300-420 Cisco Designing Cisco Enterprise Networks (ENSLD) v1.1 Free Practice Exam Questions (2026 Updated)

MSDP is the correct solution for multicast across different autonomous systems when RPs must discover active sources outside their local domain. In PIM Sparse Mode, each multicast domain can have its own rendezvous point. Without a mechanism to exchange source information, receivers in one domain may not know about active sources registered with an RP in another domain. Multicast Source Discovery Protocol solves that problem by allowing RPs to establish peer relationships and exchange Source-Active information. Cisco multicast design uses MSDP with PIM-SM when separate domains need to share multicast source reachability while relying on the unicast routing table for connectivity between RPs. SSM does not use an RP and depends on receivers joining a specific source and group. PIM-SM by itself works inside a domain but does not provide interdomain source discovery between RPs. PIM-DM is flood-and-prune and is not suitable for this sparse, interdomain design. Therefore, the organization should deploy MSDP between the RP devices or RP domains. Reference topics: MSDP, PIM-SM, interdomain multicast, Source-Active messages, RP-to-RP source discovery.

Interdomain multicast designs commonly use MP-BGP and MSDP together. MP-BGP carries multicast routing information between domains so routers can perform RPF checks based on the correct multicast topology rather than relying only on unicast routing. MSDP is used between rendezvous points in different PIM sparse-mode domains to exchange information about active sources. Cisco multicast documentation describes MSDP as a mechanism that connects multiple PIM-SM domains and allows RPs to discover multicast sources in other domains. Together, MP-BGP provides the reachability information and MSDP provides source discovery between RPs. IGMPv2 is a host-to-router group membership protocol inside a local subnet, not an interdomain multicast routing protocol. MLD provides the IPv6 equivalent of host group membership signaling. BIDIR-PIM is a multicast forwarding mode optimized for many-to-many traffic inside a domain, but it is not the pair of protocols used for interdomain source and receiver communication in this question. Therefore, the correct protocols are MP-BGP and MSDP.

The design goal is to reduce the impact of branch and remote-office instability while using the fewest possible ABRs. In OSPF, topology changes inside an area trigger SPF calculations for routers in that area. Creating separate areas behind aggregation points contains those changes and prevents every branch link flap from affecting the entire backbone. The minimal-ABR approach is to place the area boundary at the higher aggregation layer, where fewer routers connect the new areas to area 0. In the described topology, R5 and R6 can serve as ABRs for both sets of downstream aggregation connections. That supports a new area for the R1/R2 branch connections with R5 and R6 as ABRs, and a new area for the R3/R4 remote-office connections with R5 and R6 as ABRs. Making R1, R2, R3, and R4 the ABRs increases the ABR count and spreads area-boundary functions deeper into the network. A single new area for all downstream connections would reduce isolation between different failure domains. The selected design improves stability and keeps the OSPF hierarchy clean.

The primary capability of IaaS in this question is elastic scaling: the ability to increase or decrease infrastructure resources based on demand. In Infrastructure as a Service, the provider offers compute, storage, and network resources as an on-demand service, while the customer deploys operating systems and applications on top of that infrastructure. Cisco cloud material describes this model as providing scalable IT capacity without requiring the organization to own all physical assets. Option C is the best answer because dynamic capacity adjustment is a fundamental cloud capability and a major reason enterprises choose IaaS for variable workloads. Option B is a valid business benefit because consumption-based billing can reduce cost, but the question asks for a primary capability, not the pricing model. Option D describes automation and orchestration, which support cloud operations but are not the specific capability being tested. Option A is closer to hybrid-cloud workload mobility and is not guaranteed by IaaS alone. Reference topics: cloud service models, IaaS, elasticity, scalable compute, on-demand resource provisioning.

The VRF receive feature is the mechanism that fits the constraint when the customer does not want BGP, VRF-Lite links, or static routing for the inter-VRF requirement. Inter-VRF connectivity is normally achieved through route leaking with MP-BGP, static routes, firewall interfaces in each VRF, or VRF-Lite handoff links. The question explicitly excludes those common approaches and asks for a mechanism on the core network layer. The VRF receive capability allows selected traffic received on a global routing interface to be associated with a VRF context for locally configured addresses, supporting limited interaction without building a full routing exchange between the global table and the VRF. Policy-based routing with a global set statement can solve some forwarding cases, but it is not the specific mechanism described by the option set. A route map with import features would typically depend on route leaking behavior. Therefore, the best answer is the VRF receive feature under the global routing interfaces. Reference topics: VRF, inter-VRF routing, VRF receive, route leaking alternatives, core-layer segmentation.

The correct technologies are loop guard on uplinks and root guard on downlinks. Cisco campus Layer 2 design guidance recommends protecting the intended spanning-tree topology by placing root guard on ports where the root bridge should never appear and loop guard on non-designated ports that depend on receiving BPDUs. In a hierarchical topology, downlinks toward access switches should not be allowed to become a path to a new STP root; root guard enforces that design by moving a port to root-inconsistent state if a superior BPDU is received. Uplinks are vulnerable to failures where expected BPDUs stop arriving, which can cause an alternate or root port to incorrectly transition to forwarding. Loop guard prevents that by placing the port into loop-inconsistent blocking state. BPDU guard is not appropriate on normal interswitch uplinks or trunk downlinks because those links are expected to exchange BPDUs; it belongs mainly on PortFast edge ports. Reference topics: STP protection, loop guard, root guard, campus Layer 2 design, Rapid PVST+.

Cisco Catalyst SD-WAN Cloud OnRamp is built to simplify and automate cloud connectivity from enterprise sites. Cisco describes the feature as a way to simplify connecting on-premises environments to cloud-hosted applications and workloads while extending SD-WAN policy into the cloud. The key design value is automation: branches and data centers can connect to SaaS, IaaS, or multicloud resources without manually building every tunnel, route policy, and cloud attachment. That is why option D is the strongest answer. Option A is too broad because generic transport independence is a core SD-WAN value, not the specific purpose of Cloud OnRamp. Option B confuses Cloud OnRamp with application-aware routing policy. Option C describes a business outcome, but the operational purpose tested here is automated on-premises-to-cloud integration and consistent policy extension. Reference topics: Cisco Catalyst SD-WAN Cloud OnRamp, multicloud connectivity, cloud workload access, SD-WAN fabric extension, automated cloud onboarding.

The selected IPv4 plan is correct because the design must maximize the number of subnets while still meeting the host requirements for each location. With VLSM, the largest subnet must be allocated first. A segment requiring 500 hosts needs at least 9 host bits, because 2^9 provides 512 addresses and 510 usable host addresses, so a /23 is required. A segment requiring 100 hosts needs 7 host bits, giving 126 usable addresses, so a /25 is sufficient. A segment requiring 25 hosts needs 5 host bits, giving 30 usable addresses, so a /27 is sufficient. Any plan that uses larger prefixes than necessary wastes addresses and reduces the number of available subnets inside 172.16.0.0/16. Any plan using smaller subnets would fail the host requirement. The correct option is the one that uses the smallest valid subnet size for each requirement while keeping the addressing blocks aligned. Reference topics: IPv4 VLSM, CIDR, subnet sizing, usable host calculation, hierarchical addressing plans.

An additional Cisco SD-Access fabric site requires edge and border roles in addition to the control-plane function. Edge nodes connect wired endpoints, access-layer devices, and sometimes access points into the fabric. They perform endpoint detection, anycast gateway functions, and fabric encapsulation for user traffic. Border nodes provide connectivity between the fabric site and external networks such as the WAN, data center, internet edge, or shared services. Without edge nodes, the site has no practical access-layer fabric attachment for endpoints. Without border nodes, the site cannot properly exchange traffic with resources outside the local fabric. A wireless LAN controller may be needed when fabric wireless is part of the design, but it is not one of the mandatory fabric roles for every additional site. Leaf and cEdge are not Cisco SD-Access fabric roles in this context. Reference topics: Cisco SD-Access fabric roles, edge node, border node, control-plane node, fabric site expansion.

This YANG mapping is based on how IETF, OpenConfig, and Cisco native models differ in portability and schema organization. IETF models are produced through the standards process and are appropriate when the same management structure is expected across vendors for common protocols. OpenConfig models are also vendor-neutral, but they are built around a consistent operational model used heavily for streaming telemetry and multivendor automation. Cisco native models mirror Cisco platform configuration more closely and expose device-specific capabilities that may not exist in common models. The selected answers keep those boundaries clear. This matters because a NETCONF or RESTCONF payload is validated against the YANG schema; a payload written for one model family cannot be assumed to work against another. In design terms, the model family should be selected after confirming device software release support, feature coverage, operational-state requirements, and vendor diversity. Open models give portability; native models give feature completeness. Reference topics: IETF YANG, OpenConfig YANG, Cisco native YANG, schema validation, automation model selection.

VPLS is the appropriate design model when multiple remote sites must appear to share the same Layer 2 segment. Because all sites use the same IP subnet, the solution must preserve a common broadcast domain rather than require Layer 3 route exchange between unique subnets. Cisco VPLS provides multipoint Layer 2 VPN service across a provider network, allowing customer edge devices at different sites to communicate as though they were attached to the same Ethernet LAN. Including 802.1Q connectivity on the LAN-facing side of the CE is the practical requirement because the CE must carry the relevant VLAN toward the provider-delivered VPLS service. Route exchange with the provider is not the main mechanism because VPLS is a Layer 2 service. NAT would hide overlapping addressing, but it would defeat the requirement to keep the same subnet operational across the sites. Placing each site in a different VLAN would also break the shared-subnet design. The correct design is therefore VPLS with VLAN tagging on the CE LAN side. Reference topics: VPLS, Layer 2 VPN, 802.1Q trunking, shared subnet extension, Ethernet WAN design.

The multicast-replicator function is used to optimize multicast traffic distribution across Cisco SD-WAN. Cisco Catalyst SD-WAN multicast overlay design avoids forcing the ingress WAN Edge router to replicate every multicast packet to every remote receiver. Instead, multicast routes and receiver information are exchanged through OMP, and a WAN Edge can be designated as a multicast or OMP replicator. The replicator then distributes streams to interested receivers across the overlay, reducing bandwidth and processing pressure on the source-side edge. That is why multicast-replicator is the feature that optimizes WAN bandwidth for IGMP-driven multicast receiver traffic among WAN Edge routers in the same VPN. IGMPv2 is only the host-to-router group membership protocol and does not optimize overlay distribution by itself. A multicast RP is used in PIM sparse mode, but it is not the SD-WAN overlay replication feature. Multicast service routes advertise multicast service information, but the bandwidth-saving forwarding role is the replicator. Reference topics: Cisco SD-WAN multicast overlay, OMP multicast routes, multicast replicator, IGMP receiver joins.

The control-plane node in Cisco SD-Access acts as the map system that manages endpoint-to-device relationships. Cisco SD-Access documentation describes control-plane nodes as maintaining the host database that maps endpoint identifiers to the fabric edge devices where those endpoints are attached. This mapping function is based on LISP control-plane behavior. When an endpoint appears on an edge node, the edge registers the endpoint information with the control plane. When another fabric device needs to send traffic to that endpoint, it queries the control-plane node to resolve the endpoint location. A fabric edge node is the device that connects wired endpoints to the fabric, so option A describes an edge role. Wireless endpoints may attach through fabric AP and fabric WLC integration, but that is not the control-plane node’s role. External Layer 3 networks are connected through border nodes, not through the control-plane node. Therefore, the correct role is endpoint-to-device mapping. Accurate control-plane design is essential for fabric scale, endpoint mobility, and fast location resolution.

The OSPF design should include LSA/SPF timer tuning and summarization with appropriate stub-area design. Cisco OSPF convergence is affected by failure detection, LSA generation, flooding, SPF scheduling, and routing-table installation. Tuning LSA and SPF throttling timers helps the network react quickly to genuine failures while avoiding excessive CPU churn during repeated flaps. This is especially important when voice and video traffic are sensitive to convergence delay. Manual route summarization at area boundaries reduces the number of detailed routes advertised between areas and limits the blast radius of link failures. Configuring nonbackbone areas as stub networks where appropriate also reduces external LSA propagation and lowers router resource use. Reducing DR and BDR election frequency is not a primary design tool for convergence, and increasing hello and hold timers would slow failure detection rather than improve it. Advertising default routes can be useful, but it does not by itself contain link flap impact. Reference topics: OSPF area design, LSA throttling, SPF throttling, route summarization, stub areas, convergence optimization.

Dynamic NAT-PT is the correct selection when IPv6 hosts in an IPv6 island must access IPv4-only servers and services. NAT-PT translates between IPv6 and IPv4 packet headers and allows IPv6-only nodes to communicate with IPv4-only destinations by dynamically creating translation state. In this scenario, IPv6 hosts need access to file servers and DNS services in an IPv4 network, so a dynamic translation mechanism is required. Stateless NAT66 and stateful NAT66 are IPv6-to-IPv6 translation mechanisms and do not connect IPv6 hosts to IPv4-only resources. Static NAT-PT would be appropriate for fixed one-to-one mappings where specific hosts are permanently mapped, but the question describes general access from an IPv6 island to IPv4 services, making dynamic NAT-PT the better match. In modern designs, NAT64 and DNS64 are commonly preferred successors, but within the answer choices NAT-PT is the IPv6-to-IPv4 transition mechanism. Reference topics: IPv6 transition, NAT-PT, IPv6-to-IPv4 translation, DNS access, dual-protocol migration.

Secure segmentation is the Cisco SD-WAN Secure Direct Cloud Access function that separates user traffic into different zones and VPNs or VRFs. In Cisco SD-WAN, VPNs provide logical segmentation that is comparable to VRF separation in traditional routing. Secure Direct Cloud Access extends this segmentation model when users access internet and cloud applications directly from the branch. The design can keep corporate, guest, payment, voice, IoT, and other traffic classes isolated, with policy and security controls applied per segment or zone. Centralized data policy controls forwarding behavior, but the feature that divides traffic into separate zones and VPN or VRF contexts is secure segmentation. Perimeter control and application-aware routing are useful security and performance functions, but they do not describe the core segmentation mechanism. Segmentation is a fundamental SD-WAN design requirement because direct cloud access must not collapse trust boundaries simply because traffic no longer hairpins through a central data center. Reference topics: Cisco SD-WAN secure segmentation, VPNs, VRFs, direct cloud access, zone-based policy.

Manual underlay is the correct deployment approach for a brownfield SD-Access scenario. In a greenfield fabric, Cisco DNA Center LAN Automation can build the routed underlay by discovering devices, assigning addresses, and creating the required underlay adjacencies. Brownfield environments already have an installed campus network, addressing plan, routing policy, operational constraints, and production dependencies. Rebuilding that underlay automatically can introduce unnecessary disruption. Cisco SD-Access brownfield designs normally preserve and validate the existing routed underlay, then use Cisco DNA Center to discover devices and automate the fabric overlay, policy, and endpoint segmentation functions. Subnet stretching is not the required deployment model and can create operational complexity. Automated underlay and LAN automation are powerful when the physical network is being newly built, but they are not the safest default for an established production environment. A professional brownfield design should first confirm MTU, routing reachability, loopback advertisements, device support, and fabric readiness before onboarding nodes. Reference topics: SD-Access brownfield migration, manual underlay, Cisco DNA Center, LAN Automation, fabric readiness.

The correct design is to advertise a default route from the aggregation layer toward the access layer and summarize the VLAN subnets at the aggregation layer toward the core. Cisco hierarchical campus design places summarization at aggregation or distribution boundaries because that is where access-layer routes are collected before entering the core. Summarizing the VLAN ranges into 10.0.0.0/16 hides individual access VLAN instability from the core, reducing routing table entries, protocol churn, and memory consumption on core devices. Sending a default route from aggregation to access also keeps access switches simple and prevents them from carrying unnecessary campus routing detail. This design contains failures and convergence events inside the appropriate block. Summarizing at the access layer is less practical when multiple VLANs aggregate at distribution. Advertising a default toward the core is backwards, because the core must know the summarized access block. Reference topics: hierarchical campus routing, aggregation-layer summarization, default routing to access, route-table reduction, convergence containment.

MSTP is the correct spanning-tree choice for a Layer 2 design with many logical ports, multiple trunked VLANs, and a subsecond convergence requirement. Rapid PVST+ provides rapid convergence, but it creates a separate spanning-tree instance for every VLAN. With 30 VLANs on trunks and hundreds of active ports, the number of logical STP ports can grow quickly and increase CPU and memory load. MSTP maps many VLANs into a smaller number of spanning-tree instances while still using rapid convergence behavior based on IEEE 802.1w principles. This makes it more scalable for large Layer 2 domains than PVST+ or Rapid PVST+ when many VLANs are present. CST provides a single instance but lacks the flexibility and convergence characteristics expected in modern enterprise designs. The design needs both scalability and fast convergence, and MSTP is the standards-based protocol that best satisfies both requirements. Reference topics: MSTP, Rapid STP, logical STP ports, VLAN-to-instance mapping, Layer 2 scalability, convergence.