Pass the Cisco CCNP Enterprise 300-420 Questions and answers with CertsForce

A full-mesh topology best satisfies the requirement that devices make informed forwarding decisions, backup paths always exist, and suboptimal paths are used only after a failure. In a full mesh, each site or WAN node has direct connectivity to every other relevant node. This gives the routing protocol complete path visibility and allows traffic to use direct optimal paths under normal conditions. If a direct link fails, alternate paths remain available through other nodes, so the network can reroute without depending on a single hub. A hub-and-spoke design is simpler and less expensive, but spoke-to-spoke traffic must traverse the hub, which is suboptimal even during normal operation. A partial mesh can reduce cost but may still force some traffic over indirect paths when no direct connection exists. Clos is a data center fabric topology concept and is not the typical WAN topology answer here. The full mesh is the most resource-intensive design, but it best matches the stated forwarding and backup requirements. Reference topics: WAN topology, full mesh, path optimality, backup paths, routing convergence.

Redistributing OSPF process 1 into process 2 on both R1 and R4 provides the required backup routing behavior between the management network and the target routers. The design requirements are failure driven: if R1 fails, NMS traffic must use R4, and if the link between R5 and R6 fails, traffic to 10.6.6.6 must still route through R4. When separate OSPF processes or domains exist, controlled redistribution at both exit points allows reachability to be maintained through either redistribution point. Advertising a single address into OSPF with high cost on R1 does not solve both failure cases. Static routes with IP SLA on R2 and R3 would be more manual and less aligned with the dynamic OSPF design. Default-information originate would provide a default path but would not accurately advertise the specific internal reachability required for the NMS destinations. The redistribution design must also include route filtering or tagging in production to prevent feedback loops. Reference topics: OSPF redistribution, redundant redistribution points, management reachability, route control, failure-path design.

GETVPN is the correct transport-encryption design for this environment. The company is using a private MPLS-based service and requires encryption without maintaining permanent point-to-point tunnels. GETVPN was designed for private WAN environments where routing remains native and packets are encrypted without adding GRE or IPsec tunnel overlays between every pair of sites. It uses group-based keying, typically with key servers that distribute security policy and rekey material to group members. That supports dynamic key rotation and spoke-to-spoke communication while avoiding the operational burden of building and maintaining individual tunnels. DMVPN also supports dynamic spoke-to-spoke tunnels, but it is still a tunnel overlay using mGRE, NHRP, and IPsec, and it is usually selected for Internet or mixed transport overlays. Standard IPsec VPN requires maintaining tunnel relationships, and GRE VPN alone does not provide encryption. GETVPN therefore best matches tunnel-less encryption across a private MPLS WAN with centralized security policy and direct site-to-site forwarding. Reference topics: GETVPN, group encrypted transport, tunnel-less IPsec, private MPLS WAN encryption, group keying.

LISP is the control-plane protocol responsible for Endpoint Identifier to Routing Locator mapping in Cisco SD-Access. In the SD-Access architecture, an endpoint address is treated as an EID, and the fabric node location is represented by an RLOC. The fabric control-plane node performs LISP map-server and map-resolver functions so edge nodes can register local endpoints and resolve the current location of remote endpoints. This separation allows the overlay to support host mobility, anycast gateway behavior, and segmentation without depending only on traditional subnet-bound forwarding. VXLAN is the fabric data-plane encapsulation used to carry traffic across the fabric and preserve policy information, but it does not provide the EID-to-RLOC mapping function. CEF is the local forwarding mechanism inside Cisco devices, and GBAC is not the SD-Access mapping protocol. Therefore, LISP is the correct answer because it provides the SD-Access fabric control plane. Reference topics: Cisco SD-Access control plane, LISP, EID, RLOC, map-server, map-resolver.

OSPF with stub areas is the correct implementation. The reference to RFC 5340 points to OSPFv3, which Cisco documents as the OSPF version used for IPv6 and also capable of carrying IPv4 unicast address families in modern implementations. OSPF is a link-state routing protocol that provides loop-free convergence through SPF calculation, making it a stronger fit than static routing or RIP for a growing WAN. Stub areas reduce routing information inside branch or regional areas by blocking external LSAs and allowing the ABR to inject a default route. That reduces route-table size and limits update propagation, which matches the requirement to optimize routing tables and reduce routing updates between routers. EIGRP with multiple autonomous systems is not aligned with RFC 5340. BGP address families are useful in provider and MPLS VPN designs but are not the best internal route-optimization answer here. OMP is specific to Cisco SD-WAN, not a generic RFC 5340 routing design. Reference topics: OSPFv3, RFC 5340, stub areas, LSA reduction, SPF convergence.

Native policy-based IPsec protects unicast IP traffic between defined proxy identities, but it does not inherently provide a multiprotocol tunnel interface that supports multicast routing protocol packets. Many enterprise VPN designs require multicast for applications, routing protocols, or service discovery. To support multicast across an encrypted VPN, the design commonly uses GRE over IPsec or a tunnel interface such as VTI where the tunnel provides a logical point-to-point or multipoint interface and IPsec secures the encapsulated traffic. GRE can encapsulate multicast and broadcast traffic, allowing dynamic routing protocols and multicast packets to traverse the VPN. IPsec then encrypts the GRE or tunnel traffic for confidentiality and integrity. Transport mode by itself does not solve multicast forwarding, and tunnel mode still requires suitable encapsulation or tunnel-interface behavior for multicast support. Additional headend bandwidth may be required in large VPN designs, but it is not the unique technical requirement for multicast. Therefore, when IPsec VPNs must support IP multicast, the design must include GRE or VTI-style encapsulation.

A dual-homed Internet design with a single edge router and site-to-site VPN topology best matches the stated cost and flexibility requirements. The customer needs redundant WAN links, has a limited budget, wants easy future bandwidth increases, and does not require consistent end-to-end QoS on the branch routers. Internet circuits are typically less expensive and easier to upgrade than MPLS access circuits, making them appropriate for small to medium-sized remote branches when strong QoS guarantees are not required. A single edge router also reduces hardware cost and operational complexity compared with dual edge routers. WAN MPLS designs can provide stronger service-level guarantees and QoS treatment, but they are more expensive and less flexible for rapid bandwidth upgrades. A design with dual edge routers improves device redundancy but conflicts with the limited-budget condition. Therefore, a dual-homed Internet solution using a site-to-site VPN overlay is the most appropriate option. The architect should still validate encryption requirements, failover behavior, routing preference, and whether the Internet underlay can meet application performance expectations. Reference topics: branch WAN design, dual Internet connectivity, site-to-site VPN, cost-driven WAN selection.

The standards-based mechanism for dynamic rendezvous point distribution in a large PIM domain is Bootstrap Router. BSR allows candidate RPs and candidate BSRs to participate in a standards-based election and advertisement process so PIM routers can learn the RP set dynamically. This avoids configuring every router manually with static RP information and avoids depending on a Cisco-proprietary mechanism. Auto-RP can also distribute RP information dynamically, but Auto-RP is Cisco proprietary and therefore does not meet the nonproprietary requirement. Embedded RP is associated with IPv6 multicast group addressing and is not the general-purpose answer for automating RP discovery in a large IPv4 PIM domain. Static RP configuration is simple and deterministic, but it does not automate RP distribution and becomes operationally fragile as the multicast domain grows. In Cisco multicast design, BSR is the correct choice when the network requires dynamic RP discovery, vendor-neutral behavior, and scalable PIM-SM operation across a large domain.

When multicast is included in a Cisco SD-Access architecture, the architect must account for multicast transport in the overlay for endpoint traffic. Cisco SD-Access separates the underlay, which provides IP connectivity between fabric nodes, from the overlay, which carries user endpoint traffic in the endpoint identifier space. For wired and wireless clients, multicast traffic is transported as part of the overlay service rather than treating clients as underlay participants. That is why the correct design element is that multicast traffic is transported in the overlay and EID space for both wired and wireless clients. PIM SSM does not have to run in the underlay for this purpose, and multicast clients do not simply reside in the underlay. The statement about RPs being required in an SSM deployment is also wrong because source-specific multicast is specifically designed to avoid the traditional RP model. In a fabric design, multicast requirements affect border behavior, receiver placement, replication mode, wireless integration, and policy boundaries. Reference topics: Cisco SD-Access multicast, overlay forwarding, EID space, wired and wireless fabric clients.

Option B is retained because the subnetting task depends on the exhibit options and the chosen plan must divide 10.1.8.0/21 into nonoverlapping partner VPN subnets without allocating more address space than required. The design principle is variable-length subnet masking: allocate the smallest subnet that satisfies each partner requirement, then place the subnets on valid prefix boundaries inside the reserved aggregate. Cisco addressing design emphasizes conserving address space, avoiding overlap, and preserving summarization where possible. A /21 provides 2048 total addresses, so the designer can carve several smaller partner ranges while keeping the entire allocation summarizable as 10.1.8.0/21 toward the data-center core. Incorrect options would either waste addresses, overlap existing ranges, place subnets on invalid boundaries, or allocate blocks larger than necessary. Option B is the mapping that satisfies the exhibit constraints while keeping the design clean for routing, firewall policy, and VPN onboarding. Reference topics: IPv4 VLSM, subnet boundary alignment, partner VPN addressing, summarization, nonoverlapping address design.