Pass the Cisco CCNP Enterprise 300-420 Questions and answers with CertsForce

The drag-and-drop mapping separates WAN connectivity technologies by the service characteristics they deliver. Cisco enterprise WAN designs distinguish private WAN options, such as MPLS Layer 3 VPN, Ethernet WAN, VPLS, and VPWS, from Internet-based options such as broadband, LTE, and VPN overlays. Layer 3 MPLS VPN gives the provider responsibility for routing between customer sites and is commonly used when private any-to-any routing, QoS treatment, and segmentation are required. Layer 2 services such as VPWS and VPLS extend customer Layer 2 adjacency across a provider network; VPWS is point-to-point, while VPLS is multipoint. Internet and cellular links are typically lower-cost and fast to deploy, but they require overlay security, such as IPsec, DMVPN, or SD-WAN encryption, when used for enterprise private traffic. The selected mapping therefore aligns each description with the WAN category that actually provides that behavior. In design work, the architect must compare latency, resiliency, SLA, QoS preservation, encryption requirements, routing control, and operational ownership before selecting the WAN type. Reference topics: enterprise WAN connectivity, MPLS VPN, VPLS, VPWS, Internet VPN, cellular backup.

Route leaking on R13 and R9 is required so the Level 1 area can make a better exit decision toward the server. In an IS-IS hierarchy, Level 1 routers know detailed topology only inside their own area. For destinations outside the area, they normally follow the closest attached Level 1/Level 2 router, which can produce suboptimal latency when another exit has a better end-to-end path. Route leaking selectively injects more specific Level 2 reachability information into Level 1, allowing routers in the New Office area to evaluate a better path instead of blindly following the nearest attached-bit exit. Changing metric style on R8 alone does not import the external-area route information needed for better path selection. A static route could force a path but would not be a scalable dynamic IS-IS design. Making R8 Level 1/Level 2 does not solve the need to expose the relevant route through the correct area boundary. Reference topics: IS-IS Level 1 and Level 2, attached bit, route leaking, interarea optimization, latency-aware routing.

The vSmart controller provides the centralized control plane in a Cisco SD-WAN deployment. It establishes secure control connections with WAN Edge routers and exchanges routing, topology, security, and policy information using OMP. The vSmart controller does not forward user data traffic; data-plane forwarding occurs directly between WAN Edge routers over IPsec or other supported encapsulations. Its function is to distribute reachability information, TLOC information, service routes, centralized policies, application-aware routing policies, and segmentation information that determines how the overlay operates. vBond orchestrates onboarding, authentication facilitation, and NAT traversal for control connections. vManage provides centralized management, monitoring, configuration templates, and operational GUI/API functions. vEdge or Cisco IOS XE SD-WAN routers provide the branch or site data plane and local routing functions. Therefore, among the choices, the vSmart controller is responsible for the centralized control plane of the SD-WAN network. Correctly separating orchestration, management, control, and data-plane roles is a core Cisco SD-WAN design principle.

The SD-Access control-plane node maintains the endpoint database and resolves mappings between endpoints and the fabric edge nodes where those endpoints are located. Cisco SD-Access uses LISP in the fabric control plane. Edge nodes register endpoint identifiers with the control-plane node, and other fabric nodes query the control plane when they need to locate a destination endpoint. This control-plane function is commonly described through LISP Map-Server and Map-Resolver behavior. Option B is not correct because endpoint detection occurs at the edge node, not at the control-plane node. The edge is the device connected to users, access points, or endpoint-facing networks, so it learns local endpoint presence and registers that information. Option C refers to authentication and identity, which is integrated with Cisco ISE. Option D describes the border-node role, because border nodes connect the fabric to external networks. The corrected answer is therefore A. A stable SD-Access design must provide redundant control-plane reachability and scale the control-plane role according to fabric size, mobility, and endpoint churn. Reference topics: SD-Access control plane, LISP Map-Server, LISP Map-Resolver, endpoint-to-location mapping.

OpenConfig separates intended configuration from operational state by using separate config and state containers, while many IETF and Cisco native models use a single hierarchy for configuration and operational data or expose operational data differently. This distinction is important in automation because the client must know whether it is writing desired configuration or reading actual device state. OpenConfig’s structure was designed to provide consistent multivendor modeling, with configuration data placed under config containers and observed state under state containers. Cisco native models tend to mirror the Cisco device CLI and feature hierarchy more closely, while IETF models focus on standards-based interoperability. Option B correctly states the contrast presented in the question. Option A reverses the relationship. Option C incorrectly assigns split containers to IETF and native models. Option D incorrectly isolates Cisco native models as the only split-container style. Reference topics: YANG model structure, OpenConfig config and state containers, IETF YANG, Cisco native models, network automation data modeling.

MSDP is the correct technology when a large multicast design uses multiple PIM Sparse Mode domains and needs to exchange active source information between those domains. Cisco describes Multicast Source Discovery Protocol as the mechanism used by RPs in different PIM-SM domains to learn about multicast sources outside their own domain. When a source becomes active, the local RP can advertise Source-Active information to MSDP peers, allowing receivers in other domains to discover and join that source. This supports domain separation and can help balance multicast control-plane scope in large networks. DVMRP and MOSPF are legacy multicast routing approaches and are not the design mechanism for modern PIM-SM domain interconnection. IGMP is used between hosts and local multicast routers for receiver membership signaling; it does not exchange source information between multicast domains. Therefore, a design with more than 100 routers, several multicast domains, and PIM-SM traffic balancing should include MSDP. The architect should also design RP placement, Anycast RP behavior, peer mesh scaling, and source filtering. Reference topics: MSDP, PIM-SM domains, Source-Active messages, interdomain multicast.

L2VPN is the correct technology because the requirement is for two remote offices to share a common broadcast domain across a private WAN with minimal overhead. A Layer 2 VPN service extends Ethernet or VLAN connectivity between customer sites while keeping the customer routing design independent of the provider core. From the customer perspective, the two sites can appear to be on the same Layer 2 segment, which satisfies the shared broadcast-domain requirement. GET VPN, IPsec, and GRE are Layer 3-oriented technologies. They can connect sites securely or provide tunneling, but they do not natively create a common Layer 2 broadcast domain between the offices. GRE also adds additional encapsulation overhead, and IPsec alone generally provides encrypted routed connectivity rather than an Ethernet service. For a simple direct logical path over a private WAN, an L2VPN service such as VPWS or VPLS is the appropriate design family. Reference topics: L2VPN, VPWS, VPLS, Ethernet WAN services, broadcast-domain extension, private WAN connectivity.

The route-reflector design should make R2 a client of R1 and R4, and R5 a client of R3 and R4. The requirement states that the route reflector must have direct physical connections to the core routers R3 and R4, must avoid a single point of failure, and must account for high utilization on the R2-to-R1 link. In BGP route-reflector design, clients peer with redundant route reflectors so they can continue receiving reflected routes if one route reflector or path fails. Placing R5 as a client of R3 and R4 satisfies the direct-core requirement and provides redundant reflection through the core. Placing R2 as a client of R1 and R4 provides redundancy while reducing dependence on the heavily utilized R2-to-R1 link by including R4 as an alternate reflector. Making a router a client of two reflectors is a standard design technique for route-reflector high availability. The other combinations either fail the direct-core requirement, do not provide balanced redundancy, or keep traffic tied to the congested link. Reference topics: BGP route reflectors, client redundancy, iBGP scaling, route-reflector placement, core resiliency.

The new BGP route-reflector design reduces the iBGP peerings by 27. A full-mesh iBGP design with 9 routers requires n times n minus 1 divided by 2 peerings, which equals 9 times 8 divided by 2, or 36 sessions. Route reflectors are used specifically to reduce this scaling burden. In the redesigned topology, each of the three clusters has one route reflector and two clients, which requires two client-to-reflector sessions per cluster, or six sessions total. The three route reflectors must still maintain iBGP sessions with one another as nonclient peers, which adds three more sessions. The redesigned total is therefore nine sessions. The reduction is 36 minus 9, which equals 27. This reflects the core scaling benefit of route reflectors: clients no longer need a full iBGP mesh with every other client in the autonomous system. Reference topics: BGP route reflectors, iBGP scaling, full-mesh formula, route-reflector clients, nonclient peering.

For multimedia conferencing over MPLS, Cisco QoS design normally classifies the traffic into the multimedia conferencing class and marks it with AF4, commonly AF41. This class is intended for interactive video conferencing and similar applications that need assured bandwidth and controlled loss, but that are not usually placed in the same strict-priority class as voice bearer traffic. A bandwidth queue provides a minimum bandwidth guarantee during congestion, while DSCP-based WRED can selectively manage congestion within the class by using the drop precedence encoded in the AF marking. AF3 is generally associated with multimedia streaming, not interactive conferencing. A simple bandwidth queue without WRED does not fully use per-hop behavior characteristics for congestion handling. LLQ is typically reserved for voice and sometimes very tightly controlled real-time classes, because overusing strict priority can starve other traffic. Therefore, bandwidth queuing with DSCP WRED using AF4 is the appropriate per-hop behavior design. Reference topics: Cisco QoS baseline, DiffServ, AF41, multimedia conferencing, MPLS QoS, WRED.