300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

Out-of-band Ethernet is the correct management design for a large data center when the customer wants device grouping, management-plane isolation, and reduced blast radius from compromise. In an out-of-band design, management traffic uses a physically or logically separate management network instead of traversing the production data plane. This allows different device classes to be placed into management zones, protected by access control, authentication, logging, and rate-limiting policies. If one managed device is compromised, the attacker should not automatically gain production network reachability through the management interface. In-band Ethernet would share the production infrastructure and therefore would not provide the same isolation. Dial-up out-of-band access can be useful for emergency console access, but it is not appropriate as the primary management architecture for a large data center. Out-of-band Ethernet provides scale, speed, and segmentation while still allowing centralized management systems to reach routers, switches, controllers, and appliances. Reference topics: out-of-band management, management-plane security, data-center operations, isolation, access control, DoS mitigation.

Implementing network summarization on the edge routers is the correct EIGRP design action to reduce query range and improve convergence. In EIGRP, when a route is lost and no feasible successor exists, DUAL sends queries to neighbors. If the network is large or poorly summarized, those queries can propagate widely and increase convergence time. Hierarchical addressing allows each office or edge block to advertise a summary instead of many specific prefixes. If a specific subnet inside an office fails, the summary can remain stable toward the rest of the network, preventing the failure from triggering unnecessary queries across the dark-fiber interoffice topology. Stub routing can also reduce query scope, but the option says to configure stub areas on non-edge routers, which is not the right EIGRP terminology or placement. Different EIGRP processes add redistribution complexity, and route filtering alone does not provide the same clean convergence boundary as summarization. Reference topics: EIGRP summarization, DUAL query scope, hierarchical addressing, convergence optimization, dark-fiber campus routing.

Cisco Catalyst SD-WAN separates orchestration from management, control, and data forwarding. The orchestration-plane function is provided by vBond, which authenticates WAN Edge devices and helps establish secure connectivity between edges and controllers. In Cisco design terms, vBond is also the NAT traversal facilitator because it allows devices sitting behind NAT to discover reachable public and private address information and form the correct control connections. These two functions match the options for primary authentication point and NAT traversal facilitation. Centralized provisioning, troubleshooting, monitoring, and template-based configuration belong to vManage, the management plane. Route and policy distribution belongs to vSmart, the control plane, through OMP. Zero Touch Provisioning is part of the onboarding workflow, but the question asks for orchestration-plane functions, not the broader provisioning service. A sound SD-WAN design should deploy redundant vBond instances, ensure DNS reachability to them, and validate firewall rules so DTLS/TLS control connections can be established reliably across Internet and private transports. Reference topics: Cisco SD-WAN architecture, vBond orchestration, control connections, NAT traversal.