Cisco 300-420 - Designing Cisco Enterprise Networks (ENSLD) v1.1

The correct solution is again a management VRF with SSH keys for device access. This duplicate item tests the same design principle: management traffic should be logically isolated from the overlay and production forwarding paths. A VRF gives the management plane its own routing table, so changes or failures in the overlay do not normally alter management reachability. That makes the network easier to operate because engineers can troubleshoot device access, routing, and overlay behavior as separate concerns. SSH keys satisfy the secure-access requirement by providing encrypted management sessions with public-key authentication. Private VLANs and standard VLANs can segment Layer 2 traffic, but they do not solve routing separation by themselves. TACACS+ and RADIUS provide authentication, authorization, and accounting, but they do not prevent overlay routing from interacting with management reachability. A separate physical interface can help in some designs, but option A is the cleanest answer because it combines routing isolation with secure access. Reference topics: management VRF, SSH, secure management plane, route isolation, overlay troubleshooting.

Cisco SD-WAN uses the Overlay Management Protocol to exchange control-plane information between WAN Edge routers and vSmart controllers. OMP advertises three major categories of routing information: OMP routes, TLOC routes, and service routes. OMP routes represent reachability to prefixes in service VPNs, such as connected, static, OSPF, EIGRP, BGP, or other routes learned at the local site. TLOC routes describe transport locations, which bind a system IP, color, and encapsulation to a WAN transport attachment. Service routes indicate service insertion capabilities, such as firewalls or other network services that can be reached through a particular site. This separation allows Cisco SD-WAN to build a secure overlay over any public or private transport while keeping transport reachability, service-side prefixes, and inserted services distinct. The other answer choices use generic terms such as underlay, MPLS, Internet, backup, or primary routes, but those are not the formal OMP advertisement categories. Therefore, the correct answer is prefix, TLOC, and service.

Dynamic NAT-PT is the correct selection when IPv6 hosts in an IPv6 island must access IPv4-only servers and services. NAT-PT translates between IPv6 and IPv4 packet headers and allows IPv6-only nodes to communicate with IPv4-only destinations by dynamically creating translation state. In this scenario, IPv6 hosts need access to file servers and DNS services in an IPv4 network, so a dynamic translation mechanism is required. Stateless NAT66 and stateful NAT66 are IPv6-to-IPv6 translation mechanisms and do not connect IPv6 hosts to IPv4-only resources. Static NAT-PT would be appropriate for fixed one-to-one mappings where specific hosts are permanently mapped, but the question describes general access from an IPv6 island to IPv4 services, making dynamic NAT-PT the better match. In modern designs, NAT64 and DNS64 are commonly preferred successors, but within the answer choices NAT-PT is the IPv6-to-IPv4 transition mechanism. Reference topics: IPv6 transition, NAT-PT, IPv6-to-IPv4 translation, DNS access, dual-protocol migration.

A dual-homed Internet design with a single edge router and site-to-site VPN topology best matches the stated cost and flexibility requirements. The customer needs redundant WAN links, has a limited budget, wants easy future bandwidth increases, and does not require consistent end-to-end QoS on the branch routers. Internet circuits are typically less expensive and easier to upgrade than MPLS access circuits, making them appropriate for small to medium-sized remote branches when strong QoS guarantees are not required. A single edge router also reduces hardware cost and operational complexity compared with dual edge routers. WAN MPLS designs can provide stronger service-level guarantees and QoS treatment, but they are more expensive and less flexible for rapid bandwidth upgrades. A design with dual edge routers improves device redundancy but conflicts with the limited-budget condition. Therefore, a dual-homed Internet solution using a site-to-site VPN overlay is the most appropriate option. The architect should still validate encryption requirements, failover behavior, routing preference, and whether the Internet underlay can meet application performance expectations. Reference topics: branch WAN design, dual Internet connectivity, site-to-site VPN, cost-driven WAN selection.

The correct overlay considerations are that virtual networks provide data-plane isolation and that overlapping IP addresses should be avoided for operational simplicity. In Cisco SD-Access, virtual networks are used for macro segmentation and are commonly mapped to VRFs. This separates routing and forwarding tables between major groups such as corporate users, guests, IoT, and shared services. Security Group Tags provide finer policy control and microsegmentation, but they are not the primary mechanism for data-plane isolation between virtual networks. The phrase “virtual networks should be used for microsegmentation” is therefore inaccurate; microsegmentation is SGT and SGACL driven. Although overlapping IP addresses can technically exist in separate VRF-like contexts, Cisco design practice discourages unnecessary overlap because it complicates troubleshooting, service insertion, external connectivity, and inter-VN communication. A clean overlay address plan improves operations and reduces policy ambiguity. Reference topics: SD-Access overlay design, virtual networks, macro segmentation, SGTs, microsegmentation, overlapping IP avoidance. This also simplifies day-two operations.

The 8-class QoS model is the appropriate DiffServ design when an enterprise is adding voice and video to an existing data network and needs priority treatment for voice. Cisco enterprise QoS designs commonly evolve from a simple data-only model to a multi-class model that separates routing/control, voice bearer, video, signaling, transactional data, bulk data, scavenger traffic, and default traffic. This separation is important because voice requires strict low latency, low jitter, and minimal loss, while video usually requires guaranteed bandwidth but must not starve voice or network control traffic. A 4-class model can be too coarse when both VoIP and IP video are introduced because it often collapses distinct traffic types into broad queues. A 12-class model may be appropriate for very mature or complex environments, but it is more operationally demanding. The 6-class model can work in some cases, but the common Cisco campus and WAN baseline for mixed voice, video, and data is the 8-class model. Reference topics: DiffServ QoS, enterprise QoS class models, voice priority queue, video classification, DSCP design.

The correct EIGRP design consideration is to prevent unnecessary neighborships from forming across switch virtual interfaces. In a data center or campus switching environment, many SVIs may exist for VLAN default gateways, but those VLANs do not necessarily need EIGRP adjacencies with attached hosts, firewalls, load balancers, or peer switches. Cisco EIGRP design commonly uses passive-interface behavior to advertise connected networks while suppressing EIGRP hello packets on interfaces where neighbor relationships are not required. This reduces control-plane noise, minimizes accidental adjacencies, and limits the failure domain. Manual summarization is useful at hierarchy boundaries, but performing summarization on all Layer 3 interfaces can create black holes or hide topology detail where it is still needed. Lowering hello and hold timers to minimum values can increase CPU load and is not the primary design recommendation. Multiple EIGRP autonomous systems may be used for specific segmentation designs, but they add redistribution and operational complexity. Therefore, preventing unnecessary EIGRP neighborships across SVIs is the best design practice from the choices.

AS-path prepending is the correct inbound path-control tool for this design. The objective is for traffic entering AS100 to use link 1 during normal operation and link 2 only after a failure. In BGP, the AS_PATH attribute is a primary path-selection attribute used by external autonomous systems; a shorter AS path is normally preferred over a longer path. By prepending AS100 multiple times on advertisements sent from R4 across link 2, AS100 makes the backup path look less attractive to upstream networks while leaving it available for failover. Modifying next-hop on R3 or R4 does not influence how external networks choose between two entry points into AS100. Prepending on R3 would make the preferred link less attractive, which is the opposite of the requirement. The design should also document provider policy because some providers local-preference routes before AS path, but within the choices, prepending on R4 is the appropriate inbound traffic-engineering method. Reference topics: BGP AS_PATH, inbound path control, multihoming, backup Internet edge design.

The design must enable IPv6 multi-topology behavior at the appropriate edge routers and move metric handling toward transition support where the current IS-IS network still uses narrow metrics. Multi-topology IS-IS is important during IPv4-to-IPv6 migration because IPv4 and IPv6 reachability do not always exist on identical links at every stage of the migration. If IPv6 follows the IPv4 topology when some devices or paths are not IPv6-ready, traffic can be blackholed. Multi-topology allows independent IPv4 and IPv6 SPF calculations, which prevents IPv6 traffic from being forwarded through IPv4-only portions of the network. The metric-style transition setting is used when migrating from narrow to wide metrics, allowing interoperability while routers are upgraded and the design scales. Because the requirement says IPv6 areas will grow and the current network uses narrow metrics, the selected edge devices must support the IPv6 topology and metric transition behavior shown in the exhibit. Reference topics: IS-IS IPv6, multi-topology IS-IS, narrow metrics, wide metric transition, IPv6 migration, blackhole prevention.