300-420 Exam Dumps - Designing Cisco Enterprise Networks (ENSLD) v1.1

The correct solution is again a management VRF with SSH keys for device access. This duplicate item tests the same design principle: management traffic should be logically isolated from the overlay and production forwarding paths. A VRF gives the management plane its own routing table, so changes or failures in the overlay do not normally alter management reachability. That makes the network easier to operate because engineers can troubleshoot device access, routing, and overlay behavior as separate concerns. SSH keys satisfy the secure-access requirement by providing encrypted management sessions with public-key authentication. Private VLANs and standard VLANs can segment Layer 2 traffic, but they do not solve routing separation by themselves. TACACS+ and RADIUS provide authentication, authorization, and accounting, but they do not prevent overlay routing from interacting with management reachability. A separate physical interface can help in some designs, but option A is the cleanest answer because it combines routing isolation with secure access. Reference topics: management VRF, SSH, secure management plane, route isolation, overlay troubleshooting.

The correct subnet choice is 192.168.32.0/27. The design must support at least five subnets and at least 25 usable hosts per subnet from a /24 allocation. A /27 leaves five host bits, giving 32 total addresses and 30 usable host addresses after excluding the subnet and broadcast addresses. It also borrows three bits from the /24 host field, creating eight equal /27 subnets, which satisfies the requirement for at least five departmental networks. A /26 provides 62 usable hosts, but only four subnets inside a /24, so it fails the subnet-count requirement. A /25 provides only two subnets. A /28 provides enough subnets but only 14 usable host addresses, which fails the host requirement. Cisco subnetting guidance uses exactly this host-bit and prefix-length calculation model when selecting VLSM blocks. Reference topics: IPv4 subnetting, CIDR prefix length, host-bit calculation, VLSM design, private IPv4 addressing.

The best design is the option that prefers ISP-1 for both outbound and inbound traffic while keeping ISP-2 available as a backup. For outbound traffic from the enterprise, local preference is the correct BGP attribute because it is evaluated inside the local AS and higher local preference wins. R1 should assign a high local preference to routes learned from ISP-1, while R2 should assign a low local preference to routes learned from ISP-2. For inbound traffic from the Internet toward the enterprise, AS-path prepending is the practical signal sent to external networks. Advertising routes to ISP-1 with no prepending and routes to ISP-2 with five prepends makes the ISP-1 path look shorter and therefore more attractive. The R1-to-R2 internal advertisements should not be blocked by NO-ADVERTISE because each edge router must still share reachability internally for failover. Option B matches these controls without unnecessarily suppressing routes between the edge routers. Reference topics: BGP local preference, AS-path prepending, active/backup Internet design, inbound and outbound path control.

Cisco traffic policing evaluates packets against a configured traffic contract and classifies them into action states such as conforming, exceeding, and violating. The policy then applies configured actions to those states, such as transmit, drop, or remark. In a two-rate or three-color policing design, conforming traffic is within the committed rate, exceeding traffic is above the committed rate but may still be within an excess burst allowance, and violating traffic is outside the permitted profile. Therefore, conforming and violating are valid policing parameters or state/action categories in the context of the question. Shaping is not a policing parameter; it is a different QoS mechanism that buffers excess traffic and sends it later. Marking can be an action applied by policing, but the listed policing state that directly corresponds to Cisco class-based policing syntax is conform or violate. Bursting is related to token bucket sizing, but the answer choices specifically align to policing state categories. The correct pair is violating and conforming.

Making R2 active for half of the VLANs improves utilization by distributing first-hop gateway forwarding across both core routers. HSRP provides default-gateway redundancy by making one router active and another standby for a VLAN. If the same router is active for every VLAN, traffic from all downstream VLANs is forwarded through the same core path, which can leave some interfaces congested while parallel links on the standby side remain underused. Cisco campus designs commonly tune HSRP priorities per VLAN and align the active HSRP gateway with the spanning-tree root for that VLAN. This creates a deterministic load-sharing model while preserving gateway redundancy. Adding more interfaces may help capacity, but the question states that some downstream interfaces are already underutilized, so the issue is load distribution rather than absolute port count. A port channel is useful only when the topology supports bundling the specific links and does not by itself move gateway activity. RSTP improves convergence, not HSRP forwarding balance. Reference topics: HSRP load sharing, per-VLAN gateway placement, STP root alignment, campus capacity design.

The design should combine IP SLA with Enhanced Object Tracking on router R1. HSRP by itself tracks the health of the local interface and peer state, but it may not detect a remote WAN failure beyond the directly connected segment. IP SLA can actively probe a target through WAN 1, such as an upstream next hop or reachable service address. Enhanced Object Tracking then tracks the IP SLA result and adjusts the HSRP priority when the probe fails. If R1 loses WAN 1 reachability, its HSRP priority is decremented, allowing R2 to become the active default gateway. A floating static route can provide routing backup, but it does not directly trigger HSRP state change for gateway failover. Policy-based routing and IP source routing are not appropriate high-availability mechanisms for this requirement. The correct design pattern is therefore IP SLA plus object tracking integrated with HSRP. The architect should set preemption, decrement values, timers, and tracked destinations carefully to avoid false failovers during transient loss. Reference topics: HSRP, IP SLA, Enhanced Object Tracking, first-hop redundancy, WAN failure detection.

The Cisco SD-Access data plane is based on VXLAN. Cisco SD-Access separates the fabric into functional planes: the underlay provides IP reachability, the control plane uses LISP to map endpoints to locations, and the data plane uses VXLAN encapsulation to carry user traffic across the routed underlay. VXLAN allows the fabric edge node to encapsulate endpoint traffic and forward it through the fabric while preserving virtual network and segmentation information. This is what enables SD-Access to provide Layer 2 and Layer 3 overlay services over a Layer 3 routed transport. OMP is the control-plane protocol for Cisco SD-WAN, not SD-Access. NHRP is associated with DMVPN tunnel resolution. LISP is essential in SD-Access, but its role is endpoint ID to routing locator mapping, not packet encapsulation in the data plane. Therefore, VXLAN is the correct protocol for the SD-Access data plane. Reference topics: SD-Access fabric, VXLAN data plane, LISP control plane, overlay encapsulation, routed underlay.

The valid EIGRP stub options listed are receive-only and summary. Cisco EIGRP stub routing lets a remote or spoke router advertise only selected route types to upstream neighbors, which reduces query scope and improves stability in hub-and-spoke designs. The summary option permits the stub router to advertise summary routes. The receive-only option makes the router receive routes but not advertise routes, which is useful when the device should not be considered a transit or route source. “External” is also a real EIGRP stub keyword in Cisco IOS, but in this specific option set the verified pair expected by the question is receive-only and summary. “Summary-only” is not the correct EIGRP stub keyword. “Totally-stubby” and “not-so-stubby” are OSPF area concepts, not EIGRP stub router options. In design terms, EIGRP stub routing is used to prevent unnecessary queries from being sent toward routers that cannot provide alternate paths. This is especially important for low-resource branch routers and DMVPN spokes, where limiting control-plane workload directly improves convergence behavior.