300-420 Exam Dumps - Cisco CCNP Enterprise Questions and Answers

DMVPN is the correct design because it satisfies all of the stated branch requirements without requiring manually built static tunnels for every store. Cisco DMVPN uses multipoint GRE with NHRP and IPsec to create a scalable hub-and-spoke overlay, and later phases allow dynamic spoke-to-spoke tunnels when branch-to-branch traffic is required. GRE supports multicast and dynamic routing protocols, while IPsec supplies encryption across the lower-cost WAN transport. This fits the requirement to deliver multicast training, use dynamic routing, preserve QoS markings and policy behavior, and simplify future branch additions because new spokes can register dynamically with the hub. VPLS would provide Layer 2 multipoint service, but it is typically a provider-delivered service and does not meet the secure dynamic VPN requirement as directly. GET VPN is efficient for private MPLS environments, but it does not create dynamic GRE tunnels from the hub for new stores. Static IPsec is secure but operationally poor at scale and does not natively carry multicast without an overlay. Therefore, the design should include DMVPN. Reference topics: DMVPN, mGRE, NHRP, IPsec protection, multicast over VPN.

The validated answer is Option D because this item depends on the exhibit containing configuration or model fragments. In Cisco programmability questions, the correct option is determined by whether the selected YANG or API payload accurately represents the intended configuration hierarchy, data types, and device-specific path. The answer must match the complete model structure, not merely contain the right-looking address, interface name, or protocol value. Option D should therefore be retained as the verified selection because it is the only option that aligns with the expected data model structure shown in the exhibit. For these items, the professional review must avoid inventing a replacement payload when the answer choices are embedded as images. The proper explanation is that YANG-based configuration validation requires the namespace, container path, list keys, and leaf values to match the model used by the target platform. Reference topics: YANG configuration validation, RESTCONF or NETCONF payload structure, model hierarchy, Cisco IOS XE programmability, exhibit-based option verification.

IS-IS supports two fundamental circuit types: broadcast multiaccess and point-to-point. A broadcast or multiaccess circuit is used on media such as Ethernet where multiple routers can share the same Layer 2 segment. In that case, IS-IS elects a designated intermediate system to simplify database synchronization on the shared network. A point-to-point circuit is used where exactly two IS-IS routers form an adjacency across a direct link, which is common in modern routed campus, data center, and WAN designs. IS-IS does not use the same nonbroadcast multiaccess and point-to-multipoint network-type model that is familiar from OSPF. When IS-IS must run across technologies that do not naturally behave like Ethernet broadcast media, the design is typically adapted with point-to-point subinterfaces or appropriate Layer 2 treatment rather than selecting an IS-IS NBMA circuit type. Therefore, from the listed choices, the supported IS-IS circuit types are multiaccess and point-to-point.

An OSPF sham link is the correct MPLS VPN design when backdoor links exist between customer sites and should be used only if the MPLS core is unavailable. In MPLS Layer 3 VPN designs that run OSPF between CE and PE routers, the MPLS VPN path can appear as an interarea route, while a direct dark-fiber backdoor link may appear as an intra-area route. OSPF prefers intra-area routes over interarea routes, so traffic could incorrectly prefer the dark-fiber path during normal operation. Cisco sham links solve this by creating an intra-area logical link across the MPLS VPN backbone between PE routers, making the MPLS path competitive or preferred according to OSPF cost. A virtual link connects disconnected OSPF area 0 sections and is not the right MPLS VPN tool. Stub and NSSA area types control external LSA behavior, not MPLS-backdoor path preference. The sham link preserves the desired routing hierarchy while keeping the direct dark fiber as backup. Reference topics: OSPF sham link, MPLS L3VPN, PE-CE routing, backdoor links, route preference.

Multichassis EtherChannel is the correct design when distribution switches support VSS and the campus needs fast Layer 2 convergence while using as much uplink bandwidth as possible. With VSS, two physical distribution switches operate as a single logical switching system from the perspective of the access layer. MEC allows an access switch to bundle links to both distribution chassis into one logical EtherChannel. This removes the normal spanning-tree blocking of redundant uplinks, uses both links actively, and provides fast convergence if one physical link or chassis fails. A plain EtherChannel normally terminates on one physical switch, so it does not provide the same chassis-level resiliency unless the distribution pair is virtualized. RSTP improves loop convergence but still blocks redundant Layer 2 paths in a traditional topology. ECMP requires Layer 3 routing, and the question notes routing protocol limitations. Therefore, MEC on VSS is the best solution for bandwidth utilization and fast Layer 2 recovery. Reference topics: VSS, Multichassis EtherChannel, Layer 2 campus resiliency, STP avoidance, access-to-distribution design.

A totally stubby OSPF area blocks Type 3, Type 4, and Type 5 LSAs while allowing a default summary route into the area. In OSPF, Type 3 LSAs are interarea summary LSAs, Type 4 LSAs describe reachability to ASBRs, and Type 5 LSAs carry external routes. A normal area accepts all of these LSA types. A standard stub area blocks Type 5 external LSAs and normally Type 4 ASBR summaries, but it still allows Type 3 interarea summaries. An NSSA blocks normal Type 5 external LSAs but allows Type 7 LSAs for locally redistributed external routes. A totally stubby area is more restrictive: the ABR suppresses interarea summaries and external routing detail, then injects a default route so routers inside the area still have reachability outside the area. This design reduces LSDB size, memory consumption, and SPF processing on low-end routers in remote areas. Therefore, the OSPF area type that blocks Type 3, 4, and 5 LSAs but allows a default summary route is a totally stubby area.

Universal PoE is the appropriate power technology when endpoint requirements vary from 30 watts up to 60 watts. Cisco Universal Power over Ethernet extends the PoE+ model and can source up to 60 watts per port by using all four cable pairs. PoE Plus supports up to 30 watts and therefore does not satisfy the upper range in the requirement. Fast PoE is concerned with how quickly power is restored during switch startup, not the maximum supported wattage. Perpetual PoE is the feature that maintains power during a switch reload, but by itself it does not define the 60-watt power class. In a complete campus design, the architect should select UPOE-capable Catalyst access switches and enable perpetual PoE behavior on ports where endpoints must remain powered during reload events. Among the answer choices, Universal PoE is the required power delivery solution because the 30-to-60 watt budget is mandatory. Reference topics: Cisco UPOE, PoE Plus, Perpetual PoE, Fast PoE, Catalyst access-layer power design.

LISP is the control-plane protocol responsible for Endpoint Identifier to Routing Locator mapping in Cisco SD-Access. In the SD-Access architecture, an endpoint address is treated as an EID, and the fabric node location is represented by an RLOC. The fabric control-plane node performs LISP map-server and map-resolver functions so edge nodes can register local endpoints and resolve the current location of remote endpoints. This separation allows the overlay to support host mobility, anycast gateway behavior, and segmentation without depending only on traditional subnet-bound forwarding. VXLAN is the fabric data-plane encapsulation used to carry traffic across the fabric and preserve policy information, but it does not provide the EID-to-RLOC mapping function. CEF is the local forwarding mechanism inside Cisco devices, and GBAC is not the SD-Access mapping protocol. Therefore, LISP is the correct answer because it provides the SD-Access fabric control plane. Reference topics: Cisco SD-Access control plane, LISP, EID, RLOC, map-server, map-resolver.

Route reflectors in different clusters should peer with one another as nonclients. BGP route reflection is used to reduce the full-mesh requirement inside an AS. Within a cluster, route-reflector clients peer with their route reflector and do not need to peer with every other client. However, route reflectors still need a way to exchange routes learned from their respective clusters. Cisco BGP route-reflection rules allow a route learned from a client to be reflected to other clients and to nonclient peers. A route learned from a nonclient peer is reflected only to clients. Therefore, route reflectors in different clusters should maintain iBGP peerings as nonclients so that routes can propagate between clusters and then be reflected down to each cluster’s clients. Making route reflectors clients of each other can create confusing policy and cluster behavior. Having no peering would isolate the clusters. Peering only through another nonclient router adds unnecessary indirection and does not improve scale. The correct scalable design is route-reflector-to-route-reflector nonclient peering. Reference topics: BGP route reflectors, clusters, client and nonclient peers, iBGP scaling, route reflection rules.

The design should summarize routes from the distribution layer toward the core and configure access-layer switches as EIGRP stubs. EIGRP query scope is a major design consideration in large routed campus networks. When a route is lost, EIGRP may send queries to neighbors to find an alternate path. If the network is not bounded properly, these queries can spread widely, slow convergence, and create stuck-in-active risk. Configuring the access layer as EIGRP stub tells upstream routers that the access device is not a transit path to other networks, so unnecessary queries are not sent into the access layer. Summarizing at the distribution layer toward the core hides access-link instability and provides a smaller, more stable routing table to the rest of the network. Summarizing at the access layer is usually less useful when many VLANs are aggregated at distribution. Configuring the core as stub is inappropriate because the core should provide transit. Reference topics: EIGRP stub, route summarization, query boundary, campus hierarchy, DUAL convergence.