Free Cisco 300-420 Practice Exam with Questions & Answers | Set: 2

The expected port state follows Rapid Spanning Tree Protocol role selection on equal-speed point-to-point links. With 802.1w, each non-root switch selects one root port based on the lowest path cost to the root bridge. Where there are redundant Layer 2 paths of equal speed, one side of a redundant segment must remain blocked as an alternate port to maintain a loop-free topology. Because all links are 1 Gbps, path cost is equal unless bridge priority, bridge ID, or port ID breaks the tie. The selected option identifies the port pair that becomes alternate blocking based on the root placement and tie-breakers shown in the exhibit. RSTP improves convergence compared with classic 802.1D by using proposal and agreement handshakes on point-to-point links, but it still blocks redundant paths when a pure Layer 2 loop exists. A design requiring all links to forward would need a routed access design, MEC, StackWise Virtual, VSS, or another loop-free multipath technology. Reference topics: RSTP, root port, designated port, alternate port, point-to-point links, Layer 2 loop prevention.

The No-Export community is the appropriate filtering mechanism when a design must prevent an autonomous system from becoming an unintended transit path. In a multihomed BGP design, a customer AS can accidentally advertise routes learned from one provider to another provider. If that happens, external traffic may cross the customer network to reach destinations beyond it, making the customer a transit AS. Applying No-Export to the appropriate learned or advertised routes instructs the receiving AS not to advertise those routes outside its own AS boundary. This helps contain route propagation and prevents third parties from learning paths through AS64512. Maximum-prefix protects a router from receiving too many routes; it is not a transit-prevention policy. No-advertise is more restrictive and prevents advertisement to all peers, which may break required internal or provider reachability. Next-hop is a path attribute used for reachability and path selection, not a route-leak prevention mechanism. In production, No-Export should be combined with explicit prefix filters so policy does not depend on community handling alone. Reference topics: BGP No-Export, transit AS prevention, route-leak control, BGP communities, multihoming.

Integrated Services is the QoS model that allows an application to signal its traffic requirements to the network and request specific service treatment. Cisco QoS guidance distinguishes IntServ from DiffServ by explaining that IntServ follows a signaled-QoS model, while DiffServ uses provisioned per-hop behavior based on markings. IntServ uses RSVP to reserve resources along the end-to-end path. That reservation process allows the network to admit or deny the flow based on available bandwidth and policy, which is why IntServ aligns with applications that require consistent and dedicated bandwidth. DiffServ is much more scalable and widely deployed in enterprise networks, but it does not provide per-flow resource reservation by itself. LLQ is a queuing mechanism commonly used inside a DiffServ design for delay-sensitive traffic such as voice. WRED is a congestion-avoidance technique, not an end-to-end reservation architecture. Because the question explicitly says that the application informs the network of its traffic profile and requests a service level, the correct QoS architecture is IntServ.

The most efficient campus design aligns the active first-hop gateway with the Layer 2 forwarding path. In a traditional access-distribution topology using STP and HSRP, traffic should not cross the distribution-to-distribution link simply because the HSRP active gateway is on the opposite distribution switch from the STP forwarding path. Cisco campus design guidance stresses aligning the STP root bridge with the active FHRP gateway so hosts forward northbound traffic directly to the distribution switch that owns the optimal Layer 2 path. Reconfiguring distribution switch A to become the HSRP active device fixes the asymmetric and inefficient traffic flow in the exhibit. Adding a link between access switches would extend the Layer 2 domain and increase loop-prevention complexity, not improve the northbound default-gateway path. Changing the distribution interconnect to a routed link may be valid in a routed-access redesign, but it is not the targeted correction for this Layer 2/FHRP misalignment. An EtherChannel between distribution switches only increases interswitch capacity; it does not remove the unnecessary hairpin path caused by the wrong active gateway.

The best allocation is to give each branch adjacent /24 prefixes from the 10.0.0.0/8 private range, using one /24 for data and the next contiguous /24 for voice. Each /24 provides 254 usable host addresses, which satisfies the requirement for up to 128 hosts. More importantly, pairing two contiguous /24s creates a clean /23 summary per branch. For example, 10.0.0.0/24 for data and 10.0.1.0/24 for voice summarize as 10.0.0.0/23; the next branch can use 10.0.2.0/24 and 10.0.3.0/24 summarized as 10.0.2.0/23. This pattern supports aggregation and keeps the security team’s identification simple because voice prefixes can consistently use the odd-numbered third octet. Option C uses /25 prefixes, but /25 provides only 126 usable addresses, which fails a strict requirement for up to 128 hosts if the subnet and broadcast addresses are excluded. Separate 172.16 ranges reduce per-site summarization clarity. Reference topics: RFC 1918 addressing, VLSM, route summarization, branch addressing design, data and voice prefix allocation.

Traffic shaping is the QoS mechanism that queues excess packets and transmits them later to conform to a configured rate. In Cisco QoS design, shaping smooths bursts by buffering traffic instead of immediately discarding it when the offered rate exceeds the configured rate. This makes shaping appropriate on egress interfaces where the enterprise router has a higher physical interface speed than the actual provider committed information rate. WRED and RED are congestion-avoidance mechanisms that drop packets probabilistically to prevent full queue exhaustion, especially for TCP traffic. They do not intentionally hold excess packets for later transmission as the primary behavior. Policing enforces a traffic rate by dropping or remarking traffic that exceeds the configured contract; it does not buffer traffic to smooth bursts. Therefore, when the design requirement says excess packets must be queued for later transmission, the mechanism must be shaping. In WAN edge QoS, shaping is often paired with child queuing policies so latency-sensitive and business-critical classes receive correct treatment inside the shaped parent rate.

The selected IPv6 summary must be the smallest prefix that covers all of the site subnets in the exhibit while not including unnecessary additional networks. IPv6 route summarization works by identifying the common high-order bits shared by the component prefixes and advertising the shortest aggregate that contains them all. Cisco routing design uses summarization at WAN or aggregation boundaries to reduce routing-table size, contain convergence events, and simplify policy. Option C is retained because it represents the aggregate identified by the exhibit answer set. Option A is a different /60 boundary and would be correct only if all component subnets fell under that exact nibble range. Option B is not a usable summary route in normal IPv6 prefix notation as written. Option D is too broad or malformed for a precise site summary. The professional design rule is to summarize on valid nibble or bit boundaries and verify that every component prefix is included without accidentally absorbing unrelated site networks. Reference topics: IPv6 summarization, prefix aggregation, route boundary calculation, WAN route scale, convergence containment.

A dedicated management VRF is the correct feature when management protocols must traverse the production network but remain logically separated. The question describes in-band management because SSH, NTP, FTP, and SNMP are carried over the production network rather than over a separate physical console or out-of-band network. The design still requires routers and switches across different networks to be managed securely. A management VRF gives the management plane its own routing table, allowing the engineer to restrict management reachability, apply separate routing, and keep management traffic from leaking into user or service forwarding paths. Management Plane Protection can restrict which interfaces accept management-plane traffic, but it does not by itself provide separate routing across different networks. A terminal server or dedicated console connection is an out-of-band operational tool, not the production-network management design requested here. A dedicated management VRF per device is therefore the correct feature. Reference topics: in-band management, management VRF, SNMP and SSH reachability, management-plane segmentation, enterprise operations design.

A single-homed enterprise that runs BGP with one ISP should advertise its assigned public prefix to the ISP and receive a default route from the ISP. Because there is only one upstream provider, the customer does not need the full Internet table to make path-selection decisions; all Internet destinations exit the same provider path. Receiving only a default route conserves memory and CPU on the CE router and simplifies operations. The customer must still originate its public prefix toward the ISP so the provider can advertise reachability to the Internet. The ISP should not be the originator of the customer-owned ARIN prefix toward the customer; it may advertise that prefix to the Internet after receiving it from the customer. Requesting the full BGP table or even a partial table adds unnecessary scale for a single-homed site. Advertising a default route to the ISP is also wrong because the ISP already owns upstream Internet reachability. Reference topics: single-homed BGP, CE-PE peering, default route, public prefix advertisement, Internet edge design.

Loop guard should be used on SW2 to reduce the chance of Layer 2 forwarding loops caused by a unidirectional fiber failure. In spanning-tree operation, a root or alternate port expects to receive BPDUs from the designated bridge. If BPDUs stop arriving because the fiber becomes unidirectional, the port may incorrectly assume that the path is no longer receiving a superior BPDU and transition toward forwarding. Cisco loop guard prevents this by moving the port into a loop-inconsistent state when BPDUs are unexpectedly lost on a non-designated port. That behavior protects the topology from a port role change that could create a Layer 2 loop. BPDU filter is dangerous in this context because it can suppress BPDUs and hide the control-plane signal STP needs. BPDU guard is mainly for PortFast edge ports that should never receive BPDUs. Root guard prevents superior BPDUs from changing root placement, but it does not address unidirectional loss of expected BPDUs. Therefore, loop guard on SW2 is the proper design control. Reference topics: STP loop guard, unidirectional fiber failure, BPDU loss, loop-inconsistent state, Layer 2 resiliency.