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It does not establish the necessary change in this case.
E:This offered choice, “Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path”, addresses a separate concern. That answer belongs to this other scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not establish the necessary change in this case.
Question 930
In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
- Verify underlay IGP and fabric VRF configuration as separate acceptance tests.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
Explanation
Correct Answers
A:Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks. This is the corrective design for the stated topology.
C:Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN. This is the observable acceptance check for the change.
E:Verify underlay IGP and fabric VRF configuration as separate acceptance tests. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames”, addresses a separate concern. This statement relates to a different requirement: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not address the condition described here.
D:This offered choice, “Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes”, addresses a separate concern. This statement relates to a different requirement: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not address the condition described here.
F:This offered choice, “Test the smallest interswitch path and supported MTU settings before fabric activation”, addresses a separate concern. This statement relates to a different requirement: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
