Cisco 300-420 - Designing Cisco Enterprise Networks (ENSLD) v1.1

A distribute list is the correct method to filter routes exchanged between EIGRP neighbors within the same autonomous system. In Cisco EIGRP designs, distribute lists can be applied inbound or outbound under the EIGRP process to control which routes are accepted from or advertised to neighbors. The filter can reference an access list, prefix list, or route map depending on platform and configuration style. This allows the designer to limit route visibility without changing the forwarding behavior of packets that are already routed. Policy-based routing is a data-plane forwarding feature that changes next-hop selection for matching traffic; it does not filter EIGRP route advertisements between neighbors. Leak maps are used with route summarization to selectively advertise more specific routes through a summary, not as the general route-filtering method between EIGRP neighbors. Route tagging is valuable in redistribution designs to identify route origin and prevent feedback loops, but the tag alone does not filter routes unless a route map or distribute list uses it. Therefore, the correct route-filtering mechanism between EIGRP neighbors is a distribute list.

BGP community is the correct attribute because it can support both policy requirements through coordination with the service provider. Communities are route tags that an upstream provider can match to apply routing policy, such as adjusting local preference to influence which dual-homed provider link is preferred for inbound traffic. Communities also include well-known values used to constrain route propagation. Cisco documents no-export as a community that prevents a route from being advertised outside the receiving AS, and no-advertise as a community that prevents advertisement to any peer. This directly matches the requirement that several customer-advertised networks must propagate no further. MED can influence inbound path selection in some dual-link designs, but it does not provide the propagation-control function. AS-path prepending can influence inbound traffic but is less precise and again does not solve the no-further-advertisement requirement. Local preference is normally applied inside an AS, not directly by the customer to external peers. Reference topics: BGP communities, no-export, no-advertise, provider policy, inbound traffic engineering.

Universal PoE is the appropriate power technology when endpoint requirements vary from 30 watts up to 60 watts. Cisco Universal Power over Ethernet extends the PoE+ model and can source up to 60 watts per port by using all four cable pairs. PoE Plus supports up to 30 watts and therefore does not satisfy the upper range in the requirement. Fast PoE is concerned with how quickly power is restored during switch startup, not the maximum supported wattage. Perpetual PoE is the feature that maintains power during a switch reload, but by itself it does not define the 60-watt power class. In a complete campus design, the architect should select UPOE-capable Catalyst access switches and enable perpetual PoE behavior on ports where endpoints must remain powered during reload events. Among the answer choices, Universal PoE is the required power delivery solution because the 30-to-60 watt budget is mandatory. Reference topics: Cisco UPOE, PoE Plus, Perpetual PoE, Fast PoE, Catalyst access-layer power design.

GETVPN is the correct transport-encryption design for this environment. The company is using a private MPLS-based service and requires encryption without maintaining permanent point-to-point tunnels. GETVPN was designed for private WAN environments where routing remains native and packets are encrypted without adding GRE or IPsec tunnel overlays between every pair of sites. It uses group-based keying, typically with key servers that distribute security policy and rekey material to group members. That supports dynamic key rotation and spoke-to-spoke communication while avoiding the operational burden of building and maintaining individual tunnels. DMVPN also supports dynamic spoke-to-spoke tunnels, but it is still a tunnel overlay using mGRE, NHRP, and IPsec, and it is usually selected for Internet or mixed transport overlays. Standard IPsec VPN requires maintaining tunnel relationships, and GRE VPN alone does not provide encryption. GETVPN therefore best matches tunnel-less encryption across a private MPLS WAN with centralized security policy and direct site-to-site forwarding. Reference topics: GETVPN, group encrypted transport, tunnel-less IPsec, private MPLS WAN encryption, group keying.

The strict-priority queue should be limited to approximately 33 Mbps on a 100 Mbps Internet connection. Cisco QoS design guidance warns that strict priority traffic must be bounded, because excessive priority traffic can starve other queues and cause poor application performance for non-real-time traffic. For voice and interactive video, priority queuing is appropriate, but the priority class should normally be constrained to about one-third of the link capacity in a converged enterprise design. That makes 33 Mbps the best choice for a 100 Mbps link. A 75 Mbps strict-priority allocation is far too high and would leave inadequate bandwidth for routing, signaling, business data, and default traffic. A 50 Mbps allocation still gives real-time media excessive control of the interface. A 25 Mbps allocation may work in some environments but is not the standard upper-limit design answer for strict priority in this Cisco context. The architect should also classify TelePresence accurately, mark traffic consistently, and police the priority queue to protect the WAN. Reference topics: LLQ, CBWFQ, strict priority limits, TelePresence QoS, WAN congestion management.

In-band management is the correct design because the management plan must reach all IP-enabled interfaces, and not every device has a dedicated management port. In-band management uses the production IP network for administrative access, allowing management stations to reach loopbacks, SVIs, routed interfaces, or front-panel interfaces through normal routing. Cisco management guidance distinguishes in-band management from out-of-band designs that depend on a separate physical management network or console path. Because the question requires reachability to all IP-enabled interfaces, in-band is the only listed model that naturally supports that scope. Security must still be enforced with encrypted protocols where supported, such as SSH and HTTPS, plus ACLs, AAA, and management-plane protection where appropriate. A terminal server provides console access, not routed IP management to every interface. A KVM server is a server-management tool, not a network-device management architecture. Out-of-band management is preferred for isolation, but it does not fit devices without dedicated management access. Reference topics: in-band management, secure management protocols, SSH, HTTPS, network management design.

The design should summarize routes from the distribution layer toward the core and configure access-layer switches as EIGRP stubs. EIGRP query scope is a major design consideration in large routed campus networks. When a route is lost, EIGRP may send queries to neighbors to find an alternate path. If the network is not bounded properly, these queries can spread widely, slow convergence, and create stuck-in-active risk. Configuring the access layer as EIGRP stub tells upstream routers that the access device is not a transit path to other networks, so unnecessary queries are not sent into the access layer. Summarizing at the distribution layer toward the core hides access-link instability and provides a smaller, more stable routing table to the rest of the network. Summarizing at the access layer is usually less useful when many VLANs are aggregated at distribution. Configuring the core as stub is inappropriate because the core should provide transit. Reference topics: EIGRP stub, route summarization, query boundary, campus hierarchy, DUAL convergence.

Route tagging with a route map is the correct redistribution loop-prevention method. In a design with mutual redistribution between OSPF and IS-IS, a route learned from one domain can be redistributed into the other domain and then fed back into the original domain at another redistribution point. This creates route feedback, suboptimal routing, or loops. Cisco routing design commonly prevents this by tagging routes at the point of redistribution and then filtering or denying routes with that tag when they are seen again at another redistribution boundary. A route map can set the tag during redistribution and match the tag on the reverse redistribution direction. Changing administrative distance may influence local route selection, but it does not reliably prevent feedback throughout the network. Stub areas reduce external LSA scope in OSPF, but they do not solve a multipoint redistribution loop between OSPF and IS-IS. Prefix filtering can work, but tagging scales better and preserves route identity across redistribution points. Reference topics: route redistribution, route tagging, route maps, OSPF, IS-IS, loop prevention.

Cisco IS-IS supports Level 1, Level 2, and Level 1/Level 2 operation, and the design should restrict each link to the level it actually needs. Cisco documentation for the isis circuit-type command states that it “configures the type of adjacency that is required for neighbors on the specified interface.” In this case, the router is configured as L1/L2 and has both L1 and L2 neighbors, which causes unnecessary LSP flooding, SPF processing, and database maintenance on links that may not need both levels. Making the entire router only L1 or only L2 would be too blunt, because the router may legitimately need to participate in both domains on different interfaces. Making the router a DIS also does not solve the underlying issue; it only controls designated intermediate system behavior on broadcast networks. The best optimization is to configure each interface with the correct circuit type, such as level-1 for intra-area links and level-2-only for backbone links. This reduces control-plane load while preserving the intended two-level hierarchy.

The best summarization design is for the aggregation layer to advertise a default route toward the access layer and to summarize the VLAN subnets toward the core. Cisco hierarchical campus design uses summarization at natural layer boundaries so that access-layer instability is hidden from the rest of the network. If individual access VLANs flap, the core should not have to process every specific route change. Advertising a summary such as 10.0.0.0/16 from the aggregation layer toward the core reduces routing-table size, lowers CPU and memory use, and confines convergence events to the lower layer. At the same time, the access layer normally does not need full knowledge of the enterprise routing table; a default route from the aggregation layer is sufficient for northbound reachability. Summarizing at the access layer is normally less effective because the aggregation layer is the first stable boundary that sees multiple access networks. Advertising a default from the core toward aggregation would hide information in the wrong direction. Reference topics: hierarchical routing, route summarization, campus aggregation design, convergence containment, routing-table scaling.