100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 950
An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Target PCs wake under a controlled off-hours test without exposing unnecessary broadcast reachability.
- The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
- Reclassify the specific supported bridge-facing port and retain edge protection elsewhere.
- Validate cabling and spanning-tree domain boundaries before exempting any port.
- Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted.
Explanation
Correct Answers
B:The authorized bridge participates without disabling BPDU protection for unrelated endpoint ports. This is the observable acceptance check for the change.
D:Reclassify the specific supported bridge-facing port and retain edge protection elsewhere. This is the corrective design for the stated topology.
E:Validate cabling and spanning-tree domain boundaries before exempting any port. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This statement relates to a different requirement: A switch must remotely wake office PCs overnight, but the access port powers down and the design assumes Wake-on-LAN works regardless of power state. It does not address the condition described here.
C:This offered choice, “Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
F:This offered choice, “Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted”, addresses a separate concern. This statement relates to a different requirement: A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. It does not address the condition described here.
Question 951
A company wants to expose IPv6 resources to a partner with IPv4-only routing and assumes dual stack at headquarters solves the partner boundary. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary.
- Activate and filter the correct IPv6 unicast MP-BGP address family on the intended peers.
- Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion.
- Observed inbound paths trend toward ISP B from representative external monitors without assuming universal control.
- Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path.
Explanation
Correct Answers
A:Design an explicit IPv4/IPv6 translation or application-layer gateway at the interconnection boundary. This applies directly to the reported network-design requirement.
E:Authorized IPv4 partner sessions reach the selected IPv6 service through the documented translation path. This is the observable acceptance check for the change.
Incorrect Answers
B:That answer belongs to this other scenario: A dual-stack enterprise BGP peer exchanges IPv4 NLRI but no IPv6 routes despite IPv6 addressing on the transport. It does not establish the necessary change in this case.
C:This offered choice, “Assess supported inbound traffic engineering such as scoped AS-path prepending or provider communities, recognizing remote-AS policy discretion”, addresses a separate concern. That answer belongs to this other scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It does not establish the necessary change in this case.
D:This offered choice, “Observed inbound paths trend toward ISP B from representative external monitors without assuming universal control”, addresses a separate concern. That answer belongs to this other scenario: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It does not establish the necessary change in this case.
Question 952
A Python network tool must update structured interface configuration through web-style requests but the engineer chooses CLI scraping instead of a supported API. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture.
- Calculate device and collector resource impact for chosen telemetry frequency.
- Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations.
- Confirm HTTP authentication, model paths, ETags and expected status-code handling.
- Collector time series captures the brief spikes with timestamped relevant YANG measurements.
- An approved RESTCONF PATCH changes only the intended interface fields and a GET verifies effective state.
Explanation
Correct Answers
C:Evaluate RESTCONF with its YANG-modeled REST resources and authorized HTTP operations. This is the corrective design for the stated topology.
D:Confirm HTTP authentication, model paths, ETags and expected status-code handling. This applies directly to the reported network-design requirement.
F:An approved RESTCONF PATCH changes only the intended interface fields and a GET verifies effective state. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Use appropriately sampled or on-change model-driven telemetry for the monitored signals, with a scalable receiver architecture”, addresses a separate concern. This statement relates to a different requirement: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It does not address the condition described here.
B:This offered choice, “Calculate device and collector resource impact for chosen telemetry frequency”, addresses a separate concern. This statement relates to a different requirement: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It does not address the condition described here.
E:This offered choice, “Collector time series captures the brief spikes with timestamped relevant YANG measurements”, addresses a separate concern. This statement relates to a different requirement: An NOC polls every router with SNMP once every ten minutes and misses 30-second interface utilization spikes. It does not address the condition described here.
Question 953
Several PIM-SM sites use a single RP placed across a high-latency WAN and suffer slow source registration after provider reconvergence. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Standardize classification and remarking policy across all controlled network trust boundaries.
- Local receiver joins and new-source registrations recover within target SLA during WAN failure.
- A WAN outage still produces actionable diagnostics and authorized operator access.
- Provide independent telemetry or out-of-band access appropriate to site criticality and budget.
- Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency.
Explanation
Correct Answers
B:Local receiver joins and new-source registrations recover within target SLA during WAN failure. This is the observable acceptance check for the change.
E:Review RP placement and supported redundancy to reduce cross-WAN control-plane dependency. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: Two sites use different DSCP mappings for the same video stream and one class is downgraded at the carrier boundary. It does not establish the necessary change in this case.
C:This offered choice, “A WAN outage still produces actionable diagnostics and authorized operator access”, addresses a separate concern. That answer belongs to this other scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not establish the necessary change in this case.
D:This offered choice, “Provide independent telemetry or out-of-band access appropriate to site criticality and budget”, addresses a separate concern. That answer belongs to this other scenario: Network management of a branch uses a VPN over its sole primary WAN, and the organization reports no way to diagnose a provider outage. It does not establish the necessary change in this case.
Question 954
A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- A controlled failure of either carrier access route leaves required service operational on the independent path.
- Obtain documented path diversity evidence rather than relying on separate provider names.
- Design controlled interprovider VRF routing and CE route policy with explicit security and resiliency boundaries.
- Require physical route and carrier diversity, including demarcation and access-path audits.
- Validate underlay next hops and NAT traversal on each WAN interface independently.
- The edge establishes intended tunnels over both transports and applications use their approved paths.
Explanation
Correct Answers
A:A controlled failure of either carrier access route leaves required service operational on the independent path. This is the observable acceptance check for the change.
B:Obtain documented path diversity evidence rather than relying on separate provider names. This applies directly to the reported network-design requirement.
D:Require physical route and carrier diversity, including demarcation and access-path audits. This is the corrective design for the stated topology.
Incorrect Answers
C:This statement relates to a different requirement: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It does not address the condition described here.
E:This offered choice, “Validate underlay next hops and NAT traversal on each WAN interface independently”, addresses a separate concern. This statement relates to a different requirement: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not address the condition described here.
F:This offered choice, “The edge establishes intended tunnels over both transports and applications use their approved paths”, addresses a separate concern. This statement relates to a different requirement: A small branch must use both Internet and private MPLS, and engineers assume the two underlays cannot coexist on one SD-WAN edge. It does not address the condition described here.
Question 955
Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Use BPDU Guard on approved edge ports and root-protection policy where appropriate for uplinks.
- A moved endpoint retains its intended policy and access to only approved destinations.
- Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking.
- Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration.
- Clients retain gateway reachability after either distribution switch fails.
Explanation
Correct Answers
B:A moved endpoint retains its intended policy and access to only approved destinations. This is the observable acceptance check for the change.
D:Design endpoint identity and SGT policy consistently across fabric edges with appropriate authentication integration. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: An attacker plugs an unmanaged switch into a lobby edge port and advertises superior STP BPDUs, changing the root topology. It does not establish the necessary change in this case.
C:This offered choice, “Design an appropriate first-hop redundancy protocol with a shared virtual gateway and verified uplink tracking”, addresses a separate concern. That answer belongs to this other scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not establish the necessary change in this case.
E:This offered choice, “Clients retain gateway reachability after either distribution switch fails”, addresses a separate concern. That answer belongs to this other scenario: A building has two independent distribution switches but hosts use the physical IP of one switch as their default gateway. It does not establish the necessary change in this case.
Question 956
An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Test route withdrawal and actual traffic forwarding, not just neighbor state.
- IPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks.
- Failure of the primary underlay forces traffic to a tested eligible secondary path within the service objective.
- Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings.
- Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed.
- Confirm tunnel endpoints, encryption requirements and path MTU before production.
Explanation
Correct Answers
B:IPv6 packets traverse the IPv4-only transit without unintended address-family policy leaks. This is the observable acceptance check for the change.
E:Evaluate a managed IPv6-over-IPv4 tunnel overlay with endpoints, MTU and failure behavior explicitly designed. This is the corrective design for the stated topology.
F:Confirm tunnel endpoints, encryption requirements and path MTU before production. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “Test route withdrawal and actual traffic forwarding, not just neighbor state”, addresses a separate concern. This statement relates to a different requirement: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It does not address the condition described here.
C:This offered choice, “Failure of the primary underlay forces traffic to a tested eligible secondary path within the service objective”, addresses a separate concern. This statement relates to a different requirement: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It does not address the condition described here.
D:This offered choice, “Pair next-hop reachability and supported BFD or track-based detection with appropriate BGP convergence settings”, addresses a separate concern. This statement relates to a different requirement: A BGP customer has two provider uplinks and wants automatic loss-of-transport detection when the BGP session remains Established over a stale recursive path. It does not address the condition described here.
Question 957
A campus carries multicast across dual uplinks and incorrectly assumes that equal-cost unicast routes guarantee both incoming multicast paths are valid. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Intended receivers across the routed boundary receive the source stream.
- Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling.
- Verify the designated RPF path used for each multicast source and align routed topology as needed.
- Validate reconvergence of multicast RPF and join/prune state after unicast routing changes.
- Legitimate multicast traffic arrives on the expected upstream interface without duplicates.
Explanation
Correct Answers
C:Verify the designated RPF path used for each multicast source and align routed topology as needed. This applies directly to the reported network-design requirement.
E:Legitimate multicast traffic arrives on the expected upstream interface without duplicates. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Intended receivers across the routed boundary receive the source stream”, addresses a separate concern. That answer belongs to this other scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not establish the necessary change in this case.
B:This offered choice, “Establish supported PIM routing with unicast RPF reachability and correct receiver membership signaling”, addresses a separate concern. That answer belongs to this other scenario: A source sends multicast through one router but users join from another site and no multicast routing is configured between them. It does not establish the necessary change in this case.
D:This offered choice, “Validate reconvergence of multicast RPF and join/prune state after unicast routing changes”, addresses a separate concern. That answer belongs to this other scenario: The RPF interface changes after a unicast route failover, but the multicast router retains stale upstream join state. It does not establish the necessary change in this case.
Question 958
Two site-to-site IPsec gateways show phase-one success but application traffic fails because their protected-subnet selectors differ. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes.
- Check overlapping subnets and security policy at both ends before broadening selectors.
- Child SAs establish for the matching traffic selectors and permitted applications pass.
- Measure path MTU over primary and backup carriers before setting MSS limits.
- Large application sessions succeed with correct effective packet sizing over each approved transport.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
Explanation
Correct Answers
A:Align IPsec proxy IDs or traffic selectors and routing across the tunnel to the approved prefixes. This is the corrective design for the stated topology.
B:Check overlapping subnets and security policy at both ends before broadening selectors. This applies directly to the reported network-design requirement.
C:Child SAs establish for the matching traffic selectors and permitted applications pass. This is the observable acceptance check for the change.
Incorrect Answers
D:This offered choice, “Measure path MTU over primary and backup carriers before setting MSS limits”, addresses a separate concern. This statement relates to a different requirement: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not address the condition described here.
E:This offered choice, “Large application sessions succeed with correct effective packet sizing over each approved transport”, addresses a separate concern. This statement relates to a different requirement: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not address the condition described here.
F:This offered choice, “Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path”, addresses a separate concern. This statement relates to a different requirement: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not address the condition described here.
Question 959
A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Permitted uplinks forward under normal operation and converge cleanly on individual link loss.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
- Choose a validated loop-free logical bundle or routed-access topology if active-active use is required.
- Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative.
- Clients discover approved printers across subnets without carrying all broadcasts between buildings.
Explanation
Correct Answers
D:Keep local VLAN boundaries and provide a scoped supported discovery relay or service registration alternative. This applies directly to the reported network-design requirement.
E:Clients discover approved printers across subnets without carrying all broadcasts between buildings. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Permitted uplinks forward under normal operation and converge cleanly on individual link loss”, addresses a separate concern. That answer belongs to this other scenario: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It does not establish the necessary change in this case.
B:This offered choice, “Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer”, addresses a separate concern. That answer belongs to this other scenario: A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. It does not establish the necessary change in this case.
C:This offered choice, “Choose a validated loop-free logical bundle or routed-access topology if active-active use is required”, addresses a separate concern. That answer belongs to this other scenario: Multiple access switches connect to one distribution block through independent Layer 2 uplinks with a blocked redundant path. It does not establish the necessary change in this case.
Question 960
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answers
A:Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation. This is the corrective design for the stated topology.
B:Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements. This applies directly to the reported network-design requirement.
E:All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. This statement relates to a different requirement: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not address the condition described here.
D:This offered choice, “Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch”, addresses a separate concern. This statement relates to a different requirement: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not address the condition described here.
F:This offered choice, “Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites”, addresses a separate concern. This statement relates to a different requirement: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
