Free Practice Questions for Cisco 300-420 Exam

The Cisco SD-Access edge node acts as the access-layer fabric device that connects endpoints to the fabric, provides the anycast Layer 3 gateway, and maps users or endpoints into the correct virtual network. Cisco SD-Access fabric edges register endpoint information with the control-plane node and encapsulate user traffic into VXLAN for transport across the fabric. The anycast gateway function allows a consistent default gateway to exist on multiple edge nodes, supporting mobility without forcing traffic through a central gateway. The edge node also applies policy context by associating users, endpoints, or ports with a virtual network and scalable group information. Advertising EID subnets is primarily associated with border connectivity and external route advertisement. LISP proxy tunnel router functionality belongs to border node behavior for external connectivity. Routing and transporting IP packets between fabric nodes is the intermediate-node underlay role. Therefore, the two edge-node functions in the options are acting as the anycast Layer 3 gateway and mapping users to virtual networks. Reference topics: SD-Access edge node, anycast gateway, endpoint registration, virtual networks, fabric policy.

Option B is retained because the subnetting task depends on the exhibit options and the chosen plan must divide 10.1.8.0/21 into nonoverlapping partner VPN subnets without allocating more address space than required. The design principle is variable-length subnet masking: allocate the smallest subnet that satisfies each partner requirement, then place the subnets on valid prefix boundaries inside the reserved aggregate. Cisco addressing design emphasizes conserving address space, avoiding overlap, and preserving summarization where possible. A /21 provides 2048 total addresses, so the designer can carve several smaller partner ranges while keeping the entire allocation summarizable as 10.1.8.0/21 toward the data-center core. Incorrect options would either waste addresses, overlap existing ranges, place subnets on invalid boundaries, or allocate blocks larger than necessary. Option B is the mapping that satisfies the exhibit constraints while keeping the design clean for routing, firewall policy, and VPN onboarding. Reference topics: IPv4 VLSM, subnet boundary alignment, partner VPN addressing, summarization, nonoverlapping address design.

TLOC extension is the Cisco SD-WAN mechanism that allows a WAN Edge router without direct access to a transport to reach that transport through another WAN Edge router at the same site. Cisco describes TLOC extension as a redundancy feature in SD-WAN networks. In the question, the WAN Edge router is connected to an MPLS transport link, but Internet access is available through another WAN Edge device. With TLOC extension, the MPLS-only edge can extend traffic through the peer router toward the Internet transport, allowing the site to use multiple transports without requiring every edge router to have a physical connection to every circuit. OMP can advertise routes and TLOCs, but OMP alone does not create physical Internet access for a router attached only to MPLS. Requiring a local 4G/5G or Internet circuit on the same router is not necessary when TLOC extension is part of the design. An MPLS extranet is also not the normal SD-WAN solution for Internet transport reachability. Therefore, TLOC extension is the correct design method.

Scalable groups provide intra-VN traffic filtering and control in Cisco SD-Access. Within a virtual network, macro segmentation separates routing tables, but endpoints inside the same VN may still need policy control based on identity, role, or security posture. Cisco SD-Access uses scalable group tags and scalable group ACLs to implement group-based policy. This allows policy to be expressed as user or device group relationships instead of only subnet-based ACL entries. The result is microsegmentation inside the virtual network, where traffic between groups can be permitted or denied consistently across the fabric. MAC ACLs are limited Layer 2 filters and do not provide the identity-based policy model required for SD-Access. Prefix lists are route-filtering tools, not intra-VN access-control mechanisms. Service policies are used for QoS or traffic treatment and do not define group-based segmentation. Scalable groups are therefore the correct policy construct for intra-VN filtering in the fabric. Reference topics: Cisco SD-Access policy, scalable groups, SGT, SGACL, microsegmentation, intra-VN control.

The Cisco SD-Access data plane is based on VXLAN. Cisco SD-Access separates the fabric into functional planes: the underlay provides IP reachability, the control plane uses LISP to map endpoints to locations, and the data plane uses VXLAN encapsulation to carry user traffic across the routed underlay. VXLAN allows the fabric edge node to encapsulate endpoint traffic and forward it through the fabric while preserving virtual network and segmentation information. This is what enables SD-Access to provide Layer 2 and Layer 3 overlay services over a Layer 3 routed transport. OMP is the control-plane protocol for Cisco SD-WAN, not SD-Access. NHRP is associated with DMVPN tunnel resolution. LISP is essential in SD-Access, but its role is endpoint ID to routing locator mapping, not packet encapsulation in the data plane. Therefore, VXLAN is the correct protocol for the SD-Access data plane. Reference topics: SD-Access fabric, VXLAN data plane, LISP control plane, overlay encapsulation, routed underlay.

Summarization on routers A and C is the correct design because the requirement is to keep failures of the listed access networks from impacting the core while still supporting fast convergence in both access and core. Route summarization creates an aggregation boundary: more-specific access routes can flap behind the summary without causing the core to learn and withdraw every individual prefix. Cisco hierarchical routing design uses summarization at distribution or aggregation boundaries to reduce routing-table size, contain convergence events, and protect the core from access-layer instability. Adding another aggregation layer may be appropriate in some large designs, but it is not necessary when the question asks for the mechanism that stops specific prefix failures from impacting the core. Graceful restart protects forwarding during control-plane restart events, not ordinary access-prefix failures. FRR provides fast reroute for link or node failures but does not hide individual connected-network changes from the core. Summarizing at routers A and C directly addresses the stated networks and reduces the query, LSA, or update impact depending on the routing protocol used. Reference topics: route summarization, hierarchical routing, convergence containment, core protection, prefix aggregation.

For multimedia conferencing over MPLS, Cisco QoS design normally classifies the traffic into the multimedia conferencing class and marks it with AF4, commonly AF41. This class is intended for interactive video conferencing and similar applications that need assured bandwidth and controlled loss, but that are not usually placed in the same strict-priority class as voice bearer traffic. A bandwidth queue provides a minimum bandwidth guarantee during congestion, while DSCP-based WRED can selectively manage congestion within the class by using the drop precedence encoded in the AF marking. AF3 is generally associated with multimedia streaming, not interactive conferencing. A simple bandwidth queue without WRED does not fully use per-hop behavior characteristics for congestion handling. LLQ is typically reserved for voice and sometimes very tightly controlled real-time classes, because overusing strict priority can starve other traffic. Therefore, bandwidth queuing with DSCP WRED using AF4 is the appropriate per-hop behavior design. Reference topics: Cisco QoS baseline, DiffServ, AF41, multimedia conferencing, MPLS QoS, WRED.

NAT64 is the correct solution when IPv6-only hosts must communicate with an IPv4-only public web server. NAT64 translates IPv6 packets from the client side into IPv4 packets toward the server and translates the return traffic back into IPv6. In most practical designs, NAT64 is paired with DNS64 so IPv6-only clients can receive synthesized AAAA records for IPv4-only destinations. NAT44 is only IPv4-to-IPv4 translation and cannot support IPv6-only hosts. 6to4 is an IPv6-over-IPv4 tunneling mechanism, not an IPv6-to-IPv4 translation service for reaching an IPv4-only server. 6PE carries IPv6 reachability across an MPLS IPv4 core and does not solve IPv6-only client access to an IPv4-only domain. The question specifically states that the hosts support IPv6-only and the public web server has only IPv4 domain name resolution. That is the classic NAT64/DNS64 use case. The architect must also plan stateful translation capacity, logging requirements, IPv4 address pool sizing, and DNS behavior. Reference topics: NAT64, DNS64, IPv6 transition, IPv6-only hosts, IPv4-only server access.

Moving the link between routers C and D into area 10 provides the most direct OSPF design correction for optimal routing between the internal networks after the C-E link fails. OSPF requires careful area design because intra-area routes are preferred over interarea routes, and traffic between two routers in the same regular area should not be forced through a less optimal backbone or interarea path when a better local path exists. If the C-D link remains outside area 10, the failure of C-E can cause traffic between 10.1.1.0/24 and 172.16.1.0/24 to take a suboptimal interarea route. Placing the C-D link in area 10 keeps the alternate path within the same area and allows OSPF to calculate the best intra-area route when the primary link fails. A virtual link is used to connect a disconnected area to area 0, not to optimize this intra-area failure case. A tunnel adds unnecessary overlay complexity, and making area 10 NSSA changes external LSA behavior, not internal path optimization. Reference topics: OSPF area design, intra-area preference, failure-path optimization, link placement.

The correct model set is the one that configures the IOS XE interface GigabitEthernet2/1/0 with IPv4 address 10.10.10.10 and prefix length 27 using valid XML according to the selected YANG schema. The directly connected host address 10.10.10.1/27 confirms the subnet relationship; both addresses belong to 10.10.10.0/27, so the interface configuration must use that prefix length rather than a host mask or an unrelated network. YANG-based configuration is strict: the namespace, container hierarchy, interface type, interface name, and address fields must match the device model. If an option places GigabitEthernet under the wrong container, represents the mask incorrectly, or uses a schema from a different model family, the device will reject the payload or configure the wrong object. Option D correctly represents the IOS XE XML structure and the required addressing. In real operations, the engineer should follow this with a get-config readback against the running datastore to prove that the structured configuration committed as intended. Reference topics: IOS XE interface YANG, XML payload structure, NETCONF configuration, IPv4 subnet validation.