100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 940
An iBGP route reflector sees several candidate routes to the same destination but advertises only its best path to clients. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Validate advertised stub route classes and redundancy if the branch has multiple uplinks.
- Confirm path diversity at reflectors and ensure no unintended loops or excess table growth.
- Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs.
- Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms.
- Clients retain enough independent eligible paths to support the agreed failover policy.
- Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible.
Explanation
Correct Answers
B:Confirm path diversity at reflectors and ensure no unintended loops or excess table growth. This applies directly to the reported network-design requirement.
D:Evaluate whether additional-paths or path diversity is required and supported by the topology and platforms. This is the corrective design for the stated topology.
E:Clients retain enough independent eligible paths to support the agreed failover policy. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Validate advertised stub route classes and redundancy if the branch has multiple uplinks”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
C:This offered choice, “Configure an appropriate EIGRP stub design on the branch while allowing its locally connected routes to reach the hubs”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
F:This offered choice, “Hubs avoid querying through the branch as a transit path and branch-local prefixes remain visible”, addresses a separate concern. This statement relates to a different requirement: A branch EIGRP router advertises remote routes back into its hub and occasionally becomes a transit path between hubs. It does not address the condition described here.
Question 941
A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Approved site prefixes propagate across the interconnect while unrelated customer VPN routes remain isolated.
- Require physical route and carrier diversity, including demarcation and access-path audits.
- Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries.
- A controlled failure of either carrier access route leaves required service operational on the independent path.
- Design redundant supported key servers and registration/rekey recovery for the group encryption domain.
Explanation
Correct Answers
A:Approved site prefixes propagate across the interconnect while unrelated customer VPN routes remain isolated. This is the observable acceptance check for the change.
C:Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Require physical route and carrier diversity, including demarcation and access-path audits”, addresses a separate concern. That answer belongs to this other scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It does not establish the necessary change in this case.
D:This offered choice, “A controlled failure of either carrier access route leaves required service operational on the independent path”, addresses a separate concern. That answer belongs to this other scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It does not establish the necessary change in this case.
E:This offered choice, “Design redundant supported key servers and registration/rekey recovery for the group encryption domain”, addresses a separate concern. That answer belongs to this other scenario: GET VPN group members can route between branches but new devices cannot obtain group security policy after a key-server loss. It does not establish the necessary change in this case.
Question 942
Two tenants use 10.0.0.0/8 addressing and share the same campus core but require separate routing and firewall policies. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- The unintended default is absent from production campus RIBs while valid branch summaries propagate.
- Duplicate prefixes coexist in isolated tables and cross-tenant routes appear only where authorized.
- Define explicit allowed prefixes and monitored deny counters before deployment.
- Use VRF-based routing separation with explicitly controlled route leaking for shared services.
- Validate shared-services next-hop and return-path symmetry before enabling route leaking.
- Design VRF-aware border handoffs or supported segmentation-preserving transit consistent with the policy boundary.
Explanation
Correct Answers
B:Duplicate prefixes coexist in isolated tables and cross-tenant routes appear only where authorized. This is the observable acceptance check for the change.
D:Use VRF-based routing separation with explicitly controlled route leaking for shared services. This is the corrective design for the stated topology.
E:Validate shared-services next-hop and return-path symmetry before enabling route leaking. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “The unintended default is absent from production campus RIBs while valid branch summaries propagate”, addresses a separate concern. This statement relates to a different requirement: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It does not address the condition described here.
C:This offered choice, “Define explicit allowed prefixes and monitored deny counters before deployment”, addresses a separate concern. This statement relates to a different requirement: A regional core accepts all branch routes and one lab site leaks its test 0.0.0.0/0 default into the global table. It does not address the condition described here.
F:This statement relates to a different requirement: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It does not address the condition described here.
Question 943
A script writes `ietf-interfaces` fields to a platform supporting only a different module revision and receives an unknown-element error. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The device accepts the schema-valid request and exposes the expected operational result.
- Select subscription modes according to the actual leaf and device support, using periodic for counters when necessary.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Negotiate supported YANG model names/revisions and update payload paths accordingly.
- The receiver obtains the expected measurement updates for every required signal.
Explanation
Correct Answers
A:The device accepts the schema-valid request and exposes the expected operational result. This is the observable acceptance check for the change.
D:Negotiate supported YANG model names/revisions and update payload paths accordingly. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Select subscription modes according to the actual leaf and device support, using periodic for counters when necessary”, addresses a separate concern. That answer belongs to this other scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not establish the necessary change in this case.
C:This offered choice, “Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership”, addresses a separate concern. That answer belongs to this other scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It does not establish the necessary change in this case.
E:This offered choice, “The receiver obtains the expected measurement updates for every required signal”, addresses a separate concern. That answer belongs to this other scenario: A routing telemetry client assumes every operational counter supports on-change updates and receives no updates on one platform. It does not establish the necessary change in this case.
Question 944
A campus advertises a /18 summary into the WAN but has no route for one constituent /24 after a building is decommissioned. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Remove or constrain the summary when it attracts traffic to networks not reachable through the campus boundary.
- Compare active specifics with the aggregate and identify valid exception routes before withdrawal.
- Peer-received advertisements exclude the protected prefix while approved public routes remain.
- Branch routers no longer send packets for the retired /24 into a blackhole created by the former summary.
- Apply a scoped outbound prefix filter that blocks private/internal routes from the external BGP adjacency.
- Verify the resulting advertised-route set from the partner-facing perspective.
Explanation
Correct Answers
A:Remove or constrain the summary when it attracts traffic to networks not reachable through the campus boundary. This is the corrective design for the stated topology.
B:Compare active specifics with the aggregate and identify valid exception routes before withdrawal. This applies directly to the reported network-design requirement.
D:Branch routers no longer send packets for the retired /24 into a blackhole created by the former summary. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Peer-received advertisements exclude the protected prefix while approved public routes remain”, addresses a separate concern. This statement relates to a different requirement: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It does not address the condition described here.
E:This offered choice, “Apply a scoped outbound prefix filter that blocks private/internal routes from the external BGP adjacency”, addresses a separate concern. This statement relates to a different requirement: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It does not address the condition described here.
F:This offered choice, “Verify the resulting advertised-route set from the partner-facing perspective”, addresses a separate concern. This statement relates to a different requirement: A partner BGP session accidentally advertises a sensitive 10.0.0.0/8 internal route to an external ASN. It does not address the condition described here.
Question 945
A low-bandwidth remote management VPN carries huge nightly backup transfers that prevent emergency SSH access. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
- Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries.
- An emergency administrator maintains workable session latency while backup transfer runs.
- Give critical management/control traffic an appropriate protected class and regulate bulk backup load.
- Classify traffic by actual application need and reserve EF treatment for suitable expedited traffic.
Explanation
Correct Answers
C:An emergency administrator maintains workable session latency while backup transfer runs. This is the observable acceptance check for the change.
D:Give critical management/control traffic an appropriate protected class and regulate bulk backup load. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure”, addresses a separate concern. That answer belongs to this other scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It does not establish the necessary change in this case.
B:This offered choice, “Segment management-plane access by role/tenant and enforce ACLs and authentication at the boundaries”, addresses a separate concern. That answer belongs to this other scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: A campus uses DSCP EF for voice signaling, voice media, and backup traffic, causing priority queue overload. It does not establish the necessary change in this case.
Question 946
Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- The hub forwards only to reachable site prefixes or intentionally documented summary ranges.
- Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements.
- Check the AS number, K values, and authentication compatibility on both peers.
- Compare the aggregation with the live branch prefix inventory and EIGRP summary discard behavior.
- The prefix exits through the intended ASBR and remains loop-free on failover.
- Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components.
Explanation
Correct Answers
A:The hub forwards only to reachable site prefixes or intentionally documented summary ranges. This is the observable acceptance check for the change.
D:Compare the aggregation with the live branch prefix inventory and EIGRP summary discard behavior. This applies directly to the reported network-design requirement.
F:Refine the summary to reflect reachable networks and provide appropriate handling for withdrawn components. This is the corrective design for the stated topology.
Incorrect Answers
B:This offered choice, “Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements”, addresses a separate concern. This statement relates to a different requirement: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. It does not address the condition described here.
C:This statement relates to a different requirement: A regional site uses EIGRP neighbors with mismatched autonomous system numbers despite matching IP subnet and authentication. It does not address the condition described here.
E:This offered choice, “The prefix exits through the intended ASBR and remains loop-free on failover”, addresses a separate concern. This statement relates to a different requirement: An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. It does not address the condition described here.
Question 947
An SD-Access architect assumes the fabric's LISP control plane transports all user packets like a data-plane tunnel. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges.
- Plan redundant supported fabric control-plane nodes with resilient underlay reachability.
- Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding.
- A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies.
- Plan NSF graceful-restart interoperability with compatible neighbors and realistic convergence timeouts.
Explanation
Correct Answers
A:Control-plane endpoint mappings resolve and separate packet captures show VXLAN data forwarding between fabric edges. This is the observable acceptance check for the change.
C:Distinguish endpoint mapping/control distribution from VXLAN-encapsulated user-data forwarding. This applies directly to the reported network-design requirement.
Incorrect Answers
B:That answer belongs to this other scenario: A fabric control-plane node becomes unavailable and endpoint mobility updates stop at one campus site. It does not establish the necessary change in this case.
D:This offered choice, “A tested hardware or supervisor failure meets application recovery objectives without unexpected shared dependencies”, addresses a separate concern. That answer belongs to this other scenario: A virtualized distribution pair uses one logical control plane and engineers assume it offers separate failure domains like two chassis in different buildings. It does not establish the necessary change in this case.
E:That answer belongs to this other scenario: An NSF-capable router pair loses a control-plane process briefly and the design assumes all neighboring routers will preserve forwarding. It does not establish the necessary change in this case.
Question 948
An enterprise's primary WAN circuit fails but BGP route withdrawal is delayed while the underlay interface remains up. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- The branch switches to the secondary circuit within the required service recovery interval.
- Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers.
- Test partial-provider outages and hold-down behavior to prevent flapping.
- Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship.
- Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable.
- Check certificates, site IDs, controller sessions and OMP timers before changing underlay routes.
Explanation
Correct Answers
A:The branch switches to the secondary circuit within the required service recovery interval. This is the observable acceptance check for the change.
B:Use supported failure detection/track or BFD mechanisms with explicit failover policy and reasonable timers. This is the corrective design for the stated topology.
C:Test partial-provider outages and hold-down behavior to prevent flapping. This applies directly to the reported network-design requirement.
Incorrect Answers
D:This offered choice, “Distinguish orchestration, management, control-plane and data-plane roles and repair the controller/OMP relationship”, addresses a separate concern. This statement relates to a different requirement: SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. It does not address the condition described here.
E:This offered choice, “Edges establish controller sessions and exchange authorized OMP reachability while the transport remains reachable”, addresses a separate concern. This statement relates to a different requirement: SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. It does not address the condition described here.
F:This offered choice, “Check certificates, site IDs, controller sessions and OMP timers before changing underlay routes”, addresses a separate concern. This statement relates to a different requirement: SD-WAN edges register to the validator but receive no OMP route updates from the controller, and the team claims the underlay is broken. It does not address the condition described here.
Question 949
A campus has out-of-band console servers but all consoles depend on the production AAA server reachable only over the failed production network. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Provide an independently reachable out-of-band management network and approved emergency access process.
- Operators can reach device management after production routing is intentionally removed.
- Authorized emergency operators can administer devices when primary campus routing and AAA are down.
- Verify correct Reverse Path Forwarding behavior and IGP unicast route alignment for multicast sources.
- Design OOB authentication and recovery with an approved bounded fallback independent of production paths.
Explanation
Correct Answers
C:Authorized emergency operators can administer devices when primary campus routing and AAA are down. This is the observable acceptance check for the change.
E:Design OOB authentication and recovery with an approved bounded fallback independent of production paths. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Provide an independently reachable out-of-band management network and approved emergency access process”, addresses a separate concern. That answer belongs to this other scenario: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It does not establish the necessary change in this case.
B:This offered choice, “Operators can reach device management after production routing is intentionally removed”, addresses a separate concern. That answer belongs to this other scenario: A core router's production data plane fails, leaving SSH reachable only through the same failed core path. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: A multicast source is reachable through an interface other than the one receiving the packet, but the router still forwards it to all receivers. It does not establish the necessary change in this case.
Question 950
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
- Validate cabling and spanning-tree domain boundaries before exempting any port.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Explanation
Correct Answers
B:The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports. This is the observable acceptance check for the change.
D:Reclassify the specific supported bridge-facing port and retain edge protection elsewhere. This is the corrective design for the stated topology.
E:Validate cabling and spanning-tree domain boundaries before exempting any port. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This statement relates to a different requirement: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It does not address the condition described here.
C:This offered choice, “Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
F:This offered choice, “Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
