Cisco 300-420 - Designing Cisco Enterprise Networks (ENSLD) v1.1

DiffServ is the correct QoS model for a business-critical, delay-sensitive, high-bandwidth application across DMVPN tunnels protected with IPsec. Differentiated Services classifies and marks traffic, usually with DSCP, and then applies per-hop behavior at each network device. This model scales well across enterprise WANs because routers do not need to maintain per-flow reservation state. DMVPN and IPsec overlays can carry marked traffic, and the WAN design can apply queuing, shaping, and congestion avoidance based on those markings. IntServ with RSVP can provide explicit resource reservation, but it is stateful and does not scale well across many branch tunnels. RSVP also becomes operationally difficult across encrypted overlay environments. WRED is only a congestion avoidance mechanism, not a complete QoS architecture. Because the application needs differentiated treatment but the WAN must remain scalable, DiffServ is the practical Cisco enterprise design model. Reference topics: DiffServ, DSCP marking, DMVPN QoS, IPsec QoS pre-classify, per-hop behavior, enterprise WAN QoS.

Cisco SD-WAN uses Path MTU Discovery to avoid fragmentation problems across the overlay. SD-WAN traffic is encapsulated and encrypted, which adds overhead beyond the original packet size. If the effective path MTU is smaller than the encapsulated packet, fragmentation or packet loss can occur, especially when the DF bit is set or when intermediate devices block fragmentation-related ICMP messages. PMTUD allows devices to discover the largest packet size that can traverse the path without fragmentation and adjust forwarding behavior accordingly. Marking traffic with DF alone does not solve the issue; it may expose the problem by causing packets to be dropped when too large. Jumbo frames are not a universal WAN solution because service-provider, Internet, and broadband paths often do not support them consistently. Configuring every access circuit with a fixed 1600-byte MTU is not a reliable design assumption. The correct design is to rely on PMTUD and validate tunnel overhead, device MTU, TCP MSS adjustment where needed, and ICMP handling across transports. Reference topics: Cisco SD-WAN MTU, PMTUD, tunnel overhead, fragmentation avoidance, IPsec encapsulation.

VSS is the best choice because it provides distribution-layer redundancy with a simplified operational model and fast failover. Cisco Virtual Switching System combines two physical Catalyst switches into one logical switch from the perspective of neighboring devices. This allows the access layer to use Multichassis EtherChannel toward the distribution pair, creating a loop-free Layer 2 topology without relying on STP blocking for normal forwarding. Cisco also describes VSS as using Stateful Switchover and Nonstop Forwarding so the standby chassis can preserve forwarding during supervisor or chassis events. That meets the requirement for very fast convergence while simplifying deployment for a small IT team. GLBP, VRRP, and HSRP are first-hop redundancy protocols. They provide default-gateway resiliency, but they do not merge the distribution layer into a single logical control plane or simplify dual-uplink forwarding the way VSS with MEC does. Reference topics: VSS, Multichassis EtherChannel, distribution-layer redundancy, SSO, NSF, campus high availability.

The correct XML/YANG data model set is the option that accurately represents the IOS XE interface hierarchy, assigns the IPv4 address to GigabitEthernet2/1/0, and uses the correct prefix length of 27. In model-driven programmability, the payload must match both the selected YANG model schema and the target platform’s interface naming conventions. For IOS XE native models, interface configuration is structured under the Cisco native namespace, with interface type and name represented in the schema before IPv4 address elements are applied. The address 10.10.10.10/27 must also support a directly connected host at 10.10.10.1/27, which places both addresses in the same 10.10.10.0/27 subnet. Options that place the address under the wrong interface type, use the wrong namespace, incorrectly represent the mask, or configure the host route rather than the interface are invalid. Option D is the only answer aligned to the IOS XE YANG structure and the requested addressing. Reference topics: IOS XE native YANG, NETCONF XML payloads, interface configuration, IPv4 prefix length, model-driven programmability.

Reverse Path Forwarding prevents multicast loops and duplicate packet forwarding. Multicast routing is source-oriented, so a router must verify that multicast traffic arrives on the interface it would use to reach the source or rendezvous point, depending on the tree state. If the packet arrives on the expected reverse-path interface, the RPF check succeeds and the router can forward the packet to the outgoing interface list. If it arrives on the wrong interface, the packet is dropped because accepting it could create a loop or duplicate stream. Cisco multicast designs rely on RPF checks with PIM to maintain loop-free distribution trees across redundant routed topologies. RPF does not notify upstream routers by itself, does not eliminate overlapping multicast group addresses, and is not simply a prune-generation mechanism. Prune behavior can occur as part of PIM tree maintenance, but the function asked here is loop prevention. Reference topics: multicast RPF check, PIM forwarding, source tree, shared tree, outgoing interface list, duplicate suppression.

The fabric management plane in Cisco SD-Access enables automation techniques for device deployment and configuration. Cisco DNA Center, now commonly referenced as Cisco Catalyst Center, provides the management-plane capabilities used to automate underlay deployment, discover and provision devices, create fabric sites, assign roles, deploy virtual networks , and push policy-driven configurations. LISP-based endpoint identifiers and EID-to-RLOC mappings belong to the fabric control plane, not the management plane. IS-IS underlay routing is part of underlay network design and operation, not the management-plane function itself. The management plane exists so administrators do not have to build every fabric role, network segment, and policy manually on each individual device. In a well-designed SD-Access deployment, management-plane automation reduces configuration drift, accelerates site onboarding, and provides a consistent operational model across the campus fabric. Reference topics: Cisco SD-Access management plane, Cisco Catalyst Center, automation, device provisioning, fabric deployment, policy orchestration. It also provides the operational interface for assurance, inventory, and repeatable change control across the fabric.

NETCONF supports XML, while RESTCONF supports both XML and JSON. Cisco programmability documentation describes NETCONF as an XML-based protocol that exchanges RPC requests and replies such as get, get-config, and edit-config using XML encoding. NETCONF is tightly aligned with YANG-modeled data, but the protocol message format itself is XML. RESTCONF exposes YANG-modeled data through an HTTP or HTTPS API and can represent payloads in XML or JSON. Cisco DevNet material commonly summarizes the comparison as NETCONF equals XML, while RESTCONF equals XML or JSON. That is why option D is accurate. Option A is wrong because NETCONF does not use JSON in the same way RESTCONF does. Option B is incomplete because RESTCONF is not limited to JSON. Option C reverses the protocol encodings. This distinction matters in automation design because tool selection, content type, parsing, and API workflows differ by protocol. Reference topics: NETCONF, RESTCONF, YANG, XML encoding, JSON encoding, model-driven programmability.

The correct technologies are loop guard on uplinks and root guard on downlinks. Cisco campus Layer 2 design guidance recommends protecting the intended spanning-tree topology by placing root guard on ports where the root bridge should never appear and loop guard on non-designated ports that depend on receiving BPDUs. In a hierarchical topology, downlinks toward access switches should not be allowed to become a path to a new STP root; root guard enforces that design by moving a port to root-inconsistent state if a superior BPDU is received. Uplinks are vulnerable to failures where expected BPDUs stop arriving, which can cause an alternate or root port to incorrectly transition to forwarding. Loop guard prevents that by placing the port into loop-inconsistent blocking state. BPDU guard is not appropriate on normal interswitch uplinks or trunk downlinks because those links are expected to exchange BPDUs; it belongs mainly on PortFast edge ports. Reference topics: STP protection, loop guard, root guard, campus Layer 2 design, Rapid PVST+.

The telemetry-mode mapping distinguishes configured subscriptions from dynamic collector-initiated subscriptions. In dial-out telemetry, the network device initiates the connection to the collector according to a configured subscription. This model is useful when devices must proactively stream data to a known receiver, especially where firewall policy allows outbound sessions from the network device. In dial-in telemetry, the collector initiates the session to the device and subscribes to the desired data stream. This approach is useful for ad hoc collection, testing, or centralized collectors that can reach the devices directly. Cisco model-driven telemetry also distinguishes periodic and on-change behavior. Periodic subscriptions send data at configured intervals, while on-change subscriptions publish updates when subscribed state changes. These design choices affect firewall rules, collector reachability, device configuration, scale, and data volume. The architect should match telemetry mode to operational requirements: dial-out for stable production streams from many devices, dial-in for collector-driven access, periodic for baselines, and on-change for efficient state-change monitoring. Reference topics: model-driven telemetry, dial-in, dial-out, subscriptions, periodic and on-change streaming.

In Cisco SD-Access, an intermediate node is an underlay transit device. Its responsibility is to provide IP reachability between fabric edge nodes, border nodes, and other fabric infrastructure roles. Intermediate nodes forward routed underlay traffic and do not perform endpoint registration, endpoint lookup, or VXLAN encapsulation for user traffic. Endpoint-to-location mapping is handled through the fabric control plane, which is based on LISP map-server and map-resolver functions. Fabric edge nodes identify connected endpoints, apply policy, act as anycast gateways, and encapsulate user traffic into VXLAN. Border nodes connect the fabric to external networks and handle traffic entering or leaving the fabric. The intermediate node is therefore comparable to a routed distribution or core transport device in a traditional hierarchical campus, except it is participating in the SD-Access underlay. It must provide stable Layer 3 reachability and appropriate MTU for encapsulated traffic but does not maintain the host tracking database or add security group information to VXLAN headers. The correct function is transporting IP packets between edge and border nodes.