Cisco 300-420 - Designing Cisco Enterprise Networks (ENSLD) v1.1

4G/5G connectivity is the best fit among the choices for edge-computing use cases because it can place network access close to users and endpoints while providing high bandwidth and low latency relative to many traditional WAN options. Edge computing is valuable when application processing, storage, or content delivery is moved closer to the point of consumption. Mobile broadband and 5G designs can support rapid deployment, local breakout, and low-latency access for distributed sites, sensors, and mobile users. MPLS Layer 3 VPN services provide predictable private WAN separation and mature QoS, but they are generally tied to provider POPs and data center-oriented connectivity rather than the closest edge location. DWDM is high-bandwidth optical transport but is primarily a metro or data center interconnect technology, not a flexible edge access service. Metro Ethernet can be strong in metropolitan areas but does not offer the broad mobile edge characteristics of 4G/5G. Reference topics: edge computing, 4G/5G WAN, low-latency access, distributed applications, WAN technology selection.

End-to-end microsegmentation in Cisco SD-Access is enforced with Security Group Tags and Security Group ACLs. Virtual networks provide macrosegmentation by separating routing tables and address spaces, but SGTs provide more granular group-based policy inside or across those virtual networks. Cisco SD-Access segmentation guidance explains that users or endpoints are assigned to security groups through SGTs and that SGACLs control communication between those groups. This avoids building large numbers of VLANs or IP ACLs tied to topology. VLANs alone provide Layer 2 separation but do not deliver identity-based end-to-end microsegmentation. Five-tuple ACLs can filter traffic, but they are more operationally complex and less policy-oriented than group-based access control. VRFs are useful for macrosegmentation, not microsegmentation within a virtual network. Therefore, SGTs and SGACLs are the correct enforcement method. In a professional design, the architect should define scalable groups according to business roles and application access needs, then use Cisco DNA Center and ISE integration to automate consistent policy deployment across the fabric.

The scalable EIGRP hub-and-spoke design should make each spoke a stub router and summarize routes from the spokes toward the hubs. Cisco EIGRP documentation states that stub routing improves network stability, reduces resource utilization, and simplifies branch or edge router configuration. Stub spokes limit the routes they advertise and prevent the hub routers from sending unnecessary queries through remote sites. Summarizing spoke routes toward the hubs further reduces routing-table size and contains convergence events when a subnet fails behind a spoke. Exchanging all routes between every location would increase memory, CPU, and query scope, which is the opposite of good EIGRP scale design. Summarizing only between the hubs may be useful in a dual-data-center design, but it does not solve the spoke scaling requirement. Splitting the network into two autonomous systems is unnecessary when the requirement states that all locations belong to a single AS. Reference topics: EIGRP hub-and-spoke design, stub routing, route summarization, query scope reduction, branch scale.

BFD is the correct mechanism for sub-second failure detection. The question describes unequal failover behavior when an interface on an ISP router toward the campus fails. In many WAN and Internet edge designs, BGP timers or next-hop tracking may not react fast enough when the physical failure is not directly visible to the customer router. Cisco defines Bidirectional Forwarding Detection as a lightweight protocol that provides rapid forwarding-path failure detection independent of the routing protocol timers. When BFD is associated with BGP, OSPF, EIGRP, or static routing, the routing process receives failure notification quickly and can withdraw or replace the route without waiting for longer protocol hold timers. Aggressive timers can improve reaction time but increase session churn and CPU load. Next-hop address tracking improves BGP response when next-hop reachability changes, but it is not the most precise sub-second detection tool. Graceful restart is intended to preserve forwarding during control-plane restart, not detect failures faster. Reference topics: BFD, WAN edge resiliency, BGP failure detection, sub-second convergence.

Area 1 should be configured as an NSSA when the design must allow selected external routes, such as EIGRP-originated routes, while controlling other external routes such as those from the RIP domain. A normal OSPF area receives Type 5 external LSAs, so it would not inherently block the unwanted RIP-originated external routes. A stub area blocks Type 5 external LSAs, but it also cannot contain an ASBR that injects external routes in the normal way. An NSSA is designed for this exact middle ground: it restricts external LSAs from the backbone while allowing external routes to be injected inside the area as Type 7 LSAs, which are translated by the ABR when needed. This allows Area 1 to receive the necessary internal and selected redistributed information while excluding external routes originated elsewhere. Making the routers part of area 0 would not solve the external-route filtering requirement and would weaken the intended area structure. Therefore, NSSA provides the required balance of route visibility and external-route control. Reference topics: OSPF NSSA, Type 5 LSAs, Type 7 LSAs, external route control, area design.

A higher local preference on R3 for the relevant routes is the correct method to influence outbound traffic inside the autonomous system. Local preference is a well-known discretionary BGP attribute used within an AS to choose the preferred exit path. A higher local preference is preferred over a lower one, and the attribute is propagated to iBGP peers so routers in the AS make a consistent outbound decision. The requirement says all traffic originating from AS100 must pass through AS200 toward the NTP and DHCP server, and if the R3-to-R4 link fails, the path must move to the R2-to-R9 link. Applying local preference on R3 toward the routers that need to reach the data center establishes R3 as the primary exit while preserving the alternate path through R2 and R9. AS-path prepending is mainly used to influence inbound traffic from other autonomous systems, not the local AS exit choice. Redistributing IGP metrics into BGP is less deterministic and not the right policy control. Reference topics: BGP local preference, outbound traffic engineering, iBGP policy propagation, primary and backup path design.

Before troubleshooting IPsec in a DMVPN deployment, the administrator should verify the GRE tunnel operation. DMVPN is built from multipoint GRE, NHRP, routing, and usually IPsec encryption. IPsec protects the tunnel traffic, but the logical tunnel and overlay reachability must be valid first. If the tunnel interface is down, incorrectly addressed, or unable to carry GRE traffic, troubleshooting crypto maps or ISAKMP will waste time because encryption cannot fix a broken overlay. After the GRE tunnel state is validated, the administrator can confirm NHRP registration and resolution, routing adjacencies, and then IPsec security associations. ISAKMP and crypto map troubleshooting are relevant only after basic tunnel operation is known to be correct. NHRP is also critical in DMVPN, but the question asks what to do before troubleshooting IPsec configuration; the first prerequisite is to verify that the GRE tunnel itself is functioning. This layered troubleshooting order follows Cisco operational practice: confirm transport reachability, then tunnel interface behavior, then NHRP and routing, and finally cryptographic protection.

Root guard is the correct feature when the design must allow switches to be attached for testing but prevent those switches from influencing the spanning-tree root placement. Cisco root guard protects the intended STP root by placing a port into a root-inconsistent state if superior BPDUs are received on a port where the root should never appear. This directly addresses the risk created by rogue or lab switches connected by end users: if a user switch advertises a better bridge priority, the production access topology is not allowed to reconverge around that unauthorized device. BPDU guard is usually used on PortFast edge ports to err-disable a port that receives any BPDU, which is excellent for strict host-only ports but less aligned with the wording that users may connect their own switches for testing. Loop guard protects root or alternate ports from losing BPDUs and accidentally forwarding. BPDU skew detection is a diagnostic feature, not the correct design control. Therefore, root guard is the appropriate protection against rogue switches affecting STP topology. Reference topics: STP root placement, root guard, superior BPDUs, campus Layer 2 protection.

OSPF with stub areas is the correct implementation. The reference to RFC 5340 points to OSPFv3, which Cisco documents as the OSPF version used for IPv6 and also capable of carrying IPv4 unicast address families in modern implementations. OSPF is a link-state routing protocol that provides loop-free convergence through SPF calculation, making it a stronger fit than static routing or RIP for a growing WAN. Stub areas reduce routing information inside branch or regional areas by blocking external LSAs and allowing the ABR to inject a default route. That reduces route-table size and limits update propagation, which matches the requirement to optimize routing tables and reduce routing updates between routers. EIGRP with multiple autonomous systems is not aligned with RFC 5340. BGP address families are useful in provider and MPLS VPN designs but are not the best internal route-optimization answer here. OMP is specific to Cisco SD-WAN, not a generic RFC 5340 routing design. Reference topics: OSPFv3, RFC 5340, stub areas, LSA reduction, SPF convergence.

The multicast-replicator function is used to optimize multicast traffic distribution across Cisco SD-WAN. Cisco Catalyst SD-WAN multicast overlay design avoids forcing the ingress WAN Edge router to replicate every multicast packet to every remote receiver. Instead, multicast routes and receiver information are exchanged through OMP, and a WAN Edge can be designated as a multicast or OMP replicator. The replicator then distributes streams to interested receivers across the overlay, reducing bandwidth and processing pressure on the source-side edge. That is why multicast-replicator is the feature that optimizes WAN bandwidth for IGMP-driven multicast receiver traffic among WAN Edge routers in the same VPN. IGMPv2 is only the host-to-router group membership protocol and does not optimize overlay distribution by itself. A multicast RP is used in PIM sparse mode, but it is not the SD-WAN overlay replication feature. Multicast service routes advertise multicast service information, but the bandwidth-saving forwarding role is the replicator. Reference topics: Cisco SD-WAN multicast overlay, OMP multicast routes, multicast replicator, IGMP receiver joins.