Pass the Cisco CCNP Enterprise 300-420 Questions and answers with CertsForce

MSDP is the correct solution for multicast across different autonomous systems when RPs must discover active sources outside their local domain. In PIM Sparse Mode, each multicast domain can have its own rendezvous point. Without a mechanism to exchange source information, receivers in one domain may not know about active sources registered with an RP in another domain. Multicast Source Discovery Protocol solves that problem by allowing RPs to establish peer relationships and exchange Source-Active information. Cisco multicast design uses MSDP with PIM-SM when separate domains need to share multicast source reachability while relying on the unicast routing table for connectivity between RPs. SSM does not use an RP and depends on receivers joining a specific source and group. PIM-SM by itself works inside a domain but does not provide interdomain source discovery between RPs. PIM-DM is flood-and-prune and is not suitable for this sparse, interdomain design. Therefore, the organization should deploy MSDP between the RP devices or RP domains. Reference topics: MSDP, PIM-SM, interdomain multicast, Source-Active messages, RP-to-RP source discovery.

The telemetry mapping separates dial-in and dial-out behavior. In dial-in telemetry, the collector initiates the session toward the network device and subscribes to the data that it wants streamed. This model gives the collector direct control over the subscription lifecycle, but it requires the collector to reach the device and manage each session. In dial-out telemetry, the network device initiates the session toward the collector based on a configured subscription. This is useful when devices must stream telemetry to a centralized destination through firewalls or controlled management paths. Cisco model-driven telemetry can stream structured data from YANG models using subscription behavior rather than relying on repeated CLI polling. The selected drag-and-drop answer matches each consideration to the mode that owns the connection initiation and subscription handling. In design work, the architect must consider reachability direction, security policy, NAT traversal, collector scale, subscription persistence, and whether subscriptions should be configured on the device or created by the collector. Reference topics: model-driven telemetry, dial-in mode, dial-out mode, YANG subscriptions, gRPC telemetry, operational data streaming.

The drag-and-drop mapping should be preserved as the validated answer because the item depends on the exhibit categories and the original coordinate map identifies which descriptions belong to each category. In Cisco design questions of this form, the important skill is distinguishing the functional category from the implementation detail. A professional design answer must map each description to the correct operational class instead of treating all items as interchangeable features. This is common in ENSLD topics such as WAN connectivity, SD-Access roles, telemetry modes, and QoS service models, where a description may sound similar but belongs to a different architectural layer. The coordinate answer keeps the specific pairings intact while the explanation documents the design logic: categorize by function, control-plane responsibility, data-plane behavior, and operational use case. If the exhibit contains technology categories, the selected mapping should be read as the official answer for those categories rather than converted into free text. Reference topics: Cisco design categorization, architectural roles, technology-to-function mapping, ENSLD drag-and-drop interpretation.

The correct answer is bidirectional PIM. Cisco describes bidirectional PIM as a multicast mode designed for many-to-many applications where traffic is forwarded only along a shared tree rooted at the rendezvous point. Unlike traditional PIM Sparse Mode, BIDIR-PIM does not build source-specific shortest-path trees for each active source. That design reduces multicast state in the network because routers maintain group state rather than separate source and group state for every sender. PIM Sparse Mode initially uses a shared tree through the RP, but it can switch to source trees after receivers and routers learn the active source. Dense mode floods and prunes and is not a shared-tree-only model. Source-specific multicast explicitly uses source-specific joins and does not use an RP-based shared tree. The wording “shared tree only” is the key distinction: BIDIR-PIM is built for scalable many-to-many multicast, accepts some non-shortest-path forwarding tradeoff, and avoids per-source state growth. Therefore, the stored answer must be corrected to bidirectional. Reference topics: BIDIR-PIM, shared trees, rendezvous points, many-to-many multicast scaling, PIM-SM source-tree behavior.

VPN 0 is the transport VPN in Cisco SD-WAN. It carries control traffic and provides connectivity from WAN Edge routers toward the transport networks, such as MPLS, Internet, LTE, or other WAN services. Control connections to Cisco SD-WAN controllers are established through transport interfaces that belong to VPN 0. Data VPNs carry service-side user traffic and are separate from the transport VPN. VPN 512 is commonly used for out-of-band management, not for carrying overlay control connections. VPN 128 and VPN 256 are not the reserved transport VPN identifiers. The design importance is that VPN 0 must have correct addressing, color assignment, routing reachability, NAT traversal considerations, and certificate-based controller connectivity. If VPN 0 is misdesigned, the WAN Edge cannot establish stable control connections, cannot receive OMP routes and policies, and cannot build the secure overlay properly. Therefore, VPN 0 is the correct transport VPN for underlay control traffic. Reference topics: Cisco SD-WAN VPN 0, transport VPN, control connections, WAN Edge onboarding, overlay formation.

The WAN connectivity mapping distinguishes private, public, and overlay connectivity use cases. Enterprise WAN design normally selects the transport according to the required security, availability, latency, cost, and operational control. MPLS Layer 3 VPN is commonly used when the enterprise needs private routed WAN service with provider-managed segmentation and predictable QoS behavior. Internet VPN designs are used when cost, rapid deployment, or broadband availability is more important, with IPsec or SD-WAN providing encryption and overlay control. Layer 2 services such as VPWS or VPLS are selected when the customer requires Ethernet adjacency, VLAN transport, or transparent LAN-like connectivity across sites. The drag-and-drop answer preserves those distinctions by matching each WAN type to the use case it is designed to support. A professional WAN architecture can combine these transports in a hybrid model, but the design must still identify which service carries private routing, which carries encrypted overlay traffic, and which provides Layer 2 extension. Reference topics: WAN transport selection, MPLS L3VPN, Internet VPN, Metro Ethernet, VPWS, VPLS, hybrid WAN design.

Advertising more-specific prefixes toward the preferred service provider is the correct way to influence inbound traffic to enter through a chosen CE interface. BGP inbound path control is indirect: the enterprise cannot set local preference inside remote autonomous systems, and MED is honored only under specific provider policies. The most deterministic option available to the customer is to advertise a longer-prefix route to the preferred provider because Internet and BGP route selection generally prefer the longest matching prefix before BGP path attributes are considered. If the aggregate is advertised to both providers but a more-specific route is advertised to the provider connected to gig0/0, return traffic for that more- specific destination is attracted through that interface. Lowering MED toward the less preferred provider is the opposite of the desired effect. AS-path prepending toward the preferred provider would make that path less attractive. Local preference affects outbound path selection inside the local AS, not inbound traffic from external networks. Reference topics: BGP inbound traffic engineering, longest-prefix match, route aggregation, AS-path prepending, MED, local preference.

BIDIR-PIM is the correct multicast mode for a video conferencing environment with numerous dispersed senders and receivers. Bidirectional PIM is designed for many-to-many multicast applications where receivers may also transmit and where maintaining per-source trees would create unnecessary state and control-plane overhead. Instead of building a shortest-path tree for every source, BIDIR-PIM uses a shared tree rooted at the rendezvous point and forwards traffic bidirectionally. This makes it attractive for collaborative applications and conferencing scenarios with many active participants. MP-BGP can carry multicast VPN or multicast routing information in service-provider designs, but it is not itself the multicast forwarding mode for this requirement. MSDP is used to exchange source information between PIM-SM domains, not to optimize many-to-many forwarding within the multicast design. IGMPv2 handles host membership signaling on local segments and does not provide the routed multicast mode. Reference topics: BIDIR-PIM, many-to-many multicast, shared tree, video conferencing multicast, PIM design.

Cisco Identity Services Engine is the SD-Access component that integrates with Cisco DNA Center to provide identity-based policy, Security Group Tags, and Security Group ACL policy enforcement. Cisco SD-Access uses Cisco TrustSec technology concepts for group-based policy, but ISE is the actual policy and identity services platform that integrates with Cisco DNA Center. DNA Center automates fabric deployment and policy orchestration, while ISE provides endpoint identity, group assignment, scalable group information, and policy authorization. SGACLs define permitted or denied communication between security groups, and SGTs classify users or endpoints into those groups. APIC-EM is not the SD-Access policy platform. Cisco Network Data Platform supports analytics and assurance functions, not identity policy enforcement. Cisco TrustSec is the underlying policy technology, but the question asks for the component that integrates with Cisco DNA Center. Therefore, the verified answer is Cisco Identity Services Engine. In design terms, ISE should be planned as a critical policy-plane dependency with redundancy, pxGrid integration, RADIUS services, and consistent scalable group policy design.

Cisco SD-WAN components map to distinct control, management, orchestration, and forwarding roles. vManage is the centralized management plane used for configuration templates, monitoring, software management, and operational visibility. vSmart is the centralized control-plane component that distributes OMP routes, TLOC information, security parameters, and centralized policy to WAN Edge devices. vBond is the orchestration component used during onboarding; it authenticates devices, helps them discover controllers, and assists with NAT traversal. The WAN Edge router, whether physical or virtual, forms the data plane at the branch, campus, or data center and forwards user traffic through secure overlay tunnels. Correctly identifying these roles is essential because SD-WAN scale and resiliency depend on separating management, control, orchestration, and forwarding responsibilities. A design that confuses vManage with vSmart or vBond will misplace policy, onboarding, and forwarding functions. Reference topics: Cisco SD-WAN architecture, vManage, vSmart, vBond, WAN Edge, OMP, overlay control plane.