300-420 Exam Dumps - Cisco CCNP Enterprise Questions and Answers

Dual DMVPN with EIGRP routing is the correct solution because the requirements call for secure public-internet connectivity, redundant paths, automatic path selection, multicast support, and minimal remote-site configuration. DMVPN builds dynamic multipoint GRE tunnels protected by IPsec, allowing spoke sites to communicate securely through the public internet while supporting routing protocols and multicast over GRE. A dual DMVPN design provides redundancy through separate hubs, transports, or tunnel clouds, so a spoke can continue operating if one path fails. EIGRP can calculate alternate paths and react to metric changes, supporting automatic path selection based on failure and quality when engineered correctly. MPLS with BGP does not meet the public-internet and encryption requirements by itself. A full mesh of IPsec tunnels with OSPF or IS-IS would increase configuration complexity at every remote site and does not scale as well. DMVPN is specifically built to simplify deployment of secure, scalable, multipoint branch VPNs. Reference topics: DMVPN, IPsec, mGRE, EIGRP over DMVPN, WAN redundancy, multicast over GRE.

Route leaking on R13 and R9 is required so the Level 1 area can make a better exit decision toward the server. In an IS-IS hierarchy, Level 1 routers know detailed topology only inside their own area. For destinations outside the area, they normally follow the closest attached Level 1/Level 2 router, which can produce suboptimal latency when another exit has a better end-to-end path. Route leaking selectively injects more specific Level 2 reachability information into Level 1, allowing routers in the New Office area to evaluate a better path instead of blindly following the nearest attached-bit exit. Changing metric style on R8 alone does not import the external-area route information needed for better path selection. A static route could force a path but would not be a scalable dynamic IS-IS design. Making R8 Level 1/Level 2 does not solve the need to expose the relevant route through the correct area boundary. Reference topics: IS-IS Level 1 and Level 2, attached bit, route leaking, interarea optimization, latency-aware routing.

Improved application experience and optimized cloud connectivity are two principal advantages of Cisco SD-WAN technology. Cisco SD-WAN separates the control plane from the data plane and applies centralized policy to choose the best available transport path for business applications. Features such as application-aware routing, performance measurement, path quality monitoring, forward error correction, packet duplication for selected traffic, and QoS integration help improve user experience for voice, video, SaaS, and other critical applications. SD-WAN also improves cloud connectivity by allowing branches to access trusted SaaS and IaaS resources directly instead of backhauling all traffic through a central data center. Cloud OnRamp functions further simplify connectivity to cloud-hosted workloads and SaaS applications. Easier deployment and proactive management may be operational benefits in some designs, but the strongest technology advantages in this answer set are application experience and optimized cloud access. Consistent connectivity is too generic and does not identify a specific SD-WAN design value. Reference topics: Cisco SD-WAN benefits, application-aware routing, direct internet access, Cloud OnRamp, SaaS optimization.

Incremental SPF is the correct solution because the problem specifically states that Type 1 or Type 2 LSAs force the OSPF process to recompute the entire shortest path tree. Cisco OSPF documentation states that when changes to a Type 1 or Type 2 LSA occur, the entire SPT is normally recomputed, and that incremental SPF allows the system to recompute only the affected part of the tree. This improves convergence and reduces CPU use because the router does not have to run a full Dijkstra calculation for every topology change. BFD detects failures quickly, but it does not change how OSPF recalculates the SPT after the LSA arrives. Standard SPF is the default full calculation behavior and therefore does not solve the optimization requirement. PRC is associated with partial route calculation behavior in some link-state contexts, but for this OSPF question the Cisco feature name is iSPF. Reference topics: OSPF incremental SPF, Type 1 LSA, Type 2 LSA, SPF optimization, campus OSPF scaling.

The correct code snippet must use a secure HTTPS-based RESTCONF transaction with the YANG JSON media type. The requirement explicitly states that the content type is application/yang-data+json and that the connection to the network device must be secured. In Cisco IOS XE programmability, RESTCONF uses HTTP methods against YANG-modeled resources, and secure deployments use HTTPS rather than clear-text HTTP. A loopback interface with address 172.16.15.12/32 would be configured by sending a JSON payload that follows the selected YANG model structure, commonly an IETF or Cisco native interface model, with the correct content-type and authentication headers. The key security indicator in the option must therefore be HTTPS/TLS, not an insecure HTTP URL or a non-YANG content type. NETCONF over SSH would also be secure, but the stated content-type points to RESTCONF with JSON encoding. Option A is the valid snippet because it aligns the payload format with a secure transport. Reference topics: RESTCONF, YANG JSON encoding, application/yang-data+json, HTTPS, IOS XE programmability.

Option A is the best addressing design because it gives each site enough capacity while avoiding excessive address waste and supporting summarization. A campus requiring 12,000 devices needs at least 14 host bits because 2^13 minus two is only 8190 usable addresses, while a /18 provides 16,382 usable addresses. That leaves room for growth without assigning an unnecessarily huge block. Each branch requiring 1,000 devices needs at least 10 host bits; a /22 provides 1,022 usable addresses, but /21 provides 2,046 usable addresses and additional growth capacity. The selected branch blocks, 10.0.192.0/21 and 10.0.200.0/21, are contiguous on valid /21 boundaries and can be summarized cleanly where appropriate. Option D fails because a /20 supports only 4094 usable addresses and cannot accommodate the 12,000-device campus. Option B overallocates a /16 to the campus and /20s to branches, wasting resources. Option C is grossly oversized and operationally poor. Reference topics: hierarchical IPv4 addressing, route summarization, VLSM, host-capacity planning, convergence containment.

The provider must activate the VPNv4 unicast address family between PE routers. In an MPLS Layer 3 VPN, customer routes learned from CE routers are placed into VRFs on the PE routers. To carry those customer routes across the provider backbone without overlap, MP-BGP advertises VPNv4 routes, which combine an IPv4 prefix with a route distinguisher. Route targets then control which receiving VRFs import the routes. Plain IPv4 unicast would not preserve customer VPN context and would not solve overlapping route separation. L2VPN EVPN is used for Ethernet VPN services and data center or Layer 2 VPN use cases, not classic MPLS L3VPN route exchange between PEs. Address-family multicast is unrelated to exchanging customer unicast routes between PE routers. Cisco MPLS VPN design relies on MP-BGP VPNv4 between provider edge routers, while PE-CE routing can be static, OSPF, EIGRP, BGP, or another supported method. Therefore, VPNv4 unicast is the correct PE-to-PE address family. Reference topics: MPLS Layer 3 VPN, MP-BGP, VPNv4 unicast, route distinguishers, route targets, PE-CE routing.

The correct answer is bidirectional PIM. Cisco describes bidirectional PIM as a multicast mode designed for many-to-many applications where traffic is forwarded only along a shared tree rooted at the rendezvous point. Unlike traditional PIM Sparse Mode, BIDIR-PIM does not build source-specific shortest-path trees for each active source. That design reduces multicast state in the network because routers maintain group state rather than separate source and group state for every sender. PIM Sparse Mode initially uses a shared tree through the RP, but it can switch to source trees after receivers and routers learn the active source. Dense mode floods and prunes and is not a shared-tree-only model. Source-specific multicast explicitly uses source-specific joins and does not use an RP-based shared tree. The wording “shared tree only” is the key distinction: BIDIR-PIM is built for scalable many-to-many multicast, accepts some non-shortest-path forwarding tradeoff, and avoids per-source state growth. Therefore, the stored answer must be corrected to bidirectional. Reference topics: BIDIR-PIM, shared trees, rendezvous points, many-to-many multicast scaling, PIM-SM source-tree behavior.

BFD is not required for the specific failure described: a physical fiber break on point-to-point routed links. In a Layer 3 campus or routed-access design, a direct physical link failure is detected by the interface state change, so the routing protocol can react immediately without waiting for hello/dead timers. Cisco campus design guidance favors point-to-point routed links partly because they give rapid convergence and avoid STP delays. BFD is valuable when a forwarding-path failure is not reliably detected by Layer 1 or Layer 2, or when a protocol adjacency must detect loss faster than its native timers. It does not automatically create convergence by itself; it detects failure and notifies the routing protocol. For a clean fiber cut on a routed point-to-point link, link-down detection is already fast enough for sub-second failover in the design. OSPF timer tuning is also not the preferred design answer for this physical-failure case. Reference topics: routed access design, point-to-point links, link-failure detection, BFD, OSPF convergence.

If the RPF check is successful in PIM sparse mode, the multicast packet is forwarded according to the outgoing interface list. The Reverse Path Forwarding check verifies that the packet arrived on the interface the router would use to reach the source, or the RP in the case of shared-tree state. This prevents loops and duplicate multicast forwarding. After the check passes, the router consults the multicast forwarding entry and sends the packet only out interfaces in the OIL where downstream receivers or PIM neighbors require the traffic. It is not automatically forwarded out every PIM-enabled interface, and it is not forwarded back out the receiving interface. If the RPF check fails, the packet is dropped to protect the multicast distribution tree. The OIL therefore represents the correct controlled forwarding behavior after a successful RPF validation. Reference topics: PIM sparse mode, RPF check, outgoing interface list, multicast forwarding state, loop prevention.