Cisco 300-420 Bundle

Traditional active-standby first-hop redundancy does not by itself provide the desired per-client gateway load distribution. “Consider GLBP where supported or a different routed access and anycast design, based on platform capability and operational needs” would remedy that alternative situation, but it would not correct the present issue: a single physical gateway address makes host access depend on one distribution device even when a second gateway exists.

“Track the required upstream path and decrement priority enough for a healthy standby gateway to assume forwarding” is the supported response when FHRP presence alone may not account for upstream path viability without appropriate object or interface tracking. Here the decisive response is “Design a supported FHRP virtual gateway with aligned priorities, Layer 2 reachability and safe failover between distribution switches”, so that different intervention does not meet the stated requirement.

FHRP peers must exchange control messages in a correctly shared VLAN to maintain a single active forwarding role. “Restore approved VLAN trunk reachability and compatible HSRP group and timer settings across both devices” applies to that other condition. The reported evidence is a campus user VLAN has two distribution switches, but its hosts use the physical IP of only one switch as the default gateway and lose external connectivity during maintenance; this alternative would address the wrong dependency.

That change concerns carrier layer 2 vpn mtu requirements, where Service encapsulation consumes transport overhead and can exceed an underlay MTU that was sized only for native Ethernet payloads. The reported issue instead stems from: Shortcut VPN topology changes can bypass required inspection if the WAN policy assumes every flow transits a central hub.

That change concerns multihomed BGP provider route preference, where Uncontrolled multihoming can select unpredictable exits and cause asymmetry or suboptimal paths under provider changes. In this question the necessary remedy is “Use a security-enforcing hub design or distributed inspection architecture with explicit policy for branch-to-branch traffic”, which this alternative does not provide.

That change concerns single homed wan failure domain, where Multiple logical VLANs on the same physical CE and provider device do not provide independent failure domains. The observed condition is a company permits interbranch traffic only after central security inspection, but a newly deployed direct branch tunnel bypasses the hub firewall; this mechanism addresses another problem.

That change concerns network management vrf segmentation, where A common routing table broadens the management attack surface and increases risk of route or ACL leakage. The reported issue instead stems from: Local log storage and rollover cannot substitute for reliable centralized timestamped security event retention.

That change concerns prioritizing network management traffic, where Without proper management traffic classification and minimum bandwidth, congestion can starve necessary operations traffic. In this question the necessary remedy is “Design redundant remote syslog collectors with protected transport, appropriate facilities and retention controls”, which this alternative does not provide.

That change concerns snmpv3 authenticated management design, where Legacy community strings do not provide SNMPv3's user-based authentication and encryption capabilities needed by the policy. The observed condition is a campus router logs only locally and loses fault evidence after flash rotation, despite a requirement for long-term security investigation; this mechanism addresses another problem.

A totally stubby or regular stub area cannot originate external LSAs through an internal ASBR in the required manner. “Design a supported NSSA with correct Type 7 origination and ABR translation handling where needed” would remedy that alternative situation, but it would not correct the present issue: overlay headers reduce usable path MTU and blocked ICMPv6 Packet Too Big feedback can prevent Path MTU Discovery.

“Develop explicit IPv6 security policies for routing, access, logging and required ICMPv6 control behavior” is the supported response when IPv4-only security rules do not automatically enforce the same trust boundary for IPv6 traffic on a dual-stack path. Here the decisive response is “Budget tunnel overhead in MTU planning, preserve required ICMPv6 control messages and validate endpoints' segment sizes”, so that different intervention does not meet the stated requirement.

Translation adds stateful dependencies and application edge cases that may be unnecessary when a controlled native dual-stack phase is viable. “Select native dual stack for capable segments and reserve translation for real IPv4-only boundaries with documented requirements” applies to that other condition. The reported evidence is a dual-stack application works with small IPv6 probes through a GRE overlay but stalls on larger encrypted payloads after tunnel encapsulation; this alternative would address the wrong dependency.

A common routing instance cannot enforce independent overlapping IP destinations and controlled route exposure by itself. “Design supported VRF-lite routing instances with carefully governed shared-services connectivity and separate interface assignments” would remedy that alternative situation, but it would not correct the present issue: missing site-level address summarization increases routing state and exposes the WAN to local campus topology churn.

“Design supported VACL, private VLAN or separate VLAN segmentation according to local traffic patterns and platform capabilities” is the supported response when an SVI routed ACL does not necessarily inspect intra-VLAN switched frames that never reach Layer 3 forwarding. Here the decisive response is “Plan contiguous campus address blocks and advertise valid site summaries at L3 distribution or WAN boundaries”, so that different intervention does not meet the stated requirement.

Extending Layer 2 broadly across campus buildings increases loop, convergence and failure-domain exposure. “Design routed access where supported, using local Layer 3 boundaries and deterministic IGP connectivity between buildings” applies to that other condition. The reported evidence is three campus sites advertise hundreds of access prefixes into a common WAN but changes at one site continuously trigger WAN routing state updates; this alternative would address the wrong dependency.

Unnecessary specific-route propagation increases state and change sensitivity without providing required central policy detail. “Apply well-bounded route summaries at distribution interfaces only after validating component networks and discard consequences” would remedy that alternative situation, but it would not correct the present issue: BGP aggregation can hide component failures and attract traffic for unreachable portions of the summarized prefix.

“Evaluate path attributes and supported multipath settings, then choose a design that preserves deterministic failover” is the supported response when BGP additional paths must satisfy supported multipath eligibility rules and configured maximum-path policy to share traffic. Here the decisive response is “Choose an aggregate policy with reviewed component-route dependencies, conservative discard behavior and correct reachability design”, so that different intervention does not meet the stated requirement.

Graceful restart depends on both peers' supported capabilities and bounded stale-route handling, not merely a routing session name. “Enable and verify supported graceful restart with sensible stale timers and failover safeguards where appropriate” applies to that other condition. The reported evidence is a border advertises a BGP aggregate for several site prefixes but after one internal site is withdrawn, the advertised summary still attracts traffic to its unavailable block; this alternative would address the wrong dependency.

Layer 1 carrier state may not reveal a downstream path failure and slow neighbor detection extends blackhole time. “Deploy supported BFD for the intended OSPF peers, validate timers against platform capacity and test false-positive risk” would remedy that alternative situation, but it would not correct the present issue: a fragmented area-address plan and missing ABR inter-area summarization cause avoidable detailed LSAs to propagate.

“Select E1 or E2 route treatment to reflect the required exit preference, testing both external and internal metrics” is the supported response when external Type 2 cost behavior does not account for internal cost in the same way as Type 1 when external metrics differ. Here the decisive response is “Allocate summarizable ranges and apply appropriate ABR area range configuration with complete component-route validation”, so that different intervention does not meet the stated requirement.

OSPF hierarchical inter-area connectivity depends on a stable backbone design and resilient area border connectivity. “Design redundant ABRs with valid backbone area connectivity and deterministic cost preferences for inter-area paths” applies to that other condition. The reported evidence is dozens of contiguous branch prefixes are flooded individually into the OSPF backbone after a regional restructuring, increasing LSDB churn; this alternative would address the wrong dependency.

Multicast RPF decisions can be sensitive to unicast path selection, including ECMP and asymmetric routing behavior. “Verify source-tree RPF after routing metric changes rather than only testing unicast ping” would remedy that alternative situation, but it would not correct the present issue: RP location affects shared-tree path efficiency and control resilience for ASM groups and can create a remote common-mode dependency.

“Benchmark group sizes and failure behavior before replacing unicast with multicast distribution” is the supported response when naive replicated unicast can consume far more shared-link capacity than a suitable multicast tree for many receivers. Here the decisive response is “Reevaluate RP placement whenever adding large receiver clusters or relocating content sources”, so that different intervention does not meet the stated requirement.

PIM sparse mode forwarding relies on supported multicast routing and receiver membership along the required multicast distribution tree. “Include receiver-driven join tests and group-state verification on every routed multicast hop” applies to that other condition. The reported evidence is an enterprise places its single PIM rendezvous point at a remote edge site with unstable connectivity and sees long join delays for the entire multicast domain; this alternative would address the wrong dependency.

A hybrid WAN needs explicit route and security decisions because reachability alone does not guarantee sensitive traffic uses approved paths. “Classify traffic by trust and business criticality and apply supported routing or SD-WAN policies for each transport” would remedy that alternative situation, but it would not correct the present issue: the orchestration function helps WAN edges discover and authenticate to the fabric but should not be placed in the regular data forwarding path.

“Size redundant WAN capacity for failure-state critical loads or design explicit congestion and traffic-class degradation policy” is the supported response when n-minus-one operation cannot carry combined load if each remaining link lacks spare capacity or business traffic prioritization. Here the decisive response is “Design supported Catalyst SD-WAN orchestrator reachability and certificate trust separately from data-plane transport tunnels”, so that different intervention does not meet the stated requirement.

Bandwidth alone does not determine application suitability when propagation delay and jitter exceed interactive service limits. “Choose appropriate low-latency WAN transport and QoS treatment, evaluating cost, resilience and route diversity” applies to that other condition. The reported evidence is a design document treats Cisco SD-WAN orchestration as the same component that carries every branch's user payload rather than enabling secure device discovery; this alternative would address the wrong dependency.

Uncontrolled multihoming can select unpredictable exits and cause asymmetry or suboptimal paths under provider changes. “Define local preference, inbound announcement policy and health tracking based on primary and backup business requirements” would remedy that alternative situation, but it would not correct the present issue: multihoming and address translation must account for both directions; outbound route changes alone may not preserve return paths.

“Classify traffic by trust and business criticality and apply supported routing or SD-WAN policies for each transport” is the supported response when a hybrid WAN needs explicit route and security decisions because reachability alone does not guarantee sensitive traffic uses approved paths. Here the decisive response is “Design consistent BGP advertisement, NAT and routing failover so return flows follow the reachable secondary path”, so that different intervention does not meet the stated requirement.

Bandwidth alone does not determine application suitability when propagation delay and jitter exceed interactive service limits. “Choose appropriate low-latency WAN transport and QoS treatment, evaluating cost, resilience and route diversity” applies to that other condition. The reported evidence is an enterprise tests its secondary Internet link and sees outbound connectivity, but return traffic continues toward a withdrawn primary public prefix; this alternative would address the wrong dependency.

RP location affects shared-tree path efficiency and control resilience for ASM groups and can create a remote common-mode dependency. “Choose strategically located and redundant RPs considering source and receiver topology, routing cost and failover” would remedy that alternative situation, but it would not correct the present issue: source-specific multicast applications need supported source-aware receiver membership signaling, commonly IGMPv3 for IPv4.

“Evaluate supported SPT threshold and source-tree design for bandwidth and latency goals without creating RPF inconsistencies” is the supported response when ASM initially uses a shared RP tree and may switch to source-specific shortest-path forwarding according to design and platform behavior. Here the decisive response is “Design SSM-compatible group range, sender addressing and receiver IGMPv3 support end to end”, so that different intervention does not meet the stated requirement.

PIM DR election provides a defined designated router role on a multiaccess segment to avoid conflicting join responsibilities. “Design suitable PIM interface priorities and neighbor reachability for predictable designated-router selection” applies to that other condition. The reported evidence is a video delivery platform wants receivers to accept only one known multicast source per group but the access network uses receiver signaling that cannot express source preference; this alternative would address the wrong dependency.