View 300-420 Exam Questions

Q: 1

Which feature of Cisco SD-WAN Secure Direct Cloud Access divides user traffic into different zones and VPNs or VRFs?

Options

Discussion

Amelia Y. Mar 3, 2026 5:55 pm

B. but if the question was about traffic routing and not zones/VRFs, D could technically fit.

Sean C. Feb 28, 2026 4:09 am

My vote is it's B, since secure segmentation is what actually creates separate zones or VRFs for user traffic in SD-WAN. Application-aware routing (D) just directs flows by app, doesn't segment like B. Open if anyone disagrees.

PiyaM Feb 14, 2026 10:16 am

B tbh

Ryan Mar 3, 2026 2:27 am

Probably B. Secure segmentation is what actually splits up traffic into separate zones/VRFs in SD-WAN, not centralized policy (A) or application-aware routing (D). D is just for picking links based on app type, doesn't actually split the topology. Trap for people who mix those up. Pretty sure from similar question on a practice test.

Chloe B. Mar 5, 2026 7:43 am

Seen this on some practice exams, official guide also points to B.

Hannah N. Feb 19, 2026 5:27 am

Adam B. Feb 22, 2026 5:00 am

D or maybe C. Sounds like app-aware could handle it but not totally sure.

Sara J. Feb 22, 2026 11:35 pm

B tbh

Mia Mar 6, 2026 10:10 pm

Maybe D, since application-aware routing could send traffic on different VPNs based on app but not totally sure.

Owen M. Feb 18, 2026 8:21 am

For me, D, since application-awareness routing sounds like it could steer traffic into different VPNs depending on the app requirements. Not 100% though-could be overthinking it and missing something about segmentation. Anyone else see app-aware routing dividing traffic that way?

Be respectful. No spam.

Q: 2

What is one function of the vSmart controller in an SD-WAN deployment?

Options

Discussion

Ajay Q. Feb 22, 2026 4:14 pm

Almost certain it's A. Saw a similar question on a practice exam and vSmart was described as handling orchestration between devices.

Jamie M. Mar 5, 2026 8:11 pm

Its B, but I keep seeing this get mixed with A in some exam reports so maybe check the official Cisco guide for SD-WAN role definitions. Practice test questions sometimes phrase it weird.

Sara Feb 27, 2026 2:41 am

A feels close to me since vSmart does take part in orchestrating device connectivity, especially during onboarding of vEdge/cEdge routers. Pretty sure that's a key function early on. Though I know the official answer is B, just see a lot of overlap with A if we're not being super strict on wording. Anyone else think A could work here if you focus on orchestration?

Chloe Mar 1, 2026 3:37 pm

B . If they asked about data plane at branch, D would fit, but since it's centralized control, B makes sense here.

Ben Feb 21, 2026 11:07 pm

B here. Seen similar on practice and official guides, vSmart is all about centralized control plane, not GUI management. If you want to drill deeper on SD-WAN roles, Cisco's documentation and legit lab work help clear up device responsibilities. Pretty sure that's the intent but open to corrections.

Noah Mar 3, 2026 2:49 pm

A , since vSmart does orchestration between cEdge and vEdge for connectivity if you get technical about it.

Olivia Feb 25, 2026 11:56 am

B vs A, but B is right. Centralized control plane is vSmart's job, not orchestration like A hints.

Adam D. Mar 6, 2026 8:43 pm

Definitely B for vSmart, it handles the control plane in SD-WAN. Not seeing any reason to pick A or C here.

RaviQ Feb 23, 2026 7:21 am

B , vSmart is all about the control plane, not orchestration like A tries to hint.

Olivia Feb 24, 2026 8:52 am

Its A. I figured vSmart helps orchestrate connectivity between vEdge and cEdge devices, so that fits. Pretty sure vManage is for the GUI stuff and control plane is more advanced than just setting up connections. Correct me if I'm mixing things up.

Be respectful. No spam.

Q: 3

An architect must address sustained congestion on the access and distribution uplink of network. QoS has already been implemented and optimized, but it is no longer effective in ensuring optimal network performance. Which two solutions should the architect use to improver network performance? (Choose two)

Options

Discussion

Logan W. Feb 18, 2026 4:10 am

B E imo. C and D might look tempting but if QoS is already maxed, adding more bandwidth isn't always possible in the scenario. B and E work to better manage congestion left over. Anyone see this on a recent practice?

Kevin N. Feb 17, 2026 12:14 pm

B tbh

Casey Q. Mar 3, 2026 7:38 am

Interesting take, but I gotta say B and E. With QoS maxed out, managing drops using RED and selective discard makes sense here. Not 100% but leaning that way.

PiyaL Feb 16, 2026 12:08 am

Pretty sure it's B and E. Had something like this in a mock, where after QoS is fully optimized and congestion's still an issue, solutions like RED (B) and selective packet discard (E) are more about managing which traffic gets dropped gracefully. C and D would be ideal if physical upgrades are possible but the scenario hints those aren't options here. Agree?

Alex Mar 5, 2026 7:59 am

C or D, honestly. In real practice, adding uplinks (C/D) tends to solve congestion outright compared to just tweaking packet drop methods like B/E. Maybe B is a distractor since RED helps in some cases, but not when links are maxed out.

Logan T. Feb 16, 2026 3:33 pm

B E

Luna I. Feb 19, 2026 3:02 am

B imo and E. D looks like a trap since the question focuses on congestion when QoS is already tuned.

Mia Feb 18, 2026 12:26 pm

Option B and E. D’s tempting but exam guides usually call out RED and selective discard for this exact situation.

EmmaO Feb 15, 2026 1:55 am

I think C and D since adding more uplinks or increasing speed should help more in this scenario.

Rowan A. Feb 25, 2026 3:50 pm

C/D? If QoS is maxed out, usually the next step is to increase physical bandwidth, so higher-speed uplinks or EtherChannel aggregation (C and D). B sounds like a trap since RED doesn’t fix sustained congestion. Disagree?

Be respectful. No spam.

Q: 4

Refer to the exhibit. C0FD9

F48C9ACDC725EA850EC2476EE1E An architect must design a solution that uses the direct link between R1 and R2 for traffic from 10.10.10.0/24 toward network 10.10.20.0/24. Which solution should the architect include in the design?

Options

Discussion

Riley A. Feb 26, 2026 6:31 am

My pick: A. OSPF always prefers the route with the lowest cost, so setting a lower cost on the direct link makes sure it gets used. B is a trap-admin distance isn't per-area in OSPF. Chime in if I'm off here.

Karan I. Feb 24, 2026 5:59 am

Call it A, but that only works if no route summarization or route filtering interferes along the path.

Neha W. Feb 25, 2026 4:31 pm

Honestly a bit confused here. Looks like A is right since OSPF uses the lowest cost path, so if you lower the cost on that direct link it'll prefer it over others. Not 100% sure if I'm missing something about multi-area adjacencies but none of the other options seem to fit as well for standard OSPF path selection. Anyone else see it differently?

Maya Feb 14, 2026 5:51 pm

D . Multiarea adjacency (D) could create a more direct routing path between R1 and R2, assuming the topology supports it. I think it helps in some scenarios, but not 100 percent sure here.

Nora M. Feb 25, 2026 6:21 am

A or maybe D. OSPF cost tweaking (A) is the quick fix since it directly affects path selection, but sometimes I've seen design scenarios in the official guide where multiarea adjacency (D) gets considered for more complex topologies. If you want to be sure, double check the diagrams and compare with the practice labs.

Robin R. Mar 4, 2026 12:25 am

C is a bit much for this scenario. Lowering the OSPF cost on the direct link (A) gets you where you need to be since OSPF chooses lowest-cost paths. Pretty sure that's all they're looking for here.

Grace Feb 28, 2026 8:13 am

I don't think B is right, A makes more sense. OSPF doesn't let you adjust admin distance by area, but lowering the cost on the direct link will force OSPF to pick that path. Pretty sure that's what they want here, though open to other readings.

Adam P. Mar 3, 2026 12:27 am

Nah, D is a distractor here-OSPF always uses the lowest cost for path selection. A.

Kevin Feb 21, 2026 3:53 am

A imo, because the cost metric always wins in OSPF unless there's an odd redistribution scenario.

Be respectful. No spam.

Q: 5

Refer to the exhibit.

Refer to the exhibit. The connection between SW2 and SW3 is fiber and occasionally experiences unidirectional link failure. An architect must optimize the network to reduce the change of layer2 forwarding loops when the link fails. Which solution should the architect include?

Options

Discussion

Adam C. Feb 24, 2026 4:21 am

Hard to say, it's B for this one. Loop guard on SW2 is the classic solution for unidirectional link issues and stops L2 loops if BPDUs are lost on fiber. Official guide and practice labs cover this scenario too, worth reviewing those if you want extra confirmation.

MasonT Feb 25, 2026 3:36 pm

If the issue is unidirectional fiber failure, I'd actually pick D. Root guard on SW1 could stop another device from becoming root due to a weird STP state, especially if SW2/3 lose BPDUs one way. Pretty sure, but maybe I'm missing something about SW2 being the better spot?

Owen A. Mar 2, 2026 6:55 pm

C BPDU guard is tempting here since it's for loop prevention, but I think that's more about rogue BPDUs than fiber issues.

Riley Feb 15, 2026 2:59 am

C. not B. BPDU guard is usually good for stopping loops if a device starts sending BPDUs unexpectedly, especially at the edge. Unidirectional fiber is tricky though.

Jordan K. Mar 6, 2026 4:36 am

B , had something like this in a mock and it matched loop guard on SW2.

Amelia Feb 20, 2026 8:41 am

Loop guard on SW2 helps with these unidirectional fiber failures because it stops ports from going to forwarding if BPDUs are missing. So B fits best here. I've seen the official guides and labs suggest this approach.

RileyU Feb 17, 2026 3:04 pm

Ugh, Cisco loves to test you with these unidirectional fiber scenarios. Probably B, since loop guard on SW2 will actually catch the lack of incoming BPDUs and block the port, which stops the forwarding loop. Root guard (D) is good for rogue root prevention but not really the fix here. Pretty sure that's what official exam guides match too.

Ravi X. Feb 26, 2026 5:12 pm

I don’t think it’s B. D would be better since root guard on SW1 could prevent another switch from taking over as root, especially if there’s a one-way BPDU loss. That could help avoid unexpected STP changes if the fiber acts up. Pretty sure, but open to being proven wrong.

Aaron P. Feb 22, 2026 11:03 am

B tbh, loop guard on SW2 is what you want with unidirectional fiber problems. Root guard (D) is more for keeping the right root bridge and stopping rogue devices, but it won't handle this specific loop risk from link failure. Seen similar questions in practice.

Jason P. Mar 4, 2026 8:40 pm

D imo, since root guard on SW1 could help prevent a rogue switch from claiming root and changing the spanning tree. I thought that's useful for stopping certain L2 loops if someone plugs in unexpected gear. Might be missing something specific about fiber unidirectional fails though.

Be respectful. No spam.

Q: 6

An enterprise customer has these requirements: end-to-end QoS for the business-critical applications and VoIP services based on CoS marking. flexibility to offer services such as IPv6 and multicast without any reliance on the service provider. support for full-mesh connectivity at Layer 2. Which WAN connectivity option meets these requirements?

Options

Discussion

Ivy D. Feb 24, 2026 11:38 pm

Casey G. Mar 6, 2026 4:59 am

D imo. C looks tempting but DMVPN is L3 mesh only, VPLS is the only option matching end-to-end QoS with full-mesh at Layer 2. Trap for those missing the L2 part, agree?

Mia N. Feb 18, 2026 1:47 pm

What if "no reliance on the service provider" actually means running your own WAN? Wouldn’t C then make more sense?

Sofia Feb 25, 2026 12:26 am

I don’t see how C works here, since DMVPN doesn’t do full-mesh Layer 2. D fits the requirements best, even though "no reliance" is a bit tricky. The trap is thinking DMVPN covers L2 full-mesh just because it’s flexible.

Ryan Feb 20, 2026 1:13 pm

A is wrong, D. VPLS gives you full-mesh Layer 2 and supports QoS and multicast, which matches everything they're asking for.

Jamie Feb 17, 2026 10:45 am

C/D? C (DMVPN) is tempting since it's flexible and doesn't depend on the provider, but the full-mesh L2 part really points to D (VPLS). CoS and multicast are also strong VPLS capabilities. I think some might pick C by mistake since DMVPN gets hyped for WAN flexibility, but VPLS checks every box here. Disagree?

Alex T. Mar 5, 2026 12:15 pm

C or D? DMVPN can do full-mesh L2 too, but I'm thinking C since VPLS usually needs provider config for some features.

Amelia Feb 28, 2026 3:30 am

Its D because VPLS is designed for full-mesh L2 connectivity and supports QoS with CoS markings, which matches the requirements. DMVPN is flexible but works at Layer 3, not true L2 mesh. I'm pretty sure about D but open if anyone thinks otherwise.

Jamie C. Feb 14, 2026 10:22 am

C or D for me. DMVPN (C) gives you flexibility, supports IPv6 and multicast, and you don't need to rely on the provider for L2/L3 VPN services. But not sure about full-mesh at true Layer 2 with it, which makes D tempting. Anyone else see this tested as C in practice questions?

Jack Feb 20, 2026 12:12 pm

Its D for VPLS. Official study material and practice labs usually highlight VPLS as the only one here supporting Layer 2 full-mesh with QoS end-to-end. Pretty sure that fits all the listed requirements.

Be respectful. No spam.

Q: 7

Which routes does the overlay management protocol advertise in an SD-WAN overlay?

Options

Discussion

Ravi D. Feb 23, 2026 2:24 pm

C tbh, prefix, TLOC, and service routes are what vSmart advertises. B is a common trap here.

Alex Y. Feb 18, 2026 1:33 am

Seen this type in some exam reports, it's always C.

Liam W. Feb 20, 2026 8:09 pm

C. that's what vSmart advertises (prefix, TLOC, service). Pretty sure here but let me know if you see it differently.

SteadyDev4301 Mar 2, 2026 2:07 pm

I don’t think it’s C. B looks more like it since primary, backup, and load-balanced are the route types you’d see for SD-WAN overlays managing active paths. Could be off though if they mean something more specific.

Kevin Feb 18, 2026 2:40 pm

Option C

Jason P. Mar 2, 2026 2:19 pm

I don't think it's B here. Prefix, TLOC, and service (C) are the specific route types vSmart advertises in an SD-WAN overlay, not just connection statuses like primary or backup. B is a classic mix-up with operational roles, not route types. Anyone see a case where B would make sense?

Ben T. Mar 3, 2026 1:32 am

Seen similar SD-WAN overlay protocol questions on practice exams, always comes up as C.

CaseyC Feb 20, 2026 3:37 pm

Its B, not totally sure but primary, backup, and load-balanced seem like the types advertised with SD-WAN overlays.

Riley Mar 6, 2026 1:00 pm

A is wrong, C. Prefix, TLOC, and service routes are what you see in SD-WAN overlays, not underlay or transport types. I think that's correct but tell me if I'm missing something.

Karan Mar 1, 2026 2:57 pm

Cisco changes terminology every blueprint, why can't they just be clear? Which protocol are they even hinting at here?

Be respectful. No spam.

Q: 8

How is internet access provided to a WAN edge router that is connected to a MPLS transport link?

Options

Discussion

AveryD Feb 23, 2026 10:39 am

C/D? MPLS alone can't give internet access so extranet (C) looks tempting, but Cisco exams want SD-WAN TLOC extension (D). Pretty sure D is the expected answer, C is a bit of a trap.

Sofia Mar 3, 2026 7:05 pm

B is what I picked. MPLS-only edge routers usually need local internet like 4G/5G or a broadband link for direct access, right? D feels too SD-WAN-specific but maybe I missed some nuance. Open to other takes.

Chloe S. Feb 14, 2026 1:41 pm

Option D, saw something similar on a practice test. TLOC extensions are the Cisco SD-WAN way here.

Olivia G. Feb 20, 2026 4:40 pm

D imo, lots of practice exams highlight TLOC extension for SD-WAN so I'd check official guide too.

JamieQ Feb 26, 2026 7:14 am

Option B seems right to me because you can just give the WAN edge router a direct internet circuit alongside MPLS. Not 100% sure though, since Cisco loves to ask about SD-WAN TLOC stuff. Agree?

QuinnH Mar 4, 2026 3:17 am

B isn't right for vEdge and MPLS, D. Saw similar in exam reports.

Ava U. Feb 25, 2026 1:50 am

Its B

Adam Y. Feb 25, 2026 6:02 pm

Maybe D, saw something like this in a practice test. Confident TLOC extensions handle this scenario.

Luke F. Feb 14, 2026 6:21 pm

Probably D here. TLOC extension lets a WAN Edge on MPLS reach the internet through another router's direct internet link, so you don't actually need a local circuit at every site. B trips people up because it sounds logical, but that's not always the case with SD-WAN designs. I think D fits best, unless I’m missing something subtle.

Robin A. Mar 1, 2026 1:10 pm

Its B

Be respectful. No spam.

Q: 9

Which component is part of the Cisco SD-Access overlay architecture?

Options

Discussion

Rowan D. Feb 21, 2026 12:19 pm

Option D Cisco DNA Center is the overlay controller piece here. Seen that in official guides and labs.

Morgan Feb 16, 2026 4:40 am

Not B, it's D. DNA Center does the real overlay orchestration and policy stuff in SD-Access, it's not just about who forwards VXLAN. Pretty sure that's what Cisco wants here, even if it's a bit confusing.

DirectMentor2853 Feb 20, 2026 2:03 am

B , I figured spine node since it handles VXLAN traffic in the overlay. Maybe that's a trick though, since sometimes "component" means controller too, but on tech diagrams spines look core to the overlay piece.

Nathan N. Mar 5, 2026 3:32 am

C or D here. DNA Center (D) is usually seen as the brains of the overlay, handling automation and policy, but sometimes Cisco test questions blur that with network nodes like border or spine (C/B). I think D fits best if they're focusing on overlay architecture from a management perspective, but not 100% sure. Anyone pick C for a reason?

Cameron S. Feb 17, 2026 10:27 am

LiamS Mar 3, 2026 12:08 pm

D, DNA Center is the overlay controller, not underlay hardware like border/spine/leaf. Pretty sure that's what Cisco asks for.

Luke F. Mar 6, 2026 12:36 am

D , Cisco DNA Center is part of the overlay and manages policy/automation. Border, spine, and leaf nodes are underlay components in SD-Access. Seen similar wording in practice, open to other views if I missed something.

Ajay H. Mar 6, 2026 4:08 am

Its B. Had something like this in a mock and pretty sure the overlay uses spine/leaf too.

Chloe Feb 18, 2026 4:11 am

D makes sense since DNA Center orchestrates the SD-Access overlay and manages control/policy planes, not just forwarding traffic. The overlays in Cisco docs always include DNA Center as a core component, pretty sure that's what they're after here. Anyone disagree?

Owen W. Mar 3, 2026 3:09 am

Are they considering DNA Center (D) as part of the overlay itself, not just as a controller? Usually, overlay architecture points to devices handling actual VXLAN traffic, like spines or borders. Not fully clear from the wording.

Be respectful. No spam.

Q: 10

Refer to the exhibit.

Refer to the exhibit. An architect reviews the low-level design of a company's enterprise network and advises optimizing the STP convergence time. Which functionality must be to Gi1/0/1-10 to follow the architect's recommendation?

Options

Discussion

SkylerB Mar 5, 2026 5:43 pm

Option A makes sense here. PortFast speeds up STP convergence on access ports by moving them directly to forwarding state. Not sure about uplinks, but for regular user ports this is pretty much required. Someone correct me if I’m missing a catch.

Ethan K. Feb 17, 2026 7:52 pm

Probably A here. PortFast is all about speeding up STP convergence for access ports, which matches the goal. If you want to double-check, Cisco's official guide and some lab practice on PortFast really help clear this up. Always open to a second opinion if I missed something.

Mason L. Feb 27, 2026 8:24 pm

Likely I ran into a similar one in exam. on a practice test and it was A.

Adam M. Feb 28, 2026 1:50 pm

C or A. I get why people say PortFast (A) since that's the classic STP tweak for quick convergence on access ports, but if those interfaces are acting as uplinks, UplinkFast (C) might fit too. Kinda depends how those Gi1/0/1-10 are being used on the diagram. I think it's A, but wouldn't be shocked by C if they're uplink connections.

Maya Q. Feb 27, 2026 11:04 pm

A for sure. PortFast moves access ports to forwarding really fast, which is what you want for convergence. Not seeing how B or D would fit unless the goal was security over speed.

Ava Feb 24, 2026 3:08 pm

Probably A, since PortFast gets access ports out of blocking state almost instantly and that's what you want for fast convergence. C (UplinkFast) is for non-root switch uplinks, not regular server/user ports. Seen similar wording on exam reports too, pretty sure it's A but open if anyone sees something in the diagram I missed.

Parker Y. Feb 16, 2026 1:48 am

If those Gi1/0/1-10 are trunk ports and not access, wouldn't C actually be the right call here?

Sean C. Feb 21, 2026 5:32 pm

A , PortFast is meant for speeding up STP on access ports. C is tempting but mainly for uplinks, so feels like a trap.

Chloe Mar 3, 2026 2:05 pm

Probably A for PortFast. That speeds up STP convergence on access ports because they skip the listening/learning states. If those Gi1/0/1-10 are access, this is the way to go, I think. Let me know if you see something else.

Rowan V. Feb 24, 2026 9:30 am

Not B here, PortFast is what actually improves STP convergence time. Root guard’s for role protection, not speed.

Be respectful. No spam.

Question 1 of 20 · Page 1 / 2

Premium Access Includes

✓ Quiz Simulator
✓ Exam Mode
✓ Progress Tracking
✓ Question Saving
✓ Flash Cards
✓ Drag & Drops
✓ 3 Months Access
✓ PDF Downloads

Get Premium Access

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE