Free 300-420 Practice Test Questions and Answers (2026)

Last Update Check
View Mode
Q: 1
Which feature of Cisco SD-WAN Secure Direct Cloud Access divides user traffic into different zones and VPNs or VRFs?
Options
24 comments in the community discussion
2
B. but if the question was about traffic routing and not zones/VRFs, D could technically fit.
1
My vote is it's B, since secure segmentation is what actually creates separate zones or VRFs for user traffic in SD-WAN. Application-aware routing (D) just directs flows by app, doesn't segment like B. Open if anyone disagrees.
Q: 2
What is one function of the vSmart controller in an SD-WAN deployment?
Options
26 comments in the community discussion
1
Almost certain it's A. Saw a similar question on a practice exam and vSmart was described as handling orchestration between devices.
1
Its B, but I keep seeing this get mixed with A in some exam reports so maybe check the official Cisco guide for SD-WAN role definitions. Practice test questions sometimes phrase it weird.
Q: 3
An architect must address sustained congestion on the access and distribution uplink of network. QoS has already been implemented and optimized, but it is no longer effective in ensuring optimal network performance. Which two solutions should the architect use to improver network performance? (Choose two)
Options
18 comments in the community discussion
1
B E imo. C and D might look tempting but if QoS is already maxed, adding more bandwidth isn't always possible in the scenario. B and E work to better manage congestion left over. Anyone see this on a recent practice?
1
B tbh
Q: 4
Refer to the exhibit. C0FD9 CISCO 300-420 question F48C9ACDC725EA850EC2476EE1E An architect must design a solution that uses the direct link between R1 and R2 for traffic from 10.10.10.0/24 toward network 10.10.20.0/24. Which solution should the architect include in the design?
Options
20 comments in the community discussion
5
My pick: A. OSPF always prefers the route with the lowest cost, so setting a lower cost on the direct link makes sure it gets used. B is a trap-admin distance isn't per-area in OSPF. Chime in if I'm off here.
1
Call it A, but that only works if no route summarization or route filtering interferes along the path.
Q: 5
Refer to the exhibit. CISCO 300-420 question Refer to the exhibit. The connection between SW2 and SW3 is fiber and occasionally experiences unidirectional link failure. An architect must optimize the network to reduce the change of layer2 forwarding loops when the link fails. Which solution should the architect include?
Options
33 comments in the community discussion
1
Hard to say, it's B for this one. Loop guard on SW2 is the classic solution for unidirectional link issues and stops L2 loops if BPDUs are lost on fiber. Official guide and practice labs cover this scenario too, worth reviewing those if you want extra confirmation.
1
If the issue is unidirectional fiber failure, I'd actually pick D. Root guard on SW1 could stop another device from becoming root due to a weird STP state, especially if SW2/3 lose BPDUs one way. Pretty sure, but maybe I'm missing something about SW2 being the better spot?
Q: 6

An enterprise customer has these requirements: end-to-end QoS for the business-critical applications and VoIP services based on CoS marking. flexibility to offer services such as IPv6 and multicast without any reliance on the service provider. support for full-mesh connectivity at Layer 2. Which WAN connectivity option meets these requirements?

Options
41 comments in the community discussion
1
C
1
D imo. C looks tempting but DMVPN is L3 mesh only, VPLS is the only option matching end-to-end QoS with full-mesh at Layer 2. Trap for those missing the L2 part, agree?
Q: 7

Which routes does the overlay management protocol advertise in an SD-WAN overlay?

Options
26 comments in the community discussion
1
C tbh, prefix, TLOC, and service routes are what vSmart advertises. B is a common trap here.
Seen this type in some exam reports, it's always C.
Q: 8

How is internet access provided to a WAN edge router that is connected to a MPLS transport link?

Options
35 comments in the community discussion
2
C/D? MPLS alone can't give internet access so extranet (C) looks tempting, but Cisco exams want SD-WAN TLOC extension (D). Pretty sure D is the expected answer, C is a bit of a trap.
1
B is what I picked. MPLS-only edge routers usually need local internet like 4G/5G or a broadband link for direct access, right? D feels too SD-WAN-specific but maybe I missed some nuance. Open to other takes.
Q: 9
Which component is part of the Cisco SD-Access overlay architecture?
Options
34 comments in the community discussion
4
Option D Cisco DNA Center is the overlay controller piece here. Seen that in official guides and labs.
1
Not B, it's D. DNA Center does the real overlay orchestration and policy stuff in SD-Access, it's not just about who forwards VXLAN. Pretty sure that's what Cisco wants here, even if it's a bit confusing.
Q: 10
Refer to the exhibit. CISCO 300-420 question Refer to the exhibit. An architect reviews the low-level design of a company's enterprise network and advises optimizing the STP convergence time. Which functionality must be to Gi1/0/1-10 to follow the architect's recommendation?
Options
27 comments in the community discussion
4
Option A makes sense here. PortFast speeds up STP convergence on access ports by moving them directly to forwarding state. Not sure about uplinks, but for regular user ports this is pretty much required. Someone correct me if I’m missing a catch.
2
Probably A here. PortFast is all about speeding up STP convergence for access ports, which matches the goal. If you want to double-check, Cisco's official guide and some lab practice on PortFast really help clear this up. Always open to a second opinion if I missed something.
Q: 11

Refer to the exhibit. CISCO 300-420 question Which solution decreases the EIGRP convergence time?

Options
8 comments in the community discussion
1
Option D makes sense here. Enabling stub routing on spokes simplifies EIGRP queries and reduces convergence time since fewer routers have to respond to network changes. Pretty sure that's the core idea from the official guide, though happy to hear another angle.
1
Ugh, Cisco loves to throw these EIGRP timer questions. I'd go with B here because increasing the hold time should give neighbors more time before considering each other down, which I think helps with stability. Not totally sure though, anyone else see it this way?
Q: 12

Which NETCONF operation creates filtering that is specific to the session notifications?

Options
7 comments in the community discussion
C vs A. Encountered exactly similar question in my exam, pretty sure it's A.
Q: 13

DRAG DROP Drag and drop the characteristics from the left onto the correct telemetry mode on the right. CISCO 300-420 question

Drag & Drop
7 comments in the community discussion
4
Makes sense to pair Dial-In with 'collector initiates to device' and gRPC only, Dial-Out gets 'device initiates' plus multiple protocols.
1
That's how I mapped it too: Dial-In gets 'collector initiates' plus 'gRPC only,' and Dial-Out gets 'supports TCP, UDP, and gRPC' with 'device initiates.' Pretty sure that's what Cisco expects. Let me know if you see it differently.
Q: 14

DRAG DROP Drag and drop the properties from the left onto the protocols they describe on the right. CISCO 300-420 question

Drag & Drop
8 comments in the community discussion
7
NETCONF: SSH-based, built to support candidate configuration. RESTCONF: HTTPS-based, lacks support for two-phase commit transactions.
4
HTTPS-based → RESTCONF, SSH-based → NETCONF, candidate config → NETCONF, lacks two-phase commit → RESTCONF
Q: 15

DRAG DROP Drag and drop the properties from the left onto the Cisco SD-WAN components that perform them on the right. CISCO 300-420 question

Drag & Drop
5 comments in the community discussion
6
vSmart handles both fabric discovery and control plane, vBond is for orchestration, and WAN Edge does ZTP. That's what Cisco recommends, fits with how management and onboarding work. Pretty sure this is right but let me know if you see it different.
2
vSmart: fabric discovery, control plane. vBond: orchestration. WAN Edge: zero-touch provisioning.Seen similar on practice-if vBond loses connectivity, ZTP fails and orchestration can't happen. vSmart never does ZTP so careful not to mix those.
Q: 16

DRAG DROP An engineer must design an addressing plan for a small business using a single /24 network. Each department must have its own subnet. Drag and drop the subnets from the left onto the departments requirements that they fulfill on the right. Not all options are used. 300-420: Designing Cisco Enterprise Networks (ENSLD) → 300 ...

Drag & Drop
7 comments in the community discussion
2
Saw a similar subnetting question on official practice. Mapping is HR -> 10.1.1.112/29, Facilities -> 10.1.1.16/27, Engineering -> 10.1.1.96/26, Finance -> 10.1.1.96/28.
2
Looks like it should beHR: 10.1.1.112/29, Facilities: 10.1.1.16/27, Engineering: 10.1.1.96/26, Finance: 10.1.1.96/28
Q: 17

Which two border nodes are available in the Cisco SD-Access architecture? (Choose two.)

Options
5 comments in the community discussion
7
Pretty sure it's C and D, those match the roles defined for SD-Access border nodes. Internal and anywhere border nodes are both used. Someone correct me if I'm off.
B edge border and E intermediate border.
Q: 18

Refer to the exhibit. CISCO 300-420 question Refer to the exhibit. Customers report low video quality and delays when having point-to-point telepresence video calls between the two locations. An architect must optimize a design so that traffic follows the same path for egress and ingress traffic flows. Which technique optimizes the design?

Options
9 comments in the community discussion
5
Looks like C is best. Official guide and practice lab questions cover OSPF metrics and path selection pretty well.
5
C
Q: 19

Which two functions are provided by the Cisco SD-WAN orchestration plane? (Choose two.)

Options
7 comments in the community discussion
6
Yeah, it's easy to confuse the roles but orchestration in Cisco SD-WAN mainly handles things like authenticating new WAN Edge devices (so, primary authentication point) and helping devices communicate across NAT (NAT traversal facilitation). Management plane is more about provisioning. So I'd lock in B and C here. O
2
B and C. Had something like this in a mock, that matches what the orchestration plane does.
Q: 20

An engineer is tasked with designing a dual BGP peering solution with a service provider. The design must meet these conditions: The routers will not learn any prefix with a subnet mask greater than /24. The routers will determine the routes to include in the routing table based on the length of the mask alone. The routers will make this selection regardless of the service provider configuration. Which solution should the engineer include in the design?

Options
7 comments in the community discussion
4
D fits best. You want to filter prefixes from the provider as they come in, and applying a prefix list inbound is how you control what gets added based on mask length. Pretty sure that's what the scenario wants.
Makes sense to use a prefix list inbound here. D fits since you want to filter what gets installed from the provider based on prefix length, regardless of their config. Pretty sure that's it, but open to corrections.
Question 1 of 20

Premium Access Includes

  • ✓Quiz Simulator
  • ✓Exam Mode
  • ✓Progress Tracking
  • ✓Question Saving
  • ✓Flash Cards
  • ✓Drag & Drops
  • ✓3 Months Access
  • ✓PDF Downloads
Get Premium Access

← Back to all Cisco exams & practice tests

Scroll to Top