Free Practice Questions for Cisco 300-420 Exam

Cisco SD-WAN WAN Edge devices can be brought into the overlay through automated zero-touch provisioning or through manual bootstrap configuration. Zero-touch provisioning allows a device to discover the SD-WAN controllers and receive the information needed to authenticate and join the overlay with minimal on-site work. This is a core operational benefit of Cisco SD-WAN because branch routers can be shipped to sites and onboarded without a specialist manually building the entire control-plane configuration locally. Manual configuration remains available when ZTP is not used, when the site has special connectivity constraints, or when the administrator needs to stage the router directly. DHCP options and DNS records can help devices learn controller information in some deployment models, but they are not the complete pair of bootstrap methods named for vEdge onboarding. vManage is the management system, not a bootstrap method by itself. Therefore, the correct methods are ZTP and manual configuration. The design should also validate certificates, organization name, system IP, site ID, and transport interface reachability during onboarding.

The action is to configure the EIGRP stub router in receive-only mode. Cisco EIGRP stub routing limits which routes a router advertises to neighbors, reducing query scope and improving stability in hub-and-spoke or WAN designs. The receive-only keyword is the most restrictive stub option: the router receives routes from neighbors but does not advertise any routes to them. That directly satisfies the requirement that WAN routes must not be advertised to the routers in the data center. Advertising only a default route still advertises routing information, so it does not meet the wording. Summarizing local subnets reduces the number of routes, but it still advertises reachability. The “distributed mode” option is not the correct EIGRP stub behavior for this requirement; redistributed stub mode would allow redistributed routes to be advertised. Receive-only is therefore the precise design control for stopping route advertisement from the stub router. Reference topics: EIGRP stub routing, receive-only mode, query scoping, route advertisement control, WAN-to-data-center design.

Dial-In: collector initiates a session to the device; supports gRPC only. Dial-Out: device initiates a session to the collector; supports TCP, UDP, and gRPC.

Model-driven telemetry can operate in dial-in or dial-out mode, and the distinction is based on which side initiates the session and how the subscription is established. In dial-in telemetry, the collector initiates a session to the network device and dynamically subscribes to the required sensor paths. This is useful when the collector wants direct control over the subscription lifecycle. Cisco telemetry documentation commonly associates dial-in with gRPC-based dynamic subscriptions on supported platforms. In dial-out telemetry, the device initiates the session toward the collector based on a configured subscription. The subscription exists in the device configuration, and the device streams telemetry data to the configured destination without requiring the collector to start the connection. This design is useful when devices are behind NAT, firewalls, or operational models where the network device should push telemetry to a known collector. Therefore, the mapping is: dial-in equals collector-initiated and gRPC-only in this context; dial-out equals device-initiated and supports the listed transport options. This distinction is central to Cisco model-driven telemetry design.

Cisco IS-IS supports Level 1, Level 2, and Level 1/Level 2 operation, and the design should restrict each link to the level it actually needs. Cisco documentation for the isis circuit-type command states that it “configures the type of adjacency that is required for neighbors on the specified interface.” In this case, the router is configured as L1/L2 and has both L1 and L2 neighbors, which causes unnecessary LSP flooding, SPF processing, and database maintenance on links that may not need both levels. Making the entire router only L1 or only L2 would be too blunt, because the router may legitimately need to participate in both domains on different interfaces. Making the router a DIS also does not solve the underlying issue; it only controls designated intermediate system behavior on broadcast networks. The best optimization is to configure each interface with the correct circuit type, such as level-1 for intra-area links and level-2-only for backbone links. This reduces control-plane load while preserving the intended two-level hierarchy.

The selected IPv6 summary must be the smallest prefix that covers all of the site subnets in the exhibit while not including unnecessary additional networks. IPv6 route summarization works by identifying the common high-order bits shared by the component prefixes and advertising the shortest aggregate that contains them all. Cisco routing design uses summarization at WAN or aggregation boundaries to reduce routing-table size, contain convergence events, and simplify policy. Option C is retained because it represents the aggregate identified by the exhibit answer set. Option A is a different /60 boundary and would be correct only if all component subnets fell under that exact nibble range. Option B is not a usable summary route in normal IPv6 prefix notation as written. Option D is too broad or malformed for a precise site summary. The professional design rule is to summarize on valid nibble or bit boundaries and verify that every component prefix is included without accidentally absorbing unrelated site networks. Reference topics: IPv6 summarization, prefix aggregation, route boundary calculation, WAN route scale, convergence containment.

The requirement for end-to-end path verification identifies the Integrated Services model with RSVP. IntServ uses per-flow resource reservation, and RSVP signals the path between sender and receiver so devices along that path can admit or reject the requested service based on available resources. This makes IntServ appropriate when the design requires explicit end-to-end path validation and reservation for application flows. DiffServ works differently. In a DiffServ design, traffic is marked, normally with DSCP or CoS at the edge, and each hop applies a configured per-hop behavior. DiffServ is scalable and common in enterprise WAN and campus QoS designs, but it does not perform per-flow signaling or verify that every device in the path can reserve the requested resources. Marking traffic at the access layer is an important QoS design practice, but marking alone is not path verification. Therefore, when the customer explicitly requires end-to-end path verification for business-critical traffic, Cisco QoS architecture points to IntServ with RSVP rather than a pure DiffServ marking model.

Dual-stack is the correct IPv6 migration technique because the DWDM devices provide Layer 2 transport between routers that already support both IPv4 and IPv6. Layer 2 transport is generally transparent to IPv6 because it forwards Ethernet frames rather than participating in Layer 3 routing. The routers at the ends of the DWDM circuit can peer directly over the Layer 2 service and run IPv6 in parallel with IPv4, while mail servers can also retain IPv4 reachability during the migration. Cisco dual-stack migration guidance uses simultaneous IPv4 and IPv6 operation to support phased application and host transition with minimal tunneling overhead. 6to4, ISATAP, and 6rd are tunneling or transition mechanisms used when IPv6 islands must cross IPv4-only routed infrastructure. In this case, the limiting devices are in the transport layer and do not need to route IPv6. Deploying dual-stack on the capable routers and servers is simpler, more transparent, and avoids unnecessary encapsulation. Reference topics: IPv6 dual-stack migration, Layer 2 transparency, IPv6 over Ethernet, tunneling avoidance, phased migration.

gRPC provides secure communication between network devices and control systems by supporting TLS. In Cisco programmability and model-driven telemetry designs, gRPC is commonly used as a high-performance remote procedure call framework that carries structured data encoded with Protocol Buffers. Security is provided through TLS so that the client and server can authenticate and protect the session in transit. The question asks for security functionality, so TLS support is the correct selection. The other options describe incorrect or misleading cryptographic behavior. gRPC does not implement generic RSA tunnel encryption as described in option A, and it does not provide mandatory encryption of data at rest. RC6 with CRC is not the security model used for Cisco gRPC telemetry or programmability. In a secure management design, gRPC should be deployed with certificates, TLS verification, controlled access lists, and appropriate AAA integration so only authorized collectors or controllers can communicate with infrastructure devices. Reference topics: gRPC, TLS, model-driven telemetry, Protocol Buffers, secure automation transport.

The design must influence how EIGRP-learned routes are injected into the OSPF domain, so R2 should redistribute EIGRP into OSPF as metric-type E1 and R3 as metric-type E2. Cisco OSPF documentation distinguishes external Type 1 and Type 2 routes. An E1 route includes the external cost plus the internal OSPF cost to reach the ASBR, while an E2 route uses only the external metric. Cisco path selection prefers O E1 over O E2 for the same external destination. Therefore, making R2 advertise the EIGRP routes as E1 causes OSPF routers to prefer R2 as the exit toward the EIGRP domain. Option C adjusts OSPF-to-EIGRP redistribution, which is the wrong direction for traffic passing toward EIGRP from OSPF. Removing redistribution on R3 would reduce redundancy. Option D reverses the preference and would favor R3. Reference topics: OSPF external route types, EIGRP-to-OSPF redistribution, ASBR preference, E1 versus E2 metrics.

Multiple Spanning Tree Protocol is the standards-based solution that allows many VLANs to be mapped into a smaller number of spanning-tree instances. MSTP is defined by IEEE 802.1s and incorporated into IEEE 802.1Q, making it suitable for a multivendor campus where proprietary per-VLAN behavior is not acceptable. The question states that all configured VLANs must be grouped into two STP instances. That is exactly the design purpose of MST: VLAN-to-instance mapping lets the architect reduce the number of active spanning-tree calculations while still supporting different forwarding topologies for selected VLAN groups. Traditional STP runs a single common spanning tree and cannot provide two separate VLAN instance groups. RSTP improves convergence but does not by itself group VLANs into multiple instances. Rapid PVST+ provides one rapid spanning-tree instance per VLAN, but it is Cisco-oriented and creates far more instances than required. For a vendor-neutral design with two spanning-tree instances, MSTP is the correct choice and also reduces CPU and memory pressure compared with running a separate instance per VLAN.