Cisco 300-420 Bundle

A purely hub-and-spoke forwarding policy can add latency and load when the DMVPN design is intended to allow direct spoke shortcuts. “Use a supported DMVPN phase and NHRP routing design that safely establishes eligible spoke-to-spoke tunnels” would remedy that alternative situation, but it would not correct the present issue: GRE provides encapsulation for multiple protocols but does not itself encrypt or authenticate payload confidentiality.

“Align supported NHRP and tunnel registration settings and verify the hub can map the spoke's current public transport address” is the supported response when dynamic spoke resolution needs correct NHRP network ID, authentication, hub mapping and reachable tunnel source rather than only a live Internet connection. Here the decisive response is “Combine supported GRE transport with an appropriate IPsec protection design, or select a secure alternative meeting multicast needs”, so that different intervention does not meet the stated requirement.

Logical dual-circuit contracts may share a physical access path and suffer a common-cause outage. “Choose WAN edge circuits with validated last-mile, provider and facility diversity where the service recovery target requires it” applies to that other condition. The reported evidence is an architect proposes plain GRE between remote branches to carry multicast routing updates and claims GRE alone satisfies corporate confidentiality requirements; this alternative would address the wrong dependency.

That change concerns vrf-lite campus tenant isolation, where A common routing instance cannot enforce independent overlapping IP destinations and controlled route exposure by itself. The reported issue instead stems from: Missing site-level address summarization increases routing state and exposes the WAN to local campus topology churn.

That change concerns vacl segmentation inside one vlan, where An SVI routed ACL does not necessarily inspect intra-VLAN switched frames that never reach Layer 3 forwarding. In this question the necessary remedy is “Plan contiguous campus address blocks and advertise valid site summaries at L3 distribution or WAN boundaries”, which this alternative does not provide.

That change concerns campus distributed layer 3 access, where Extending Layer 2 broadly across campus buildings increases loop, convergence and failure-domain exposure. The observed condition is three campus sites advertise hundreds of access prefixes into a common WAN but changes at one site continuously trigger WAN routing state updates; this mechanism addresses another problem.

Without explicit multicast boundary control, group advertisements or forwarding may extend beyond authorized trust domains. “Apply supported multicast group or source boundary filtering at the appropriate WAN and tenant interfaces” would remedy that alternative situation, but it would not correct the present issue: RP location affects shared-tree path efficiency and control resilience for ASM groups and can create a remote common-mode dependency.

“Assess multicast replication at branching points or other supported content distribution design with receiver policy” is the supported response when naive replicated unicast can consume far more shared-link capacity than a suitable multicast tree for many receivers. Here the decisive response is “Choose strategically located and redundant RPs considering source and receiver topology, routing cost and failover”, so that different intervention does not meet the stated requirement.

Multicast RPF decisions can be sensitive to unicast path selection, including ECMP and asymmetric routing behavior. “Align multicast source reachability and acceptable RPF design with supported ECMP handling and stable upstream selection” applies to that other condition. The reported evidence is an enterprise places its single PIM rendezvous point at a remote edge site with unstable connectivity and sees long join delays for the entire multicast domain; this alternative would address the wrong dependency.

A high-speed physical port does not imply equal committed service rate, so uncontrolled bursts can be discarded in the provider network. “Revalidate shaping rates against provider CIR and accounting overhead after circuit or device changes” would remedy that alternative situation, but it would not correct the present issue: overly aggressive polling can consume limited control-plane CPU and management bandwidth without improving decision quality.

“Test management service continuity as part of data center disaster recovery rather than only device link redundancy” is the supported response when central monitoring infrastructure can become a single point of failure even when individual access devices have redundant uplinks. Here the decisive response is “Capacity-test telemetry subscription counts and sampling periods before expanding monitoring fleets”, so that different intervention does not meet the stated requirement.

ASM shared-tree setup may depend on reachable RP control functions that need deliberate redundancy. “Include RP election, anycast or redundancy testing during multicast design acceptance” applies to that other condition. The reported evidence is a team polls every interface on hundreds of switches every second over the production WAN and then experiences management-plane load spikes; this alternative would address the wrong dependency.

Unauthenticated routing adjacencies on a shared segment create topology-manipulation exposure and accidental peer acceptance. “Enable the appropriate supported OSPF authentication and key rollout at trusted adjacency boundaries” would remedy that alternative situation, but it would not correct the present issue: a BGP TCP session does not automatically negotiate or advertise every address family without appropriate capabilities and policy.

“Apply explicit approved outbound prefix filters at the eBGP boundary and validate maximum prefix expectations” is the supported response when unrestricted BGP export policy exposes destinations not authorized for upstream announcement and risks routing leaks. Here the decisive response is “Enable intended IPv6 unicast AFI/SAFI activation, reachable next hops and export filtering consistently on peers”, so that different intervention does not meet the stated requirement.

Default broadcast OSPF network behavior can elect designated routers even when the topology is only a two-router link. “Use supported point-to-point OSPF network type consistently on both sides where the physical design permits” applies to that other condition. The reported evidence is two enterprise BGP routers establish a TCP session and exchange IPv4 reachability but their IPv6 networks remain absent after enabling the underlying IPv6 interface; this alternative would address the wrong dependency.

OSPF hierarchical inter-area connectivity depends on a stable backbone design and resilient area border connectivity. “Design redundant ABRs with valid backbone area connectivity and deterministic cost preferences for inter-area paths” would remedy that alternative situation, but it would not correct the present issue: external Type 2 cost behavior does not account for internal cost in the same way as Type 1 when external metrics differ.

“Choose a supported stub-area design consistently across the area and ensure the ABR provides an appropriate default route” is the supported response when a normal area floods external routing information that stub-capable branches may not need when a default route is sufficient. Here the decisive response is “Select E1 or E2 route treatment to reflect the required exit preference, testing both external and internal metrics”, so that different intervention does not meet the stated requirement.

A totally stubby or regular stub area cannot originate external LSAs through an internal ASBR in the required manner. “Design a supported NSSA with correct Type 7 origination and ABR translation handling where needed” applies to that other condition. The reported evidence is a redistribution design sends external OSPF Type 2 routes across sites with very different internal transit costs, yet expects remote sites to prefer the closest exit; this alternative would address the wrong dependency.

A fabric control plane supplies locator information, while the data plane uses supported VXLAN encapsulation to carry endpoint traffic. “Design overlay forwarding paths with validated VXLAN reachability, fabric edge encapsulation and proper transport MTU” would remedy that alternative situation, but it would not correct the present issue: fabric overlay endpoints require a suitable border function to exchange external route reachability with nonfabric networks.

“Use supported redundant LISP control-plane nodes and verify endpoint registration and mapping refresh behavior” is the supported response when fabric control-plane endpoint-to-location mapping must reflect movement and be consistent with current host registration. Here the decisive response is “Select appropriate fabric border nodes and external routing policy matching the site's transit and segmentation needs”, so that different intervention does not meet the stated requirement.

Ordinary underlay reachability does not assign endpoint onboarding and VXLAN edge functions to a nonfabric access device. “Provision eligible access devices as supported fabric edge nodes and verify host onboarding and virtual network assignments” applies to that other condition. The reported evidence is fabric users can communicate internally, but no external network reaches them because no node provides the correct border between fabric and traditional campus routing; this alternative would address the wrong dependency.

Local breakout bypasses central inspection unless equivalent secure edge controls and policy are deliberately placed. “Treat breakout decisions as combined WAN and security design approvals rather than routing-only changes” would remedy that alternative situation, but it would not correct the present issue: remote-only controller dependencies and insufficient regional capacity can degrade onboarding, resiliency and convergence at scale.

“Review VPN to VRF mapping and centralized policy whenever adding new tenant classes” is the supported response when an unsegmented overlay routing context can make trust-boundary errors more likely even if some edge access rules exist. Here the decisive response is “Capacity-test controller sessions and regional redundancy before large multi-region migration waves”, so that different intervention does not meet the stated requirement.

Static transport preference does not substitute for application-aware path decisions using measured latency, loss and jitter. “Review application SLAs and measurement probes after changing WAN providers or regional geography” applies to that other condition. The reported evidence is a global SD-WAN fabric grows across continents but keeps every edge tied to a distant single control region, causing instability during regional carrier outages; this alternative would address the wrong dependency.

Routing graceful restart requires compatible neighbor capability and safe stale-route lifetimes, not merely redundant uplinks. “Test interactions between graceful restart, BFD and partial data-plane failure before relying on nonstop behavior” would remedy that alternative situation, but it would not correct the present issue: a virtualized or stacked switching design needs supported control, state and multichassis link mechanisms to act as one logical system.

“Include root placement and protection checks in switch onboarding templates” is the supported response when without deliberate STP root design, Layer 2 forwarding paths may traverse inappropriate access hardware. Here the decisive response is “Evaluate shared-control-plane failure risk and upgrade procedures when choosing platform abstraction over independent switches”, so that different intervention does not meet the stated requirement.

Unprotected edge-port fast transition can introduce topology-change or loop risks if another bridge is attached. “Periodically test edge-port protections and review exceptions for meeting rooms and shared desks” applies to that other condition. The reported evidence is two distribution switches are intended to behave as one logical platform, but engineers assume separate independent control planes deliver the same cross-chassis link semantics; this alternative would address the wrong dependency.

PIM DR election provides a defined designated router role on a multiaccess segment to avoid conflicting join responsibilities. “Record PIM DR priorities and test host join continuity after an access router outage” would remedy that alternative situation, but it would not correct the present issue: source-specific multicast applications need supported source-aware receiver membership signaling, commonly IGMPv3 for IPv4.

“Test multicast forwarding path changes and source-tree utilization for large streaming applications” is the supported response when ASM initially uses a shared RP tree and may switch to source-specific shortest-path forwarding according to design and platform behavior. Here the decisive response is “Verify switch snooping and receiver protocol versions before enabling SSM at scale”, so that different intervention does not meet the stated requirement.

Independent rendezvous points do not automatically exchange all active-source information across ASM multicast domains. “Maintain explicit source and RP boundary policy in interdomain multicast peering arrangements” applies to that other condition. The reported evidence is a video delivery platform wants receivers to accept only one known multicast source per group but the access network uses receiver signaling that cannot express source preference; this alternative would address the wrong dependency.

Bidirectional multipoint redistribution without route tagging or authoritative direction can reintroduce routes into their source protocol. “Apply explicit redistribution filters, tags, metrics and domain ownership at each boundary with deliberate failure fallback” would remedy that alternative situation, but it would not correct the present issue: MST region membership requires consistent region identifier, revision and VLAN mapping rather than matching only some VLAN names.

“Enable appropriate UDLD modes on supported fiber links and validate shutdown and recovery procedures” is the supported response when physical link-up is insufficient to guarantee bidirectional signal integrity, which can affect control-plane protocols and forwarding. Here the decisive response is “Align approved MST region configuration and verify boundary ports and per-instance root placement”, so that different intervention does not meet the stated requirement.

A per-VLAN spanning-tree model scales protocol state with VLAN count and may become less efficient than suitable aggregated instances. “Assess MST or Layer 3 access boundaries against actual traffic steering and availability requirements” applies to that other condition. The reported evidence is two campus buildings should share one MST region but have different region names or VLAN-to-instance maps, unexpectedly changing STP behavior at the boundary; this alternative would address the wrong dependency.