100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 930
In a planned SD-Access fabric, border nodes can reach edge loopbacks but endpoints fail because the team placed user subnets into the underlay instead of overlay VRFs. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks.
- Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames.
- Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN.
- Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes.
- Verify underlay IGP and fabric VRF configuration as separate acceptance tests.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
Explanation
Correct Answers
A:Keep underlay IP reachability independent of endpoint addressing and establish the intended overlay virtual networks. This is the corrective design for the stated topology.
C:Underlay nodes reach fabric RLOCs while user endpoints are mapped and forwarded through the correct overlay VN. This is the observable acceptance check for the change.
E:Verify underlay IGP and fabric VRF configuration as separate acceptance tests. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Size the entire routed underlay MTU for supported encapsulated payloads rather than only endpoint Ethernet frames”, addresses a separate concern. This statement relates to a different requirement: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not address the condition described here.
D:This offered choice, “Encapsulated end-to-end test packets pass between fabric edges without fragmentation blackholes”, addresses a separate concern. This statement relates to a different requirement: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not address the condition described here.
F:This offered choice, “Test the smallest interswitch path and supported MTU settings before fabric activation”, addresses a separate concern. This statement relates to a different requirement: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It does not address the condition described here.
Question 931
An OSPF deployment puts all 600 remote access switches into area 0 and floods changes to every site. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope.
- Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed.
- Restore contiguous area-0 connectivity with a supported physical or carefully justified virtual-link design.
- Local access failures generate bounded LSDB changes without disrupting unrelated branches.
- Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area.
Explanation
Correct Answers
A:Use properly bounded OSPF areas and appropriate summarization at ABRs to contain topology scope. This applies directly to the reported network-design requirement.
D:Local access failures generate bounded LSDB changes without disrupting unrelated branches. This is the observable acceptance check for the change.
Incorrect Answers
B:This offered choice, “Required external routes originate inside the NSSA and are translated into the rest of the OSPF domain as designed”, addresses a separate concern. That answer belongs to this other scenario: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It does not establish the necessary change in this case.
E:This offered choice, “Evaluate an NSSA design and associated ABR external-route translation rather than a plain stub area”, addresses a separate concern. That answer belongs to this other scenario: A remote branch uses an OSPF stub area but a design change introduces an ASBR that must redistribute external routes within it. It does not establish the necessary change in this case.
Question 932
Video and voice both use one strict-priority queue, causing voice jitter when video surges. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Voice delay stays within SLA during video bursts while other classes retain scheduled service.
- Priority queuing protects genuine voice media while backup traffic no longer occupies the strict-priority class.
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
- Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees.
- Audit markings at endpoint, access and WAN boundaries before rewriting application policies.
- Size the priority class and verify congestion behavior with realistic mixes.
Explanation
Correct Answers
A:Voice delay stays within SLA during video bursts while other classes retain scheduled service. This is the observable acceptance check for the change.
D:Separate delay-critical voice priority from video classes with appropriate bounded queuing and bandwidth guarantees. This is the corrective design for the stated topology.
F:Size the priority class and verify congestion behavior with realistic mixes. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Priority queuing protects genuine voice media while backup traffic no longer occupies the strict-priority class”, addresses a separate concern. This statement relates to a different requirement: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not address the condition described here.
C:This offered choice, “Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic”, addresses a separate concern. This statement relates to a different requirement: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not address the condition described here.
E:This offered choice, “Audit markings at endpoint, access and WAN boundaries before rewriting application policies”, addresses a separate concern. This statement relates to a different requirement: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not address the condition described here.
Question 933
A 5,000-user branch rollout wants direct SaaS breakout through local cloud on-ramp but all DNS still resolves clients to the distant headquarters proxy region. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Authorized cloud prefixes are reachable over intended private paths after one interconnect fails.
- Prefer a supported OpenConfig model for common telemetry and document device-specific augmentations where unavoidable.
- Classify the offering as IaaS and document customer responsibilities for guest OS, identities and workloads.
- Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning.
- SaaS sessions use an approved closer path while security controls and logging remain effective.
Explanation
Correct Answers
D:Coordinate cloud on-ramp routing with DNS, security and application placement to reduce unnecessary tromboning. This applies directly to the reported network-design requirement.
E:SaaS sessions use an approved closer path while security controls and logging remain effective. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Authorized cloud prefixes are reachable over intended private paths after one interconnect fails”, addresses a separate concern. That answer belongs to this other scenario: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not establish the necessary change in this case.
B:That answer belongs to this other scenario: A multivendor enterprise wants one consistent YANG representation for interface operational counters but each platform exposes vendor-specific native trees. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. It does not establish the necessary change in this case.
Question 934
A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required.
- Test provider MTU, loop prevention and circuit failover before cutover.
- Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled.
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
- Enterprise routers form intended routing neighbors over the circuit while provider internals remain hidden.
- Verify encapsulation overhead, security associations, and multicast reachability separately.
Explanation
Correct Answers
B:Test provider MTU, loop prevention and circuit failover before cutover. This applies directly to the reported network-design requirement.
D:Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring. This is the corrective design for the stated topology.
E:Enterprise routers form intended routing neighbors over the circuit while provider internals remain hidden. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Use GRE for appropriate multiprotocol encapsulation and add IPsec separately if confidentiality is required”, addresses a separate concern. This statement relates to a different requirement: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It does not address the condition described here.
C:This offered choice, “Multicast protocol control and user traffic traverse the overlay while mandated encryption tests also pass where enabled”, addresses a separate concern. This statement relates to a different requirement: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It does not address the condition described here.
F:This offered choice, “Verify encapsulation overhead, security associations, and multicast reachability separately”, addresses a separate concern. This statement relates to a different requirement: A lab requires a routed overlay carrying multicast between sites but encryption is not part of the GRE service itself. It does not address the condition described here.
Question 935
A design team treats NSR and NSF as synonyms and assumes route preservation when the only Routing Processor crashes. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
- Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles.
- Intersite overlay flows survive the engineered path and meet their measured size and latency limits.
- Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance.
- A standby control plane takes over or forwarding is preserved according to the selected capability's documented scope.
Explanation
Correct Answers
B:Differentiate NSR control-plane state replication from NSF forwarding continuity and design according to supported platform roles. This applies directly to the reported network-design requirement.
E:A standby control plane takes over or forwarding is preserved according to the selected capability's documented scope. This is the observable acceptance check for the change.
Incorrect Answers
A:That answer belongs to this other scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It does not establish the necessary change in this case.
C:That answer belongs to this other scenario: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. It does not establish the necessary change in this case.
Question 936
A branch enables IPv6 DNS records before adding IPv6 firewall rules and users bypass legacy IPv4 access controls. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- IPv6 connections to protected applications are blocked or allowed consistently with approved policy.
- Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions.
- Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records.
- Test both A and AAAA record resolution from representative client networks.
- The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client.
- Inventory application dependencies and DNS behavior before choosing the translation mechanism.
Explanation
Correct Answers
A:IPv6 connections to protected applications are blocked or allowed consistently with approved policy. This is the observable acceptance check for the change.
C:Coordinate IPv6 rollout with equivalent policy, logging, and path monitoring before publishing AAAA records. This is the corrective design for the stated topology.
D:Test both A and AAAA record resolution from representative client networks. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Evaluate a suitable NAT64/DNS64 or application-proxy boundary with supported protocol assumptions”, addresses a separate concern. This statement relates to a different requirement: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not address the condition described here.
E:This offered choice, “The IPv6 client resolves and accesses the approved IPv4 service without adopting IPv4 on the client”, addresses a separate concern. This statement relates to a different requirement: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not address the condition described here.
F:This offered choice, “Inventory application dependencies and DNS behavior before choosing the translation mechanism”, addresses a separate concern. This statement relates to a different requirement: A new IPv6-only client subnet must access a legacy IPv4-only web endpoint through an enterprise gateway. It does not address the condition described here.
Question 937
An enterprise wants to expose a multicast stream to one receiver group but the original source uses a group address conflicting with a remote application. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The receiver sends a source-specific join and obtains only the authorized stream.
- Intended receivers obtain the translated stream while unrelated multicast groups remain separate.
- Align SSM membership to include the desired (S,G) source/group relationship.
- Evaluate controlled multicast service reflection or translation with explicit source/group mappings.
- Separate management access into a restricted VRF, VPN, or protected OOB context with explicit source policy.
Explanation
Correct Answers
B:Intended receivers obtain the translated stream while unrelated multicast groups remain separate. This is the observable acceptance check for the change.
D:Evaluate controlled multicast service reflection or translation with explicit source/group mappings. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “The receiver sends a source-specific join and obtains only the authorized stream”, addresses a separate concern. That answer belongs to this other scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It does not establish the necessary change in this case.
C:This offered choice, “Align SSM membership to include the desired (S,G) source/group relationship”, addresses a separate concern. That answer belongs to this other scenario: A new multicast source uses group 232.1.1.1 but the client sends only (*,G) membership instead of a source-specific join. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It does not establish the necessary change in this case.
Question 938
A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Conduct site-specific signal and application testing rather than assuming headline cellular bandwidth.
- Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing.
- Record SLA impact and safe return criteria before enabling automatic restoration.
- The required VPN tunnels and critical services establish over cellular during a failure exercise.
- Application sessions remain stable through short intermittent primary path disturbances.
- Introduce deliberate recovery policy or dampening to prevent repeated unstable failback.
Explanation
Correct Answers
C:Record SLA impact and safe return criteria before enabling automatic restoration. This applies directly to the reported network-design requirement.
E:Application sessions remain stable through short intermittent primary path disturbances. This is the observable acceptance check for the change.
F:Introduce deliberate recovery policy or dampening to prevent repeated unstable failback. This is the corrective design for the stated topology.
Incorrect Answers
A:This offered choice, “Conduct site-specific signal and application testing rather than assuming headline cellular bandwidth”, addresses a separate concern. This statement relates to a different requirement: A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. It does not address the condition described here.
B:This offered choice, “Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing”, addresses a separate concern. This statement relates to a different requirement: A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. It does not address the condition described here.
D:This statement relates to a different requirement: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It does not address the condition described here.
Question 939
Three campus sites peer with a shared WAN hub; every site transits through the hub even for cross-campus traffic and voice suffers latency. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Site-to-site voice follows a lower-latency approved route while hub failure leaves planned alternate reachability.
- Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress.
- Explicitly control default route origination and conditional advertisements at authorized borders.
- Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border.
- Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover.
Explanation
Correct Answers
A:Site-to-site voice follows a lower-latency approved route while hub failure leaves planned alternate reachability. This is the observable acceptance check for the change.
E:Design a routed intercampus topology with appropriate direct or regional paths and deterministic failover. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Place route summarization at contiguous ownership boundaries and preserve specific exceptions needed for proper egress”, addresses a separate concern. That answer belongs to this other scenario: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. It does not establish the necessary change in this case.
C:This offered choice, “Explicitly control default route origination and conditional advertisements at authorized borders”, addresses a separate concern. That answer belongs to this other scenario: A branch router redistributes a static default to the campus IGP without approval, causing arbitrary sites to shift egress. It does not establish the necessary change in this case.
D:This offered choice, “Prefix changes within a campus no longer cause unnecessary global churn while remote packets use the proper border”, addresses a separate concern. That answer belongs to this other scenario: Branch-specific prefix updates flood every campus router; a proposed aggregate crosses two distinct WAN egress sites. It does not establish the necessary change in this case.
Question 940
An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Confirm path diversity at reflectors and ensure no unintended loops or excess table growth.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.
- Clients retain enough independent eligible paths to support the agreed failover policy.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answers
B:Confirm path diversity at reflectors and ensure no unintended loops or excess table growth. This applies directly to the reported network-design requirement.
D:Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms. This is the corrective design for the stated topology.
E:Clients retain enough independent eligible paths to support the agreed failover policy. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Validate advertised stub route classes and redundancy if the branch has multiple uplinks”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
C:This offered choice, “Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
F:This offered choice, “Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
