100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 960
A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation.
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
- Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch.
- All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits.
- Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites.
Explanation
Correct Answers
A:Subdivide the /48 hierarchically by branch and VLAN, with unique /64s and aggregate boundaries that fit the delegation. This is the corrective design for the stated topology.
B:Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements. This applies directly to the reported network-design requirement.
E:All advertised LAN /64s are distinct and can be summarized within the delegated /48 where topology permits. This is the observable acceptance check for the change.
Incorrect Answers
C:This offered choice, “Allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation”, addresses a separate concern. This statement relates to a different requirement: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not address the condition described here.
D:This offered choice, “Each site advertises unique prefixes and the regional summarization boundary routes traffic to the correct branch”, addresses a separate concern. This statement relates to a different requirement: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not address the condition described here.
F:This offered choice, “Inventory existing static and DHCP scopes before assigning addresses; coordinate migration of the affected sites”, addresses a separate concern. This statement relates to a different requirement: A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. It does not address the condition described here.
Question 961
A routed-access campus needs equal-cost forwarding to two distribution routers while keeping each VLAN local to one wiring closet. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Provide independent power infrastructure for each redundant network node and validate dual-path resilience.
- Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites.
- Both routed uplinks forward to the rest of campus and a link failure reroutes traffic without a campus STP event.
- Approved intersite traffic carries the expected segmentation context without undesired leakage.
- Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer.
Explanation
Correct Answers
C:Both routed uplinks forward to the rest of campus and a link failure reroutes traffic without a campus STP event. This is the observable acceptance check for the change.
E:Build point-to-point routed access uplinks and use ECMP-capable IGP convergence at the access layer. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: Two campus distribution routers each have a single power feed from the same rack PDU, yet the architecture counts them as separate fault domains. It does not establish the necessary change in this case.
B:This offered choice, “Evaluate a supported SDA transit that preserves virtual network and SGT policy semantics between sites”, addresses a separate concern. That answer belongs to this other scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not establish the necessary change in this case.
D:This offered choice, “Approved intersite traffic carries the expected segmentation context without undesired leakage”, addresses a separate concern. That answer belongs to this other scenario: An organization needs consistent segmentation across two SD-Access fabric sites connected by a routed MPLS service. It does not establish the necessary change in this case.
Question 962
A retail chain needs many spokes to make dynamic spoke-to-spoke tunnels without permanent full-mesh configuration. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Evaluate a DMVPN hub/spoke design using NHRP registration and supported dynamic shortcut behavior.
- Authorized branch prefixes appear within the appropriate VPN and survive a PE failure as contracted.
- Add separate encryption where the threat model requires it and verify provider SLA.
- Approved spoke-to-spoke traffic forms an appropriate direct overlay path after registration.
- Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy.
- Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security.
Explanation
Correct Answers
A:Evaluate a DMVPN hub/spoke design using NHRP registration and supported dynamic shortcut behavior. This is the corrective design for the stated topology.
D:Approved spoke-to-spoke traffic forms an appropriate direct overlay path after registration. This is the observable acceptance check for the change.
F:Confirm NHRP authentication, routing protocol compatibility and suitable tunnel security. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Authorized branch prefixes appear within the appropriate VPN and survive a PE failure as contracted”, addresses a separate concern. This statement relates to a different requirement: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. It does not address the condition described here.
C:This offered choice, “Add separate encryption where the threat model requires it and verify provider SLA”, addresses a separate concern. This statement relates to a different requirement: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. It does not address the condition described here.
E:This offered choice, “Select MPLS L3VPN service with CE-PE routing, per-customer VRFs and explicit route policy”, addresses a separate concern. This statement relates to a different requirement: A regional healthcare group wants routed site separation within a provider-managed private WAN without building its own full mesh of tunnels. It does not address the condition described here.
Question 963
An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Police untrusted guest ingress traffic to an appropriate rate and violation action at the policy boundary.
- All essential classes receive their planned treatment without violating actual egress capacity.
- Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints.
- Excess guest bursts are contained while voice packet-delay variation remains acceptable.
- Engineer a policer with an appropriate burst tolerance and separate real-time queue protection.
Explanation
Correct Answers
D:Excess guest bursts are contained while voice packet-delay variation remains acceptable. This is the observable acceptance check for the change.
E:Engineer a policer with an appropriate burst tolerance and separate real-time queue protection. This applies directly to the reported network-design requirement.
Incorrect Answers
A:That answer belongs to this other scenario: A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. It does not establish the necessary change in this case.
B:This offered choice, “All essential classes receive their planned treatment without violating actual egress capacity”, addresses a separate concern. That answer belongs to this other scenario: A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. It does not establish the necessary change in this case.
C:This offered choice, “Create feasible bandwidth allocations and an explicit priority bandwidth budget that sums within supported scheduler constraints”, addresses a separate concern. That answer belongs to this other scenario: A switch QoS scheduler guarantees 30% to backup traffic and 80% to voice under full congestion, exceeding possible link capacity. It does not establish the necessary change in this case.
Question 964
A large enterprise wants to contain detailed IS-IS prefixes within buildings while preserving intercampus reachability. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Use a hierarchical IS-IS L1/L2 design and summarization at supported area boundaries where it fits topology.
- Use local preference or another AS-wide BGP policy rather than relying on locally significant weight.
- Building-specific churn stays within the intended area while intercampus summaries remain available.
- Confirm summary ownership and any discontiguous prefixes to avoid unwanted blackholes.
- Reserve a contiguous per-site allocation and validate all router advertisements during cutover.
- Observed inbound paths trend toward ISP B from representative external monitors without assuming universal control.
Explanation
Correct Answers
A:Use a hierarchical IS-IS L1/L2 design and summarization at supported area boundaries where it fits topology. This is the corrective design for the stated topology.
C:Building-specific churn stays within the intended area while intercampus summaries remain available. This is the observable acceptance check for the change.
D:Confirm summary ownership and any discontiguous prefixes to avoid unwanted blackholes. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This statement relates to a different requirement: A BGP operator attempts to influence routes within one AS by changing the weight attribute only on one edge router. It does not address the condition described here.
E:This offered choice, “Reserve a contiguous per-site allocation and validate all router advertisements during cutover”, addresses a separate concern. This statement relates to a different requirement: A campus plans IPv6 addressing with one /64 shared between two routed VLAN interfaces in different buildings. It does not address the condition described here.
F:This offered choice, “Observed inbound paths trend toward ISP B from representative external monitors without assuming universal control”, addresses a separate concern. This statement relates to a different requirement: A company wants most return traffic for its public prefix to enter ISP B rather than ISP A. It does not address the condition described here.
Question 965
A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing.
- Use an appropriate Cisco native YANG model for supported platform-specific configuration.
- Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership.
- Schema registry entries identify the correct module namespace and revisions for each controller operation.
- The controller successfully reads and writes only the supported wireless policy nodes on target devices.
Explanation
Correct Answers
B:Use an appropriate Cisco native YANG model for supported platform-specific configuration. This applies directly to the reported network-design requirement.
E:The controller successfully reads and writes only the supported wireless policy nodes on target devices. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Evaluate a dedicated cloud interconnect or partner/private WAN option with diverse regional termination and routing”, addresses a separate concern. That answer belongs to this other scenario: A company needs private predictable cloud connectivity to two regions but its design considers only commodity internet VPNs. It does not establish the necessary change in this case.
C:This offered choice, “Distinguish IETF standards-track models from OpenConfig community models and vendor-native schema ownership”, addresses a separate concern. That answer belongs to this other scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It does not establish the necessary change in this case.
D:This offered choice, “Schema registry entries identify the correct module namespace and revisions for each controller operation”, addresses a separate concern. That answer belongs to this other scenario: A standards group needs an interoperable interface model but mistakenly calls every IETF YANG module an OpenConfig model. It does not establish the necessary change in this case.
Question 966
A site cutover retains a withdrawn /24 under an unchanged /20 campus summary and traffic follows an obsolete transit path. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Probes to live destinations follow correct routes while the decommissioned /24 is no longer misdirected.
- Use link utilization and application SLA data before tuning routing metrics.
- Update summary ownership and ensure discarded or absent specifics cannot mask the retired destination.
- Normal flow distribution avoids congesting the slow backhaul and failover still reaches the destination.
- Align advertised costs and path policy with available bandwidth and acceptable backup behavior.
- Audit the specific-prefix RIB/FIB at source and destination before moving the aggregate.
Explanation
Correct Answers
A:Probes to live destinations follow correct routes while the decommissioned /24 is no longer misdirected. This is the observable acceptance check for the change.
C:Update summary ownership and ensure discarded or absent specifics cannot mask the retired destination. This is the corrective design for the stated topology.
F:Audit the specific-prefix RIB/FIB at source and destination before moving the aggregate. This applies directly to the reported network-design requirement.
Incorrect Answers
B:This offered choice, “Use link utilization and application SLA data before tuning routing metrics”, addresses a separate concern. This statement relates to a different requirement: A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. It does not address the condition described here.
D:This offered choice, “Normal flow distribution avoids congesting the slow backhaul and failover still reaches the destination”, addresses a separate concern. This statement relates to a different requirement: A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. It does not address the condition described here.
E:This offered choice, “Align advertised costs and path policy with available bandwidth and acceptable backup behavior”, addresses a separate concern. This statement relates to a different requirement: A distribution pair advertises the same summary at two locations, but one has a 100-Mbps backhaul and receives half of campus traffic. It does not address the condition described here.
Question 967
A data-center team assigns the same loopback IPv4 address to two route reflectors for convenience but also uses it as unique BGP router identifiers. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible.
- Both reflectors establish independent sessions and logs identify each peer without duplicate router IDs.
- Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks.
- Use a legitimately allocated private or global prefix at the remote site and reserve IPv4 link-local for local-only communication.
- Give each route reflector a stable unique loopback/router ID and advertise reachability through the IGP.
Explanation
Correct Answers
B:Both reflectors establish independent sessions and logs identify each peer without duplicate router IDs. This is the observable acceptance check for the change.
E:Give each route reflector a stable unique loopback/router ID and advertise reachability through the IGP. This applies directly to the reported network-design requirement.
Incorrect Answers
A:This offered choice, “The optimal successor forwards normally and eligible backup takes over without a network-wide query where feasible”, addresses a separate concern. That answer belongs to this other scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It does not establish the necessary change in this case.
C:This offered choice, “Plan the EIGRP successor and feasible-successor relationship using composite metric and feasibility checks”, addresses a separate concern. That answer belongs to this other scenario: A router receives two EIGRP routes for a prefix with different metrics and the design team wants deterministic failover. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: A remote office assigns clients addresses from 169.254.0.0/16 and expects them to be reachable through a routed WAN. It does not establish the necessary change in this case.
Question 968
A guest wireless SSID creates burst traffic exceeding its contracted share and disrupts campus applications. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Guest over-limit traffic is dropped or remarked as specified while protected applications maintain quality.
- Police untrusted guest ingress traffic to an appropriate rate and violation action at the policy boundary.
- Engineer a policer with an appropriate burst tolerance and separate real-time queue protection.
- Select policing rate and burst parameters using representative traffic rather than averages alone.
- Measure token-bucket behavior and provider burst tolerance before tightening thresholds.
- Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure.
Explanation
Correct Answers
A:Guest over-limit traffic is dropped or remarked as specified while protected applications maintain quality. This is the observable acceptance check for the change.
B:Police untrusted guest ingress traffic to an appropriate rate and violation action at the policy boundary. This is the corrective design for the stated topology.
D:Select policing rate and burst parameters using representative traffic rather than averages alone. This applies directly to the reported network-design requirement.
Incorrect Answers
C:This offered choice, “Engineer a policer with an appropriate burst tolerance and separate real-time queue protection”, addresses a separate concern. This statement relates to a different requirement: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It does not address the condition described here.
E:This offered choice, “Measure token-bucket behavior and provider burst tolerance before tightening thresholds”, addresses a separate concern. This statement relates to a different requirement: An enterprise edge allows a contracted 50-Mbps guest rate but users report voice degradation during microbursts despite the average staying under 50 Mbps. It does not address the condition described here.
F:This offered choice, “Unit administrators can reach authorized nodes but are denied management of unrelated infrastructure”, addresses a separate concern. This statement relates to a different requirement: Two business units share one management VLAN with unrestricted access to each other's routers. It does not address the condition described here.
Question 969
An enterprise replaces a point-to-point GRE tunnel with raw IPsec ESP and expects dynamic multicast routing hellos to work unchanged. Select TWO statements that together define the best corrective design and its acceptance evidence. (Choose TWO.)
- Only authorized multicast receivers on selected sites receive the required production feed.
- Select a tunnel mechanism or supported IPsec profile that carries required multicast/routing traffic.
- Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path.
- Use a provider Layer 2 service with customer-controlled Layer 3 adjacencies and monitoring.
- Routed adjacency and encapsulated application flows operate through the secure tunnel.
Explanation
Correct Answers
B:Select a tunnel mechanism or supported IPsec profile that carries required multicast/routing traffic. This applies directly to the reported network-design requirement.
E:Routed adjacency and encapsulated application flows operate through the secure tunnel. This is the observable acceptance check for the change.
Incorrect Answers
A:This offered choice, “Only authorized multicast receivers on selected sites receive the required production feed”, addresses a separate concern. That answer belongs to this other scenario: A manufacturing WAN requires multicast distribution but the SD-WAN overlay has only validated unicast OMP reachability. It does not establish the necessary change in this case.
C:This offered choice, “Plan underlay/overlay MTU and MSS handling for encapsulation overhead across the WAN path”, addresses a separate concern. That answer belongs to this other scenario: A branch uses IPsec overlay on broadband with 1400-byte effective MTU, but an application sends 1500-byte DF-set packets and stalls. It does not establish the necessary change in this case.
D:That answer belongs to this other scenario: A financial organization leases a transparent point-to-point Ethernet service but requires independent routing at each site. It does not establish the necessary change in this case.
Question 970
A multicampus network has two equal-cost paths but the design assumes packets always alternate evenly across every individual packet. Choose THREE statements that form the design action, direct verification, and deployment safeguard. (Choose THREE.)
- Validate hash entropy and elephant-flow effects before sizing links.
- Representative flows distribute across eligible next hops while a single ordered flow remains stable.
- Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Intercampus traffic follows authorized shortest feasible paths rather than unwanted data-center detours.
- Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance.
Explanation
Correct Answers
A:Validate hash entropy and elephant-flow effects before sizing links. This applies directly to the reported network-design requirement.
B:Representative flows distribute across eligible next hops while a single ordered flow remains stable. This is the observable acceptance check for the change.
F:Plan ECMP based on actual per-flow hashing and application sensitivity rather than guaranteed per-packet load balance. This is the corrective design for the stated topology.
Incorrect Answers
C:This offered choice, “Evaluate supported multisite design with MTU, latency, encapsulation, and control-plane reachability constraints”, addresses a separate concern. This statement relates to a different requirement: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not address the condition described here.
D:This offered choice, “Test the full supported transit profile rather than relying on basic IP ping success”, addresses a separate concern. This statement relates to a different requirement: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It does not address the condition described here.
E:This statement relates to a different requirement: A branch aggregation point has both IS-IS and OSPF neighbors with multiple equal-cost exits; traffic unexpectedly hairpins through a data center. It does not address the condition described here.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
