Pass the Cisco CCNP Enterprise 300-420 Questions and answers with CertsForce

The active logical interface count for Switch A is 202 based on the spanning-tree scalability method used for logical ports. In STP design, a logical port is counted per active VLAN instance on each active trunk or access interface. A trunk carrying multiple VLANs therefore consumes multiple logical STP ports, while an access link normally consumes one logical STP port for its VLAN. Cisco campus design guidance uses logical-port counts to ensure that the selected STP mode and platform stay within supported scalability limits. The calculation in the exhibit produces 202 active logical interfaces for Switch A, not simply the number of physical links. Answer A counts only physical interfaces and ignores VLAN instances. Answer D is too low because it does not account for all active VLANs across the relevant links. Answer B overstates the count by including VLANs or links that are not active for Switch A. Reference topics: STP scalability, logical ports, VLAN instances, trunk design, Layer 2 campus sizing.

BIDIR-PIM is the correct multicast deployment model when redundant paths and active links may create RPF challenges for many-to-many multicast traffic. Bidirectional PIM builds a shared tree rooted at the rendezvous point and avoids maintaining separate source-specific shortest-path trees for every sender. This is valuable when sources and receivers are spread across a redundant branch design and traffic can enter the multicast domain from multiple directions. Because BIDIR-PIM uses the Designated Forwarder mechanism on each link, it helps control which router forwards traffic toward the RP and reduces duplicate forwarding in topologies where normal RPF behavior could be problematic. PIM-SM is widely used, but it normally moves to source trees for active sources unless specifically controlled. PIM-SSM requires receivers to know the source and is not designed for arbitrary many-to-many communication. PIM-BSR is a mechanism for dynamic RP discovery, not a multicast forwarding model. Reference topics: BIDIR-PIM, multicast RPF, many-to-many multicast, Designated Forwarder, branch multicast design.

AES Galois/Counter Mode is the appropriate AES mode for Cisco SD-WAN environments that include multicast applications. In SD-WAN data-plane security, encryption must protect traffic efficiently while supporting high-throughput forwarding and modern integrity protection. AES-GCM is an authenticated encryption mode, which means it provides confidentiality and integrity in a single efficient operation. It is well suited to modern IPsec designs and avoids the older requirement to combine a confidentiality mode with a separate authentication algorithm. Cipher Block Chaining and Cipher Feedback are older modes and are not preferred for this design requirement. Electronic Code Book is unsuitable because it exposes patterns in plaintext and is not considered secure for network transport encryption. Multicast support also requires a data-plane security model that can scale without per-flow negotiation overhead. AES-GCM is therefore the correct selection for a secure, efficient Cisco SD-WAN deployment that must carry multicast traffic. Reference topics: Cisco SD-WAN encryption, AES-GCM, IPsec data-plane security, multicast transport, authenticated encryption.

TLOC information is the OMP update that allows Cisco SD-WAN to build an overlay over any public or private transport without depending on the actual underlay link addressing. Cisco OMP advertises route reachability along with Transport Location mappings. A TLOC represents where and how a WAN Edge can be reached in the transport network, using attributes such as system IP, transport color, encapsulation, and next-hop information. Remote WAN Edge routers use this information to form secure data-plane tunnels to the correct transport attachment. RLOC is a LISP locator term associated with SD-Access and LISP designs, not the SD-WAN OMP construct. DTLS is the secure transport used for control connections, but it is not an OMP route information type. LISP PITR is unrelated to Cisco SD-WAN OMP. The secure overlay is built by combining OMP routes, TLOCs, policy, and encrypted tunnel establishment. Reference topics: Cisco SD-WAN OMP, TLOC routes, transport color, overlay routing, secure data-plane tunnels.

Making R2 active for half of the VLANs improves utilization by distributing first-hop gateway forwarding across both core routers. HSRP provides default-gateway redundancy by making one router active and another standby for a VLAN. If the same router is active for every VLAN, traffic from all downstream VLANs is forwarded through the same core path, which can leave some interfaces congested while parallel links on the standby side remain underused. Cisco campus designs commonly tune HSRP priorities per VLAN and align the active HSRP gateway with the spanning-tree root for that VLAN. This creates a deterministic load-sharing model while preserving gateway redundancy. Adding more interfaces may help capacity, but the question states that some downstream interfaces are already underutilized, so the issue is load distribution rather than absolute port count. A port channel is useful only when the topology supports bundling the specific links and does not by itself move gateway activity. RSTP improves convergence, not HSRP forwarding balance. Reference topics: HSRP load sharing, per-VLAN gateway placement, STP root alignment, campus capacity design.

BFD for EIGRP is the strongest design option for improving convergence after access-layer switch or uplink failure on Layer 3 links. EIGRP hello and hold timers can detect failures, but aggressive timer reduction increases control-plane chatter and still may not provide consistent subsecond detection across platforms. Cisco BFD is specifically designed to provide rapid forwarding-path failure detection for routing protocols, including EIGRP, independent of the routing protocol hello mechanism. On point-to-point Layer 3 uplinks, BFD can notify EIGRP quickly when a neighbor path fails, allowing DUAL to react without waiting for the EIGRP hold timer. Summarization from access to aggregation is useful for query scoping and stability, but it does not directly detect an access switch failure faster. Summarization from core to aggregation has even less relevance to access uplink failure detection. Therefore, the design should enable BFD for EIGRP on the access-layer uplinks, with timer values chosen carefully according to platform capability and operational stability. Reference topics: EIGRP convergence, BFD, routed access, failure detection, DUAL.

The IPv4 network 172.16.10.0/24 maps to 2001:db8:abcd::ac10:a00/120 when the IPv4 address is placed into the lowest significant bits of the IPv6 address. The calculation converts each IPv4 octet into hexadecimal: 172 is AC, 16 is 10, 10 is 0A, and 0 is 00. Combining those bytes gives AC10:0A00, displayed in IPv6 notation as ac10:a00. Because a /24 IPv4 network has 8 host bits, the mapped IPv6 network leaves the same 8 host bits, resulting in a /120 IPv6 prefix. Option B incorrectly places decimal IPv4 octets into separate IPv6 hextets and uses /96, which represents a much larger mapping block than the /24 network. Option C does not represent 172.16.10.0 in hexadecimal. Option D changes the higher-order IPv6 prefix and does not match the supplied address plan. The correct address therefore preserves the planned IPv6 prefix and embeds the IPv4 network in the low-order bits. Reference topics: IPv4-to-IPv6 address mapping, hexadecimal conversion, IPv6 prefix length, migration addressing plans.

Summarization on routers A and C is the correct design because the requirement is to keep failures of the listed access networks from impacting the core while still supporting fast convergence in both access and core. Route summarization creates an aggregation boundary: more-specific access routes can flap behind the summary without causing the core to learn and withdraw every individual prefix. Cisco hierarchical routing design uses summarization at distribution or aggregation boundaries to reduce routing-table size, contain convergence events, and protect the core from access-layer instability. Adding another aggregation layer may be appropriate in some large designs, but it is not necessary when the question asks for the mechanism that stops specific prefix failures from impacting the core. Graceful restart protects forwarding during control-plane restart events, not ordinary access-prefix failures. FRR provides fast reroute for link or node failures but does not hide individual connected-network changes from the core. Summarizing at routers A and C directly addresses the stated networks and reduces the query, LSA, or update impact depending on the routing protocol used. Reference topics: route summarization, hierarchical routing, convergence containment, core protection, prefix aggregation.

EIGRP and BGP are the two listed routing protocols that can support unequal-cost load balancing in Cisco enterprise designs. EIGRP performs unequal-cost load sharing by using the variance command. Feasible successor routes whose feasible distance falls within the variance multiplier can be installed alongside the successor route, provided they satisfy EIGRP loop-prevention rules. This allows traffic to use links with different composite metrics while still maintaining loop-free forwarding. BGP can also support unequal-cost distribution in specific designs, such as using BGP multipath features with additional bandwidth-based mechanisms or policy to influence traffic sharing across nonidentical paths. OSPF and IS-IS commonly support equal-cost multipath, but they do not natively perform EIGRP-style unequal-cost load balancing based on different path metrics. RIPng is also limited by hop-count behavior and is not used for unequal-cost multipath in this context. The correct design answer is therefore EIGRP and BGP. In production, the engineer must still validate hardware forwarding behavior, policy consistency, and whether the traffic-sharing method is per-flow or per-prefix.

An inbound IP prefix list is the correct tool because the routers must decide which prefixes to accept from the service provider based only on prefix length. Prefix lists are designed to match network prefixes and mask-length ranges using operators such as le and ge. Applying the prefix list inbound to the BGP neighbors prevents routes with masks longer than /24 from entering the local BGP table, regardless of what the service provider advertises. This conserves memory and ensures the customer routing policy is enforced locally. An access list is a poor fit because it does not natively express prefix-length logic as cleanly as a prefix list. Applying the policy outbound would filter routes the customer sends to the provider, which is the wrong direction; the requirement is about routes the customer learns. A route map could reference a prefix list, but the simplest and most exact answer is to use an IP prefix list inbound. Therefore, the design should apply an inbound prefix list to both BGP peers to block prefixes greater than /24. Reference topics: BGP route filtering, prefix lists, inbound policy, maximum accepted prefix length.