300-420 Exam Dumps - Cisco CCNP Enterprise Questions and Answers

A single VPLS instance is the correct Layer 2 VPN design because the customer requires service-provider transparency and direct communication between CE routers attached to the same VLAN. Virtual Private LAN Service provides a multipoint Ethernet LAN service across a provider MPLS or IP backbone. To the customer, the provider network behaves like a transparent Layer 2 switching domain, allowing CE devices in the same VLAN to communicate directly at Layer 2. VPWS is point-to-point, so multiple VPWS circuits would be required to approximate multipoint connectivity, and the design would not provide the same transparent shared LAN behavior. Multiple VPLS instances are unnecessary when the requirement is a single VLAN or single broadcast domain. VPLS also hides provider devices from the customer Layer 2 service view while allowing MAC learning and forwarding across the provider edge. Reference topics: VPLS, Layer 2 VPN, multipoint Ethernet service, CE transparency, VLAN extension, service provider WAN design.

Configuring the remote router as an EIGRP stub is the correct action to stabilize the design and reduce Stuck-in-Active risk. A DUAL-3-SIA message indicates that EIGRP did not receive a reply to a query within the active timer. This is common in designs where low-speed or resource-constrained routers are queried for destinations they should never provide transit reachability for. EIGRP stub routing tells upstream neighbors that the router is not a transit device and limits which routes it advertises. As a result, upstream routers do not send unnecessary queries through the stub router, which reduces query scope, CPU load, and convergence delay. Poison reverse and split horizon adjustments are not the right design response to an SIA condition caused by excessive query range. A summary route can help reduce query scope in some places, but the branch or edge router in this scenario should also be explicitly marked as a stub. Reference topics: EIGRP DUAL, Stuck-in-Active, EIGRP stub routing, query scope, low-bandwidth links, convergence stability.

The route-reflector design should make R2 a client of R1 and R4, and R5 a client of R3 and R4. The requirement states that the route reflector must have direct physical connections to the core routers R3 and R4, must avoid a single point of failure, and must account for high utilization on the R2-to-R1 link. In BGP route-reflector design, clients peer with redundant route reflectors so they can continue receiving reflected routes if one route reflector or path fails. Placing R5 as a client of R3 and R4 satisfies the direct-core requirement and provides redundant reflection through the core. Placing R2 as a client of R1 and R4 provides redundancy while reducing dependence on the heavily utilized R2-to-R1 link by including R4 as an alternate reflector. Making a router a client of two reflectors is a standard design technique for route-reflector high availability. The other combinations either fail the direct-core requirement, do not provide balanced redundancy, or keep traffic tied to the congested link. Reference topics: BGP route reflectors, client redundancy, iBGP scaling, route-reflector placement, core resiliency.

Multiple Spanning Tree Protocol is the standards-based solution that allows many VLANs to be mapped into a smaller number of spanning-tree instances. MSTP is defined by IEEE 802.1s and incorporated into IEEE 802.1Q, making it suitable for a multivendor campus where proprietary per-VLAN behavior is not acceptable. The question states that all configured VLANs must be grouped into two STP instances. That is exactly the design purpose of MST: VLAN-to-instance mapping lets the architect reduce the number of active spanning-tree calculations while still supporting different forwarding topologies for selected VLAN groups. Traditional STP runs a single common spanning tree and cannot provide two separate VLAN instance groups. RSTP improves convergence but does not by itself group VLANs into multiple instances. Rapid PVST+ provides one rapid spanning-tree instance per VLAN, but it is Cisco-oriented and creates far more instances than required. For a vendor-neutral design with two spanning-tree instances, MSTP is the correct choice and also reduces CPU and memory pressure compared with running a separate instance per VLAN.

Area 1 should be configured as an NSSA when the design must allow selected external routes, such as EIGRP-originated routes, while controlling other external routes such as those from the RIP domain. A normal OSPF area receives Type 5 external LSAs, so it would not inherently block the unwanted RIP-originated external routes. A stub area blocks Type 5 external LSAs, but it also cannot contain an ASBR that injects external routes in the normal way. An NSSA is designed for this exact middle ground: it restricts external LSAs from the backbone while allowing external routes to be injected inside the area as Type 7 LSAs, which are translated by the ABR when needed. This allows Area 1 to receive the necessary internal and selected redistributed information while excluding external routes originated elsewhere. Making the routers part of area 0 would not solve the external-route filtering requirement and would weaken the intended area structure. Therefore, NSSA provides the required balance of route visibility and external-route control. Reference topics: OSPF NSSA, Type 5 LSAs, Type 7 LSAs, external route control, area design.

The valid EIGRP stub options listed are receive-only and summary. Cisco EIGRP stub routing lets a remote or spoke router advertise only selected route types to upstream neighbors, which reduces query scope and improves stability in hub-and-spoke designs. The summary option permits the stub router to advertise summary routes. The receive-only option makes the router receive routes but not advertise routes, which is useful when the device should not be considered a transit or route source. “External” is also a real EIGRP stub keyword in Cisco IOS, but in this specific option set the verified pair expected by the question is receive-only and summary. “Summary-only” is not the correct EIGRP stub keyword. “Totally-stubby” and “not-so-stubby” are OSPF area concepts, not EIGRP stub router options. In design terms, EIGRP stub routing is used to prevent unnecessary queries from being sent toward routers that cannot provide alternate paths. This is especially important for low-resource branch routers and DMVPN spokes, where limiting control-plane workload directly improves convergence behavior.

Dual stack is the correct migration strategy when the application chooses IPv6 or IPv4 based on DNS resolution. In a dual-stack deployment, hosts and network devices run IPv4 and IPv6 at the same time. Applications can query DNS and then select the protocol based on the returned records, such as using an AAAA record for IPv6 or an A record for IPv4. This gives the organization a controlled migration path because IPv6-capable applications and services can move to IPv6 while legacy IPv4 services remain reachable during the transition. Address-family translation for public web presence is useful when IPv6-only and IPv4-only endpoints must communicate through a translation boundary, but it does not provide native application choice between the protocols. Host-initiated tunnels and site-to-site IPv6-over-IPv4 tunnels encapsulate one protocol over another and add operational overhead. The question’s key phrase is that the application chooses between IPv6 and IPv4 based on DNS; that is the normal dual-stack behavior. Reference topics: IPv6 migration, dual stack, DNS A and AAAA records, transition strategy, application protocol selection.

VSS is the best choice because it provides distribution-layer redundancy with a simplified operational model and fast failover. Cisco Virtual Switching System combines two physical Catalyst switches into one logical switch from the perspective of neighboring devices. This allows the access layer to use Multichassis EtherChannel toward the distribution pair, creating a loop-free Layer 2 topology without relying on STP blocking for normal forwarding. Cisco also describes VSS as using Stateful Switchover and Nonstop Forwarding so the standby chassis can preserve forwarding during supervisor or chassis events. That meets the requirement for very fast convergence while simplifying deployment for a small IT team. GLBP, VRRP, and HSRP are first-hop redundancy protocols. They provide default-gateway resiliency, but they do not merge the distribution layer into a single logical control plane or simplify dual-uplink forwarding the way VSS with MEC does. Reference topics: VSS, Multichassis EtherChannel, distribution-layer redundancy, SSO, NSF, campus high availability.

The correct solution is again a management VRF with SSH keys for device access. This duplicate item tests the same design principle: management traffic should be logically isolated from the overlay and production forwarding paths. A VRF gives the management plane its own routing table, so changes or failures in the overlay do not normally alter management reachability. That makes the network easier to operate because engineers can troubleshoot device access, routing, and overlay behavior as separate concerns. SSH keys satisfy the secure-access requirement by providing encrypted management sessions with public-key authentication. Private VLANs and standard VLANs can segment Layer 2 traffic, but they do not solve routing separation by themselves. TACACS+ and RADIUS provide authentication, authorization, and accounting, but they do not prevent overlay routing from interacting with management reachability. A separate physical interface can help in some designs, but option A is the cleanest answer because it combines routing isolation with secure access. Reference topics: management VRF, SSH, secure management plane, route isolation, overlay troubleshooting.

The best summarization design is for the aggregation layer to advertise a default route toward the access layer and to summarize the VLAN subnets toward the core. Cisco hierarchical campus design uses summarization at natural layer boundaries so that access-layer instability is hidden from the rest of the network. If individual access VLANs flap, the core should not have to process every specific route change. Advertising a summary such as 10.0.0.0/16 from the aggregation layer toward the core reduces routing-table size, lowers CPU and memory use, and confines convergence events to the lower layer. At the same time, the access layer normally does not need full knowledge of the enterprise routing table; a default route from the aggregation layer is sufficient for northbound reachability. Summarizing at the access layer is normally less effective because the aggregation layer is the first stable boundary that sees multiple access networks. Advertising a default from the core toward aggregation would hide information in the wrong direction. Reference topics: hierarchical routing, route summarization, campus aggregation design, convergence containment, routing-table scaling.