Cisco Updated 300-420 Exam Questions and Answers by storm

NAT64 is the correct solution when IPv6-only hosts must communicate with an IPv4-only public web server. NAT64 translates IPv6 packets from the client side into IPv4 packets toward the server and translates the return traffic back into IPv6. In most practical designs, NAT64 is paired with DNS64 so IPv6-only clients can receive synthesized AAAA records for IPv4-only destinations. NAT44 is only IPv4-to-IPv4 translation and cannot support IPv6-only hosts. 6to4 is an IPv6-over-IPv4 tunneling mechanism, not an IPv6-to-IPv4 translation service for reaching an IPv4-only server. 6PE carries IPv6 reachability across an MPLS IPv4 core and does not solve IPv6-only client access to an IPv4-only domain. The question specifically states that the hosts support IPv6-only and the public web server has only IPv4 domain name resolution. That is the classic NAT64/DNS64 use case. The architect must also plan stateful translation capacity, logging requirements, IPv4 address pool sizing, and DNS behavior. Reference topics: NAT64, DNS64, IPv6 transition, IPv6-only hosts, IPv4-only server access.

Cisco SD-WAN uses the Overlay Management Protocol to exchange control-plane information between WAN Edge routers and vSmart controllers. OMP advertises three major categories of routing information: OMP routes, TLOC routes, and service routes. OMP routes represent reachability to prefixes in service VPNs, such as connected, static, OSPF, EIGRP, BGP, or other routes learned at the local site. TLOC routes describe transport locations, which bind a system IP, color, and encapsulation to a WAN transport attachment. Service routes indicate service insertion capabilities, such as firewalls or other network services that can be reached through a particular site. This separation allows Cisco SD-WAN to build a secure overlay over any public or private transport while keeping transport reachability, service-side prefixes, and inserted services distinct. The other answer choices use generic terms such as underlay, MPLS, Internet, backup, or primary routes, but those are not the formal OMP advertisement categories. Therefore, the correct answer is prefix, TLOC, and service.

DiffServ is the correct technology because the customer wants distributed QoS based on packet marking and per-hop treatment. Cisco differentiated services designs classify and mark traffic at the network edge, normally using DSCP values, and each device along the path applies a locally defined per-hop behavior to that traffic class. This model scales well in enterprise WANs because routers do not need to maintain per-flow state across the entire network. CBWFQ and LLQ are queuing mechanisms that can implement DiffServ treatment, but they are not the overall QoS architecture requested by the question. IntServ uses RSVP and per-flow resource reservation, which provides stronger admission-style guarantees but does not scale as well for large distributed WAN environments. The question specifically mentions individual packet marking and forwarding based on hop-by-hop treatment, which is the language of DiffServ. A complete design should define trust boundaries, DSCP markings, class maps, queue policy, and provider handoff behavior. Reference topics: DiffServ, DSCP marking, per-hop behavior, distributed QoS, WAN QoS architecture.

For in-band management over the production WAN, the proper marking is DSCP CS2 mapped into the management or operations class with a minimum bandwidth guarantee. Cisco enterprise QoS guidance separates network control traffic from network management traffic. Routing protocol and control-plane traffic should not be diluted by ordinary management flows. CS6 is typically reserved for routing and network-control traffic; EF is reserved for low-latency voice bearer traffic; CS1 is commonly used for scavenger or low-priority traffic. Network management flows such as SSH, SNMP, NTP, FTP-based maintenance, and syslog require reliable delivery, but they should not starve business traffic or real-time services. Therefore, marking with CS2 and mapping the traffic into Class2 is the correct design choice. The bandwidth adjustment should come from a lower-priority class, not from the routing/control or real-time class. Because this is in-band management, the architect must also ensure access control, source restrictions, AAA, logging, and management-plane protection. QoS classification alone does not secure management access; it only gives the traffic an appropriate forwarding treatment over the MPLS WAN. Reference topics: in-band management, DSCP CS2, enterprise QoS classes, management-plane traffic.