Free Cisco 300-420 Exam Practice Questions & Explanations

Making R3 an L1/L2 router restores the required IS-IS hierarchy and prevents the outage caused by the failed R1-to-R2 link. In IS-IS, Level 1 routers have detailed topology only inside their own area, while Level 2 routers provide the interarea backbone. Routers that connect a Level 1 area to the Level 2 backbone must operate as Level 1/Level 2 devices so they can participate in both databases and provide an exit path for area traffic. If a path between areas depends on a router that is only Level 1 or only Level 2 in the wrong location, traffic can be blackholed when a key link fails. Configuring R3 as L1/L2 gives the topology an additional valid transition point between the local area and the backbone, improving continuity after the R1-to-R2 failure. Making unrelated routers L1 or L2 does not necessarily create the required interarea attachment. Reference topics: IS-IS Level 1, Level 2 backbone, L1/L2 routers, interarea reachability, hierarchical IGP design.

The correct technologies are loop guard on uplinks and root guard on downlinks. Cisco campus Layer 2 design guidance recommends protecting the intended spanning-tree topology by placing root guard on ports where the root bridge should never appear and loop guard on non-designated ports that depend on receiving BPDUs. In a hierarchical topology, downlinks toward access switches should not be allowed to become a path to a new STP root; root guard enforces that design by moving a port to root-inconsistent state if a superior BPDU is received. Uplinks are vulnerable to failures where expected BPDUs stop arriving, which can cause an alternate or root port to incorrectly transition to forwarding. Loop guard prevents that by placing the port into loop-inconsistent blocking state. BPDU guard is not appropriate on normal interswitch uplinks or trunk downlinks because those links are expected to exchange BPDUs; it belongs mainly on PortFast edge ports. Reference topics: STP protection, loop guard, root guard, campus Layer 2 design, Rapid PVST+.

Improved application experience and optimized cloud connectivity are two principal advantages of Cisco SD-WAN technology. Cisco SD-WAN separates the control plane from the data plane and applies centralized policy to choose the best available transport path for business applications. Features such as application-aware routing, performance measurement, path quality monitoring, forward error correction, packet duplication for selected traffic, and QoS integration help improve user experience for voice, video, SaaS, and other critical applications. SD-WAN also improves cloud connectivity by allowing branches to access trusted SaaS and IaaS resources directly instead of backhauling all traffic through a central data center. Cloud OnRamp functions further simplify connectivity to cloud-hosted workloads and SaaS applications. Easier deployment and proactive management may be operational benefits in some designs, but the strongest technology advantages in this answer set are application experience and optimized cloud access. Consistent connectivity is too generic and does not identify a specific SD-WAN design value. Reference topics: Cisco SD-WAN benefits, application-aware routing, direct internet access, Cloud OnRamp, SaaS optimization.

Dynamic NAT-PT is the correct selection when IPv6 hosts in an IPv6 island must access IPv4-only servers and services. NAT-PT translates between IPv6 and IPv4 packet headers and allows IPv6-only nodes to communicate with IPv4-only destinations by dynamically creating translation state. In this scenario, IPv6 hosts need access to file servers and DNS services in an IPv4 network, so a dynamic translation mechanism is required. Stateless NAT66 and stateful NAT66 are IPv6-to-IPv6 translation mechanisms and do not connect IPv6 hosts to IPv4-only resources. Static NAT-PT would be appropriate for fixed one-to-one mappings where specific hosts are permanently mapped, but the question describes general access from an IPv6 island to IPv4 services, making dynamic NAT-PT the better match. In modern designs, NAT64 and DNS64 are commonly preferred successors, but within the answer choices NAT-PT is the IPv6-to-IPv4 transition mechanism. Reference topics: IPv6 transition, NAT-PT, IPv6-to-IPv4 translation, DNS access, dual-protocol migration.

Explicit QoS trust should be configured at the network boundary points where markings first enter the managed DiffServ domain and are known to be reliable. In a DiffServ design, traffic classification and marking are typically performed at the access edge or at a controlled ingress boundary, and downstream devices then honor DSCP or CoS markings based on the trust boundary. Cisco QoS design stresses that the trust boundary must be intentionally placed; endpoints or unmanaged devices should not be trusted by default because they can mark traffic incorrectly and steal priority treatment. The exhibit answer identifies B and E as the correct trust points, meaning those are the controlled ingress locations where markings should be accepted. Options that trust uncontrolled endpoint-facing points or internal transit locations would either create a security problem or add no practical value. Once traffic is trusted and marked at the correct boundary, queuing, policing, and shaping policies can use the DSCP values consistently across the campus or WAN. Reference topics: DiffServ, QoS trust boundary, DSCP marking, classification, enterprise QoS design.