Cisco 300-420 Bundle

Overly aggressive polling can consume limited control-plane CPU and management bandwidth without improving decision quality. “Select telemetry collection intervals and methods proportional to observed change rates and device capacity” would remedy that alternative situation, but it would not correct the present issue: central monitoring infrastructure can become a single point of failure even when individual access devices have redundant uplinks.

“Design correct multicast reverse paths and compatible unicast routing so upstream interfaces pass the RPF check” is the supported response when multicast RPF typically checks the route back toward the source or RP, not merely whether a receiver destination is reachable. Here the decisive response is “Design appropriate collector and transport redundancy with supported failover and secure retention behavior”, so that different intervention does not meet the stated requirement.

Uncoordinated system clocks undermine log chronology, audit correlation and incident reconstruction. “Use resilient approved NTP sources with authenticated or trusted network delivery where supported” applies to that other condition. The reported evidence is a national enterprise sends every configuration backup and log to one management collector in a single data center with no alternate destination; this alternative would address the wrong dependency.

Naive unicast replication can consume excessive WAN capacity, while multicast support depends on platform and overlay design. “Choose a supported multicast distribution and replication approach with measured receiver count and transport constraints” would remedy that alternative situation, but it would not correct the present issue: static transport preference does not substitute for application-aware path decisions using measured latency, loss and jitter.

“Design supported regional controller and overlay architecture with redundancy, policy consistency and documented capacity limits” is the supported response when remote-only controller dependencies and insufficient regional capacity can degrade onboarding, resiliency and convergence at scale. Here the decisive response is “Create supported application-aware routing policy with validated SLA class thresholds and fallback behavior”, so that different intervention does not meet the stated requirement.

An unsegmented overlay routing context can make trust-boundary errors more likely even if some edge access rules exist. “Use separate service VPN or VRF contexts with explicit leak rules and security policy at authorized shared-service borders” applies to that other condition. The reported evidence is a voice collaboration app takes the least-cost broadband transport even when packet loss breaches an SLA because policy only prefers link color and ignores live performance; this alternative would address the wrong dependency.

Management availability and existing data-plane forwarding have different dependencies, while loss of manageability remains an operational risk. “Design redundant supported SD-WAN Managers with backup, RBAC and regional management reachability as appropriate” would remedy that alternative situation, but it would not correct the present issue: IP reachability does not imply that IKE versions, cryptographic proposals, identities and authentication settings agree across peers.

“Evaluate supported GET VPN group key distribution and policy design where technology and business requirements fit” is the supported response when traditional point-to-point encryption tunnel meshes may add unnecessary topology and scale complexity for a trusted private routed underlay. Here the decisive response is “Plan supported matching IKE/IPsec transforms and identity validation with staged security upgrades on both gateways”, so that different intervention does not meet the stated requirement.

Tenant route separation blocks cross-VPN reachability until carefully controlled route-target import/export rules make the intended service available. “Design an approved extranet or shared-services VPN import/export model with explicit prefix filters and security enforcement” applies to that other condition. The reported evidence is two enterprise VPN gateways can ping one another but fail to establish a protected site-to-site tunnel after one side moves to a stronger IKE encryption suite; this alternative would address the wrong dependency.

A virtualized or stacked switching design needs supported control, state and multichassis link mechanisms to act as one logical system. “Select a validated stacking or virtual-switch architecture and plan supervisor, interconnect and software compatibility” would remedy that alternative situation, but it would not correct the present issue: unprotected edge-port fast transition can introduce topology-change or loop risks if another bridge is attached.

“Set primary and backup STP roots on appropriate distribution devices and validate bridge priority and path costs” is the supported response when without deliberate STP root design, Layer 2 forwarding paths may traverse inappropriate access hardware. Here the decisive response is “Apply supported PortFast or edge behavior with BPDU Guard and an approved exception procedure for genuine uplinks”, so that different intervention does not meet the stated requirement.

Routing graceful restart requires compatible neighbor capability and safe stale-route lifetimes, not merely redundant uplinks. “Use supported graceful restart and nonstop forwarding features only where peer compatibility and forwarding state can be verified” applies to that other condition. The reported evidence is a user-facing access port is configured as a fast transition edge port but an employee connects a small switch that starts sending BPDUs; this alternative would address the wrong dependency.

EIGRP unequal-cost load sharing is not enabled simply because multiple routes exist and is constrained by feasibility and variance. “Review maximum path and variance behavior during circuit upgrades and dual-WAN commissioning” would remedy that alternative situation, but it would not correct the present issue: mixed or unsuitable metric styles can undermine consistent path-cost planning and overflow the intended metric range.

“Test IPv4 and IPv6 reachability separately when extending a stable routing protocol deployment” is the supported response when protocol adjacency and IPv4 routes do not alone establish correct IPv6 reachability, interface addressing or address-family support. Here the decisive response is “Govern IS-IS metric templates and perform cost-map reviews when adding high-capacity links or changing topology”, so that different intervention does not meet the stated requirement.

Unbounded EIGRP query scope and nontransit spokes can prolong active route computation across a large topology. “Validate stub declaration and query-domain boundaries for every newly onboarded nontransit branch” applies to that other condition. The reported evidence is an enterprise upgrades IS-IS for high-capacity links but one region still relies on incompatible metric expectations, producing unintended path preference for long WAN circuits; this alternative would address the wrong dependency.

Traditional active-standby first-hop redundancy does not by itself provide the desired per-client gateway load distribution. “Consider GLBP where supported or a different routed access and anycast design, based on platform capability and operational needs” would remedy that alternative situation, but it would not correct the present issue: gateway role restoration depends on the selected FHRP protocol and its configured preemption settings, not priority numbers alone.

“Restore approved VLAN trunk reachability and compatible HSRP group and timer settings across both devices” is the supported response when FHRP peers must exchange control messages in a correctly shared VLAN to maintain a single active forwarding role. Here the decisive response is “Choose a documented VRRP preemption design with safe delay and reachability tracking that fits service stability goals”, so that different intervention does not meet the stated requirement.

A single physical gateway address makes host access depend on one distribution device even when a second gateway exists. “Design a supported FHRP virtual gateway with aligned priorities, Layer 2 reachability and safe failover between distribution switches” applies to that other condition. The reported evidence is after a higher-priority distribution router returns from maintenance, operations expects it to become master automatically but the chosen VRRP preemption behavior was disabled; this alternative would address the wrong dependency.

That change concerns is-is overload-bit during maintenance, where Premature use of a partially ready intermediate system can blackhole transit despite apparently formed control-plane neighbors. The reported issue instead stems from: IS-IS Level 1 operates within an area while Level 2 provides inter-area connectivity and should bound unwanted topology flooding.

That change concerns dual stack migration dependency planning, where Network dual stacking alone does not add AAAA DNS records, IPv6 listening services, security policy or path validation to existing applications. In this question the necessary remedy is “Design appropriate Level 1 and Level 2 adjacency placement with resilient L1/L2 border routers and reachable inter-area summaries”, which this alternative does not provide.

That change concerns ipv6 ula versus global addressing design, where Provider-dependent global prefixes may require renumbering when upstream connectivity changes and do not replace a stable local-only design. The observed condition is an enterprise runs IS-IS across two geographic areas but requires every Level 1 router to store all other areas' detailed link-state information; this mechanism addresses another problem.

Secure SD-WAN fabric admission requires authorized organization identifiers and valid identity trust, not just IP routing. “Design approved CA trust, certificate lifecycle and device authorization procedures for every control node and edge” would remedy that alternative situation, but it would not correct the present issue: VPN session status can be healthy while mismatched crypto ACLs or traffic selectors omit the application flow.

“Evaluate supported GET VPN group key distribution and policy design where technology and business requirements fit” is the supported response when traditional point-to-point encryption tunnel meshes may add unnecessary topology and scale complexity for a trusted private routed underlay. Here the decisive response is “Update both peers' protected prefix definitions and routing design with least-privilege permitted flows”, so that different intervention does not meet the stated requirement.

Encapsulation and encryption overhead reduce effective path MTU, and missing PMTUD control messages can stall large packets. “Budget tunnel overhead, validate tunnel MTU/MSS adjustment and preserve necessary ICMP feedback” applies to that other condition. The reported evidence is a site-to-site tunnel negotiates successfully but finance traffic fails because protected subnet traffic selectors exclude one new destination prefix; this alternative would address the wrong dependency.

Uncontrolled bidirectional redistribution can reintroduce routes, create loops and lose source-of-truth route preference. “Use explicit tag-based redistribution policy, defined metrics and directional filters at well-documented borders” would remedy that alternative situation, but it would not correct the present issue: network dual stacking alone does not add AAAA DNS records, IPv6 listening services, security policy or path validation to existing applications.

“Allocate /64 prefixes for SLAAC access segments while using more specialized lengths only in supported and justified designs” is the supported response when typical Ethernet SLAAC uses /64 interface identifiers and ordinary host autoconfiguration expectations are not met by arbitrary longer access prefixes. Here the decisive response is “Plan application-by-application dual-stack readiness including DNS, access controls, routing, management and rollback verification”, so that different intervention does not meet the stated requirement.

Provider-dependent global prefixes may require renumbering when upstream connectivity changes and do not replace a stable local-only design. “Use an appropriately generated unique-local IPv6 prefix for suitable internal services alongside routed global addressing where Internet access is needed” applies to that other condition. The reported evidence is a company turns on IPv6 routing at its branch WAN edge but assumes every application automatically supports IPv6 even though several server DNS records and firewall policies remain IPv4-only; this alternative would address the wrong dependency.

Using only the affected data-plane overlay for operational access can eliminate remote troubleshooting when the fabric fails. “Include recovery-path isolation and management access policy in branch deployment standards” would remedy that alternative situation, but it would not correct the present issue: data-plane tunnel presence does not guarantee that control-plane route advertisement and segmentation policy deliver needed service prefixes.

“Separate management-plane restoration targets from traffic-plane availability objectives in SLA design” is the supported response when management availability and existing data-plane forwarding have different dependencies, while loss of manageability remains an operational risk. Here the decisive response is “Audit route policy and tenant VPN scoping when adding branches to SD-WAN regions”, so that different intervention does not meet the stated requirement.

Secure SD-WAN fabric admission requires authorized organization identifiers and valid identity trust, not just IP routing. “Monitor certificate expiration and trust-chain changes across regional SD-WAN controllers” applies to that other condition. The reported evidence is a new branch has functioning encrypted transport tunnels but receives no remote service routes because centralized SD-WAN control policies omit the site; this alternative would address the wrong dependency.

MST region membership requires consistent region identifier, revision and VLAN mapping rather than matching only some VLAN names. “Align approved MST region configuration and verify boundary ports and per-instance root placement” would remedy that alternative situation, but it would not correct the present issue: traditional active-standby first-hop redundancy does not by itself provide the desired per-client gateway load distribution.

“Restore approved VLAN trunk reachability and compatible HSRP group and timer settings across both devices” is the supported response when FHRP peers must exchange control messages in a correctly shared VLAN to maintain a single active forwarding role. Here the decisive response is “Consider GLBP where supported or a different routed access and anycast design, based on platform capability and operational needs”, so that different intervention does not meet the stated requirement.

Gateway role restoration depends on the selected FHRP protocol and its configured preemption settings, not priority numbers alone. “Choose a documented VRRP preemption design with safe delay and reachability tracking that fits service stability goals” applies to that other condition. The reported evidence is a large access VLAN needs multiple distribution gateways to forward client traffic concurrently, but the proposed HSRP design forwards all hosts through one active router; this alternative would address the wrong dependency.