I85PREP
⌘ K
ENSLD 300-420 study materials
ENSLD 300-420 study resources

ENSLD 300-420 practice questions

One question at a time. Build your ENSLD 300-420 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network design fundamentals

In the Cisco three-tier hierarchical design model, which layer is responsible for policy enforcement, filtering, and route summarization between distribution blocks?

  1. Fabric underlay layer
  2. Access layer
  3. Core layer
  4. Distribution layer Correct answer.

Explanation

The distribution layer sits between access and core and is where routing policy, QoS marking trust boundaries, ACL filtering, and summarization of access-layer routes are applied. It also provides redundant paths between access switches and the core.

Question 2Network design fundamentals

A campus design must support a single subnet spanning two buildings while keeping Layer 2 flooding domains bounded. Which design element best satisfies this requirement?

  1. A first-hop redundancy protocol on each closet switch
  2. A VXLAN overlay with an EVPN control plane Correct answer.
  3. A routed access layer with one subnet per closet
  4. A Layer 2 access layer extended across both buildings

Explanation

A VXLAN overlay maps Layer 2 segments onto a Layer 3 underlay, so a subnet can exist in multiple buildings without extending STP flooding domains across the routed core. EVPN supplies the control plane for MAC and IP reachability.

Question 3Network design fundamentals

Which statement describes the primary purpose of the core layer in a hierarchical campus design?

  1. It provides high-speed, low-latency transport between distribution blocks. Correct answer.
  2. It terminates endpoint VLANs and enforces port security.
  3. It hosts the default gateway for each access VLAN.
  4. It aggregates wiring closets and applies QoS policy.

Explanation

The core layer exists to move packets quickly and reliably between distribution blocks with minimal features enabled. Keeping policy off the core preserves convergence and throughput.

Question 4Network design fundamentals

A designer is choosing between a two-tier collapsed core and a three-tier campus for a single building with fewer than 400 endpoints. Which factor most strongly favors the collapsed-core design?

  1. The need to enforce policy at multiple distribution blocks
  2. The absence of a requirement for a dedicated high-speed transit layer Correct answer.
  3. The requirement for a large VXLAN EVPN overlay
  4. The need to summarize routes between many distribution blocks

Explanation

A collapsed core merges the core and distribution functions, which is appropriate when scale does not justify a separate transit tier. With one modest building there is no need for a dedicated core layer.

Question 5Network design fundamentals

Which protocol provides first-hop gateway redundancy by electing one active router while allowing load sharing across multiple gateways?

  1. STP
  2. LACP
  3. OSPF
  4. VRRP Correct answer.

Explanation

VRRP elects a master router that owns the virtual gateway address while backup routers monitor it, and multiple VRRP groups can share load. HSRP and GLBP are Cisco alternatives with similar goals.

Question 6Network design fundamentals

A campus uses HSRP with preemption disabled on both routers and the active router fails. After the original router recovers, what is the resulting HSRP state?

  1. The recovered router stays in the standby role because preemption is disabled. Correct answer.
  2. The recovered router immediately resumes the active role.
  3. The standby router reverts to listen state until a new election occurs.
  4. Both routers become active and share the virtual MAC.

Explanation

Without preemption, a recovered higher-priority router does not reclaim the active role; the current active router keeps it. Preemption must be enabled to force the preferred router to take over again.

Question 7Network design fundamentals

Which STP enhancement is designed to protect against a rogue switch that starts advertising superior BPDUs on an access port?

  1. UDLD
  2. Loop Guard
  3. BPDU Guard Correct answer.
  4. Root Guard

Explanation

BPDU Guard err-disables a port configured for PortFast when any BPDU is received, blocking an unauthorized switch from influencing topology. Root Guard instead prevents a port from becoming the root port.

Question 8Network design fundamentals

In a design that uses MST, what is the purpose of mapping multiple VLANs to a single instance?

  1. To convert the topology into a loop-free routed design
  2. To reduce the number of spanning-tree topologies while allowing load sharing across instances Correct answer.
  3. To provide a distinct spanning-tree topology per VLAN
  4. To eliminate the need for a root bridge election

Explanation

MST groups VLANs into instances so a limited number of topologies serve many VLANs, and different instances can use different root bridges for load sharing. This scales far better than one topology per VLAN.

Question 9Network design fundamentals

Which OSPF area design keeps a large campus stable by confining topology changes to a single area?

  1. A stub area connected to area 0
  2. An NSSA that imports external routes as type 7 LSAs
  3. A totally stubby area that blocks external and inter-area summaries Correct answer.
  4. A single backbone area with all routers

Explanation

A totally stubby area filters inter-area summaries and external LSAs, so routers inside rely on a default route and are insulated from external topology churn. This reduces LSDB size and SPF activity.

Question 10Network design fundamentals

A router running OSPF has interfaces in area 0 and area 1. Which LSA type does it generate for prefixes in area 1 when advertising them into area 0?

  1. Type 5 external LSA
  2. Type 1 router LSA
  3. Type 2 network LSA
  4. Type 3 summary LSA Correct answer.

Explanation

An ABR converts prefixes from one area into type 3 summary LSAs for other areas, including area 0. Type 1 and 2 LSAs stay within their originating area.

Question 11Network design fundamentals

Which EIGRP design practice improves scalability in a large hub-and-spoke network?

  1. Using route summarization at the hub toward the spokes Correct answer.
  2. Advertising all spoke subnets individually to every spoke
  3. Disabling split horizon on all hub interfaces
  4. Configuring equal metrics on every link

Explanation

Summarizing spoke routes at the hub reduces the number of prefixes advertised and limits query propagation, which improves EIGRP scalability. Manual summaries also create a natural query boundary.

Question 12Network design fundamentals

Which BGP design feature is most appropriate for a dual-homed enterprise that wants to influence inbound traffic toward one ISP link?

  1. AS-path prepending on the less preferred link Correct answer.
  2. Setting the local preference higher on the less preferred link
  3. Reducing the MED value on the less preferred link
  4. Advertising a default route to both providers

Explanation

AS-path prepending makes a path appear longer to external peers, discouraging inbound traffic from selecting that link. Local preference and MED primarily influence outbound or inter-AS choices in ways that may not affect remote ISPs.

Question 13Network design fundamentals

Why is a full mesh of IBGP sessions avoided in large networks?

  1. The number of sessions grows quadratically with the router count. Correct answer.
  2. It requires a route reflector cluster for every router.
  3. It prevents route reflection from functioning.
  4. It forces all peers into the same autonomous system.

Explanation

A full IBGP mesh requires n(n-1)/2 sessions, which becomes unmanageable as the router count grows. Route reflectors or confederations reduce the session count.

Question 14Network design fundamentals

A designer needs to connect two sites over a service provider that offers only Layer 3 VPN service. Which WAN technology fits best?

  1. Dark fiber with DWDM
  2. Point-to-point leased line
  3. MPLS Layer 3 VPN Correct answer.
  4. VPLS

Explanation

An MPLS Layer 3 VPN lets the provider route customer prefixes across a shared backbone, matching a Layer 3-only service offering. It scales to many sites without dedicated circuits.

Question 15Network design fundamentals

Which WAN design consideration most directly reduces the impact of a single provider outage for a branch that hosts latency-sensitive voice?

  1. Dual-homing to two providers with diverse physical paths Correct answer.
  2. Increasing the MTU on the primary circuit
  3. Adding a second VLAN on the branch access switch
  4. Using a single high-bandwidth circuit from one provider

Explanation

Dual-homing to two providers with physically diverse paths removes the single point of failure for WAN transport. Diversity matters because two circuits from one provider may share conduit or equipment.

Question 16Network design fundamentals

Which QoS model marks traffic at the access edge and then applies per-hop behavior based on those markings throughout the network?

  1. Integrated Services with RSVP
  2. Best-effort service
  3. Differentiated Services Correct answer.
  4. Overprovisioning only

Explanation

Differentiated Services classifies and marks packets at the edge, and each hop applies PHB treatment based on the DSCP value. It scales better than per-flow reservation.

Question 17Network design fundamentals

A designer wants voice traffic to receive priority treatment with strict queueing while preventing starvation of other classes. Which mechanism is appropriate?

  1. Weighted random early detection on all queues
  2. Low-latency queueing with a policer on the priority class Correct answer.
  3. FIFO queueing on the WAN interface
  4. Class-based weighted fair queueing with no priority queue

Explanation

LLQ provides a strict priority queue for voice, and a policer on that class caps its bandwidth so it cannot starve other queues. The remaining bandwidth is shared by class-based weighted fair queueing.

Question 18Network design fundamentals

Which address plan best supports route summarization at the distribution layer?

  1. Assigning each VLAN a subnet from a different major network
  2. Allocating contiguous address blocks to each distribution block Correct answer.
  3. Using a single flat subnet for the entire campus
  4. Assigning subnets randomly from the private space

Explanation

Contiguous allocation lets each distribution block advertise a single summary covering its access subnets. Random or scattered allocation defeats summarization and enlarges routing tables.

Question 19Network design fundamentals

An enterprise is planning IPv6 and wants to avoid manual renumbering when changing providers. Which approach is recommended?

  1. Use unique local addresses for all internal and internet-facing traffic
  2. Obtain provider-independent address space and advertise it through BGP Correct answer.
  3. Request provider-assigned global unicast space for each site
  4. Use link-local addresses for server subnets

Explanation

Provider-independent space lets the enterprise keep addresses when changing providers, with BGP advertising the prefix through the new provider. Provider-assigned space must be returned and renumbered on a provider change.

Question 20Network design fundamentals

Which statement about anycast in a network design is accurate?

  1. Anycast is limited to IPv4 and has no IPv6 equivalent.
  2. Anycast requires every node to share the same MAC address.
  3. Anycast requires a single unicast server to serve all requests.
  4. Anycast advertises the same prefix from multiple locations so clients reach the nearest instance. Correct answer.

Explanation

Anycast announces an identical prefix from several points of presence, and routing delivers each client to a topologically near instance. It is widely used for DNS and content delivery and works in IPv6 as well.

Question 21Network design fundamentals

A company wants to segment a data center so that policies follow workloads across racks without stretching Layer 2 between racks. Which design approach fits?

  1. A VXLAN EVPN overlay with distributed anycast gateways Correct answer.
  2. A large Layer 2 domain spanning all racks with STP
  3. A hub-and-spoke Layer 2 topology between racks
  4. A single VLAN per rack with no overlay

Explanation

VXLAN EVPN provides a Layer 3 underlay with an overlay that carries workload segments across racks, and distributed anycast gateways give consistent first-hop behavior. This avoids large STP domains.

Question 22Network design fundamentals

Which cloud connectivity option gives the most predictable latency and bandwidth between an on-premises data center and a public cloud provider?

  1. A dedicated private connection offered by the cloud provider Correct answer.
  2. A site-to-site IPsec tunnel over broadband
  3. A GRE tunnel over the internet
  4. Internet-based VPN tunnels

Explanation

A dedicated private connection bypasses the public internet and provides committed bandwidth with more predictable latency. Internet-based tunnels are subject to variable path conditions.

Question 23Network design fundamentals

Which element of a network design document captures assumptions, constraints, and dependencies that shape the solution?

  1. The design requirements section Correct answer.
  2. The bill of materials
  3. The implementation schedule
  4. The physical topology diagram

Explanation

The requirements section records business and technical requirements along with assumptions, constraints, and dependencies. These items justify design decisions and flag risks.

Question 24Network design fundamentals

During design validation, a designer models failure of the primary WAN link and checks that voice calls fail over within the required time. Which design activity is being performed?

  1. Configuration auditing
  2. Address allocation
  3. Failure-domain analysis Correct answer.
  4. Capacity planning

Explanation

Failure-domain analysis examines what happens when components fail and whether redundancy meets recovery objectives. Modeling link failure and measuring failover time is a direct example.

Question 25Network design fundamentals

A network must support multicast video to many branch receivers using a single distribution tree rooted at the source. Which PIM mode is designed for this?

  1. PIM source-specific mode Correct answer.
  2. PIM sparse mode with a shared tree only
  3. PIM bidirectional mode
  4. PIM dense mode

Explanation

PIM SSM builds a shortest-path tree directly from the receiver to the specified source, which suits one-to-many video from a known source. It avoids shared-tree rendezvous overhead.

Question 26Network design fundamentals

In a hierarchical campus design, which layer is responsible for providing default gateway services and enforcing policy on traffic entering the distribution block?

  1. The access layer
  2. The core layer
  3. The distribution layer Correct answer.
  4. The data center layer

Explanation

The distribution layer aggregates access switches, hosts the Layer 3 gateway (SVIs or routed ports), and applies policy through ACLs and route filtering. The access layer provides port density and edge services, while the core provides fast transport.

Question 27Network design fundamentals

Which Cisco Validated Design phase model organizes a network design project into Prepare, Plan, Design, Implement, Operate, and Optimize?

  1. The TOGAF architecture framework
  2. The OSI reference model
  3. The PPDIOO lifecycle Correct answer.
  4. The TCP/IP model

Explanation

PPDIOO is Cisco's network lifecycle framework, and it structures work from requirements gathering through optimization. It is commonly mapped onto design methodology phases in enterprise design work.

Question 28Network design fundamentals

A designer is choosing a routing protocol for a campus with many small branches and wants fast convergence with bounded query scope. Which design choice best limits EIGRP query propagation?

  1. Use unequal-cost load balancing on the hub
  2. Disable split horizon on hub interfaces
  3. Configure stub routing on branch routers Correct answer.
  4. Increase the EIGRP hello interval

Explanation

Stub routers advertise their status so that hubs do not query them for alternate paths, which bounds query scope and speeds convergence. Hello timers, split horizon, and variance affect other behaviors but do not confine queries.

Question 29Network design fundamentals

Which design principle most directly reduces the size of a failure domain in a Layer 2 campus?

  1. Keeping VLANs local to a single wiring closet or small block Correct answer.
  2. Using a flat Layer 2 topology with a single root bridge
  3. Extending a single VLAN across the entire campus
  4. Bridging all access switches into one management VLAN

Explanation

Confining a VLAN to a small physical area limits the blast radius of broadcast storms, STP topology changes, and Layer 2 loops. Large stretched VLANs enlarge the failure domain and complicate troubleshooting.

Question 30Network design fundamentals

An enterprise wants to summarize routes at the distribution layer toward the core. Which addressing practice supports this goal?

  1. Allocating contiguous address blocks per distribution block so a single prefix covers them Correct answer.
  2. Assigning addresses sequentially from one large pool across all buildings
  3. Assigning addresses from unrelated provider blocks per floor
  4. Using host routes for every access VLAN

Explanation

Summarization requires contiguous, hierarchically allocated address space so that a distribution block's subnets fall under one aggregate prefix. Sequential allocation across buildings and host routes prevent effective aggregation.

Question 31Network design fundamentals

Which statement describes the role of a Cisco FabricPath or VXLAN EVPN overlay in a data center design?

  1. It replaces spanning tree with a single large broadcast domain
  2. It eliminates the need for any routing protocol in the underlay
  3. It provides a Layer 3 control plane that enables Layer 2 extension over an IP underlay Correct answer.
  4. It requires all servers to share one VLAN across racks

Explanation

Overlay technologies such as VXLAN with EVPN use an IP underlay and a control plane to provide Layer 2 and Layer 3 services across racks without stretching broadcast domains. The underlay still requires routing for reachability.

Question 32Network design fundamentals

Which WAN design option best provides deterministic latency for a latency-sensitive trading application between two data centers?

  1. A 4G/LTE backup link
  2. A shared MPLS VPN with best-effort forwarding
  3. A dedicated point-to-point or private line circuit Correct answer.
  4. A broadband internet VPN

Explanation

A dedicated private circuit provides consistent bandwidth and low, predictable latency because it is not shared with other customers' traffic. Internet VPNs, shared MPLS, and wireless links introduce variable delay and contention.

Question 33Network design fundamentals

Which QoS marking approach is recommended at the trust boundary of an enterprise campus?

  1. Re-mark all traffic at the core to best effort
  2. Mark all traffic as EF to simplify configuration
  3. Rely on default DSCP values without classification
  4. Classify and mark traffic as close to the source as possible and trust markings only from known devices Correct answer.

Explanation

Classification and marking should occur at the edge, close to the source, and trust should be granted only to devices that mark correctly. Marking everything EF or defaulting to best effort defeats differentiated treatment.

Question 34Network design fundamentals

A designer needs to protect the control plane of a campus switch from excessive ARP and DHCP traffic. Which design technique is most appropriate?

  1. Increasing the ARP cache timeout globally
  2. Applying control plane policing with rate limits for those protocols Correct answer.
  3. Disabling DHCP snooping on all access ports
  4. Enabling proxy ARP on the core

Explanation

Control plane policing applies rate limits and policy to traffic destined for the switch CPU, protecting it from floods of ARP, DHCP, and similar protocols. Increasing timeouts or disabling snooping does not protect the control plane.

Question 35Network design fundamentals

Which statement about using anycast for DNS resolvers in an enterprise design is accurate?

  1. Anycast requires all nodes to share a single broadcast domain
  2. Multiple nodes advertise the same address and clients reach the topologically nearest instance Correct answer.
  3. Only one node may advertise the address at any time
  4. Anycast guarantees session state is preserved across nodes

Explanation

Anycast advertises the same prefix or address from multiple locations, and routing selects the nearest instance for each client. It does not preserve per-flow state across nodes, so it suits stateless services such as DNS.

Question 36Network design fundamentals

Which design element of a network design document typically captures assumptions, constraints, and dependencies?

  1. The physical cabling schedule
  2. The device configuration appendix
  3. The design requirements section Correct answer.
  4. The IP address allocation table

Explanation

Requirements documentation records business and technical requirements together with assumptions, constraints, and dependencies that bound the design. Cabling schedules, address tables, and configuration appendices are implementation artifacts.

Question 37Network design fundamentals

A designer is validating a design by modeling failure of the primary WAN link and checking voice failover within the SLA. Which activity does this represent?

  1. Capacity planning during implementation
  2. Baseline monitoring during optimization
  3. Failure analysis during design validation Correct answer.
  4. Configuration audit during operations

Explanation

Failure analysis tests the design against component or link failures to confirm that recovery meets requirements such as the voice SLA. Capacity planning, configuration audits, and monitoring address other lifecycle phases.

Question 38Network design fundamentals

Which multicast design approach uses a single shared distribution tree rooted at a rendezvous point?

  1. PIM Dense Mode
  2. Source-Specific Multicast
  3. Bidirectional PIM
  4. PIM Sparse Mode Correct answer.

Explanation

PIM Sparse Mode builds shared trees rooted at an RP and switches to shortest-path trees as needed. Dense Mode floods and prunes, SSM uses source trees, and Bidirectional PIM uses a shared tree with bidirectional forwarding but is not the general SM description.

Question 39Network design fundamentals

Which design consideration most directly supports high availability at the campus core?

  1. Deploying redundant core switches with redundant links and fast convergence Correct answer.
  2. Relying on a single uplink from each distribution block
  3. Using a single high-capacity core switch
  4. Disabling routing protocols to reduce CPU load

Explanation

Core high availability requires redundant devices and links combined with fast-converging protocols so that a single failure does not isolate distribution blocks. Single devices, single uplinks, and disabled routing all reduce resilience.

Question 40Network design fundamentals

A designer must connect two sites over a service provider that offers only Layer 3 VPN service. Which WAN technology is most appropriate?

  1. MPLS Layer 3 VPN Correct answer.
  2. Dark fiber
  3. VPLS
  4. Metro Ethernet E-Line

Explanation

An MPLS Layer 3 VPN lets the provider carry customer routing information and deliver a routed service, which matches a Layer 3-only offering. E-Line, dark fiber, and VPLS provide Layer 2 connectivity.

Question 41Network design fundamentals

Which technique best supports a design that must preserve application policies when workloads move between racks without stretching Layer 2?

  1. Extending a single VLAN across all racks
  2. Using a flat Layer 2 domain with one spanning tree
  3. Bridging racks with a single access switch
  4. Using a VXLAN EVPN overlay with distributed anycast gateways Correct answer.

Explanation

A VXLAN EVPN overlay with distributed anycast gateways lets workloads keep their addresses and policies when they move while avoiding Layer 2 stretching. Flat Layer 2 domains and single switches increase failure scope.

Question 42Network design fundamentals

Which cloud connectivity option gives the most predictable latency and bandwidth between an on-premises data center and a public cloud?

  1. A consumer broadband link
  2. A site-to-site VPN over the public internet
  3. A shared internet exchange peering
  4. A dedicated private connection to the cloud provider Correct answer.

Explanation

A dedicated private connection avoids public internet variability and provides committed bandwidth and latency characteristics. Internet VPNs, broadband, and shared peering all introduce variable paths and contention.

Question 43Network design fundamentals

Which statement describes the purpose of a design's logical topology diagram?

  1. It shows addressing, routing domains, and device roles independent of physical location Correct answer.
  2. It documents cable lengths and patch panel assignments
  3. It lists device serial numbers and support contracts
  4. It records power and cooling requirements for the equipment room

Explanation

A logical topology diagram conveys addressing, routing domains, and functional device roles without being tied to physical placement. Cable schedules, asset inventories, and facility requirements belong to other documents.

Question 44Network design fundamentals

Which design approach best limits the scope of a routing failure in a large enterprise that uses a single routing protocol?

  1. Advertising host routes between sites
  2. Redistributing all routes at every site
  3. Running one flat area across all sites
  4. Dividing the network into areas or domains with summarization at boundaries Correct answer.

Explanation

Hierarchical areas or domains with summarization at boundaries confine topology changes and reduce routing table size. A flat area, widespread redistribution, and host routes propagate instability.

Question 45Network design fundamentals

Which IPv6 design practice supports provider-independent addressing and simpler renumbering?

  1. Requesting a provider-independent prefix and advertising it through the chosen providers Correct answer.
  2. Assigning link-local addresses to all server interfaces
  3. Using the provider-assigned prefix on all internal links
  4. Embedding the provider AS number in every subnet

Explanation

A provider-independent prefix lets an enterprise change providers without renumbering internal networks. Provider-assigned prefixes and provider-embedded addressing complicate transitions.

Question 46Network design fundamentals

Which design recommendation best protects a campus from a rogue DHCP server on an access port?

  1. Removing the IP helper address from all SVIs
  2. Allowing all access ports to act as DHCP servers
  3. Enabling DHCP snooping with trusted uplink ports Correct answer.
  4. Disabling DHCP relay on the distribution switch

Explanation

DHCP snooping designates trusted ports toward legitimate servers and blocks server messages from untrusted access ports. Disabling relay or helper addresses would break client addressing rather than secure it.

Question 47Network design fundamentals

Which statement about designing a network for strict priority queueing of voice traffic is accurate?

  1. All traffic should be marked EF to guarantee priority
  2. A policer should limit voice to its engineered rate so other queues are not starved Correct answer.
  3. Voice queues should have no bandwidth reservation
  4. Voice should be placed in the default queue to simplify configuration

Explanation

Strict priority queueing can starve other classes if the priority class is unbounded, so a policer limits voice to its engineered rate. Default queueing, marking everything EF, and no reservation all defeat the design.

Question 48Network design fundamentals

A designer is comparing a two-tier collapsed core design with a three-tier design for a large campus. Which factor most strongly favors the three-tier design?

  1. A single wiring closet with no growth expected
  2. A small building with fewer than 50 users
  3. A requirement to minimize the number of devices
  4. A need to scale to many distribution blocks with a dedicated core for high-speed transport Correct answer.

Explanation

A dedicated core tier scales better when many distribution blocks must interconnect at high speed and policy should stay at distribution. Small sites and minimal-device goals favor collapsed designs.

Question 49Network design fundamentals

Which design element is most important when planning an out-of-band management network for campus devices?

  1. Sharing management addresses with user subnets
  2. A separate management VLAN or network reachable independently of the production data path Correct answer.
  3. Using the production data VLAN for all management traffic
  4. Relying on console access only for all devices

Explanation

Out-of-band management should be reachable independently of the production forwarding path so devices remain manageable during data plane failures. Sharing user subnets or relying only on consoles undermines that independence.

Question 50Network design fundamentals

A designer is evaluating a design where all branch sites connect to a single hub with no diverse paths. Which risk analysis conclusion is most accurate?

  1. The design eliminates the need for backup links
  2. The design provides inherent path diversity
  3. The design guarantees sub-second convergence
  4. The hub and its circuits are single points of failure for all branches Correct answer.

Explanation

A single hub with no diverse paths concentrates all branch connectivity into shared components, making the hub and its circuits single points of failure. The design provides no inherent diversity or convergence guarantee.