Free Cisco 300-420 Practice Exam with Questions & Answers | Set: 9

The route-reflector design should make R2 a client of R1 and R4, and R5 a client of R3 and R4. The requirement states that the route reflector must have direct physical connections to the core routers R3 and R4, must avoid a single point of failure, and must account for high utilization on the R2-to-R1 link. In BGP route-reflector design, clients peer with redundant route reflectors so they can continue receiving reflected routes if one route reflector or path fails. Placing R5 as a client of R3 and R4 satisfies the direct-core requirement and provides redundant reflection through the core. Placing R2 as a client of R1 and R4 provides redundancy while reducing dependence on the heavily utilized R2-to-R1 link by including R4 as an alternate reflector. Making a router a client of two reflectors is a standard design technique for route-reflector high availability. The other combinations either fail the direct-core requirement, do not provide balanced redundancy, or keep traffic tied to the congested link. Reference topics: BGP route reflectors, client redundancy, iBGP scaling, route-reflector placement, core resiliency.

The best summarization design is for the aggregation layer to advertise a default route toward the access layer and to summarize the VLAN subnets toward the core. Cisco hierarchical campus design uses summarization at natural layer boundaries so that access-layer instability is hidden from the rest of the network. If individual access VLANs flap, the core should not have to process every specific route change. Advertising a summary such as 10.0.0.0/16 from the aggregation layer toward the core reduces routing-table size, lowers CPU and memory use, and confines convergence events to the lower layer. At the same time, the access layer normally does not need full knowledge of the enterprise routing table; a default route from the aggregation layer is sufficient for northbound reachability. Summarizing at the access layer is normally less effective because the aggregation layer is the first stable boundary that sees multiple access networks. Advertising a default from the core toward aggregation would hide information in the wrong direction. Reference topics: hierarchical routing, route summarization, campus aggregation design, convergence containment, routing-table scaling.

The WAN connectivity mapping distinguishes private, public, and overlay connectivity use cases. Enterprise WAN design normally selects the transport according to the required security, availability, latency, cost, and operational control. MPLS Layer 3 VPN is commonly used when the enterprise needs private routed WAN service with provider-managed segmentation and predictable QoS behavior. Internet VPN designs are used when cost, rapid deployment, or broadband availability is more important, with IPsec or SD-WAN providing encryption and overlay control. Layer 2 services such as VPWS or VPLS are selected when the customer requires Ethernet adjacency, VLAN transport, or transparent LAN-like connectivity across sites. The drag-and-drop answer preserves those distinctions by matching each WAN type to the use case it is designed to support. A professional WAN architecture can combine these transports in a hybrid model, but the design must still identify which service carries private routing, which carries encrypted overlay traffic, and which provides Layer 2 extension. Reference topics: WAN transport selection, MPLS L3VPN, Internet VPN, Metro Ethernet, VPWS, VPLS, hybrid WAN design.

The Cisco SD-Access underlay provides the physical and IP transport foundation that allows fabric nodes to reach each other. In plain terms, it is the routed connectivity built from the switches, routers, links, and loopback reachability that the overlay depends on. Cisco SD-Access then uses the overlay to provide virtualization, segmentation, policy, and endpoint mobility on top of that transport. This is why the underlay is best described as establishing the connectivity between the switches and routers that form the fabric. Option A describes the abstraction performed by the overlay, not the underlay. Option B is closer to a Layer 2 tunneling description and is not the main purpose of the SD-Access underlay. Option D describes encapsulated overlay behavior, especially VXLAN-based data-plane transport, not the physical/routed foundation itself. A good SD-Access design validates underlay reachability, routing adjacencies, MTU, loopback advertisement, and redundancy before onboarding the overlay services. Without a stable underlay, LISP control-plane mappings and VXLAN data-plane forwarding cannot operate predictably. Reference topics: SD-Access underlay, routed campus foundation, fabric node reachability, overlay dependency.

Incremental SPF is the correct solution because the problem specifically states that Type 1 or Type 2 LSAs force the OSPF process to recompute the entire shortest path tree. Cisco OSPF documentation states that when changes to a Type 1 or Type 2 LSA occur, the entire SPT is normally recomputed, and that incremental SPF allows the system to recompute only the affected part of the tree. This improves convergence and reduces CPU use because the router does not have to run a full Dijkstra calculation for every topology change. BFD detects failures quickly, but it does not change how OSPF recalculates the SPT after the LSA arrives. Standard SPF is the default full calculation behavior and therefore does not solve the optimization requirement. PRC is associated with partial route calculation behavior in some link-state contexts, but for this OSPF question the Cisco feature name is iSPF. Reference topics: OSPF incremental SPF, Type 1 LSA, Type 2 LSA, SPF optimization, campus OSPF scaling.

The required resource is the organization name. During manual WAN Edge onboarding, the device needs local system identity information and transport reachability so it can authenticate into the Cisco Catalyst SD-WAN overlay. Cisco onboarding workflows identify system parameters such as system IP, site ID, organization name, and vBond information as required configuration elements. The organization name must match the value configured across the SD-WAN controllers; otherwise, certificate validation and control connection establishment fail. After the WAN Edge authenticates with vBond, vBond helps it discover the vSmart controllers and vManage. That is why the vSmart hostname is not the first required onboarding resource in this question. NAT may exist in the path and vBond can assist traversal, but NAT itself is not the configuration identity item. A generic domain name is not the same as the SD-WAN organization name. Reference topics: Cisco SD-WAN onboarding, vBond orchestrator, organization-name, control connections, WAN Edge manual configuration.

Without centralized policy, OMP allows all WAN Edge routers in the same VPN to communicate in a full-mesh overlay. Cisco Catalyst SD-WAN uses OMP as the control-plane protocol between WAN Edge routers and SD-WAN controllers. WAN Edge devices advertise OMP routes, TLOC routes, and service routes to the controllers, and the controllers distribute the reachable routes back to the relevant edge devices. Cisco policy documentation describes the default unpolicied behavior as permissive: routes are accepted and advertised so sites in the same VPN learn reachability to each other. That default route distribution produces a full-mesh data-plane capability, even though control connections remain hubbed through the controllers. Hub-and-spoke, regional isolation, point-to-point restriction, or service-chained topologies require centralized control or data policy to filter routes or steer traffic. Blocking all communication is the opposite of the default behavior. Reference topics: Cisco SD-WAN OMP, default route distribution, full-mesh overlay, centralized control policy, VPN segmentation.

A totally stubby OSPF area is the best choice for a small remote site with low-end routers and no requirement to carry transit traffic. A standard stub area blocks Type 5 external LSAs, but it still receives interarea Type 3 summary LSAs. A totally stubby area goes further by blocking external routes and most interarea summary routes, while allowing a default route to be injected by the ABR. That greatly reduces LSDB size, SPF processing, memory use, and routing-table entries on the low-end routers. The remote site still has full connectivity to the rest of the OSPF domain through the default route. NSSA and totally NSSA designs are useful when the area must inject external routes from an ASBR inside the area, but the question does not state that the remote site needs redistribution. A regular stub area is acceptable but does not minimize resources as much as a totally stubby area. Because there is no demand for traffic to pass through this area, the most efficient Cisco design is totally stubby. Reference topics: OSPF stub areas, totally stubby area, default routing, LSDB reduction, branch OSPF design.

Lowering the OSPF cost on the direct R1-to-R2 link is the cleanest way to force traffic for 10.10.20.0/24 to prefer that link. OSPF calculates the shortest path using cumulative interface cost, and Cisco designs normally tune OSPF path selection by changing interface cost rather than administrative distance. Administrative distance determines preference between different routing protocols, not between OSPF paths inside the same OSPF process. Moving the link into another area or creating a multiarea adjacency adds design complexity and does not directly solve the requirement unless the resulting cost still becomes lower. The exhibit states that the architect must use the direct link for traffic from 10.10.10.0/24 toward 10.10.20.0/24. Therefore, the direct link must have a lower total OSPF metric than the alternate path. Configuring the link cost to a value below 30 makes OSPF choose it as the preferred intra-area route. This is deterministic, easy to validate with the OSPF database and routing table, and consistent with Cisco hierarchical IGP design practice. Reference topics: OSPF cost, SPF path selection, metric tuning, intra-area routing.

Dual stack is the correct IPv4 and IPv6 deployment strategy when the customer wants a straightforward design with no information hiding and no tunnel forwarding overhead. In a dual-stack deployment, routers, switches, servers, and clients run IPv4 and IPv6 simultaneously. Applications can select IPv4 or IPv6, typically based on DNS response and protocol availability, while the network forwards each protocol natively. This avoids the translation behavior of NAT64, where address information is hidden or converted between protocols. It also avoids GRE or other tunneling mechanisms, which add encapsulation overhead and operational complexity. LISP can provide location/identity separation and mobility, but it is not the simplest migration approach for native IPv4 and IPv6 coexistence. Dual stack is often the cleanest transition model when the infrastructure supports both protocols, because it permits gradual application migration without forcing all services through translators or tunnels. Reference topics: IPv6 migration, dual-stack deployment, NAT64, tunneling overhead, native IPv4 and IPv6 forwarding.