300-420 Exam Dumps - Cisco CCNP Enterprise Questions and Answers

BIDIR-PIM is the correct multicast mode for a video conferencing environment with numerous dispersed senders and receivers. Bidirectional PIM is designed for many-to-many multicast applications where receivers may also transmit and where maintaining per-source trees would create unnecessary state and control-plane overhead. Instead of building a shortest-path tree for every source, BIDIR-PIM uses a shared tree rooted at the rendezvous point and forwards traffic bidirectionally. This makes it attractive for collaborative applications and conferencing scenarios with many active participants. MP-BGP can carry multicast VPN or multicast routing information in service-provider designs, but it is not itself the multicast forwarding mode for this requirement. MSDP is used to exchange source information between PIM-SM domains, not to optimize many-to-many forwarding within the multicast design. IGMPv2 handles host membership signaling on local segments and does not provide the routed multicast mode. Reference topics: BIDIR-PIM, many-to-many multicast, shared tree, video conferencing multicast, PIM design.

The selected command pair is appropriate because the issue is that GigabitEthernet0/2 on SW2 is not becoming the root port as expected. In spanning-tree design, the root port is selected based on the lowest root path cost, then upstream bridge ID, then port ID when necessary. If the wrong port is selected, the engineer must adjust the local spanning-tree parameters on SW2 so that the intended interface has the best path toward the root bridge. Typical corrective commands lower the spanning-tree cost or set the port priority on the desired interface or VLAN instance. The correct answer pair is therefore the combination that changes the STP decision variables for Gig0/2 rather than changing unrelated features such as PortFast, BPDU Guard, or VLAN trunking. PortFast is unsafe on switch-to-switch links, and protection features do not make an interface more attractive as a root port. The fix must influence STP path selection while keeping the topology loop-free. Reference topics: STP root port election, path cost, port priority, root bridge path selection, Catalyst Layer 2 troubleshooting.

A dedicated management VRF is the correct feature when management protocols must traverse the production network but remain logically separated. The question describes in-band management because SSH, NTP, FTP, and SNMP are carried over the production network rather than over a separate physical console or out-of-band network. The design still requires routers and switches across different networks to be managed securely. A management VRF gives the management plane its own routing table, allowing the engineer to restrict management reachability, apply separate routing, and keep management traffic from leaking into user or service forwarding paths. Management Plane Protection can restrict which interfaces accept management-plane traffic, but it does not by itself provide separate routing across different networks. A terminal server or dedicated console connection is an out-of-band operational tool, not the production-network management design requested here. A dedicated management VRF per device is therefore the correct feature. Reference topics: in-band management, management VRF, SNMP and SSH reachability, management-plane segmentation, enterprise operations design.

Class selector code points provide backward compatibility between IP Precedence and DiffServ. IP Precedence uses the three most significant bits of the former Type of Service field. DiffServ expands QoS marking by using the six-bit DSCP field, but class selector values preserve compatibility by setting the three high-order bits to match the corresponding IP Precedence value while leaving the lower bits as zeros. For example, CS3 corresponds to the old precedence value 3, and CS6 corresponds to precedence 6. This allows devices that still interpret IP Precedence to provide broadly consistent treatment while newer DiffServ-aware devices can use DSCP-based policy. Expedited forwarding is used for low-loss, low-latency traffic such as voice. Assured forwarding provides drop precedence within classes. Default per-hop behavior represents best-effort treatment. None of those are specifically the backward-compatibility mechanism for migration from IP Precedence. Therefore, the design should include class selector code points during the transition to DiffServ. Reference topics: DiffServ, DSCP, class selector, IP Precedence compatibility, QoS marking migration.

The fabric control plane in Cisco SD-Access creates and resolves endpoint-to-location mappings. SD-Access separates endpoint identity from physical topology by using LISP in the control plane. Endpoint addresses are treated as Endpoint Identifiers, and fabric node locations are represented by Routing Locators. When an endpoint appears on a fabric edge node, the edge registers that endpoint-to-edge binding with the control-plane node. When another edge needs to send traffic to that endpoint, it queries the control plane to resolve the current location and then uses the fabric data plane to encapsulate traffic toward the correct destination. Group-Based Access Control policy creation and enforcement involve Cisco ISE, security group tags, and policy components rather than the basic mapping purpose of the fabric control plane. BGP route reflection is not the SD-Access control-plane function, and extending multiple subnets to one RLOC is not the main purpose. Reference topics: SD-Access control plane, LISP, EID-to-RLOC mapping, endpoint registration, map resolution.

Without centralized policy, OMP allows all WAN Edge routers in the same VPN to communicate in a full-mesh overlay. Cisco Catalyst SD-WAN uses OMP as the control-plane protocol between WAN Edge routers and SD-WAN controllers. WAN Edge devices advertise OMP routes, TLOC routes, and service routes to the controllers, and the controllers distribute the reachable routes back to the relevant edge devices. Cisco policy documentation describes the default unpolicied behavior as permissive: routes are accepted and advertised so sites in the same VPN learn reachability to each other. That default route distribution produces a full-mesh data-plane capability, even though control connections remain hubbed through the controllers. Hub-and-spoke, regional isolation, point-to-point restriction, or service-chained topologies require centralized control or data policy to filter routes or steer traffic. Blocking all communication is the opposite of the default behavior. Reference topics: Cisco SD-WAN OMP, default route distribution, full-mesh overlay, centralized control policy, VPN segmentation.

Dual stack is the correct IPv4 and IPv6 deployment strategy when the customer wants a straightforward design with no information hiding and no tunnel forwarding overhead. In a dual-stack deployment, routers, switches, servers, and clients run IPv4 and IPv6 simultaneously. Applications can select IPv4 or IPv6, typically based on DNS response and protocol availability, while the network forwards each protocol natively. This avoids the translation behavior of NAT64, where address information is hidden or converted between protocols. It also avoids GRE or other tunneling mechanisms, which add encapsulation overhead and operational complexity. LISP can provide location/identity separation and mobility, but it is not the simplest migration approach for native IPv4 and IPv6 coexistence. Dual stack is often the cleanest transition model when the infrastructure supports both protocols, because it permits gradual application migration without forcing all services through translators or tunnels. Reference topics: IPv6 migration, dual-stack deployment, NAT64, tunneling overhead, native IPv4 and IPv6 forwarding.

IP directed broadcast must be enabled on the last Layer 3 device connected to the destination client subnet, which is R2 in the exhibit. Wake-on-LAN uses a magic packet that must reach sleeping hosts on the target LAN. Because sleeping clients often do not have an active IP stack or ARP entry, the WoL packet is commonly sent as a directed broadcast toward the target subnet. Routers forward the packet as a unicast until it reaches the destination subnet, where the last-hop router converts it into a Layer 2 broadcast if directed broadcasts are permitted. Cisco disables directed broadcasts by default on many platforms because of historical amplification-attack risks, so the design should enable it only where needed and protect it with ACLs. Spanning-tree UplinkFast is unrelated to delivering WoL packets; it improves STP convergence on access switches. Enabling directed broadcasts on the wrong router would not place the magic packet onto the client VLAN. Therefore, R2, the last-hop router toward the target WoL clients, is the correct location. Reference topics: Wake-on-LAN, IP directed broadcast, last-hop router behavior, subnet broadcast forwarding, ACL protection.

NBAR2 should be used to identify the affected cloud applications and then allocate bandwidth according to the measured application requirements. Modern collaboration suites often use dynamic ports, encrypted sessions, and multiple flows for voice, video, messaging, file sharing, and screen sharing. Classifying them only by static ports is unreliable and can misclassify traffic, especially when applications change transport behavior or use shared cloud endpoints. Cisco NBAR2 provides application recognition beyond basic port matching and can classify traffic by application signatures. Once the applications are identified, the QoS policy can be adjusted to give the required bandwidth, priority, or queue treatment. Reserving bandwidth only on perimeter routers is incomplete if congestion occurs elsewhere in the WAN path. Rate-limiting the applications would likely make the user experience worse. The key problem is that the existing policy works for other applications but not these cloud-based tools, so the first design step is accurate application visibility and classification. NBAR2 provides that visibility and supports a more precise QoS policy. Reference topics: NBAR2, application-aware QoS, cloud collaboration traffic, DSCP classification, bandwidth allocation.

The VRF receive feature is the mechanism that fits the constraint when the customer does not want BGP, VRF-Lite links, or static routing for the inter-VRF requirement. Inter-VRF connectivity is normally achieved through route leaking with MP-BGP, static routes, firewall interfaces in each VRF, or VRF-Lite handoff links. The question explicitly excludes those common approaches and asks for a mechanism on the core network layer. The VRF receive capability allows selected traffic received on a global routing interface to be associated with a VRF context for locally configured addresses, supporting limited interaction without building a full routing exchange between the global table and the VRF. Policy-based routing with a global set statement can solve some forwarding cases, but it is not the specific mechanism described by the option set. A route map with import features would typically depend on route leaking behavior. Therefore, the best answer is the VRF receive feature under the global routing interfaces. Reference topics: VRF, inter-VRF routing, VRF receive, route leaking alternatives, core-layer segmentation.