300-420 Exam Questions & Answers

When Cisco SD-WAN edge router redundancy is designed, VRRP is the supported first-hop redundancy protocol in the SD-WAN edge context. VRRP provides a virtual default gateway for LAN-side devices, allowing one WAN Edge router to act as the active gateway while another can take over if the active router or tracked condition fails. Cisco SD-WAN designs use VRRP with tracking and policy alignment so branch LAN traffic can fail over to the appropriate edge router while the SD-WAN overlay handles transport and tunnel selection. HSRP and GLBP are traditional campus first-hop redundancy protocols, but they are not the supported FHRP answer for vEdge router redundancy in this design context. OMP is the SD-WAN control-plane routing protocol used between WAN Edge routers and vSmart controllers; it is not a first-hop redundancy protocol for LAN hosts. Therefore, the correct FHRP for vEdge router redundancy is VRRP. The design should also ensure that VRRP priorities, tracking, and SD-WAN routing preferences align so traffic exits the intended edge during normal and failure conditions.

Policing is the correct mechanism for managing traffic that exceeds the configured threshold. The application is UDP-based, inelastic, and sensitive to delay and jitter, so excess traffic should not be buffered and transmitted later. Cisco defines traffic policing as measuring traffic against a configured rate and applying an action such as transmit, drop, or remark when traffic conforms, exceeds, or violates the policy. In contrast, shaping buffers excess traffic and releases it later to smooth the output rate. That behavior is useful for TCP or provider handoff control, but it can add delay and jitter, which is harmful for inelastic real-time UDP flows. Scheduling has already been addressed by allocating bandwidth and assigning queues; it decides how queues are serviced, not how excess flows are constrained. Remarking changes packet markings but does not by itself enforce a traffic threshold. Therefore, policing is the appropriate QoS conditioning action for traffic above the configured limit. Reference topics: traffic policing, QoS conditioning, shaping versus policing, UDP real-time applications, delay and jitter control.

A major SaaS challenge is the lack of direct application and infrastructure control. With Software as a Service, the provider operates the application stack, platform, upgrades, and supporting infrastructure. The customer benefits from reduced maintenance burden and lower initial deployment cost, but gives up much of the direct control normally available with on-premises applications. This affects troubleshooting, change windows, performance visibility, customization, data residency controls, and integration with existing enterprise systems. Higher initial costs are usually not a SaaS characteristic; SaaS commonly shifts spending toward subscription operating expense. Client computer upgrades are not normally required in the same way as thick-client enterprise software. Data and application integration can be complex, but the option that best captures the core architectural challenge is reduced control over the application and infrastructure. Network architects must account for this by designing secure direct internet access, cloud monitoring, identity integration, and reliable paths to SaaS providers. Reference topics: SaaS architecture, cloud application control, enterprise cloud access, operational visibility, SD-WAN SaaS design.

A major feature of the SaaS subscription model is lower initial cost. In Software as a Service, the customer consumes an application provided by a service provider rather than purchasing and operating the full application infrastructure directly. This generally shifts spending from large upfront capital expenditure to recurring operational subscription cost. The provider handles much of the platform, application maintenance, hosting, scalability, and upgrades, which lowers the customer's initial hardware and software investment. A web connection is normally required for SaaS access, so option A is incorrect. Access to industrial-strength storage and computing power is more characteristic of cloud infrastructure benefits, but it is not the defining SaaS subscription feature in this answer set. Autonomy and control over hardware is reduced, not increased, in SaaS because the provider owns and operates the underlying infrastructure. The option text contains a typo, but ''lower initial costs'' is the intended and correct feature. Reference topics: SaaS model, cloud subscription economics, operational expenditure, application hosting, cloud service models.

The requirement for end-to-end path verification identifies the Integrated Services model with RSVP. IntServ uses per-flow resource reservation, and RSVP signals the path between sender and receiver so devices along that path can admit or reject the requested service based on available resources. This makes IntServ appropriate when the design requires explicit end-to-end path validation and reservation for application flows. DiffServ works differently. In a DiffServ design, traffic is marked, normally with DSCP or CoS at the edge, and each hop applies a configured per-hop behavior. DiffServ is scalable and common in enterprise WAN and campus QoS designs, but it does not perform per-flow signaling or verify that every device in the path can reserve the requested resources. Marking traffic at the access layer is an important QoS design practice, but marking alone is not path verification. Therefore, when the customer explicitly requires end-to-end path verification for business-critical traffic, Cisco QoS architecture points to IntServ with RSVP rather than a pure DiffServ marking model.