Pass the Cisco CCNP Enterprise 300-420 Questions and answers with Dumpstech

BGP Multipath Load Sharing is the feature used when a single router has two parallel BGP paths to the same ISP and the design goal is to install more than one eligible BGP path in the routing table. By default, BGP selects a single best path after evaluating path attributes such as weight, local preference, AS path, origin, MED, eBGP over iBGP, IGP metric to next hop, and tie breakers. When the competing paths are sufficiently equivalent and BGP multipath is enabled, Cisco IOS can install multiple BGP next hops for the same prefix and allow the forwarding plane to load share across both links. Multihop is used to establish BGP sessions to non-directly connected neighbors, not to load balance. Next-Hop Address Tracking improves convergence by tracking next-hop reachability, but it does not itself create load sharing. AS-path prepending intentionally makes a path less preferred for inbound traffic engineering. Therefore, the correct BGP feature for balancing outbound traffic across two links to the same ISP is Multipath Load Sharing.

DiffServ is the correct technology because the customer wants distributed QoS based on packet marking and per-hop treatment. Cisco differentiated services designs classify and mark traffic at the network edge, normally using DSCP values, and each device along the path applies a locally defined per-hop behavior to that traffic class. This model scales well in enterprise WANs because routers do not need to maintain per-flow state across the entire network. CBWFQ and LLQ are queuing mechanisms that can implement DiffServ treatment, but they are not the overall QoS architecture requested by the question. IntServ uses RSVP and per-flow resource reservation, which provides stronger admission-style guarantees but does not scale as well for large distributed WAN environments. The question specifically mentions individual packet marking and forwarding based on hop-by-hop treatment, which is the language of DiffServ. A complete design should define trust boundaries, DSCP markings, class maps, queue policy, and provider handoff behavior. Reference topics: DiffServ, DSCP marking, per-hop behavior, distributed QoS, WAN QoS architecture.

A major SaaS challenge is the lack of direct application and infrastructure control. With Software as a Service, the provider operates the application stack, platform, upgrades, and supporting infrastructure. The customer benefits from reduced maintenance burden and lower initial deployment cost, but gives up much of the direct control normally available with on-premises applications. This affects troubleshooting, change windows, performance visibility, customization, data residency controls, and integration with existing enterprise systems. Higher initial costs are usually not a SaaS characteristic; SaaS commonly shifts spending toward subscription operating expense. Client computer upgrades are not normally required in the same way as thick-client enterprise software. Data and application integration can be complex, but the option that best captures the core architectural challenge is reduced control over the application and infrastructure. Network architects must account for this by designing secure direct internet access, cloud monitoring, identity integration, and reliable paths to SaaS providers. Reference topics: SaaS architecture, cloud application control, enterprise cloud access, operational visibility, SD-WAN SaaS design.

Multiple Spanning Tree is the correct technology for a large Layer 2 domain with hundreds of switches and VLANs when the goals are efficient link use, loop prevention, and low CPU and memory impact. MST maps multiple VLANs into a smaller number of spanning-tree instances, allowing the designer to load-balance groups of VLANs across alternate paths without running a separate STP instance for every VLAN. Cisco Rapid PVST+ improves convergence compared with classic STP, but it maintains a separate instance per VLAN, which becomes costly at scale. PVST+ has similar per-VLAN scaling concerns and slower convergence behavior than rapid variants. Plain RSTP improves convergence but does not provide the same VLAN-to-instance mapping flexibility for hundreds of VLANs. MST is standards-based and particularly useful in multivendor environments where VLAN grouping and predictable root placement are required. The design should define MST regions consistently, map VLANs deliberately to instances, place roots near the Layer 3 gateway, and keep the number of instances small enough to protect supervisor CPU and memory. Reference topics: MST, RSTP, Rapid PVST+, VLAN-to-instance mapping, Layer 2 scalability.

IS-IS supports two fundamental circuit types: broadcast multiaccess and point-to-point. A broadcast or multiaccess circuit is used on media such as Ethernet where multiple routers can share the same Layer 2 segment. In that case, IS-IS elects a designated intermediate system to simplify database synchronization on the shared network. A point-to-point circuit is used where exactly two IS-IS routers form an adjacency across a direct link, which is common in modern routed campus, data center, and WAN designs. IS-IS does not use the same nonbroadcast multiaccess and point-to-multipoint network-type model that is familiar from OSPF. When IS-IS must run across technologies that do not naturally behave like Ethernet broadcast media, the design is typically adapted with point-to-point subinterfaces or appropriate Layer 2 treatment rather than selecting an IS-IS NBMA circuit type. Therefore, from the listed choices, the supported IS-IS circuit types are multiaccess and point-to-point.

Reverse Path Forwarding prevents multicast loops and duplicate packet forwarding. Multicast routing is source-oriented, so a router must verify that multicast traffic arrives on the interface it would use to reach the source or rendezvous point, depending on the tree state. If the packet arrives on the expected reverse-path interface, the RPF check succeeds and the router can forward the packet to the outgoing interface list. If it arrives on the wrong interface, the packet is dropped because accepting it could create a loop or duplicate stream. Cisco multicast designs rely on RPF checks with PIM to maintain loop-free distribution trees across redundant routed topologies. RPF does not notify upstream routers by itself, does not eliminate overlapping multicast group addresses, and is not simply a prune-generation mechanism. Prune behavior can occur as part of PIM tree maintenance, but the function asked here is loop prevention. Reference topics: multicast RPF check, PIM forwarding, source tree, shared tree, outgoing interface list, duplicate suppression.

Native policy-based IPsec protects unicast IP traffic between defined proxy identities, but it does not inherently provide a multiprotocol tunnel interface that supports multicast routing protocol packets. Many enterprise VPN designs require multicast for applications, routing protocols, or service discovery. To support multicast across an encrypted VPN, the design commonly uses GRE over IPsec or a tunnel interface such as VTI where the tunnel provides a logical point-to-point or multipoint interface and IPsec secures the encapsulated traffic. GRE can encapsulate multicast and broadcast traffic, allowing dynamic routing protocols and multicast packets to traverse the VPN. IPsec then encrypts the GRE or tunnel traffic for confidentiality and integrity. Transport mode by itself does not solve multicast forwarding, and tunnel mode still requires suitable encapsulation or tunnel-interface behavior for multicast support. Additional headend bandwidth may be required in large VPN designs, but it is not the unique technical requirement for multicast. Therefore, when IPsec VPNs must support IP multicast, the design must include GRE or VTI-style encapsulation.

The main purpose of the Cisco SD-Access underlay is to provide a stable routed transport that carries the overlay efficiently between fabric nodes. Among the available choices, optimizing network traffic routing and load-balancing is closest to that function. The underlay is not the security segmentation layer; segmentation is created in the overlay through virtual networks, SGTs, and policy enforcement. The underlay also is not primarily responsible for firewall or IPS services. While LAN automation can help build the underlay, automation is a deployment method rather than the underlay design purpose. A good underlay provides IP reachability, fast convergence, consistent MTU, and resilient routing so that VXLAN-encapsulated overlay traffic can move between edge, border, intermediate, and control-plane nodes. If the underlay is unstable, the overlay will inherit packet loss, convergence problems, and poor application performance. Reference topics: Cisco SD-Access underlay, routed access, IP reachability, fabric transport, underlay resilience, overlay support. This preserves stable fabric forwarding.

Class selector code points provide backward compatibility between IP Precedence and DiffServ. IP Precedence uses the three most significant bits of the former Type of Service field. DiffServ expands QoS marking by using the six-bit DSCP field, but class selector values preserve compatibility by setting the three high-order bits to match the corresponding IP Precedence value while leaving the lower bits as zeros. For example, CS3 corresponds to the old precedence value 3, and CS6 corresponds to precedence 6. This allows devices that still interpret IP Precedence to provide broadly consistent treatment while newer DiffServ-aware devices can use DSCP-based policy. Expedited forwarding is used for low-loss, low-latency traffic such as voice. Assured forwarding provides drop precedence within classes. Default per-hop behavior represents best-effort treatment. None of those are specifically the backward-compatibility mechanism for migration from IP Precedence. Therefore, the design should include class selector code points during the transition to DiffServ. Reference topics: DiffServ, DSCP, class selector, IP Precedence compatibility, QoS marking migration.

Implementing direct Internet access at every Cisco SD-WAN site improves application experience and reduces unnecessary backhaul. Many modern business applications are hosted in SaaS or public cloud environments. If branch Internet traffic must hairpin through a central data center before reaching those applications, latency increases and central WAN or security stacks can become bottlenecks. SD-WAN DIA allows selected cloud and Internet-bound traffic to exit locally while still applying policy, segmentation, and security controls. This decreases latency to applications hosted by public cloud providers and improves user experience. It also alleviates traffic on MPLS circuits because Internet and cloud traffic no longer needs to consume private WAN bandwidth back to a centralized egress point. DIA does not inherently reduce the physical latency of an Internet circuit, and it does not increase the provisioned circuit bandwidth. Zero-touch provisioning may accelerate site deployment, but that is a separate SD-WAN onboarding benefit rather than a specific benefit of deploying DIA at every site. Therefore, the two correct benefits are reduced latency to public cloud applications and reduced load on MPLS circuits.