104 free Cisco 300-420 ENSLD practice questions from the CertStash pack of 417, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 104 free here, all 417 in the pack, and each step includes the one before it.
Get all 417 questions (US$39) · Download the first 10 as a PDF
Question 1
Which two BGP features will result in successful route exchanges between eBGP neighbors sharing the same AS number? (Choose two.)
Show answer and explanation
Correct answer: D, E. as-override; allow-as-in
When two eBGP neighbors share the same AS number, they are considered eBGP peers in a confederation-like scenario. The as-override feature allows a router to replace the peer's AS number in the AS path, enabling the route to be accepted by the eBGP neighbor that would normally reject it due to AS path loop prevention. The allow-as-in feature permits a router to accept and advertise routes that contain its own AS number in the AS path, which would normally be rejected as a loop. Together, these features enable successful route exchanges between eBGP neighbors with identical AS numbers.
Why the other options are wrong
- A. advertise-best-external only advertises the best external route to iBGP peers and does not permit same-AS eBGP adjacencies.
- B. bestpath as-path ignore disables AS path length comparison but does not address the AS loop prevention that blocks same-AS eBGP neighbors.
- C. client-to-client reflection is an iBGP feature for route reflection and does not enable eBGP adjacencies with identical AS numbers.
Question 2
A customer with an IPv4 only network topology wants to enable IPv6 connectivity while preserving the IPv4 topology services. The customer plans to migrate IPv4 services to the IPv6 topology, then decommission the IPv4 topology. Which topology supports these requirements?
Show answer and explanation
Correct answer: A. dual stack
Dual stack is the deployment model that allows both IPv4 and IPv6 to coexist on the same network infrastructure. This enables the customer to preserve existing IPv4 topology services while simultaneously introducing IPv6 connectivity. Applications and devices can gradually migrate from IPv4 to IPv6 over time, and once all services have been transitioned, the IPv4 topology can be decommissioned. This approach provides the necessary transition pathway while maintaining service continuity.
Why the other options are wrong
- B. 6VPE (IPv6 VPN Provider Edge) is used for IPv6 MPLS VPN services and does not preserve the IPv4 topology as required.
- C. 6to4 is a transition mechanism that encapsulates IPv6 in IPv4 but is not designed for long-term dual operation and service migration.
- D. NAT64 translates between IPv6 and IPv4 networks but does not preserve the existing IPv4 topology or support concurrent migration.
Question 3
A company is running BGP on a single router, which has two connections to the same ISP. Which BGP feature ensures traffic is load balanced across the two links to the ISP?
Show answer and explanation
Correct answer: B. Multipath Load Sharing
Multipath Load Sharing is the BGP feature that enables load balancing across multiple equal-cost paths. When a router has two connections to the same ISP with equivalent path metrics, this feature allows traffic to be distributed across both links rather than using a single path. This maximizes bandwidth utilization and provides redundancy by actively using both connections.
Why the other options are wrong
- A. Multihop is used for eBGP sessions that are not directly connected and does not control load balancing.
- C. Next-Hop Address Tracking monitors the reachability of next-hop addresses but does not enable multipath load balancing.
- D. AS-Path Prepending artificially lengthens the AS path to make certain routes less preferred and does not enable load balancing.
Question 4
Company A recently acquired another company. Users of the newly acquired company must be able to access a server that exists on Company A's network, both companies use overlapping IP address ranges. Which action conserves IP address space and provides access to the server?
Show answer and explanation
Correct answer: A. Use a single IP address to create overload NAT
Overload NAT (also known as PAT, Port Address Translation) uses a single IP address to translate multiple internal users' traffic by mapping different source ports to different internal hosts. This technique conserves IP address space by requiring only one publicly routable IP address to support all users needing access to the server, while maintaining the ability to distinguish between different internal users based on port numbers.
Why the other options are wrong
- B. Static NAT creates a one-to-one permanent mapping between internal and external addresses, which would require multiple public addresses and fail to conserve IP space.
- C. Building one-to-one NAT for every user requires as many public addresses as there are users, directly contradicting the goal of conserving address space.
- D. Re-IP overlapping address space would be a significant operational undertaking and is not the most efficient solution compared to NAT overload.
Question 5
Which design consideration should be observed when EIGRP is configured on Data Center switches?
Show answer and explanation
Correct answer: B. Prevent unnecessary EIGRP neighborships from forming across switch virtual interfaces.
When EIGRP is deployed on Data Center switches, unnecessary EIGRP adjacencies across switch virtual interfaces (SVIs) should be prevented. SVIs are management interfaces and not data-plane interfaces where EIGRP neighborships need to form. Forming unnecessary EIGRP relationships on SVIs can cause unexpected routing behavior, increased protocol overhead, and operational complexity without providing data-plane benefits.
Why the other options are wrong
- A. While manual summarization is a best practice, it is not a design consideration specific to EIGRP in Data Center switches; this is equally important in other network environments.
- C. Lowering EIGRP timers to minimum settings can cause instability and excessive CPU utilization; conservative timer settings are appropriate for Data Center switches.
- D. Running multiple EIGRP autonomous systems in a Data Center unnecessarily fragments the routing domain and increases operational complexity without clear benefits.
Question 6
Which design consideration must be made when using IPv6 overlay tunnels?
Show answer and explanation
Correct answer: B. Overlay tunnels should only be considered as a transition technique toward a permanent solution.
IPv6 overlay tunnels should be considered and deployed only as a temporary transition technique toward a permanent IPv6 native architecture. They provide a bridge for connecting isolated IPv6 networks or enabling IPv6 communication over IPv4 infrastructure during migration, but they introduce additional complexity, encapsulation overhead, and operational burden. A complete, native IPv6 deployment is the intended end state; overlay tunnels are not suitable as a final network architecture.
Why the other options are wrong
- A. Overlay tunnels connecting isolated IPv6 networks are explicitly a transition mechanism, not a final architecture.
- C. Overlay tunnels do not require only the IPv6 protocol stack; they require dual-stack or IPv4 support to function as an encapsulation mechanism.
- D. Overlay tunneling encapsulates IPv6 packets in IPv4 packets for transmission across IPv4 infrastructure, not the reverse.
Question 7
When a network is designed using IS-IS, which two circuit types are supported? (Choose two.)
Show answer and explanation
Correct answer: B, E. multiaccess; point-to-point
IS-IS supports two circuit types: nonbroadcast (for non-broadcast media such as point-to-point serial links or certain MPLS environments) and point-to-point (for direct serial links and other point-to-point media). These circuit types define how IS-IS behaves on different link types, including neighbor discovery, flooding mechanisms, and designated intermediate system (DIS) election. Multiaccess is not an IS-IS circuit type term, point-to-multipoint is not supported, and the term 'multiaccess' does not align with IS-IS topology classification.
Why the other options are wrong
- A. Nonbroadcast multiaccess (NBMA) is an OSPF term, not an IS-IS circuit type.
- C. Point-to-multipoint is not an IS-IS circuit type; IS-IS uses either point-to-point or nonbroadcast topologies.
- D. While nonbroadcast is correct, it is paired with point-to-point, not selected in isolation as circuit types are distinguished by both the correct pair.
Question 8
A network solution is being designed for a company that connects to multiple Internet service providers. Which Cisco proprietary BGP path attribute will influence outbound traffic flow?
Show answer and explanation
Correct answer: C. Weight
Weight is a Cisco proprietary BGP path attribute that influences outbound traffic flow. It is locally significant to a router and used to prefer routes exiting the local AS toward a particular ISP or next hop. Routes with higher weight values are preferred for outbound traffic. This attribute is particularly useful for multi-homed networks connecting to multiple ISPs, as it can be set on different routes to control which exit point is preferred.
Why the other options are wrong
- A. Local Preference influences inbound traffic flow (routes learned by iBGP neighbors) and is not Cisco proprietary.
- B. MED (Multi-Exit Discriminator) is primarily used to influence inbound traffic and is not Cisco proprietary.
- D. AS Path is a standard BGP attribute used for loop prevention and path selection, not Cisco proprietary.
- E. Community is a standard BGP attribute used for route tagging and filtering, not Cisco proprietary.
Question 9
A company is using OSPF between its HQ location and a branch office. HQ is assigned area 0 and the branch office is assigned area 1. The company purchases a second branch office, but due to circuit delays to HQ, it decides to connect the new branch office to the existing branch office as a temporary measure. The new branch office is assigned to area 2. Which OSPF configuration enables all three locations to exchange routes?
Show answer and explanation
Correct answer: B. A virtual link must be configured between the new branch office and HQ
In OSPF, all areas must connect to the backbone area (area 0). When area 2 connects through area 1 (a non-backbone area), it violates the standard OSPF topology requirement. A virtual link must be configured between area 2 and area 0 through the transit area (area 1) to establish a logical backbone connection and allow all three locations to exchange routes properly.
Why the other options are wrong
- A. Stub areas reduce LSA flooding but do not solve the fundamental topology requirement that all areas must connect to area 0.
- C. Sham links are used to manipulate path costs within an area and do not provide the necessary area connectivity that virtual links provide.
- D. Configuring area 2 as a stub area does not create the required logical backbone connection needed for proper area-to-area communication.
Question 10
Which method will filter routes between EIGRP neighbors within the same autonomous system?
Show answer and explanation
Correct answer: A. distribute-list
The distribute-list command is the standard method for filtering routes in EIGRP between neighbors within the same autonomous system. It can be applied to incoming or outgoing route advertisements to control which routes are learned or advertised.
Why the other options are wrong
- B. Policy-based routing determines how packets are forwarded based on policies, not how routes are filtered between neighbors.
- C. Leak-map is used in EIGRP named mode for specific redistribution scenarios, not general route filtering between neighbors.
- D. Route tagging marks routes but does not by itself filter them; filtering requires additional mechanisms like distribute-lists or route maps.
What people say about the full 300-420 pack 4.4 from 5
Question 11
A network engineer must segregate three interconnected campus networks using IS-IS routing. A two-layer hierarchy must be used to support large routing domains and to avoid more specific routes from each campus network being advertised to other campus network routers automatically. Which two actions does the engineer take to accomplish this segregation? (Choose two.)
Show answer and explanation
Correct answer: B, E. Designate two IS-IS routers from each campus to act as Level 1/Level 2 backbone routers at the edge of each campus network; Assign a unique IS-IS NET value for each campus, and configure internal campus routers with Level 1 routing.
To segregate campus networks using IS-IS two-layer hierarchy, the engineer must designate Level 1/Level 2 backbone routers at each campus edge (option B) and assign unique IS-IS NET values to each campus while configuring internal routers as Level 1 only (option E). This design prevents specific routes from being advertised between campuses by establishing clear domain boundaries. Level 1 routers remain within their campus domain and route through their Level 1/Level 2 backbone routers, which handle inter-campus Level 2 routing.
Why the other options are wrong
- A. IS-IS uses DIS (Designated Intermediate System), not BDR, and this configuration does not create proper domain separation.
- C. Using the same IS-IS NET value across campuses merges them into a single domain rather than segregating them.
- D. MTU values do not control IS-IS hierarchy or route advertisement; this is not a valid design approach.
Question 12
An architect is working on a design to connect a company's main site to several small to medium-sized remote branches. The solution must include redundant WAN links, but the customer has a limited budget and wants the ability to increase the link speed easily in the future. QoS will run on the branch routers, so there is no need for consistent end-to-end QoS. Which solution does the architect propose?
Show answer and explanation
Correct answer: B. dual-homed Internet with a single-edge router running a site-to-site VPN topology
For connecting multiple small to medium-sized branches with redundant WAN links, limited budget, easy future upgradability, and branch-based QoS, dual-homed Internet with a single-edge router running a site-to-site VPN topology is optimal. Internet circuits are cost-effective, easily upgradeable with ISPs, and a single edge router reduces capital expense while site-to-site VPN provides security. Since QoS is handled on branch routers, end-to-end QoS consistency is not required.
Why the other options are wrong
- A. Dual-homed MPLS requires carrier involvement and is more expensive than Internet, limiting budget and upgrade flexibility.
- C. Dual-edge routers with MPLS and Internet links significantly increases cost compared to the single-edge Internet solution, conflicting with the limited budget requirement.
- D. While dual-edge routers provide high availability, the added cost contradicts the budget constraint; single-edge with redundant Internet links meets requirements more economically.
Question 13
What is the role of a control-plane node in a Cisco SD-Access architecture?
Show answer and explanation
Correct answer: B. map system that manages endpoint to device relationships
Control plane nodes in SD-Access are map systems that maintain the LISP mapping database. They track and manage the relationships between endpoint identifiers (EIDs) and their locations in the network fabric, enabling proper routing and policy enforcement throughout the SD-Access domain.
Why the other options are wrong
- A. Connecting wired endpoints to the fabric is the function of edge nodes, not control plane nodes.
- C. Connecting wireless endpoints and APs is the function of wireless edge nodes, not control plane nodes.
- D. Managing external Layer 3 networks is the function of border nodes, not control plane nodes.
Question 14
An engineer is designing an EIGRP network for a small branch office site where there is only one Layer 3 router. The engineer wants the router to advertise the local LAN network to remote EIGRP neighbors without sending any unnecessary multicast messages on the local LAN. Which action should the engineer take?
Show answer and explanation
Correct answer: B. Advertise the local LAN using the network command and the passive-interface feature
Using the network command with the passive-interface feature allows the router to advertise the local LAN network to remote EIGRP neighbors while preventing unnecessary multicast messages on the local LAN segment. The network command enables EIGRP on the interface for route advertisement, while the passive-interface command suppresses EIGRP hellos and updates on that interface, eliminating multicast traffic on the local LAN where there are no other EIGRP neighbors.
Why the other options are wrong
- A. A static default route does not advertise the local LAN network to remote neighbors as required.
- C. Redistribution of connected routes is unnecessarily complex and does not leverage EIGRP's native network advertisement mechanism.
- D. Stub networks are configured on routers with limited connectivity, not on single Layer 3 routers in branch offices, and this does not address the multicast suppression requirement.
Question 15
An infrastructure team is concerned about the shared memory utilization of a device, and for this reason, they need to monitor the device state. Which solution limits impact on the device and provides the required data?
Show answer and explanation
Correct answer: D. periodic subscription
Periodic subscription telemetry provides regular data collection without the overhead of processing every state change, making it optimal for monitoring memory utilization while minimizing device impact. It collects data at defined intervals without requiring constant change detection, which reduces CPU and memory processing burden on the device.
Why the other options are wrong
- A. IPFIX is primarily used for flow data collection and is not the best approach for device state monitoring with minimal impact.
- B. Static telemetry is not a standard Model-Driven Telemetry concept and does not represent a best practice for this use case.
- C. On-change subscriptions would generate excessive updates when memory utilization fluctuates, creating higher device overhead than periodic subscriptions.
Question 16
An engineer must design a solution to connect a customer to the Internet. The solution will include a Layer 3 circuit with a CIR of 50 Mbps from the service provider. The hand-off from the provider's switch to the customer's router is 1Gbps. Which solution should the engineer include to prevent potential issues with choppy voice traffic?
Show answer and explanation
Correct answer: C. Implement hierarchical QoS with a parent shaping policy.
When a service provider provides a CIR of 50 Mbps but the hand-off is 1 Gbps, there is a mismatch where the router interface can receive traffic faster than the circuit can transmit. Implementing hierarchical QoS with a parent shaping policy limits traffic to the CIR rate, smoothing bursty traffic and preventing drops that would cause voice quality issues. Shaping buffers excess traffic while policing would discard it, making shaping the correct choice for voice quality.
Why the other options are wrong
- A. Reducing the interface bandwidth is not a practical solution and does not prevent buffer issues at the circuit edge.
- B. Policing discards traffic exceeding the CIR, causing packet loss and choppy voice; shaping is superior for voice quality.
- D. Adding a bandwidth statement configures a maximum rate but does not address the congestion management needed between the 1 Gbps interface and 50 Mbps circuit.
Question 17
Which NETCONF operation creates filtering that is specific to the session notifications?
Show answer and explanation
Correct answer: A. <create-subscription>
The <create-subscription> operation is the NETCONF RPC that creates notification subscriptions with filtering specific to a NETCONF session. This operation allows a client to specify which events or data changes should be sent as notifications, with filters applied only to that particular session.
Why the other options are wrong
- B. <commit> is used to apply configuration changes, not to create subscription filtering.
- C. <notification> is a message type that carries subscription data, not an operation that creates subscriptions.
- D. <logging> is not a standard NETCONF operation for managing subscriptions.
Question 18
An engineer must design a QoS solution for a customer. The network currently supports data only, but the customer will roll out VoIP and IP video in conjunction with the new QoS solution. The engineer plans to use DiffServ. To ensure priority for voice services, which model must the design include?
Show answer and explanation
Correct answer: A. 8-class model
The 8-class DiffServ model is the recommended design for supporting multiple service types including data, VoIP, and IP video. This model provides sufficient granularity to prioritize voice services while maintaining separate classes for video and data traffic, allowing proper queuing and resource allocation across all three service types.
Why the other options are wrong
- B. The 4-class model provides insufficient granularity to adequately separate and prioritize voice, video, and data services.
- C. The 6-class model is less commonly recommended than the 8-class model for voice, video, and data convergence.
- D. The 12-class model provides excessive complexity beyond what is necessary for voice, video, and data QoS requirements.
Question 19
A large chain of stores currently uses MPLS-based T1 lines to connect their stores to their data center. An architect must design a new solution to improve availability and reduce costs while keeping these considerations in mind: • The company uses multicast to deliver training to the stores. • The company uses dynamic routing protocols and has implemented QoS. • To simplify deployments, tunnels should be created dynamically on the hub when additional stores open. Which solution should be included in this design?
Show answer and explanation
Correct answer: C. DMVPN
DMVPN (Dynamic Multipoint VPN) is the optimal choice because it supports multicast traffic through mGRE (multicast GRE), dynamically creates spoke-to-hub tunnels on demand when new sites are added, works with dynamic routing protocols for QoS, and reduces operational complexity by eliminating manual tunnel configuration for each new store location.
Why the other options are wrong
- A. VPLS is a Layer 2 VPN technology that adds complexity and does not provide the simplicity of dynamic tunnel creation.
- B. GET VPN (Group Encrypted Transport) provides encryption but does not inherently support dynamic tunnel creation or multicast optimization.
- D. IPsec alone requires manual tunnel configuration for each store and does not support multicast natively without additional complexity.
Question 20
Which solution allows overlay VNs to communicate with each other in an SD-WAN Architecture?
Show answer and explanation
Correct answer: A. External fusion routers can be used to map VNs to VRFs and selectively route traffic between VRFs.
External fusion routers in SD-WAN architecture map Virtual Networks to VRFs and intelligently route traffic between them. This allows controlled inter-VN communication while maintaining separation. Fusion routers sit at the fabric border and can selectively permit traffic between VNs based on policy, enabling communication scenarios while preserving the isolation benefits of separate virtual networks.
Why the other options are wrong
- B. GRE tunneling between fabric edges does not directly enable VN-to-VN communication; it creates tunnels but lacks the intelligent routing and policy control for inter-VN traffic.
- C. SGTs (Security Group Tags) enforce security policies within a VN but do not inherently enable communication between separate VNs.
- D. Route leaking between VRFs on fabric border nodes can export routes but does not provide the selective traffic routing and policy enforcement needed for controlled inter-VN communication.
Question 21
Which OSPF area blocks LSA Type 3, 4 and 5, but allows a default summary route?
Show answer and explanation
Correct answer: D. totally stubby
A totally stubby area blocks LSA Type 3 (network summaries), Type 4 (ASBR summaries), and Type 5 (external routes) from entering the area, while allowing a default summary route (Type 3 for 0.0.0.0/0) from the area border router. This provides maximum route reduction while maintaining connectivity. A standard stub area still allows Type 3 LSAs, and NSSA allows Type 7 LSAs to be converted to Type 5.
Why the other options are wrong
- A. A normal area receives all LSA types with no filtering or restrictions.
- B. A stub area blocks Type 4 and Type 5 LSAs but still allows Type 3 network summary LSAs, not providing the same level of filtering as totally stubby.
- C. An NSSA blocks Type 5 LSAs but allows Type 7 LSAs from NSSAs and Type 3 summaries, not matching the totally stubby behavior.
Question 22
What is the purpose of a Cisco SD-Access underlay network?
Show answer and explanation
Correct answer: C. to establish physical connectivity between switches and routers
The underlay network provides the foundational physical IP connectivity between all network devices (switches, routers, and controllers). It consists of standard IP routing and switching infrastructure that enables basic network communication. The overlay architecture sits on top of this underlay to provide abstraction and advanced services like LISP-based mobility and segmentation.
Why the other options are wrong
- A. Abstracting IP from physical connectivity is the purpose of the overlay, not the underlay.
- B. Emulating LAN segments over Layer 3 is an overlay function using LISP encapsulation, not an underlay purpose.
- D. IP tunnel virtualization and encapsulation are overlay mechanisms, not underlay purposes.
Question 23
Which two best practices must be followed when designing an out-of-band management network? (Choose two.)
Show answer and explanation
Correct answer: A, E. Enforce access control; Ensure network isolation
Out-of-band management networks require strict access control to prevent unauthorized management access and must maintain network isolation from the production data network to ensure management plane security and independence. These two practices ensure the management network remains secure and functional even during data network compromises or outages.
Why the other options are wrong
- B. Network integration into production systems defeats the purpose of out-of-band isolation.
- C. Backup data should not traverse the management network; the management network has different security and capacity profiles.
- D. The management network should be independent from the data network, not a backup to it, to maintain separation of concerns.
Question 24
What is the purpose of a control plane node in a Cisco SD-Access network fabric?
Show answer and explanation
Correct answer: A. to maintain the endpoint database and mapping between endpoints and edge nodes
The control plane node in a Cisco SD-Access fabric maintains the endpoint database and tracks the mapping between endpoints and edge nodes. This centralized database enables the fabric to know which endpoints are connected to which edge nodes, allowing proper forwarding and policy application throughout the fabric.
Why the other options are wrong
- B. Host tracking and EID-to-fabric-edge bindings are database functions, but endpoint detection is primarily a fabric edge node responsibility, not the control plane's primary purpose.
- C. Endpoint identification and authentication occur at the fabric edge nodes and through integration with AAA servers, not as a core control plane function.
- D. Acting as a gateway between fabric and external networks is a border node function, not a control plane node function.
Question 25
Which node performs the LISP Map-Server and Map-Resolver functions in the Cisco SD-Access network architecture?
Show answer and explanation
Correct answer: A. control plane node
In Cisco SD-Access architecture, the control plane node performs LISP Map-Server and Map-Resolver functions. These functions are central to the fabric's ability to maintain and resolve endpoint locations and provide intelligent traffic steering across the SD-Access fabric.
Why the other options are wrong
- B. Fabric edge nodes handle policy enforcement and fabric edge functionality, not central LISP services.
- C. Border nodes manage connections to external networks but do not perform core LISP mapping functions.
- D. Intermediate nodes do not exist as a defined architectural role in SD-Access.
Question 26
Which design element should an engineer consider when multicast is included in a Cisco SD-Access architecture?
Show answer and explanation
Correct answer: D. Multicast traffic is transported in the overlay and the EID space for wired and wireless clients.
In Cisco SD-Access, multicast traffic is transported through the overlay network rather than relying on underlay multicast. The EID (Endpoint ID) space is used to represent both wired and wireless clients in the overlay, allowing seamless multicast delivery across the fabric regardless of client type or location.
Why the other options are wrong
- A. PIM SSM in the underlay is not a requirement; SD-Access uses overlay-based multicast transport.
- B. This inverts the typical SD-Access multicast model where sources can be in the fabric.
- C. Rendezvous points are not mandatory in SSM deployments, and SD-Access uses LISP for multicast mapping rather than traditional PIM approaches.
Question 27
A network engineer must design a multicast solution to prevent the spoofing of multicast streams and ensure efficient bandwidth utilization. The network will be merged with another multicast domain in the future, and the merge must require minimum effort. Which two solutions meet the customer requirements? (Choose two.)
Show answer and explanation
Correct answer: A, B. PIM-SSM; IGMPv3
PIM-SSM (Source-Specific Multicast) prevents spoofing by requiring explicit source authentication and enables efficient bandwidth use through shortest path trees. IGMPv3 provides source filtering capability, allowing receivers to specify which sources they want to receive from, preventing spoofing and reducing unnecessary traffic. Together, these technologies support future domain merges with minimal reconfiguration.
Why the other options are wrong
- C. IGMPv2 lacks source filtering capability and does not prevent multicast spoofing.
- D. PIM-SM requires RP configuration and creates complexity during domain merges.
- E. MSDP assists in multicast domain integration but does not prevent spoofing or provide the bandwidth efficiency of SSM.
Question 28
An engineer must propose a QoS architecture model that allows an application to inform the network of its traffic profile and to request a particular type of service to support its bandwidth and delay requirements. The application requires consistent and dedicated bandwidth end to end. Which QoS architecture model meets these requirements?
Show answer and explanation
Correct answer: D. IntServ
IntServ (Integrated Services) is a QoS architecture model that allows applications to signal the network about their traffic profile and request specific service levels. It provides resource reservation protocols like RSVP that enable end-to-end bandwidth guarantees and delay requirements with dedicated resources. DiffServ is a scalable but non-reservation model, LLQ is a queuing discipline, and WRED is a congestion avoidance mechanism, none provide the application-signaled reservation capability of IntServ.
Why the other options are wrong
- A. DiffServ is a scalable QoS model but does not support per-application signaling or resource reservation.
- B. LLQ is a queuing mechanism for traffic classification and priority, not a QoS architecture supporting application signaling.
- C. WRED is a congestion avoidance mechanism and not an architecture model for application-requested service levels.
Question 29
An engineer is designing an enterprise campus network. The LAN infrastructure consists of switches from multiple vendors, and Spanning Tree must be used as a Layer 2 loop prevention mechanism. All configured VLANs must be grouped in two STP instances. Which standards-based Spanning Tree technology supports this design solution?
Show answer and explanation
Correct answer: A. MSTP
MSTP (Multiple Spanning Tree Protocol) is the standards-based technology defined in IEEE 802.1s that allows multiple VLANs to be grouped into multiple STP instances. This enables efficient load balancing and loop prevention across multi-vendor switch environments. The requirement to group all configured VLANs into exactly two STP instances is a core MSTP capability. RSTP, Rapid PVST, and STP do not support mapping multiple VLANs to multiple instances in this manner.
Why the other options are wrong
- B. RSTP is a single-instance protocol without support for mapping VLANs to multiple STP instances.
- C. Rapid PVST creates one spanning tree instance per VLAN rather than grouping VLANs into two instances.
- D. STP is a single-instance protocol without support for mapping VLANs to multiple instances.
Question 30
Which two functions does the control plane node provide in a Cisco SD-Access architecture? (Choose two.)
Show answer and explanation
Correct answer: B, D. host tracking database; map server
The control plane node provides both the map server function, which handles LISP mapping database registration and lookups, and maintains the host tracking database, which tracks endpoint locations and EID-to-RLOC bindings. These two functions work together to enable fabric endpoint mobility and policy enforcement.
Why the other options are wrong
- A. LISP proxy ETR functions are performed by fabric edge nodes, not the control plane.
- C. Policy mapping is performed by policy servers and enforcement points, not a primary control plane function.
- E. Endpoint registration occurs at fabric edge nodes when endpoints attach; the control plane receives and stores this information but does not perform registration.
Question 31
What is the purpose of an edge node in an SD-Access network fabric?
Show answer and explanation
Correct answer: A. Edge nodes identify and authenticate endpoints and register endpoint information with control plane nodes.
Edge nodes are the access points in the SD-Access fabric that directly connect endpoints. Their primary function is to identify and authenticate these endpoints and register their information with control plane nodes, which maintain the mapping database. This allows the fabric to track which endpoints are where and enforce policy.
Why the other options are wrong
- B. Tracking endpoint ID to location mappings is the function of control plane nodes, not edge nodes.
- C. Border nodes serve as gateways between the fabric domain and external networks, not edge nodes.
- D. Resolving lookup requests is a control plane function, not performed by edge nodes.
Question 32
An engineer must design a management network that enables SSH, NTP, FTP, and SNMP over the production network. The design requires the management of routers and switches that exist across different networks. Which feature must the design include?
Show answer and explanation
Correct answer: D. dedicated management VRF connection per device
A dedicated management VRF provides isolation and security for management traffic (SSH, NTP, FTP, SNMP) across the production network while enabling access to devices in different networks. VRF separation ensures management plane traffic does not compete with production traffic and provides administrative boundary isolation.
Why the other options are wrong
- A. Management Plane Protection focuses on protecting the management plane from data plane attacks but does not address cross-network management access.
- B. Per-device console connections are impractical for managing devices across different networks and do not scale.
- C. A terminal server addresses console access but does not provide network-based management protocol isolation and security.
Question 33
Which two routing protocols allow for unequal cost load balancing? (Choose two.)
Show answer and explanation
Correct answer: A, C. EIGRP; BGP
EIGRP supports unequal cost load balancing through the variance multiplier command, allowing traffic distribution across paths with different metrics. BGP supports unequal cost load balancing through multipath BGP configuration. OSPF and IS-IS only support equal cost load balancing, while RIPng does not support multipath load balancing.
Why the other options are wrong
- B. IS-IS only supports equal cost load balancing across paths with identical metrics.
- D. OSPF only supports equal cost load balancing across paths with identical metrics.
- E. RIPng does not support any form of load balancing across multiple paths.
Question 34
An architect must design an IPv6 migration solution for a corporation with remote offices to support: * The customer has IPv4 peering with their service provider. * IPv6 users need access to IPv4 and IPv6 resources. * Existing content providers will migrate to IPv6 in the next two years. * Users will be migrated in a phase-by-phase approach. Which migration solution must the architect choose?
Show answer and explanation
Correct answer: D. dual-stack
The scenario requires supporting both IPv4 and IPv6 simultaneously during a phased migration. Users need access to both IPv4 and IPv6 resources while the corporation maintains existing IPv4 peering and gradually migrates content providers to IPv6 over two years. Dual-stack deployment allows hosts and infrastructure to run both IPv4 and IPv6 protocols concurrently, enabling seamless access to either protocol without translation overhead. This approach scales across phases, requires no complex address translation, and allows infrastructure to migrate at its own pace.
Why the other options are wrong
- A. NAT46 translates IPv4 to IPv6, but the requirement explicitly states IPv6 users need access to IPv4 resources, so pure translation to IPv6 would break IPv4 connectivity.
- B. Tunneling alone does not provide a complete solution and creates overhead; it requires complementary mechanisms and is not the primary strategy for managed migration.
- C. NAT64 translates IPv6 to IPv4, which helps IPv6-only systems reach IPv4 resources, but it does not allow IPv6 resources to be accessed during the migration and does not address the full requirement set.
Question 35
When vEdge router redundancy is designed, which FHRP is supported?
Show answer and explanation
Correct answer: D. VRRP
VRRP is the supported FHRP for vEdge router redundancy in Cisco SD-WAN deployments. VRRP provides standards-based first hop redundancy and is compatible with SD-WAN architecture. HSRP and GLBP are Cisco-proprietary protocols, and OMP is Overlay Management Protocol used for SD-WAN control plane functions, not FHRP.
Why the other options are wrong
- A. HSRP is not supported for vEdge redundancy in SD-WAN; VRRP is the standard choice.
- B. OMP is the overlay management protocol used for SD-WAN control plane operations, not a first hop redundancy protocol.
- C. GLBP is not supported for vEdge redundancy in SD-WAN deployments.
Question 36
Which method does Cisco SD-WAN use to avoid fragmentation issues?
Show answer and explanation
Correct answer: A. PMTUD is used.
Cisco SD-WAN uses Path MTU Discovery (PMTUD) to avoid fragmentation issues by determining the smallest MTU along the path and adjusting packet sizes accordingly. This allows traffic to traverse multiple transport networks with different MTU requirements without fragmentation. Static MTU configuration, jumbo frames, and DF bit marking are not the primary methods SD-WAN employs for fragmentation avoidance.
Why the other options are wrong
- B. Static MTU configuration does not dynamically address fragmentation across varying transport networks
- C. Jumbo frames would increase fragmentation risk, not prevent it
- D. The DF bit prevents fragmentation but does not solve the underlying issue that PMTUD addresses
Question 37
In the SD-WAN underlay network, which WAN Edge VPN ID is defined as the transport VPN and is used to carry control traffic?
Show answer and explanation
Correct answer: A. VPN 0
In Cisco SD-WAN, VPN 0 is defined as the transport VPN used to carry control traffic and management plane communications between WAN Edge routers and controllers. VPN 0 represents the underlay network connectivity. VPN 512 is typically used for management traffic in some configurations, while VPN 128 and 256 are allocated for customer data services and other overlay purposes.
Why the other options are wrong
- B. VPN 512 is not the transport VPN; it may be used for management but not as the primary control plane VPN
- C. VPN 128 is allocated for data services or specific overlay functions, not transport control traffic
- D. VPN 256 is not the transport VPN in standard SD-WAN architecture
Question 38
Which first hop redundancy protocol ensures that load balancing occurs over multiple routers using a single virtual IP address and multiple virtual MAC addresses?
Show answer and explanation
Correct answer: A. GLBP
GLBP (Gateway Load Balancing Protocol) is the only FHRP that provides load balancing across multiple routers using a single virtual IP address and multiple virtual MAC addresses. Each GLBP router can serve as the active virtual gateway while also forwarding traffic, distributing the load among participating routers. HSRP and VRRP provide redundancy but only one active router handles traffic. IRDP is an older protocol not designed for redundancy.
Why the other options are wrong
- B. IRDP (ICMP Router Discovery Protocol) is a basic router discovery mechanism without redundancy or load balancing capabilities.
- C. VRRP provides redundancy with a single virtual IP and MAC address but does not support load balancing across multiple routers.
- D. HSRP provides redundancy with a single virtual IP and MAC address but does not support load balancing across multiple routers.
Question 39
A client is moving to Model-Driven Telemetry and requires periodic updates. What must the network architect consider with this design?
Show answer and explanation
Correct answer: C. Periodic updates include a full copy of the data that is subscribed to.
With periodic subscription updates in Model-Driven Telemetry, each update contains a full copy of all subscribed data at the specified interval. This ensures the collector always has a complete picture of the monitored data state, regardless of whether changes have occurred since the last update.
Why the other options are wrong
- A. This describes on-change subscriptions, not periodic updates; periodic updates are sent at regular intervals regardless of changes.
- B. Empty subscriptions may generate update notifications depending on configuration; periodic subscriptions will send notifications even if data has not changed.
- D. Periodic updates are sent at configured intervals and can be delayed; they are not necessarily sent immediately.
Question 40
A network engineer must connect two sites across a public network using a secure tunneling technology that supports multicast traffic. Which technology should be selected?
Show answer and explanation
Correct answer: D. GRE over IPsec
GRE over IPsec combines the strengths of both protocols: GRE provides native multicast support and encapsulation flexibility, while IPsec adds encryption and security. IPsec alone does not support multicast traffic. GRE alone lacks encryption. PPTP is obsolete and unsuitable for modern secure site-to-site connections. GRE over IPsec is the standard solution for secure multicast-enabled tunneling across public networks.
Why the other options are wrong
- A. IPsec does not natively support multicast traffic, limiting its ability to tunnel multicast across untrusted networks.
- B. GRE alone provides no encryption or authentication, making it unsuitable for secure communication across public networks.
- C. PPTP is deprecated, lacks strong security, and does not adequately support multicast requirements.
Question 41
An enterprise customer has these requirements: • end-to-end QoS for the business-critical applications and VoIP services based on CoS marking. • flexibility to offer services such as IPv6 and multicast without any reliance on the service provider. • support for full-mesh connectivity at Layer 2. Which WAN connectivity solution meets these requirements?
Show answer and explanation
Correct answer: D. VPLS
VPLS (Virtual Private LAN Service) provides full-mesh Layer 2 connectivity, allowing end-to-end QoS based on CoS marking to be preserved across the WAN. VPLS enables customers to maintain complete control over their network without service provider dependency, supports IPv6 and multicast forwarding natively at Layer 2, and creates a virtual switched network across the provider infrastructure. VPWS provides point-to-point Ethernet services without full-mesh capabilities, MPLS VPN operates at Layer 3 and requires provider involvement in routing, and DMVPN requires overlay configuration and does not inherently provide Layer 2 full-mesh services.
Why the other options are wrong
- A. VPWS provides only point-to-point Ethernet services, not full-mesh Layer 2 connectivity.
- B. MPLS VPN operates at Layer 3 and requires reliance on service provider routing policies.
- C. DMVPN is a dynamic overlay solution that does not provide native Layer 2 full-mesh connectivity.
Question 42
How are wireless endpoints registered in the HTDB in a Cisco SD-Access architecture?
Show answer and explanation
Correct answer: B. Fabric WLCs update the HTDB as new clients connect to the wireless network.
Fabric WLCs (Wireless LAN Controllers) update the Host Tracking Database (HTDB) when new wireless clients connect. The WLC recognizes client authentication and association, then registers the endpoint's identity information in the HTDB, enabling the fabric overlay to maintain proper endpoint location tracking and policy enforcement across the wireless infrastructure.
Why the other options are wrong
- A. Border nodes handle external network connectivity, not wireless client registration.
- C. Fabric APs do not directly update the HTDB; this function belongs to the WLC managing those APs.
- D. CAPPWAP messaging between APs and WLC is control plane communication for AP management, not the mechanism for HTDB endpoint registration.
Question 43
A customer's current Layer 2 infrastructure is running Spanning Tree 802.1d, and all configuration changes are manually implemented on each switch. An architect must redesign the Layer 2 domain to achieve these goals: * reduce the impact of topology changes * reduce the time spent on network administration * reduce manual configuration errors Which two solutions should the architect include in the new design? (Choose two.)
Show answer and explanation
Correct answer: A, C. Implement Rapid PVST+ instead of STP; Use VTP to propagate VLAN information and to prune unused VLANs.
Rapid PVST+ replaces legacy 802.1d STP with faster convergence (seconds vs. minutes), reducing topology change impact and simplifying per-VLAN spanning tree management. VTP automatically propagates VLAN information across the domain and prunes unused VLANs, dramatically reducing manual configuration requirements and errors. Together, these solutions address all three goals: faster convergence, reduced administration time, and fewer manual errors.
Why the other options are wrong
- B. MST is more complex to configure and requires manual region configuration, increasing rather than reducing manual effort and errors.
- D. Storm control addresses only broadcast/multicast traffic problems, not topology change impact or configuration administration.
- E. DTP is a link negotiation protocol that does not propagate VLAN information like VTP does; it creates compatibility issues rather than reducing configuration.
Question 44
Which type of rendezvous point deployment is standards-based and supports dynamic RP discovery?
Show answer and explanation
Correct answer: A. bootstrap router
Bootstrap Router (BSR) is the standards-based mechanism defined in RFC 5059 that supports dynamic RP discovery. It allows RPs to be discovered automatically without manual configuration, using a bootstrap message mechanism that propagates RP information throughout the PIM domain.
Why the other options are wrong
- B. Anycast-RP is a deployment technique but not a standards-based dynamic discovery mechanism; it relies on manual configuration of anycast addresses.
- C. Auto-RP is a Cisco proprietary solution, not a standards-based approach, and predates the standardized BSR mechanism.
- D. Static RP requires manual configuration and does not support dynamic discovery.
Question 45
What is the function of the multicast Reverse Path Forwarding check?
Show answer and explanation
Correct answer: A. It allows for a loop-free distribution tree from the source to receivers.
Reverse Path Forwarding (RPF) check is a multicast forwarding mechanism that prevents loops by verifying that multicast packets arrive on the expected incoming interface based on the source address. It creates and maintains a loop-free distribution tree from the multicast source to all receivers. The other options describe different multicast functions: Auto RP is a rendezvous point discovery mechanism, bootstrap messages are forwarded by design to elect RPs, and RP-set information is discovered via bootstrap protocol.
Why the other options are wrong
- B. Auto RP Mapping agents discover and announce RP information, which is a different function from RPF.
- C. RPF does not prevent bootstrap messages; bootstrap protocol is a separate mechanism for RP discovery.
- D. The bootstrap protocol and RP announcement process handles RP-set discovery, not the RPF check.
Question 46
Which topology within a network underlay eliminates the need for first hop redundancy protocols while improving fault tolerance, increasing resiliency, and simplifying the network?
Show answer and explanation
Correct answer: B. routed access topology
A routed access topology in the underlay eliminates the need for first hop redundancy protocols like HSRP or VRRP by using dynamic routing protocols where every link can be active. This improves fault tolerance and resiliency through equal-cost multipath routing while simplifying the network by removing redundancy protocol complexity.
Why the other options are wrong
- A. Virtualized topology refers to overlay abstractions, not an underlay physical topology design principle.
- C. Layer 2 topology requires first hop redundancy protocols to handle link failures and prevent loops.
- D. Logical fabric topology is an abstraction of the overall fabric, not a specific underlay topology that addresses FHRP requirements.
Question 47
An engineer must design a QoS solution for a customer that is connected to an ISP over a 1Gbps link with a 100Mbps CIR. The ISP aggressively drops all traffic received over the CIR, which is causing numerous TCP retransmissions. The customer is not using any RTP applications but wants to maximize bandwidth usage up to the CIR. Which QoS solution should the engineer choose?
Show answer and explanation
Correct answer: C. traffic shaping
Traffic shaping buffers packets that exceed the CIR rate and releases them at the CIR rate to prevent drops by the ISP, while allowing bursting up to the 1Gbps link speed during low-congestion periods. This approach protects against aggressive ISP dropping while maximizing bandwidth usage within CIR constraints by smoothing traffic patterns. Policing would immediately drop excess traffic causing TCP retransmissions, queuing alone does not prevent ISP-side drops, and policer with markdown would still lose traffic and trigger retransmissions.
Why the other options are wrong
- A. Policing drops traffic exceeding CIR, causing the TCP retransmissions the customer wants to avoid.
- B. Queuing manages congestion locally but does not prevent ISP-side drops of traffic exceeding CIR.
- D. Policer with markdown still drops traffic exceeding CIR, perpetuating the retransmission problem.
Question 48
An engineer must connect a new remote site to an existing OSPF network. The new site consists of two low-end routers, one for WAN, and one for LAN. There is no demand for traffic to pass through this area. Which area type does the engineer choose to provide minimal router resource utilization, while still allowing for full connectivity to the rest of the network?
Show answer and explanation
Correct answer: C. totally stubby area
A totally stubby area provides minimal router resource utilization while maintaining full connectivity. In a totally stubby area, the remote site routers do not receive Type 3, 4, or 5 LSAs and instead use a default route injected by the area border router. This significantly reduces the routing table size and memory usage on low-end routers, which is ideal for the branch site with two low-end routers where no traffic should transit through the area.
Why the other options are wrong
- A. A not-so-stubby (NSSA) area is designed for sites that need to redistribute external routes, not for minimizing resource usage.
- B. Totally not-so-stubby (NSSA) areas still allow Type 7 LSAs and are more complex than necessary for this requirement.
- D. A stubby area still receives Type 3 LSAs for inter-area routes, consuming more router resources than a totally stubby area.
Question 49
An engineer is working with NETCONF and Cisco NX-OS based devices. The engineer needs a YANG model that supports a specific feature relevant only to Cisco NX-OS. Which model should the engineer choose?
Show answer and explanation
Correct answer: A. Native
Native YANG models are vendor-specific implementations that support device-unique features and capabilities. For Cisco NX-OS specific features not covered by standards-based models, the engineer must use Cisco's native YANG model which includes extensions and proprietary features unique to that platform.
Why the other options are wrong
- B. IEEE models are not YANG models and do not represent device-specific implementations.
- C. OpenConfig is vendor-neutral and does not include vendor-specific features unique to Cisco NX-OS.
- D. IETF models are standards-based and do not cover vendor-specific or proprietary NX-OS features.
Question 50
A customer is discussing QoS requirements with a network consultant. The customer has specified that end-to-end path verification is a requirement. Which QoS solution meets this requirement?
Show answer and explanation
Correct answer: A. IntServ model with RSVP to support the traffic flows
IntServ with RSVP is the only QoS model that provides end-to-end path verification and reservation signaling. RSVP explicitly signals and verifies available resources along the entire path from source to destination before committing traffic flows. DiffServ operates without end-to-end signaling, and CoS/DSCP marking alone do not verify path capabilities.
Why the other options are wrong
- B. DiffServ with PHB provides per-hop behavior classification but no end-to-end path verification.
- C. DSCP marking is a hop-by-hop mechanism without end-to-end verification capabilities.
- D. CoS marking operates only at Layer 2 without end-to-end path verification across network domains.
Question 51
Which two functions are provided by the Cisco SD-WAN orchestration plane? (Choose two.)
Show answer and explanation
Correct answer: B, C. primary authentication point; NAT traversal facilitation
The orchestration plane provides centralized provisioning of policies and configurations across the SD-WAN fabric, and serves as the primary authentication point where devices authenticate and register with the management infrastructure. These two functions enable centralized control and secure device onboarding. NAT traversal is a function of the control or data plane, and troubleshooting/monitoring belong to the management plane rather than the orchestration plane specifically.
Why the other options are wrong
- A. Centralized provisioning is correct, but NAT traversal is not an orchestration plane function; it is handled at the control/data plane level.
- D. Zero Touch Provisioning is a management capability, not a core orchestration plane function in the classical SD-WAN control model.
- E. Troubleshooting and monitoring are management plane functions handled by vManage, not core orchestration plane responsibilities.
Question 52
An engineer is designing an IPv4 addressing plan for an enterprise with 1000 branches. Each branch requires a prefix for data and a prefix for voice. Each prefix must accommodate up to 128 hosts, and prefixes must facilitate summarization at aggregation points in the network. The security team requires a simple method for identifying voce prefixes. Which allocation does the engineer recommend from the RFC1918 address space?
Show answer and explanation
Correct answer: B. /24 prefixes for data from 10.0.0.0/8 and /24 prefixes for voice from the next contiguous /24 prefix per site
The solution requires /24 prefixes to accommodate 128 hosts (a /25 provides exactly 128 usable addresses, but /24 provides 254 and is the standard choice for branch sites). With 1000 branches needing two /24 prefixes each, using 10.0.0.0/8 provides sufficient space (16 million addresses). Assigning voice prefixes as the next contiguous /24 per site (e.g., 10.0.0.0/24 for data and 10.0.1.0/24 for voice at branch 1) provides both a simple identification method for voice prefixes and maintains hierarchical summarization capability at aggregation points. This approach uses only RFC1918 space efficiently without requiring multiple disconnected ranges.
Why the other options are wrong
- A. Using separate /15 ranges from different RFC1918 blocks breaks the contiguous allocation principle and makes summarization at aggregation points inefficient.
- C. /25 prefixes are unnecessarily small for the requirements and complicate addressing management without proportional benefit.
- D. Splitting data and voice across two different RFC1918 ranges (10.0.0.0/8 and 172.16.0.0/12) defeats the purpose of efficient summarization and makes the addressing plan harder to manage.
Question 53
Which control-plane protocol is used to map an endpoint to a location in a Cisco SD-Access network?
Show answer and explanation
Correct answer: C. LISP
LISP (Locator/ID Separation Protocol) is the control plane protocol used in Cisco SD-Access to map endpoints (identified by EIDs) to their physical locations (RLOCs) in the network. This mapping is stored in the control plane nodes and enables efficient forwarding and policy enforcement.
Why the other options are wrong
- A. FabricPath is a data plane technology for fabric switching, not a mapping protocol.
- B. IS-IS is used for underlay routing in the fabric, not for endpoint location mapping.
- D. MP-BGP is used for overlay routing and VPN address family distribution, not endpoint mapping.
Question 54
The customer solution requires QoS to support streaming multimedia over a WAN. An architect chooses to use Per-Hop Behavior. Which solution should the engineer use to classify and mark traffic traveling between branch sites?
Show answer and explanation
Correct answer: C. CBWFQ with DSCP AF3
CBWFQ with DSCP AF3 is appropriate for streaming multimedia, which requires assured bandwidth and moderate drop probability but not the absolute priority of expedited forwarding. AF3 (Assured Forwarding class 3) provides three levels of drop precedence suitable for multimedia that tolerates some packet loss but requires reliable throughput. LLQ is designed for RTP voice/video requiring strict priority, which contradicts the stated absence of RTP applications. AF2 is lower priority than AF3, and AF4 is the lowest AF class.
Why the other options are wrong
- A. CBWFQ with AF2 is appropriate for lower-priority multimedia; AF3 is more suitable for streaming.
- B. LLQ with EF is designed for RTP voice requiring strict priority, but the customer has no RTP applications.
- D. LLQ is unnecessarily complex for non-RTP multimedia, and AF4 is the lowest AF class.
Question 55
An engineer is designing a QoS policy that queues excess packets for later transmission. Which mechanism must be included in the design?
Show answer and explanation
Correct answer: A. shaping
Shaping is the QoS mechanism that queues excess packets for later transmission when traffic exceeds a configured rate. It buffers out-of-profile packets and sends them during idle periods, ensuring smooth traffic flow. WRED and RED are congestion avoidance mechanisms that drop packets rather than queue them, while policing typically discards excess traffic rather than queuing it for transmission.
Why the other options are wrong
- B. WRED is a congestion avoidance mechanism that randomly drops packets based on queue depth, not a queuing mechanism.
- C. Policing marks or drops packets that exceed configured rates but does not queue excess traffic for later transmission.
- D. RED randomly drops packets during congestion rather than queuing excess traffic for delayed transmission.
Question 56
What is an advantage of designing an out-of-band network management solution?
Show answer and explanation
Correct answer: A. In the event of a production network outage, network devices can still be managed.
Out-of-band management networks provide continued device management access even when the production network experiences outages or failures. By maintaining a separate, independent management path, administrators retain control and visibility during production incidents. This isolation ensures management functionality is unaffected by data plane problems.
Why the other options are wrong
- B. Out-of-band management specifically requires separation between production and management networks.
- C. The management network should provide independent access, not serve as a backup data path.
- D. Out-of-band solutions typically have higher operational costs due to separate infrastructure requirements.
Question 57
An architect is designing a multicast solution for a network that contains over 100 routers. The architect plans to create several multicast domains and balance the PIM-SM traffic within the network. Which technology should the architect include in the design?
Show answer and explanation
Correct answer: D. MSDP
MSDP (Multicast Source Discovery Protocol) enables the connection of multiple PIM-SM domains and allows them to share multicast source information. In a large network with over 100 routers split into multiple multicast domains, MSDP connects these domains and balances traffic by enabling source discovery across domain boundaries. DVMRP is a legacy dense-mode protocol, IGMP handles host-to-router communication, and MOSPF is an extension of OSPF with limited deployment.
Why the other options are wrong
- A. DVMRP is a dense-mode protocol suitable only for small networks and has been largely replaced.
- B. IGMP manages host group membership but does not route multicast traffic between domains.
- C. MOSPF extends OSPF for multicast but has limited real-world deployment and scalability.
Question 58
What are two valid scaling techniques when an EIGRP network is designed that consists of more than 1000 routers? (Choose two.)
Show answer and explanation
Correct answer: A, E. Use structured hierarchical topology with route summarization; Implement multiple EIGRP autonomous systems
Scaling EIGRP networks with more than 1000 routers requires two key approaches: hierarchical topology with route summarization reduces the number of routes and queries in the network, while implementing multiple EIGRP autonomous systems segments the network into smaller, independent convergence domains. Both techniques reduce query scope and improve scalability.
Why the other options are wrong
- B. Sub-second timers would increase control traffic and CPU load, worsening scalability rather than improving it.
- C. Using distribute-list to filter routes reduces visibility but does not address the fundamental scaling issues of query propagation and convergence times.
- D. Modifying delay parameters does not address the scalability challenges of large EIGRP deployments.
Question 59
An architect must address sustained congestion on the access and distribution uplinks of a network. QoS has already been implemented and optimized, but it is no longer effective in ensuring optimal network performance. Which two solutions should the architect use to improve network performance. (Choose two.)
Show answer and explanation
Correct answer: B, D. Bundle additional uplinks into logical EtherChannels; Implement higher-speed uplink interfaces.
When QoS optimization has been exhausted, the engineer must address the root cause: insufficient bandwidth. Bundling additional uplinks via EtherChannel increases total link capacity, and implementing higher-speed uplink interfaces directly increases throughput to accommodate sustained traffic demands. These solutions expand available bandwidth rather than merely managing congestion on existing constrained links. Selective packet discard and RED manage congestion symptoms without addressing capacity constraints, and reconfiguring to IntServ is unnecessarily complex and does not increase bandwidth.
Why the other options are wrong
- A. Selective packet discard manages symptoms of congestion but does not increase available bandwidth capacity.
- C. Random Early Detection manages queues through probabilistic dropping but does not address fundamental bandwidth limitations.
- E. Reconfiguring to IntServ model is complex and does not increase bandwidth; DiffServ is already industry standard.
Question 60
A company uses cloud-based applications for voice and video calls, file sharing, content sharing, and messaging. During business hours, these applications randomly become slow and unresponsive. However, other applications work smoothly with the current applied QoS polices. Which solution must the company choose to resolve the issue?
Show answer and explanation
Correct answer: A. Identify the applications with NBAR2 and allocate the required bandwidth accordingly.
The problem is that cloud-based applications (voice, video, file sharing, messaging) are experiencing random slowness during business hours while other applications work normally. This indicates that the cloud applications are not being properly identified and prioritized by the current QoS policies. NBAR2 (Network-Based Application Recognition) provides deep packet inspection to accurately identify these applications regardless of port variability. Once identified with NBAR2, appropriate bandwidth allocation policies can be applied to guarantee service quality for these critical applications.
Why the other options are wrong
- B. Cloud applications dynamically change ports and may use encrypted protocols, making port-based identification unreliable.
- C. Reserving bandwidth only on perimeter routers does not address congestion within the internal network where slowness is likely occurring during peak usage.
- D. Rate-limiting based on port groupings does not solve the underlying problem of insufficient bandwidth allocation and may further degrade performance of critical applications.
Question 61
An engineer is working for a large cable TV provider that requires multiple sources streaming video on different channels using multicast with no rendezvous point. Which multicast protocol meets these requirements?
Show answer and explanation
Correct answer: B. PIM-SSM
PIM-SSM (Source-Specific Multicast) is ideal for cable TV provider scenarios with multiple sources streaming different content channels. SSM requires no rendezvous point and uses source trees efficiently for one-to-many distribution. Each video channel represents a different source sending to the same multicast group, fitting the SSM model perfectly. PIM-SM requires a rendezvous point, BIDIR-PIM also uses shared trees with RPs, and any-source multicast is not a protocol but a multicast delivery model.
Why the other options are wrong
- A. PIM-SM requires a rendezvous point, contradicting the design requirement.
- C. Any-source multicast describes a delivery model rather than a specific protocol.
- D. BIDIR-PIM uses shared trees with a rendezvous point, not eliminating the RP requirement.
Question 62
Which two steps can be taken to improve convergence in an OSPF network? (Choose two.)
Show answer and explanation
Correct answer: A, C. Use Bidirectional Forwarding Detection; Tune OSPF parameters
Bidirectional Forwarding Detection (BFD) enables sub-millisecond failure detection, dramatically improving convergence time. Tuning OSPF parameters such as hello intervals, dead intervals, and SPF timers directly reduces detection and calculation delays. Both techniques address convergence speed, which is critical for network reliability.
Why the other options are wrong
- B. Merging all areas into one backbone area eliminates the scalability benefits of OSPF's multi-area design and increases routing overhead.
- D. Making non-backbone areas stub areas reduces LSA flooding but does not improve convergence time in the core network.
- E. Spanning the same IP network across multiple areas violates OSPF design principles and creates routing problems rather than improving convergence.
Question 63
An engineer is designing a Layer 3 campus network running EIGRP between the core, aggregation, and access layers. The access layer switches will be connected to the aggregation layer using Layer 3 copper connections. The engineer wants to improve the convergence time for access layer switch failures. Which technique must the design include?
Show answer and explanation
Correct answer: A. enabling BFD for EIGRP on the access layer uplinks
BFD (Bidirectional Forwarding Detection) provides sub-second failure detection independent of routing protocol timers. When enabled on EIGRP adjacencies, BFD detects link failures in milliseconds and immediately triggers EIGRP reconvergence, dramatically improving convergence time for access layer switch failures. This is faster and more reliable than adjusting EIGRP timers alone, which have minimum practical values and still depend on periodic updates.
Why the other options are wrong
- B. Reducing Hello/Hold timers increases CPU load and control plane traffic without achieving sub-second convergence; BFD is the proper mechanism for fast failure detection.
- C. Core-to-aggregation summarization does not directly improve convergence for access layer failures.
- D. Access-to-aggregation summarization reduces routing table size but does not improve convergence speed for access layer failures.
Question 64
Which two statements describe source trees in a multicast environment? (Choose two.)
Show answer and explanation
Correct answer: A, B. Source trees guarantee the minimum amount of network latency for forwarding multicast traffic; Source trees create an optimal path between the source and the receivers
Source trees create optimal paths from each multicast source directly to receivers, which minimizes network latency and provides the shortest path through the network topology. A source tree uses the source address as its root, ensuring direct forwarding without intermediate rendezvous points. These characteristics guarantee minimum latency and optimal paths compared to shared tree approaches.
Why the other options are wrong
- C. Shared trees use a single common root at a chosen point; source trees are rooted at each source.
- D. Source trees minimize latency by design, not introduce it.
- E. Source trees create optimal paths by using the shortest routes from source to receivers.
Question 65
Which two border nodes are available in the Cisco SD-Access architecture? (Choose two.)
Show answer and explanation
Correct answer: C, D. internal border; anywhere border
The two types of border nodes in Cisco SD-Access are internal border nodes, which connect to external Layer 3 networks within the organization, and anywhere border nodes, which support mobile endpoints and remote access. These border nodes provide connectivity between the SD-Access fabric and external network domains.
Why the other options are wrong
- A. Extended border is not a standard SD-Access border node classification.
- B. Edge border is not a recognized border node type; border nodes are distinct from edge nodes.
- E. Intermediate border is not a defined border node type in the SD-Access architecture.
Question 66
How is a sub-second failure of a transport link detected in a Cisco SD-WAN network?
Show answer and explanation
Correct answer: B. BFD runs on the IPsec tunnels between WAN Edge routers.
In Cisco SD-WAN, BFD runs directly on IPsec tunnels between WAN Edge routers to detect sub-second link failures. BFD provides millisecond-level failure detection on the data plane tunnels, enabling rapid convergence to alternate paths without waiting for higher-layer protocol timeouts. This ensures fast detection and recovery from transport link failures.
Why the other options are wrong
- A. Hellos between WAN Edge and vSmart controller are control plane messages and lack the sub-second detection capability of BFD.
- C. BGP operates at the routing protocol layer and uses longer convergence timers, not suitable for sub-second detection.
- D. Link state messages between vSmart controllers are control plane operations that do not provide sub-second failure detection on data plane links.
Question 67
A branch office has a primary L3VPN MPLS connection back to the main office and an IPSEC VPN tunnel that serves as backup. Which design ensures that data is sent over the backup connection only if the primary MPLS circuit is down?
Show answer and explanation
Correct answer: C. Use static routes tied to an IP SLA to prefer the primary path while a floating static route points to the backup connection.
Static routes tied to IP SLA health monitoring provide active/passive failover where the primary path is preferred until it fails. When the primary MPLS circuit becomes unavailable, the IP SLA detects the failure and the static route pointing to the backup IPsec tunnel becomes active. A floating static route on the backup has a higher administrative distance, ensuring it only becomes the active route when the primary is unreachable. This is the standard approach for deterministic primary-backup switching.
Why the other options are wrong
- A. EIGRP would load-balance traffic across both paths or choose based on metric calculations, not enforce strict primary-backup behavior.
- B. BGP multipath enables equal-cost load-balancing across paths rather than active-backup failover with primary preference.
- D. OSPF passive-interface prevents routing adjacency but does not enforce failover logic; passive interfaces simply stop sending hello packets on that interface.
Question 68
A company must automate a set of complex changes aligned with DR testing in the network. These changes are specific, and the DR playbook will be adjusted in the future. The playbook has diverse routing and switching assets in scope as well as multiple vendor and hardware platforms. A developer will create a thin, web front-end microservice and integrate with an Open Daylight controller to push changes to the network. Which YANG model should be used?
Show answer and explanation
Correct answer: A. Use an open YANG model to allow the reuse of code and standardize the implementation across platforms.
When implementing automation across multiple vendor and hardware platforms with future adjustments expected, open YANG models provide standardization and code reusability. Open models like OpenConfig allow a single implementation to work across diverse platforms, reducing maintenance burden and enabling seamless integration with controllers like Open Daylight.
Why the other options are wrong
- B. Individualized models create vendor lock-in and increase long-term maintenance costs when changes are needed.
- C. Multiple native vendor models contradict the goal of code consistency and create implementation complexity.
- D. A single native vendor model cannot support the multivendor and multiplatform requirement stated in the scenario.
Question 69
Which consideration must be taken into account when using the DHCP relay feature in a Cisco SD-Access Architecture?
Show answer and explanation
Correct answer: D. DHCP Option-82 must be enabled to map the circuit IP option to the access fabric node where the DHCP discover originated.
DHCP Option-82 must be enabled to map the circuit ID option to the specific access fabric node where the DHCP discover message originated. This ensures proper DHCP scope mapping and endpoint placement within the SD-Access fabric with anycast gateways. Option-82 contains circuit ID information that identifies which fabric edge node the request came from, enabling correct IP assignment and fabric integration.
Why the other options are wrong
- A. DHCP relay functionality does not require enablement on fabric edge nodes; the anycast gateway handles DHCP within the fabric.
- B. DHCP servers do not need to be enabled on border nodes; external DHCP servers are configured and border nodes relay requests.
- C. Standard DHCP servers do not require Cisco SD-Access extensions; Option-82 provides necessary fabric integration information.
Question 70
An engineer is upgrading a company's main site to include a connection to a second ISP. The company will receive full Internet routing tables from both ISPs via BGP. The engineer must ensure that the company does not become a transit autonomous system. Which solution should be included in this design?
Show answer and explanation
Correct answer: A. Tag incoming routes from both ISPs with BGP community no-export.
To prevent a company from becoming a transit autonomous system when receiving full Internet routing tables from multiple ISPs, the engineer should tag incoming routes from both ISPs with the BGP community no-export. This community attribute prevents the company from re-advertising those routes to other neighbors, ensuring the company only announces its own prefixes and does not inadvertently carry transit traffic between the two ISPs.
Why the other options are wrong
- B. Lowering MED (Multi-Exit Discriminator) influences outbound traffic from an ISP but does not prevent transit traffic from being routed through the company's network.
- C. Preventing all prefix advertisement would also prevent the company from advertising its own prefixes, breaking legitimate outbound connectivity.
- D. Modifying local-preference affects inbound route selection but does not prevent the company from re-advertising learned routes to other peers.
Question 71
An engineer must design a solution to provide backup connectivity between two sites. The engineer plans to use an Internet connection, but company policy requires the connection to be encrypted. Additionally, there are several applications that utilize multicast to deliver video streams between the sites. Which technology should the design include?
Show answer and explanation
Correct answer: A. GRE over IPsec
GRE over IPsec is the correct choice because GRE supports multicast traffic while IPsec provides encryption for security compliance. GRE encapsulates the multicast packets, which IPsec then encrypts end-to-end. This combination meets both requirements: multicast video stream delivery and mandatory encryption over the Internet.
Why the other options are wrong
- B. IPsec direct encapsulation does not support multicast traffic, making it unsuitable for video stream applications.
- C. GETVPN is designed for large-scale deployments and uses IPsec, but does not natively support multicast in the same way GRE does.
- D. DMVPN is a hub-and-spoke topology solution and, while it can use GRE and IPsec, is unnecessarily complex for a simple two-site backup connection.
Question 72
An engineer must design a large Layer 2 domain that contains hundreds of switches and VLANs. The engineer's primary goals are to: • Efficiently utilize the bandwidth of all links • Avoid Layer 2 loops • Cause minimal impact on switch CPU and memory Which technology should the engineer include in the design?
Show answer and explanation
Correct answer: A. MST
MST (Multiple Spanning Tree) is designed for large Layer 2 domains with many VLANs. It maps multiple VLANs to spanning tree instances, efficiently utilizing bandwidth across all links while avoiding loops with minimal CPU and memory overhead compared to running separate spanning tree instances per VLAN.
Why the other options are wrong
- B. Rapid PVST+ runs one spanning tree instance per VLAN, consuming excessive CPU and memory in networks with hundreds of VLANs.
- C. RSTP provides faster convergence but still requires one instance per VLAN in modern deployments, making it inefficient for hundreds of VLANs.
- D. PVST+ is legacy and even less efficient than Rapid PVST+ for large-scale deployments with many VLANs.
Question 73
An engineer is designing a multicast network for a financial application. Most of the multicast sources also receive multicast traffic (many-tomany deployment model). To better scale routing tables, the design must not use source trees. Which multicast protocol satisfies these requirements?
Show answer and explanation
Correct answer: D. BIDIR-PIM
BIDIR-PIM (Bidirectional PIM) is designed for many-to-many multicast deployments where sources are also receivers. It eliminates source trees by using only shared trees rooted at a rendezvous point, significantly reducing routing table size and complexity. PIM-SSM requires source-specific trees and does not support many-to-many efficiently, PIM-SM uses source trees which contradicts the requirement, and MSDP is an interdomain routing protocol not a tree-building mechanism.
Why the other options are wrong
- A. PIM-SSM relies on source trees and is designed for one-to-many deployments, not many-to-many.
- B. PIM-SM creates source trees which increase routing table size, conflicting with the scalability requirement.
- C. MSDP is a protocol for sharing multicast sources across domains, not a mechanism for tree selection in many-to-many deployments.
Question 74
A global organization with several branches hired a network architect to design an overlay VPN solution. The branches communicate with each other frequently. The customer expects to add more branches in the future. To meet the customer's security requirements, the architect plans to provide traffic protection using dynamic IPsec tunnels. Which solution should the architect choose?
Show answer and explanation
Correct answer: A. DMVPN
DMVPN is the optimal solution for this scenario because it provides dynamic IPsec tunnels with branch-to-branch communication capability and exceptional scalability for growing networks. It eliminates the need for manual tunnel configuration between each site pair and supports spoke-to-spoke communication, meeting all the stated requirements. EasyVPN is primarily for remote access, L2TP is a tunneling protocol without dynamic IPsec capabilities, and GETVPN is for encryption over MPLS networks without dynamic tunnel formation.
Why the other options are wrong
- B. EasyVPN is designed for remote access VPN, not multi-branch site-to-site connectivity
- C. L2TP is a tunneling protocol that does not provide dynamic IPsec tunnel management
- D. GETVPN encrypts traffic within MPLS networks but lacks the dynamic tunnel capabilities needed here
Question 75
Which feature must be incorporated into the campus LAN design to enable Wake on LAN?
Show answer and explanation
Correct answer: B. directed broadcasts on layer 3 devices
Directed broadcasts on Layer 3 devices are required to enable Wake on LAN (WoL) functionality. Wake on LAN relies on broadcast packets (magic packets) being sent to wake sleeping hosts. Layer 3 devices block broadcasts by default, so directed broadcast must be explicitly enabled to allow these packets to traverse from the network into the local LAN segment where the sleeping hosts reside. Without directed broadcasts, WoL magic packets cannot reach the target hosts.
Why the other options are wrong
- A. Dynamic ARP Inspection Snooping protects against ARP spoofing attacks and is not required for Wake on LAN.
- C. Proxy ARP enables a router to respond to ARP requests on behalf of another host but does not facilitate broadcast delivery for Wake on LAN.
- D. DHCP Snooping prevents unauthorized DHCP servers and does not enable Wake on LAN broadcast delivery.
Question 76
How is end-to-end microsegmentation enforced in a Cisco SD-Access architecture?
Show answer and explanation
Correct answer: C. SGTs and SGTACLs are used to control access to various resources.
End-to-end microsegmentation in Cisco SD-Access is enforced through Security Group Tags (SGTs) and Security Group Access Control Lists (SGACLs). SGTs classify users and devices, while SGACLs define which traffic is permitted or denied between different security groups, enabling granular policy control independent of network location.
Why the other options are wrong
- A. VLANs are legacy Layer 2 segmentation and are not the primary mechanism in modern SD-Access.
- B. Traditional 5-tuples and ACLs do not provide the identity-based, location-independent microsegmentation that SD-Access delivers.
- D. VRFs segment traffic at Layer 3 but do not provide the fine-grained identity-based control of SGT/SGACL.
Question 77
An engineer is tasked with designing a dual BGP peering solution with a service provider. The design must meet these conditions: * The routers will not learn any prefix with a subnet mask greater than /24. * The routers will determine the routes to include in the routing table based on the length of the mask alone. * The routers will make this selection regardless of the service provider configuration. Which solution should the engineer include in the design?
Show answer and explanation
Correct answer: D. Use an IP prefix list to block the desired networks and apply the IP prefix list to BGP neighbors inbound.
An IP prefix list applied inbound to BGP neighbors is the correct solution for filtering prefixes based on subnet mask length. Prefix lists are specifically designed to match routes based on prefix length and can be applied inbound to prevent the router from accepting prefixes with masks greater than /24. The inbound direction ensures the filtering occurs when routes are received from the service provider, regardless of what the provider sends. This method is independent of provider configuration because the filtering decision is made locally on the receiving router.
Why the other options are wrong
- A. Route maps with access lists do not efficiently filter based on prefix length alone and are more complex than necessary for this requirement.
- B. Applying filtering outbound affects advertisements sent to the provider, not received routes, and does not prevent the router from learning unwanted prefixes.
- C. Prefix lists applied outbound filter what is advertised to neighbors, not what is learned, so the router would still learn unwanted prefixes.
Question 78
An engineer is designing a BGP network for a large customer. To permit efficient scaling, the BGP domain is split into clusters. Which peering solution should be used between the route reflectors in different clusters for the BGP routes to be propagated appropriately?
Show answer and explanation
Correct answer: B. The route reflectors should be nonclients with regards to each other.
When multiple route reflector clusters exist, the route reflectors between clusters must be configured as non-clients of each other. This means they peer as regular IBGP peers without a client-reflector relationship. When route reflectors are non-clients to each other, they exchange routes normally and propagate them throughout their respective clusters, ensuring proper route distribution across cluster boundaries while maintaining the scalability benefits of the route reflection architecture.
Why the other options are wrong
- A. Configuring reflectors as clients of each other creates a circular dependency and breaks the hierarchical cluster model.
- C. Route reflectors must have peering relationships to exchange routes between clusters; without peering, inter-cluster communication fails.
- D. Requiring another non-client router as an intermediary adds unnecessary complexity and creates a single point of failure between clusters.
Question 79
Which control-plane technology allows the same subnet to exist across multiple network locations?
Show answer and explanation
Correct answer: A. LISP
LISP (Locator/ID Separation Protocol) is a control-plane technology that decouples device identity (EID) from network location (RLOC), enabling the same subnet to exist across multiple geographical locations. Devices can move between locations while maintaining their Layer 2 presence and IP addressing, as LISP maps logical identifiers to physical locations dynamically.
Why the other options are wrong
- B. VXLAN is a data-plane encapsulation technology that extends Layer 2 segments but requires the same VLAN ID across locations, not the ability to have identical subnets in separate locations.
- C. FabricPath is a Cisco data-center switching protocol for loop-free topologies within a single fabric, not a control-plane mechanism for multi-location subnet extension.
- D. ISE mobility services provide authentication and policy services for user mobility but do not enable the same subnet to exist across multiple network locations.
Question 80
Which nonproprietary mechanism can be used to automate rendezvous point distribution in a large PIM domain?
Show answer and explanation
Correct answer: B. BSR
Bootstrap Router (BSR) is the nonproprietary, standards-based mechanism for automated RP distribution in PIM domains. BSR uses a bootstrap message to dynamically advertise candidate RPs throughout the domain without manual configuration. Embedded RP and Static RP require manual configuration, while Auto-RP is a Cisco proprietary mechanism.
Why the other options are wrong
- A. Embedded RP requires manual configuration within group addresses.
- C. Auto-RP is a proprietary Cisco mechanism, not a nonproprietary standard.
- D. Static RP requires manual configuration on each router.
Question 81
Which two techniques improve the application experience in a Cisco SD-WAN design? (Choose two.)
Show answer and explanation
Correct answer: A, D. utilizing forward error correction; utilizing quality of service
Forward error correction (FEC) and quality of service (QoS) are the two primary techniques that directly improve application experience in Cisco SD-WAN designs. FEC adds redundancy to transmitted data, allowing recovery from packet loss without retransmission, which reduces latency and improves performance over unreliable links. QoS prioritizes traffic based on application requirements, ensuring critical applications receive adequate bandwidth and low latency. Together, these techniques optimize application performance across the SD-WAN fabric by addressing packet loss and ensuring appropriate resource allocation.
Why the other options are wrong
- B. A stateful application firewall provides security inspection but does not inherently improve application experience or performance metrics.
- C. AMP (Advanced Malware Protection) is a security feature that detects and prevents malware threats, not a technique for improving application experience.
- E. Cisco Umbrella provides DNS-layer security and threat protection but does not directly enhance application performance or user experience.
Question 82
Which routes does the overlay management protocol advertise in an SD-WAN overlay?
Show answer and explanation
Correct answer: C. prefix, TLOC, and service
The SD-WAN overlay management protocol advertises three critical route types: prefix routes (destination networks), TLOC routes (transport location identifiers representing physical paths), and service routes (indicating available services at each location). These three route categories comprise the complete routing information needed to establish and maintain the overlay network. The protocol uses these route types to enable dynamic path selection and service routing decisions.
Why the other options are wrong
- A. Underlay and MPLS are not advertised by the overlay management protocol; these represent underlying transport layers separate from the overlay control plane.
- B. Primary, backup, and load-balanced are path behaviors, not route types advertised by the overlay management protocol.
- D. Internet, MPLS, and backup are transport types or behaviors, not the specific route categories advertised by the overlay routing protocol.
Question 83
A company with multiple service providers wants to speed up BGP convergence time in the event a failure occurs with their primary link. Which approach achieves this goal and does not impact router CPU utilization?
Show answer and explanation
Correct answer: D. Utilize BFD and keep the default BGP timers
BFD (Bidirectional Forwarding Detection) detects link failures in milliseconds independent of routing protocol timers, enabling fast BGP convergence without requiring CPU-intensive timer adjustments. Using BFD with default BGP timers is optimal because BFD operates at the hardware level and does not impact CPU utilization while still achieving rapid failure detection. Lowering BGP hello/keepalive intervals would achieve faster convergence but increases CPU load due to frequent timer processing.
Why the other options are wrong
- A. Tuning the BFD multiplier to 50 would slow down BFD detection rather than speed up convergence.
- B. Lowering the BGP hello interval increases routing protocol overhead and CPU utilization.
- C. Decreasing the BGP keepalive timer increases routing protocol overhead and CPU utilization.
Question 84
An organization is designing a detailed QoS plan that limits bandwidth to specific rates. Which two parameters are supported by the traffic policing feature? (Choose two.)
Show answer and explanation
Correct answer: A, E. violating; conforming
Traffic policing supports conforming and violating parameters. Conforming traffic is within the configured rate limit, while violating traffic exceeds the configured rate. These parameters determine what actions are taken on the traffic, such as marking or dropping. Marking is a classification action not a policing parameter, shaping is a different QoS mechanism altogether, and bursting relates to the token bucket algorithm mechanics rather than policing classification parameters.
Why the other options are wrong
- B. Marking is a classification or remarking action applied based on policing results, not a policing parameter itself.
- C. Shaping is a separate QoS mechanism and not a parameter of the policing feature.
- D. Bursting is a token bucket algorithm characteristic related to bucket depth, not a classification parameter of policing.
Question 85
In an SD-WAN architecture, which methods are used to bootstrap a vEdge router?
Show answer and explanation
Correct answer: C. ZTP or manual configuration
vEdge routers in Cisco SD-WAN are bootstrapped through Zero Touch Provisioning (ZTP) or manual configuration. ZTP enables automatic provisioning where devices contact the vManage platform using cloud-hosted onboarding services, eliminating manual configuration. Manual configuration is the alternative when ZTP is not used. DHCP options and DNS records are not primary bootstrap mechanisms for vEdge routers in standard SD-WAN deployments.
Why the other options are wrong
- A. DHCP options and manual configuration are not the standard bootstrap methods; ZTP is the primary automated bootstrap mechanism.
- B. vManage provides management functions but is not itself a bootstrap method; DNS records are not used for vEdge bootstrap.
- D. DNS records and DHCP options are not the standard bootstrap mechanisms for Cisco SD-WAN vEdge routers.
Question 86
Which design consideration must be made when dual WAN Edge routers are deployed at a branch site?
Show answer and explanation
Correct answer: C. Traffic must be symmetrical as it egresses the WAN Edges and returns from remote sites for DPI to function properly.
When dual WAN Edge routers are deployed at a branch site, traffic must be symmetrical as it egresses the WAN Edges and returns from remote sites for Deep Packet Inspection (DPI) to function properly. Asymmetrical routing, where traffic takes different paths in each direction, causes DPI engines to miss traffic patterns and fail to properly classify flows, defeating security and QoS policies that depend on complete flow visibility.
Why the other options are wrong
- A. BGP AS-path prepending and MED are used in service provider networks but are not applicable to managing dual WAN Edge routers at a branch site, which typically use overlay protocols rather than BGP.
- B. HSRP is a first-hop redundancy protocol for default gateways, not for managing dual WAN Edge routing or OMP policy preferences in SD-WAN.
- D. While BFD can detect link failures, sub-second failure detection between WAN Edge routers is not a mandatory design consideration for dual edge deployments.
Question 87
An architect must create a QoS solution for a customer to ensure that a 40 Mbps Internet connection is shared between four subnets based on these requirements: * Each subnet must receive no less than 10 Mbps of download bandwidth during peak traffic times. * A subnet can use up to 40 Mbps during nonpeak traffic times if the other subnets are idle. * Download traffic must never experience a delay. Which solution must the architect choose?
Show answer and explanation
Correct answer: B. bandwidth percentage and policing
Bandwidth percentage allocation ensures each subnet receives a guaranteed minimum (10 Mbps each), while policing enforces these limits during peak times without adding delay. Policing drops excess traffic immediately rather than queuing, preventing the delay mentioned in the requirements. This combination meets the guarantee requirement and nonpeak flexibility while maintaining zero-delay performance.
Why the other options are wrong
- A. Rate-limiting introduces delay as traffic is queued, violating the zero-delay requirement.
- C. Shaping queues excess traffic which introduces delay, conflicting with the no-delay requirement.
- D. Rate-limiting still causes delay, and this approach does not provide the required traffic management guarantees.
Question 88
Which feature is required for graceful restart to recover from a processor failure?
Show answer and explanation
Correct answer: C. Stateful Switchover
Stateful Switchover (SSO) is the feature required for graceful restart to recover from processor failures. SSO allows the standby processor to take over from the active processor while maintaining state information, enabling continuous operation without service disruption or loss of protocol sessions.
Why the other options are wrong
- A. Cisco Express Forwarding is a forwarding mechanism, not a recovery feature for processor failure.
- B. Virtual Switch System enables switch clustering but is not the mechanism for graceful restart.
- D. Bidirectional Forwarding Detection detects link failures but does not enable graceful restart from processor failures.
Question 89
What is one function of the vSmart controller in an SD-WAN deployment?
Show answer and explanation
Correct answer: B. responsible for the centralized control plane of the SD-WAN network
The vSmart controller is the centralized control plane component of SD-WAN. It distributes policies, establishes overlay connectivity rules, and manages the routing of traffic across the SD-WAN fabric. The vSmartController maintains the authoritative routing state and communicates with all edge devices to coordinate the overlay network behavior. This centralized control plane is fundamental to SD-WAN's dynamic path selection and policy-based routing capabilities.
Why the other options are wrong
- A. Orchestration of connectivity is a management function typically handled by vManage, not the vSmart controller.
- C. Centralized management and GUI monitoring are provided by vManage, which is the management plane, not the vSmart controller.
- D. Data-plane functions are performed by vEdge and cEdge routers, not controllers; controllers operate in the control plane.
Question 90
An architect is designing a network that will utilize the spanning tree protocol to ensure a loop-free topology. The network will support an engineering environment where it is necessary for end-users to connect their own network switches for testing purposes. Which feature should the architect include in the design to ensure the spanning-tree topology is not affected by these rogue switches?
Show answer and explanation
Correct answer: D. root guard
Root guard protects the spanning tree topology by preventing rogue switches from becoming the root bridge. When a switch with a better BPDU (lower bridge ID) attempts to take over as root, root guard blocks the port, maintaining the intended root bridge. This is essential in environments where untrusted devices like user-owned test switches may be connected. Root guard allows the network to remain stable despite topology changes introduced by rogue equipment.
Why the other options are wrong
- A. BPDU Skew Detection identifies timing anomalies in BPDU reception but does not prevent rogue switches from affecting the topology.
- B. BPDU Guard disables ports that receive BPDUs, but is typically used on access ports where switches should not exist, not for controlling rogue bridge elections.
- C. Loop Guard prevents alternate or root ports from becoming designated ports during failures, but does not prevent rogue switches from advertising superior BPDUs.
Question 91
When IPsec VPNs are designed, what is a unique requirement if support for IP Multicast is required?
Show answer and explanation
Correct answer: A. encapsulation of traffic with GRE or VTI
IPsec in tunnel mode encrypts the entire packet, including the IP header, which prevents multicast addressing information from being preserved across the tunnel. To support IP Multicast traffic over IPsec VPNs, traffic must be encapsulated using GRE (Generic Routing Encapsulation) or VTI (Virtual Tunnel Interface) tunnels that are then protected by IPsec. This double-encapsulation allows multicast packets to traverse the encrypted tunnel while maintaining their multicast semantics.
Why the other options are wrong
- B. IPsec transport mode protects only the payload while leaving the IP header in clear, which does not solve the multicast encapsulation problem.
- C. Additional bandwidth may be a consequence of encapsulation but is not a unique IPsec requirement specific to multicast support.
- D. IPsec tunnel mode alone does not support multicast; the encapsulation requirement is what necessitates GRE or VTI.
Question 92
An ISP provides Layer 3 VPN service over MPLS to a customer with four branches and multiple CE routers at each branch. To exchange the routes that are learned from the CE routers, which BGP address family should the ISP activate among the PE routers?
Show answer and explanation
Correct answer: C. VPNv4 unicast
In MPLS Layer 3 VPN, PE routers exchange customer routes using the VPNv4 unicast address family, which allows them to maintain separate routing tables for each VPN while exchanging routes across the provider network. VPNv4 includes both the customer IPv4 prefix and a Route Distinguisher that keeps routes from different customers or sites separate. Multicast is for multicast routing, L2VPN EVPN is for Layer 2 services, and IPv4 unicast alone cannot distinguish between overlapping customer subnets.
Why the other options are wrong
- A. Multicast address family is used for multicast traffic, not unicast route exchange between PE routers
- B. L2VPN EVPN is used for Layer 2 VPN services, not Layer 3 VPN routing
- D. IPv4 unicast does not provide the Route Distinguisher needed to separate customer routes in MPLS L3 VPN
Question 93
Which function are fabric intermediate nodes responsible for in an SD-Access Architecture?
Show answer and explanation
Correct answer: D. transporting IP packets between edge nodes and border nodes
Fabric intermediate nodes (transit nodes) are responsible for transporting IP packets between edge nodes and border nodes through the fabric underlay. They perform the core forwarding function within the SD-Access fabric, routing VXLAN-encapsulated traffic according to the underlay routing topology. Mapping EIDs and registering endpoints are control plane functions handled by controllers, while traffic encapsulation is performed at edge nodes.
Why the other options are wrong
- A. Mapping EIDs to RLOCs is a control plane function performed by SD-Access controllers, not intermediate nodes.
- B. VXLAN encapsulation is performed at fabric edge nodes, not intermediate nodes.
- C. Registering endpoints in the HTDB is a control plane function, not a data plane function of intermediate nodes.
Question 94
Which component is part of the Cisco SD-Access overlay architecture?
Show answer and explanation
Correct answer: A. border node
Border nodes are edge devices in the SD-Access overlay architecture that connect the fabric overlay to external networks and services, providing translation between LISP-encapsulated fabric traffic and standard IP routing. They are a core overlay component. Spine and leaf nodes are underlay fabric components (not overlay), and DNA Center is a management platform, not an overlay architectural component.
Why the other options are wrong
- B. Spine nodes are part of the underlay fabric topology, not the overlay architecture.
- C. Leaf nodes are underlay fabric access switches, not overlay architecture components.
- D. DNA Center is a management and automation platform, not part of the overlay architecture itself.
Question 95
An engineer must propose a solution for a campus network that includes the capability to create multiple Layer 3 virtual networks. Each network must have its own addressing structure and routing table for data forwarding. The solution must be scalable to support hundreds of virtual networks and allow simple configuration and management with minimal administrative overhead. Which solution does the engineer recommend?
Show answer and explanation
Correct answer: B. multihop MPLS core
For a scalable campus solution supporting hundreds of Layer 3 virtual networks with independent addressing and routing tables, a multihop MPLS core is the appropriate recommendation. MPLS enables the creation of multiple forwarding planes via VRFs and provides scalable label-based forwarding that easily supports hundreds of virtual routing instances with minimal administrative overhead compared to hop-by-hop manual routing.
Why the other options are wrong
- A. Hop-by-hop EVN (Ethernet Virtual Networks) is not designed for hundreds of Layer 3 virtual networks and adds significant complexity to campus configurations.
- C. Multihop IPsec tunneling for hundreds of virtual networks would create excessive tunnel overhead and complexity, making it impractical and difficult to manage.
- D. Hop-by-hop VRF-Lite requires manual configuration at each hop, creating substantial administrative overhead that does not scale to hundreds of virtual networks.
Question 96
An engineer is creating a design to enable IPv6 to run on an existing IPv4 IS-IS network. The IPv4 and IPv6 topologies will match exactly, and the engineer plans to use the same IS-IS router levels for each protocol per interface. Which IS-IS design is required?
Show answer and explanation
Correct answer: C. single topology without enabling transition feature
When IPv6 is being enabled on an existing IPv4 IS-IS network with matching topologies and the same router levels per interface, a single topology approach without the transition feature is required. Modern IS-IS implementations support both IPv4 and IPv6 within a single topology by default. The transition feature is used only when IPv6 and IPv4 have different topologies or different router levels per interface; since the requirement specifies identical topologies and levels, the transition feature is unnecessary.
Why the other options are wrong
- A. Multi-topology without transition feature is not the correct design when supporting both IPv4 and IPv6 with identical topologies.
- B. The transition feature is unnecessary when topologies and levels are identical between IPv4 and IPv6.
- D. Multi-topology with transition is overly complex when a single topology can support both protocols with identical configurations.
Question 97
Which feature is used to optimize WAN bandwidth of IGMP network traffic among WAN Edge routers in the same VPN?
Show answer and explanation
Correct answer: C. multicast-replicator
The multicast-replicator feature optimizes WAN bandwidth by replicating multicast traffic at WAN Edge routers within the same VPN instead of sending duplicate copies across the WAN link. This reduces redundant multicast traffic and conserves bandwidth resources on WAN circuits.
Why the other options are wrong
- A. IGMPv2 is a multicast membership protocol version and does not optimize WAN bandwidth utilization.
- B. A multicast RP (Rendezvous Point) is a core multicast forwarding component, not a WAN bandwidth optimization feature.
- D. Multicast service routes are configuration elements for multicast paths, not a specific feature that optimizes WAN bandwidth replication.
Question 98
How do endpoints inside an SD-Access network reach resources outside the fabric?
Show answer and explanation
Correct answer: B. Fabric borders use VRFs to map VNs to VRFs
Fabric border nodes use VRFs to map Virtual Networks (VNs) to external VRFs, enabling traffic from endpoints inside an SD-Access fabric to reach resources outside the fabric. The border nodes perform de-encapsulation and VRF-based routing to direct traffic toward external networks. This mapping allows fabric traffic to exit through border nodes and reach non-fabric resources based on VRF association.
Why the other options are wrong
- A. VRF fusion routers are not a standard SD-Access component; border nodes handle VN-to-VRF mapping.
- C. SD-Access transit links connect fabric nodes but do not transport traffic to external networks.
- D. While border nodes do de-encapsulate VXLAN traffic, they use VRF mapping rather than just converting to normal IP traffic for external delivery.
Question 99
A company's security policy requires that all connections between sites be encrypted in a manner that does not require maintenance of permanent tunnels. The sites are connected through a private MPLS-based service that uses a dynamically changing key and spoke-to-spoke communication. Which type of transport encryption must be used in this environment?
Show answer and explanation
Correct answer: A. GETVPN
GETVPN is designed specifically for encrypting traffic over MPLS networks without establishing permanent tunnels, using dynamically managed keys distributed through a Key Server. It supports spoke-to-spoke communication and provides encryption that does not require tunnel maintenance overhead, making it ideal for private MPLS-based services with dynamic security associations. DMVPN requires tunnel establishment, GRE VPN is not a security-focused solution, and standard IPsec VPN requires permanent tunnel configuration.
Why the other options are wrong
- B. DMVPN requires tunnel establishment between sites, which contradicts the no-permanent-tunnels requirement
- C. GRE VPN does not provide encryption by itself and requires additional security mechanisms
- D. Standard IPsec VPN requires permanent tunnel configuration and maintenance between sites
Question 100
An organization plans to deploy multicast across two different autonomous systems. Their solution must allow RPs to: • discover active sources outside their domain • use the underlying routing information for connectivity with other RPs • announce sources joining the group Which solution supports these requirements?
Show answer and explanation
Correct answer: B. MSDP
MSDP (Multicast Source Discovery Protocol) is specifically designed to allow Rendezvous Points in different domains to discover active sources outside their domain, share source information between RPs, and announce sources joining groups. MSDP uses the underlying unicast routing information for connectivity between RPs across autonomous systems, making it the only protocol that meets all three requirements for inter-domain multicast deployment.
Why the other options are wrong
- A. SSM (Source Specific Multicast) does not support RP-to-RP communication or cross-domain source discovery.
- C. PIM-DM (Protocol Independent Multicast - Dense Mode) is designed for intradomain use and does not support RP mechanisms or inter-domain communication.
- D. PIM-SM (Protocol Independent Multicast - Sparse Mode) operates within a single domain and does not natively support cross-domain RP discovery or source announcements.
Question 101
A customer requests a VPN solution to connect multiple sites with the company headquarters. All the sites use the same IP subnet. The engineer plans to use VPLS. Which solution must the engineer include in the design?
Show answer and explanation
Correct answer: B. address translation to hide overlapping subnets
VPLS creates a virtual Layer 2 domain connecting multiple sites, but when all sites use the same IP subnet, address translation must be implemented to prevent routing conflicts and IP address duplication. The engineer must include NAT or similar address translation in the design to allow overlapping subnets to coexist. Different VLANs would not solve the overlapping subnet issue, 802.1Q connectivity is standard for VPLS but not the solution to overlapping subnets, and route exchange with the provider does not address Layer 2 address conflicts.
Why the other options are wrong
- A. Different VLANs do not prevent overlapping IP subnets from causing routing conflicts
- C. 802.1Q connectivity is expected in VPLS but does not solve the overlapping subnet problem
- D. Route exchange with the provider does not address the duplicate IP address issue at Layer 2
Question 102
How is redundancy achieved among Cisco vBond Orchestrators in a Cisco SD-WAN deployment?
Show answer and explanation
Correct answer: A. The IP addresses of all Orchestrators are mapped to a single DNS name.
In Cisco SD-WAN deployments, redundancy among vBond Orchestrators is achieved by mapping the IP addresses of all Orchestrators to a single DNS name. WAN Edge routers resolve this DNS name to discover all available Orchestrators, enabling automatic failover if one Orchestrator becomes unavailable. This approach provides transparent redundancy without requiring manual configuration of multiple IP addresses on each device.
Why the other options are wrong
- B. Selecting the closest Orchestrator does not provide true redundancy; it only optimizes latency but fails to protect against Orchestrator outages.
- C. While WAN Edge routers can be configured with multiple Orchestrators, using DNS mapping is the standard redundancy mechanism rather than static IP configuration with priority.
- D. Deploying a single Orchestrator per network eliminates redundancy entirely and creates a single point of failure.
Question 103
An architect is creating a migration strategy for a large organization in which the choice made by the application between IPv6 and IPv4 is based on the DNS request. Which migration strategy does the architect choose?
Show answer and explanation
Correct answer: C. dual-stack
Dual-stack is the migration strategy where an application can choose between IPv6 and IPv4 based on DNS resolution. In dual-stack environments, both protocols run simultaneously on the same network infrastructure, and applications query DNS for both A records (IPv4) and AAAA records (IPv6), then select which protocol to use based on the results. This allows gradual migration as applications and services are updated to support IPv6.
Why the other options are wrong
- A. AFT (Address Family Translation) is for public web presence and is not based on DNS request selection.
- B. Host-initiated tunnels are used to encapsulate IPv6 over IPv4 or vice versa, not to allow DNS-based protocol selection.
- D. Site-to-site IPv6 over IPv4 tunnels are for interconnecting IPv6 networks across IPv4 infrastructure, not for DNS-based application selection.
Question 104
Which component of Cisco SD-Access integrates with Cisco DNA Center to perform policy segmentation and enforcement through the use of security group access control lists and security group tags?
Show answer and explanation
Correct answer: C. Cisco Identity Services Engine
In SD-Access, Cisco ISE is the policy engine that integrates with Cisco DNA Center. DNA Center defines group-based policy and pushes it to ISE, which assigns Security Group Tags and distributes the SGACLs that the fabric enforces.
Why the other options are wrong
- A. APIC-EM is a legacy controller that predates DNA Center and is not the SD-Access policy component.
- B. Network Data Platform is an analytics component used for assurance, not policy segmentation.
- D. TrustSec is the underlying tagging technology, while ISE is the component that integrates with DNA Center to provide it.
That was 104 of 417.
The full Cisco 300-420 ENSLD pack has all 417 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 162 free as one PDF by email. Get the Half Pack →