Cisco Updated 300-420 Exam Questions and Answers by kara

An MPLS Layer 3 VPN with separate VRFs for corporate and guest traffic is the correct WAN design. The customer has branch teams that must communicate with each other and access enterprise applications in the data center and cloud, while guest traffic must be isolated and allowed only to reach the Internet gateway in the data center. Cisco MPLS L3VPN designs use VRFs to create separate routing tables and isolate traffic over the shared provider backbone. A corporate VRF can carry interbranch and application traffic, while a guest VRF can be routed only toward the data-center Internet security stack. A separate service provider for guest users would increase cost and operational complexity without solving segmentation as cleanly. A firewall in the data center can enforce security, but it does not by itself provide routing separation across the WAN. A separate VRF for every branch would isolate branches from each other and would be unnecessary unless each branch required complete tenant separation. Reference topics: MPLS L3VPN, VRF segmentation, guest Internet access, enterprise WAN design, centralized Internet gateway.

A routed access topology is the underlay design that removes the normal need for first-hop redundancy protocols. In a traditional Layer 2 access design, end hosts usually rely on HSRP, VRRP, or GLBP at the distribution layer because the default gateway is shared across redundant distribution switches. In a routed access design, the Layer 3 boundary is pushed down to the access layer. The access switch routes toward the distribution layer using point-to-point routed links, so uplink failures are handled by the routing protocol instead of spanning tree and first-hop redundancy. Cisco campus design guidance highlights routed access as a way to improve convergence, avoid Layer 2 loop exposure across uplinks, and simplify resiliency by using equal-cost routed paths. Virtualized topology is too broad and does not inherently remove FHRP. A Layer 2 topology normally increases dependence on STP and gateway redundancy. A logical fabric topology is not the generic underlay topology described by the question. The correct choice is therefore routed access. Reference topics: routed access campus, Layer 3 access, FHRP elimination, routed underlay resiliency.

The selected command is correct because the port is already restricted to one manually learned MAC address, and the requirement is to let the switch dynamically learn the connected endpoint while retaining port-security control. In Cisco Catalyst port security, a static secure MAC address is manually configured, while a sticky secure MAC address is dynamically learned and then added to the running configuration. This design is useful on access ports where the administrator wants the operational convenience of dynamic learning but still wants the switch to enforce the maximum secure-address limit. Once the endpoint MAC is learned, subsequent frames from different source MAC addresses can trigger the configured violation action, such as protect, restrict, or shutdown. The command must therefore enable sticky learning on the secured interface rather than simply changing the maximum, disabling port security, or configuring a normal switching feature. This is an access-layer security function, not a routing or QoS function. Reference topics: Catalyst port security, secure MAC addresses, sticky learning, access port hardening, Layer 2 campus design.

The telemetry-mode mapping distinguishes configured subscriptions from dynamic collector-initiated subscriptions. In dial-out telemetry, the network device initiates the connection to the collector according to a configured subscription. This model is useful when devices must proactively stream data to a known receiver, especially where firewall policy allows outbound sessions from the network device. In dial-in telemetry, the collector initiates the session to the device and subscribes to the desired data stream. This approach is useful for ad hoc collection, testing, or centralized collectors that can reach the devices directly. Cisco model-driven telemetry also distinguishes periodic and on-change behavior. Periodic subscriptions send data at configured intervals, while on-change subscriptions publish updates when subscribed state changes. These design choices affect firewall rules, collector reachability, device configuration, scale, and data volume. The architect should match telemetry mode to operational requirements: dial-out for stable production streams from many devices, dial-in for collector-driven access, periodic for baselines, and on-change for efficient state-change monitoring. Reference topics: model-driven telemetry, dial-in, dial-out, subscriptions, periodic and on-change streaming.