Free Cisco 300-420 Practice Exam with Questions & Answers | Set: 6

The configuration-protocol mapping distinguishes NETCONF and RESTCONF behavior in model-driven programmability. NETCONF is an XML-based network configuration protocol that runs over a secure transport such as SSH and supports structured operations such as get-config, edit-config, lock, unlock, commit, and datastore manipulation. It is well suited to transactional configuration workflows where candidate and running datastores are supported. RESTCONF exposes YANG-modeled data through a REST-style interface over HTTP or HTTPS, using familiar methods such as GET, POST, PUT, PATCH, and DELETE. It can encode data in XML or JSON depending on headers and implementation. Both protocols use YANG models to define the structure and semantics of configuration and operational data, but they differ in transport style, operation model, and tooling. The selected mapping therefore places NETCONF characteristics with the protocol that provides RPC-style operations and datastore handling, while RESTCONF receives HTTP method and URI-based characteristics. In design, the choice depends on controller support, device operating system, required transaction semantics, security policy, and developer tooling. Reference topics: NETCONF, RESTCONF, YANG, datastores, XML and JSON encoding.

GRE over IPsec is required when the backup connection is an Internet circuit, encryption is mandatory, and multicast applications must cross the tunnel. GRE provides the logical tunnel interface and can encapsulate multicast traffic and routing protocol packets. IPsec then encrypts the GRE packets across the public Internet, satisfying the security requirement. This combination is widely used in enterprise WAN designs where dynamic routing, multicast video, or other non-unicast traffic must be transported securely between sites. Direct IPsec encapsulation protects unicast IP traffic, but it does not natively provide a multicast-capable tunnel interface for routing and multicast services. GETVPN is designed for private WAN environments where the provider network can carry the routed addresses and where tunnel-less group encryption is desired; it is not the usual choice for Internet backup. DMVPN could also use GRE and IPsec, but for a simple backup connection between two sites, GRE over IPsec is the direct answer. Reference topics: GRE tunneling, IPsec encryption, multicast over VPN, Internet backup WAN design.

Human Resources: 10.1.1.112/29; Facilities: 10.1.1.64/27; Engineering: 10.1.1.0/26; Finance: 10.1.1.96/28.

The addressing plan must use VLSM and assign the smallest subnet that satisfies each department’s host requirement without overlapping inside the single /24 block. Engineering needs 32 hosts, so a /27 is not enough because it provides only 30 usable addresses. The smallest listed subnet that satisfies Engineering is 10.1.1.0/26, which provides 62 usable addresses. Facilities needs 18 hosts, so a /27 is appropriate; 10.1.1.64/27 provides 30 usable addresses. Finance needs 12 hosts, so a /28 is sufficient because it provides 14 usable addresses; the matching listed subnet is 10.1.1.96/28. Human Resources needs 5 hosts, so a /29 is sufficient because it provides 6 usable addresses; the matching listed subnet is 10.1.1.112/29. The unused options either overlap with selected ranges, provide too few hosts for the department, or waste address space unnecessarily. Cisco addressing design favors hierarchical, nonoverlapping, right-sized prefixes so the plan remains scalable and easy to summarize where possible.

The IPv4 network 172.16.10.0/24 maps to 2001:db8:abcd::ac10:a00/120 when the IPv4 address is placed into the lowest significant bits of the IPv6 address. The calculation converts each IPv4 octet into hexadecimal: 172 is AC, 16 is 10, 10 is 0A, and 0 is 00. Combining those bytes gives AC10:0A00, displayed in IPv6 notation as ac10:a00. Because a /24 IPv4 network has 8 host bits, the mapped IPv6 network leaves the same 8 host bits, resulting in a /120 IPv6 prefix. Option B incorrectly places decimal IPv4 octets into separate IPv6 hextets and uses /96, which represents a much larger mapping block than the /24 network. Option C does not represent 172.16.10.0 in hexadecimal. Option D changes the higher-order IPv6 prefix and does not match the supplied address plan. The correct address therefore preserves the planned IPv6 prefix and embeds the IPv4 network in the low-order bits. Reference topics: IPv4-to-IPv6 address mapping, hexadecimal conversion, IPv6 prefix length, migration addressing plans.

Cisco SD-WAN is the correct solution when the design must use internet circuits at each site while providing failover, load sharing, and QoS. Basic IPsec tunnels can encrypt traffic, but they do not by themselves provide a complete WAN architecture for path measurement, dynamic traffic steering, centralized policy, application-aware routing, or scalable operational control. Cisco SD-WAN builds secure overlay tunnels across available transports and continuously measures path characteristics such as loss, latency, and jitter. It can then steer applications according to SLA policy, use multiple circuits for active/active forwarding, and fail traffic over when a path degrades or fails. QoS can be applied consistently through templates and policy across the WAN Edge routers. GET VPN is best suited to private MPLS-style networks and does not address internet-circuit overlay orchestration in the same way. Traditional DMVPN is a valid dynamic VPN technology, but SD-WAN is the more complete resilient internet-WAN design for these requirements. Reference topics: Cisco SD-WAN, internet transport, application-aware routing, failover, load sharing, QoS.

The border node provides connectivity between the SD-Access fabric and networks outside the fabric. In Cisco SD-Access, edge nodes connect endpoints to the fabric, intermediate nodes transport routed IP traffic through the underlay, control-plane nodes maintain endpoint location mappings, and border nodes connect the fabric to external Layer 3 domains such as the data center, WAN, internet edge, or shared services network. A border node may perform proxy tunnel router functions and can de-encapsulate fabric traffic that is destined outside the overlay, but its design purpose is external connectivity for the fabric site. Network virtualization is primarily delivered through virtual networks, VRF separation, LISP control-plane mappings, and VXLAN encapsulation. Expanding the network is too vague and does not identify a Cisco SD-Access role. Therefore, among the available options, the border node is the component used to connect the fabric to the required external network resources. Reference topics: Cisco SD-Access border node, external connectivity, fabric roles, LISP proxy tunnel router, VN-to-VRF mapping.

The YANG module mapping follows the distinction between standards-based, vendor-neutral, and vendor-native data models. IETF YANG models are standards-driven and are appropriate when the design goal is protocol-level interoperability across vendors for common network functions. OpenConfig models are also vendor-neutral, but they are developed by the OpenConfig community and commonly use a structured separation between intended configuration and operational state. Cisco native models expose platform-specific Cisco IOS XE, IOS XR, or NX-OS capabilities and are often the most complete option when a feature is unique to a Cisco operating system. The selected drag-and-drop answer aligns each characteristic with the model family that owns that behavior. In a professional automation design, the engineer should not choose a model only because it is familiar. The correct choice depends on feature coverage, device support, platform release, schema stability, and whether the workflow must operate consistently across vendors. For multivendor intent, choose IETF or OpenConfig first; for Cisco-specific feature depth, use Cisco native models. Reference topics: YANG, IETF models, OpenConfig, Cisco native models, NETCONF and RESTCONF automation.

Graceful restart and nonstop forwarding designs depend on preserving forwarding continuity during a control-plane processor switchover. Cisco Stateful Switchover provides the mechanism for a standby route processor or supervisor to maintain synchronized state so it can assume control when the active processor fails. When SSO is combined with NSF or graceful restart capabilities in routing protocols, neighboring devices can continue forwarding traffic while the restarting device preserves or rebuilds control-plane adjacencies. Cisco Express Forwarding is required for fast data-plane forwarding, but CEF alone does not provide route processor state synchronization after processor failure. Virtual Switch System is a chassis or switching architecture that can provide high availability in certain campus designs, but it is not the required feature named by graceful restart recovery. Bidirectional Forwarding Detection is a failure-detection protocol used to detect path or neighbor failures quickly; it does not recover a failed processor. Therefore, the feature that must be incorporated for graceful restart recovery from processor failure is Stateful Switchover. In a resilient enterprise design, SSO, NSF, and protocol graceful restart are coordinated to reduce outage impact.

Route summarization should be planned from the aggregation layer toward both the core and the access layer. In hierarchical campus routing, aggregation or distribution devices are natural summarization boundaries because they sit between more specific access-layer networks and the core. Summarizing from aggregation toward the core prevents access-layer subnet churn from forcing unnecessary recomputation and route table growth in the core. Summarizing from aggregation toward access can also provide a concise upstream route, often a default or summary route, so access devices do not need the entire network routing table. The goal is to contain failures, reduce routing state, and preserve fast convergence at hierarchy boundaries. Summarizing from the core toward aggregation may hide useful topology details in the wrong direction, while summarizing directly from access toward aggregation is not always possible or efficient when access devices are numerous and have limited resources. The answer that places summarization at aggregation in both directions best matches Cisco hierarchical design principles. Reference topics: hierarchical campus design, route summarization, aggregation layer, core route scale, convergence containment.

MSDP is the correct technology when a large multicast design uses multiple PIM Sparse Mode domains and needs to exchange active source information between those domains. Cisco describes Multicast Source Discovery Protocol as the mechanism used by RPs in different PIM-SM domains to learn about multicast sources outside their own domain. When a source becomes active, the local RP can advertise Source-Active information to MSDP peers, allowing receivers in other domains to discover and join that source. This supports domain separation and can help balance multicast control-plane scope in large networks. DVMRP and MOSPF are legacy multicast routing approaches and are not the design mechanism for modern PIM-SM domain interconnection. IGMP is used between hosts and local multicast routers for receiver membership signaling; it does not exchange source information between multicast domains. Therefore, a design with more than 100 routers, several multicast domains, and PIM-SM traffic balancing should include MSDP. The architect should also design RP placement, Anycast RP behavior, peer mesh scaling, and source filtering. Reference topics: MSDP, PIM-SM domains, Source-Active messages, interdomain multicast.