101 free Cisco 300-620 DCACI practice questions from the CertStash pack of 404, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 101 free here, all 404 in the pack, and each step includes the one before it.
Get all 404 questions (US$39) · Download the first 10 as a PDF
Question 1
An ACI administrator notices a change in the behavior of the fabric. Which action must be taken to determine if a human intervention introduced the change?
Show answer and explanation
Correct answer: C. Inspect audit logs in the APIC UI to see all user events.
Audit logs in the APIC UI provide a comprehensive record of all user actions and configuration changes performed by administrators. This is the primary interface for reviewing human interventions and tracking who made changes and when. The audit logs capture all administrative activities performed through the APIC interface.
Why the other options are wrong
- A. Event records show system events but not specifically user actions in the detail needed for troubleshooting configuration changes.
- B. The audit_messages file path is not the standard location for user action auditing in ACI; audit logs are accessed through the APIC UI.
- D. Command history on the APIC CLI does not provide a persistent, searchable audit trail of all user actions across the fabric.
Question 2
An engineer is creating a configuration import policy that must terminate if the imported configuration is incompatible with the existing system. Which import mode achieves this result?
Show answer and explanation
Correct answer: B. atomic
The atomic import mode treats the entire import as a single transaction that either succeeds completely or fails entirely. If any part of the imported configuration is incompatible with the existing system, the entire import is rejected and no changes are applied. This ensures the system remains in a consistent state.
Why the other options are wrong
- A. Merge mode adds or updates objects but does not rollback if incompatibilities are encountered.
- C. Best effort mode attempts to import as much as possible and ignores incompatibilities rather than terminating the operation.
- D. Replace mode overwrites existing configuration entirely, which does not address incompatibility concerns.
Question 3
Which components must be configured for the BGP Route Reflector policy to take effect?
Show answer and explanation
Correct answer: C. pod policy groups and profiles
BGP Route Reflector policies are applied at the pod level through pod policy groups and profiles. These pod-level policies configure the Route Reflector functionality for the fabric's control plane routing and must be deployed through pod policies.
Why the other options are wrong
- A. Spine fabric interface overrides are used for data plane interface configuration, not Route Reflector policies.
- B. Access policies configure leaf access ports and are not related to Route Reflector functionality.
- D. Leaf fabric interface overrides configure leaf-to-spine connections but do not define Route Reflector behavior at the required pod level.
Question 4
Which type of policy configures the suppression of faults that are generated from a port being down?
Show answer and explanation
Correct answer: C. fault severity assignment
In ACI, a fault severity assignment policy lets you change the severity of specific fault codes, including setting them to squelched. Squelching the port-down fault code suppresses those faults. This is configured under the monitoring policies.
Why the other options are wrong
- A. Fault lifecycle policies control timers such as soaking and retention, not suppression of specific faults.
- B. Event lifecycle assignment is not the policy used to suppress port-down faults.
- D. Event severity assignment applies to events rather than faults.
Question 5
Which type of profile needs to be created to deploy an access port policy group?
Show answer and explanation
Correct answer: D. leaf interface
A leaf interface profile must be created to deploy an access port policy group. The leaf interface profile defines which physical interfaces on leaf switches are assigned to policy groups, and the policy group itself contains the actual port configurations and policies.
Why the other options are wrong
- A. Attachable entity profiles are used for virtual machine integration, not physical port policy deployment.
- B. Pod profiles are used for fabric-wide settings, not individual access port policies.
- C. Module profiles do not exist as a configuration object type in ACI for port policy deployment.
Question 6
A situation causes a fault to be raised on the APIC. The ACI administrator does not want that fault to be raised because it is not directly relevant to the environment. Which action should the administrator take to prevent the fault from appearing?
Show answer and explanation
Correct answer: C. Under System -> Faults, right-click on the fault and select Ignore Fault to create a fault severity assignment policy that hides the fault.
Right-clicking on a fault in System -> Faults and selecting Ignore Fault creates a fault severity assignment policy that suppresses the fault. This policy hides the fault from appearing in the system while maintaining the underlying system integrity, allowing administrators to suppress irrelevant faults.
Why the other options are wrong
- A. Acknowledging faults only marks them as reviewed but does not prevent them from appearing or being raised again.
- B. Stats threshold policies with rising and falling thresholds are used for statistical monitoring, not fault suppression.
- D. Global health score policies modify health calculations but do not provide fault suppression functionality based on fault codes.
Question 7
A RADIUS user resolves its role via the Cisco AV Pair. What object does the Cisco AV Pair resolve to?
Show answer and explanation
Correct answer: B. security domain
The Cisco AV Pair in RADIUS authentication resolves the user's role to a security domain in ACI. The security domain determines which managed objects and policies the RADIUS user can access, making it the correct authorization scope for role-based access control.
Why the other options are wrong
- A. Tenants are not directly resolved by Cisco AV Pairs; security domains are the authorization boundary.
- C. The primary APIC is a system component, not an authorization object resolved by AV Pairs.
- D. While managed object class is related to ACI objects, the AV Pair specifically resolves to security domain for authorization purposes.
Question 8
Which feature dynamically assigns or modifies the EPG association of virtual machines based on their attributes?
Show answer and explanation
Correct answer: D. uSeg EPGs
Microsegmentation EPGs (uSeg EPGs) dynamically assign or modify the EPG association of virtual machines based on their attributes such as operating system, VM name, or other VM properties. This allows flexible, attribute-based policy enforcement without manual EPG assignment.
Why the other options are wrong
- A. vzAny contracts provide access to external networks but do not manage EPG assignment.
- B. Standard contracts define communication policies between EPGs but do not assign EPG membership.
- C. Application EPGs are static groupings and do not provide dynamic attribute-based assignment.
Question 9
Which feature allows firewall ACLs to be configured automatically when new endpoints are attached to an EPG?
Show answer and explanation
Correct answer: B. dynamic endpoint attach
Dynamic endpoint attach is the Cisco ACI feature that automatically configures firewall ACLs when new endpoints are attached to an EPG. This allows for automatic policy enforcement without manual intervention when endpoints join the fabric.
Why the other options are wrong
- A. ARP gleaning is used for endpoint discovery and learning, not for automatic ACL configuration.
- C. Hardware proxy relates to endpoint proxy functionality, not automatic ACL configuration.
- D. Network-stitching is used for connecting different network segments, not for automatic ACL management.
Question 10
New ESXi hosts are procured in a data center compute expansion project. An engineer must update the configuration on the Cisco APIC controllers to support the addition of the new servers to the existing VMM domain. Which action should be taken to support this change?
Show answer and explanation
Correct answer: D. Map the leaf interface selector to the AEP that is associated with the VMM domain.
To support new ESXi hosts in an existing VMM domain, the leaf interface selector must be mapped to the Attachment Entity Profile (AEP) that is already associated with the VMM domain. This enables the new hosts connected to those leaf ports to be included in the VMM domain's provisioning and policy scope. The other settings are either already established in the existing domain or not necessary for adding new servers.
Why the other options are wrong
- A. Internal VLAN ranges in the VLAN pool are already configured for the existing VMM domain and do not need updating for new servers.
- B. Encapsulation mode as VXLAN is already set when the VMM domain was initially created.
- C. Infrastructure VLAN is enabled at the AEP level during initial setup and does not need to be enabled again for additional servers.
What people say about the full 300-620 pack 5.0 from 1
I was struggling with the concepts, but these dumps made it much easier. The explanations provided alongside the answers were really helpful. Thank you Cert Stash...!
Question 11
Which routing protocol is supported between Cisco ACI spines and IPNs in a Cisco ACI Multi-Pod environment?
Show answer and explanation
Correct answer: A. OSPF
OSPF is the supported routing protocol between Cisco ACI spine switches and IPNs (Inter-Pod Networks) in a Multi-Pod environment. OSPF provides efficient routing and convergence characteristics suitable for connecting multiple pods across the fabric.
Why the other options are wrong
- B. IS-IS is used internally within the ACI fabric but not between spines and external IPNs.
- C. BGP is not the supported protocol for spine-to-IPN communication in Multi-Pod deployments.
- D. EIGRP is not supported in ACI Multi-Pod architectures.
Question 12
The existing network and ACI fabric have been connected to support workload migration. Servers will physically terminate at the Cisco ACI, but their gateway must stay in the existing network. The solution needs to adhere to Cisco’s best practices. The engineer started configuring the relevant Bridge Domain and needs to complete the configuration. Which group of settings are required to meet these requirements?
Show answer and explanation
Correct answer: B. L2 Unknown Unicast: Flood L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enable -
When servers terminate at ACI but the gateway remains in an external network, the Bridge Domain must be configured with L2 Unknown Unicast set to Flood, L3 Unknown Multicast Flooding set to Flood, Multi Destination Flooding set to Flood in BD, and ARP Flooding set to Enable. This configuration allows traffic destined for the external gateway to flood appropriately while maintaining proper L2/L3 behavior across the hybrid network.
Why the other options are wrong
- A. Hardware Proxy for L2 Unknown Unicast would restrict flooding and prevent proper communication with the external gateway.
- C. Optimizing L3 Unknown Multicast Flooding and disabling ARP Flooding would prevent the servers from properly reaching the external gateway.
- D. Hardware Proxy combined with Optimize Flood and disabling ARP Flooding does not support the hybrid network topology where the gateway is external to ACI.
Question 13
A network engineer must design a method to allow the Cisco ACI to redirect traffic to the firewalls. Only traffic that matches specific L4-L7 policy rules should be redirected. The load must be distributed across multiple firewalls to scale the performance horizontally. Which action must be taken to meet these requirements?
Show answer and explanation
Correct answer: D. Configure ACI Service Graph with Symmetric PBR.
ACI Service Graph with Symmetric PBR (Policy-Based Redirect) must be configured to meet the requirements. Symmetric PBR allows traffic matching specific L4-L7 policy rules to be redirected to firewalls, and it supports load distribution across multiple firewalls through Equal-Cost Multi-Path (ECMP) mechanisms, enabling horizontal scaling of firewall performance.
Why the other options are wrong
- A. Unidirectional PBR only handles one direction of traffic flow, not the symmetric bidirectional redirection needed for firewall inspection.
- B. GIPo (Gateway IP Option) is used for traffic steering but does not provide the L4-L7 policy matching and multi-firewall load distribution required.
- C. Two Nodes topology with GIPo is not the appropriate mechanism for L4-L7 policy-based redirection across multiple firewalls with load balancing.
Question 14
An ACI engineer is implementing a Layer 3 Out inside the Cisco ACI fabric that must meet these requirements: • The data center core switch must be connected to one of the leaf switches with a single 1G link. • The routes must be exchanged using a link-state routing protocol that supports hierarchical network design. • The data center core switch interface must be using 802.1Q tagging, and each VLAN will be configured with a dedicated IP address. Which set of steps accomplishes this goals?
Show answer and explanation
Correct answer: D. Configure the OSPF Protocol policy with an area of 0. Create Routed Outside object and Node Profile, selecting OSPF as the routing protocol. Build the Interface profile, selecting Routed Subinterface and the appropriate VLAN. Configure the External Network object with a network of 0 0.0 0/0.
OSPF is the link-state routing protocol that supports hierarchical network design (areas). The configuration requires creating an OSPF Protocol policy with area 0, establishing a Routed Outside object and Node Profile with OSPF, building an Interface profile with Routed Subinterface to support 802.1Q tagged VLANs on the single 1G link, and configuring an External Network object with 0.0.0.0/0 to represent external routes.
Why the other options are wrong
- A. EIGRP does not support hierarchical network design with areas as required.
- B. EIGRP is incorrect, and Switch profile with Port-channel is not appropriate for a single 1G link with VLAN tagging.
- C. BGP with AS 0 is incorrect, and External Bridged Domain is for Layer 2 external connectivity, not Layer 3 routing.
Question 15
An engineer is in the process of discovering a new Cisco ACI fabric consisting of two spines and four leaf switches. The discovery of leaf 1 has just been completed. Which two nodes are expected to be discovered next? (Choose two.)
Show answer and explanation
Correct answer: C, E. spine 1; spine 2
In ACI fabric discovery, once a leaf switch is discovered, the fabric discovers the spine switches next since they are directly connected to that leaf. After discovering the spines, the remaining leaf switches are discovered. Therefore, after leaf 1 completes discovery, both spine nodes (spine 1 and spine 2) are expected to be discovered next.
Why the other options are wrong
- A. Leaf 2 discovery happens after spine discovery is complete.
- B. Leaf 4 discovery occurs after spine discovery.
- D. Leaf 3 discovery occurs after spine discovery is complete.
Question 16
All workloads in VLAN 1001 have been migrated into EPG-1001. The requirement is to move the gateway address for VLAN 1001 from the core outside the Cisco ACI fabric into the Cisco ACI fabric. The endpoints in EPG-1001 must route traffic to endpoints in other EPGs and minimize flooded traffic in the fabric. Which configuration set is needed on the bridge domain to meet these requirements?
Show answer and explanation
Correct answer: D. Enable Hardware Proxy Enable Unicast Routing
To move the gateway into the fabric and allow endpoints to route between EPGs while minimizing flooded traffic, the bridge domain must have Unicast Routing enabled to support inter-EPG routing and Hardware Proxy enabled to reduce ARP flooding by having the fabric proxy ARP requests rather than flooding them throughout the network.
Why the other options are wrong
- A. Enabling Flood without Hardware Proxy increases flooded traffic rather than minimizing it.
- B. Disabling Unicast Routing prevents inter-EPG routing, which is required by the scenario.
- C. Disabling ARP Flood and Limit Endpoint Learning does not address the routing requirement or enable the gateway functionality.
Question 17
When the subnet is configured on a bridge domain, on which physical devices is the gateway IP address configured?
Show answer and explanation
Correct answer: C. only leaf switches where the bridge domain of the tenant is present
In Cisco ACI, when a subnet is configured on a bridge domain, the gateway IP address is instantiated only on the leaf switches where that bridge domain is actually present. The gateway IP does not need to be configured on spine switches, as spines do not perform endpoint learning or handle direct client-gateway communication. Spine switches only handle inter-leaf traffic routing. Border leaf nodes are a subset of leaf switches used for external connectivity, but the gateway is configured on all relevant leaves where the bridge domain exists, not exclusively on border leaves.
Why the other options are wrong
- A. Spine nodes do not require the gateway IP address; they do not perform gateway functions or endpoint communication.
- B. Spine switches are not where bridge domain gateways are configured in ACI architecture.
- D. The gateway is configured on all leaf switches with the bridge domain, not exclusively on border leaf nodes.
Question 18
An engineer must create a backup of the Cisco ACI fabric for disaster recovery purposes. The backup must be transferred over a secure and encrypted transport. The backup file must contain all user and password related information. The engineer also wants to process and confirm the backup file validity by using a Python script. This requires the data structure to have a format similar to a Python dictionary. Which configuration set must be used to meet these requirements?
Show answer and explanation
Correct answer: D. Under the Create Remote location settings, select Protocol: SCP Under the Export policy, select - Format: JSON - Modify Global AES Encryption Settings: Enabled
SCP provides secure encrypted transport over SSH, meeting the secure transfer requirement. JSON format creates a structure similar to Python dictionaries, allowing Python scripts to parse and validate the backup file. AES encryption must be enabled to include sensitive data such as user credentials and passwords in the encrypted backup.
Why the other options are wrong
- A. FTP does not provide encrypted transport, and XML format is not dictionary-like for Python processing.
- B. FTP is unencrypted and does not meet the secure transport requirement; encryption also should not be disabled when credentials are included.
- C. JSON is correct for Python dictionary processing, but encryption should be enabled when exporting sensitive credential data.
Question 19
An engineer must allow multiple external networks to communicate with internal ACI subnets. Which action should the engineer take to assign the prefix to the class ID of the external Endpoint Group?
Show answer and explanation
Correct answer: C. Configure subnets with the External Subnets for External EPG flag enabled.
Configuring subnets with the External Subnets for External EPG flag enabled allows the assignment of external network prefixes to the External Endpoint Group's class ID. This flag specifically designates which external subnets should be associated with the external EPG, enabling proper routing and communication between external networks and internal ACI subnets.
Why the other options are wrong
- A. Export Route Control Subnet is used for controlling route redistribution, not for assigning external prefixes to the external EPG.
- B. Shared Route Control Subnet on an L3Out affects route control but does not directly assign prefixes to the external EPG class ID.
- D. Import Route Control Subnet is for controlling imported routes, not for assigning external subnets to the EPG.
Question 20
An organization has encountered many STP-related issues in the past due to failed hardware components. They are in the process of long-term migration to a newly deployed ACI fabric. Senior engineers are worried that spanning-tree loops in the existing network may be extended to the ACI fabric. Which feature must be enabled on the ACI leaf ports to protect the fabric from spanning-tree loops?
Show answer and explanation
Correct answer: B. per-VLAN MCP
Per-VLAN MCP (Micro Convergence Protocol) or BPDU filter should be enabled on ACI leaf ports to protect the fabric from spanning-tree loops originating in the legacy network. Per-VLAN MCP is the ACI-native mechanism that prevents STP-related issues by avoiding participation in the legacy spanning tree while allowing proper forwarding behavior, protecting the fabric from topology changes and loops in the existing network.
Why the other options are wrong
- A. BPDU Guard shuts down ports when BPDUs are received, which is too aggressive and would disconnect servers and external networks.
- C. Storm Control limits broadcast/multicast traffic but does not specifically address the spanning-tree loop problem.
- D. BPDU Filter silently discards BPDUs but does not provide the convergence and loop prevention benefits of per-VLAN MCP.
Question 21
A network engineer demonstrates Cisco ACI to a customer. One of the test cases is to validate a disaster recovery event by resetting the ACI fabric to factory and then restoring the fabric to the state it was in before the event. Which setting must be enabled on ACI to export all configuration parameters that are necessary to meet these requirements?
Show answer and explanation
Correct answer: A. enabled AES encryption
AES encryption must be enabled when exporting ACI fabric configuration to ensure that all configuration parameters are securely encrypted during the export process. This encryption protects sensitive data during backup and allows the fabric to be restored to its previous state after a factory reset during disaster recovery operations.
Why the other options are wrong
- B. A tech-support file contains diagnostic data, not comprehensive configuration parameters needed for full fabric restoration.
- C. Encrypting only the export destination does not ensure the configuration itself is fully encrypted for secure backup.
- D. JSON format export is a data format choice but does not provide the encryption necessary for complete secure configuration backup.
Question 22
A packet is routed between two endpoints on different Cisco ACI leaf switches. Which VXLAN VNID is applied to the packet?
Show answer and explanation
Correct answer: C. VRF
When a packet is routed between endpoints on different leaf switches, the VXLAN VNID applied corresponds to the VRF (Virtual Routing and Forwarding) context, as VRF VNIDs enable inter-subnet routing and inter-pod communication in ACI fabric.
Why the other options are wrong
- A. FD (Forwarding Domain) is not a standard VXLAN VNID classification in ACI.
- B. EPG (Endpoint Group) VNIDs are used for intra-subnet communication, not inter-subnet routing.
- D. BD (Bridge Domain) VNIDs are used for intra-subnet switching; inter-subnet routing uses VRF VNIDs.
Question 23
What must be enabled in the bridge domain to have the endpoint table learn the IP addresses of endpoints?
Show answer and explanation
Correct answer: C. unicast routing
Unicast routing must be enabled in the bridge domain to allow the endpoint table to learn IP addresses of endpoints. When unicast routing is enabled, the bridge domain can perform ARP inspection and IP endpoint tracking, which populates the endpoint table with IP address information for connected hosts.
Why the other options are wrong
- A. L2 unknown unicast flooding controls how unknown MAC addresses are handled, not IP address learning.
- B. GARP-based detection is not a required setting for IP address learning in bridge domains.
- D. Subnet scope is related to EPG configuration, not endpoint IP address learning in the bridge domain.
Question 24
The engineer notices frequent MAC and IP address moves between different leaf switch ports. Which action prevents this problem from occurring?
Show answer and explanation
Correct answer: C. Enable rogue endpoint control.
Rogue endpoint control prevents MAC and IP address moves between different leaf switch ports by detecting and suppressing suspicious endpoint movement patterns. When enabled, this feature monitors endpoints and restricts rapid transitions of the same MAC or IP address across different ports, which is indicative of misconfigured devices, duplicate addresses, or security issues.
Why the other options are wrong
- A. Disabling enforce subnet check affects IP address validation within subnets but does not prevent endpoint movement between ports.
- B. Endpoint loop protection prevents loops in the fabric topology but does not address MAC and IP address moves.
- D. Disabling IP bridge domain enforcement affects IP configuration handling but is not the mechanism for preventing endpoint moves.
Question 25
An engineer configures a Cisco ACI Multi-Pod for disaster recovery. Which action should be taken for the new nodes to be discoverable by the existing Cisco APICs?
Show answer and explanation
Correct answer: C. Enable DHCP relay on all links that are connected to Cisco ACI spines on IPN devices.
Spines in a new pod are discovered by sending DHCP requests through the IPN to the APICs in the existing pod. The IPN devices must relay these requests, so DHCP relay pointing to the APIC addresses is required on the IPN interfaces that face the spines. Without it, the new nodes never get TEP addresses and cannot be discovered.
Why the other options are wrong
- A. Multicast on the IPN supports BUM traffic between pods, but it is not what makes new nodes discoverable.
- B. Dot1q subinterfaces are only required on the spine-facing IPN links (VLAN 4), not on every IPN-to-IPN link.
- D. The IPN underlay commonly runs OSPF, and BGP in the IPN is not what enables node discovery.
Question 26
A network engineer must configure a new SNMP configuration and syslog servers. The requirement is for all faults and events related to endpoint groups, bridge domains, and VRFs to be sent to it. Which action must be taken to meet the requirements?
Show answer and explanation
Correct answer: B. Utilize common tenant monitoring policies in the Cisco APIC.
Common tenant monitoring policies in Cisco APIC provide a centralized way to configure SNMP and syslog servers that send faults and events for specific object types including endpoint groups, bridge domains, and VRFs. This is the appropriate mechanism to meet the requirement of sending all related events to monitoring servers.
Why the other options are wrong
- A. Access monitoring policies are not the correct mechanism for configuring SNMP and syslog server destinations for faults and events.
- C. Fabric monitoring policies attached to spine switches apply to fabric-level events, not tenant-level objects like EPGs, bridge domains, and VRFs.
- D. Fabric-wide monitoring policies on all nodes does not specifically target the required objects (EPGs, BDs, VRFs) and represents an incorrect approach.
Question 27
A network engineer is integrating a new Hyperflex storage duster into an existing Cisco ACI fabric. The Hyperflex cluster must be managed by vCenter, so a new vSphere Distributed switch must be created. In addition, the hardware discovery must be performed by a vendor-neutral discovery protocol. Which set of steps meets these requirements?
Show answer and explanation
Correct answer: B. Configure an Interface Policy group, select LLDP, and apply it to the selected interfaces. Create a VLAN pool, add it to the VMware VMM domain, and include the appropriate interfaces. Enter the vCenter IP and credentials in the Create vCenter Controller dialog box.
Configuring an Interface Policy group and selecting LLDP (a vendor-neutral discovery protocol) satisfies the hardware discovery requirement. Creating a VLAN pool and adding it to the VMware VMM domain with appropriate interfaces integrates the vDS into ACI management. Finally, entering the vCenter IP and credentials in the Create vCenter Controller dialog establishes the management relationship. This approach provides vendor-neutral discovery via LLDP, proper vDS integration, and vCenter management connectivity.
Why the other options are wrong
- A. CDP is Cisco-proprietary, not vendor-neutral; Read-Only Mode restricts management capabilities needed for new infrastructure.
- C. Switch Policy groups apply to the entire switch, not individual interfaces; APIC credentials are not entered in vCenter controller dialogs.
- D. CDP is not vendor-neutral; adding VMware VMM domain to VLAN pool (not the reverse) is the correct relationship; Read-Only Mode limits necessary management capabilities.
Question 28
A company must connect three Cisco ACI data centers by using Cisco ACI Multi-Site. An engineer must configure the Inter-Site Network (ISN) between the existing sites. Which two configuration steps must be taken to implement the ISN? (Choose two.)
Show answer and explanation
Correct answer: A, E. Configure OSPF on subinterfaces on routers that are directly connected with spine nodes; Configure encapsulation VLAN-4 between the routers and spine nodes.
Implementing an Inter-Site Network requires configuring OSPF on subinterfaces connecting routers to spine nodes for proper routing protocol deployment, and configuring encapsulation VLAN-4 between routers and spine nodes to establish the proper data plane encapsulation for inter-site traffic.
Why the other options are wrong
- B. ISN site extension is not a configuration step; it is a deployment characteristic.
- C. OSPF on all ISN routers is not necessary; only routers directly connected to spines require OSPF configuration.
- D. BIDIR-PIM is not required for ISN configuration in Multi-Site deployments.
Question 29
As part of a migration, legacy non-ACI switches must be connected to the Cisco ACI fabric. All non-ACI switches run per-VLAN RSTP. After the non-ACI switches are connected to Cisco ACI, the STP convergence caused a microloop and significant CPU spike on all switches. Which configuration on the interfaces of the external switches that face the Cisco ACI fabric resolves the problem?
Show answer and explanation
Correct answer: D. STP type link shared
ACI does not run STP, so RSTP proposal and agreement handshakes from the external switches never complete as expected, causing rapid transitions, microloops and CPU spikes. Setting the ACI-facing interfaces to link type shared stops RSTP from using rapid proposal and agreement on those links. This is the Cisco recommendation for switches connecting to an ACI fabric.
Why the other options are wrong
- A. BPDU guard would err-disable the interfaces when BPDUs flooded through the fabric are received.
- B. Aggressive timers speed up convergence but do not stop the rapid transition problem.
- C. BPDU filtering disables loop detection across the fabric and can cause a real loop.
Question 30
An engineer configures a one-armed policy-based redirect service insertion for an unmanaged firewall. The engineer configures these Cisco ACI objects: • a contract named All_Traffic_Allowed • a Layer 4 to Layer 7 device named FW-Device • a policy-based redirect policy named FW-1Arm-Policy-Based RedirectPolicy Which configuration set redirects the traffic to the firewall?
Show answer and explanation
Correct answer: D. Configure a service graph. Associate the service graph with All_Traffic_Allowed.
To redirect traffic to the firewall in a one-armed policy-based redirect service insertion, a service graph must be configured and associated with the contract (All_Traffic_Allowed). The service graph defines how traffic flows through the Layer 4 to Layer 7 device and applies the redirect policy to actually redirect the traffic to the firewall.
Why the other options are wrong
- A. Configuring a policy-based redirect subject and associating it with the contract is part of the process but does not directly redirect traffic without the service graph.
- B. Configuring a firewall bridge domain is not the correct approach for policy-based redirect service insertion; this is used in different topologies.
- C. A device interface policy is not the mechanism used to redirect traffic in policy-based redirect configurations.
Question 31
An engineer is configuring ACI VMM domain integration with Cisco UCS-B Series. Which type of port channel policy must be configured in the vSwitch policy?
Show answer and explanation
Correct answer: B. MAC Pinning
MAC Pinning is the port channel policy that must be configured in the vSwitch policy for ACI VMM domain integration with Cisco UCS-B Series. MAC Pinning ensures that traffic from each VM is pinned to a specific physical uplink, providing deterministic forwarding and preventing packet loss and reordering that could occur with other load-balancing methods. This is the standard requirement for ACI VMM integration with UCS blades to maintain consistent policy enforcement.
Why the other options are wrong
- A. LACP Active is a port channel protocol, not the specific MAC-based pinning policy required for ACI VMM integration.
- C. LACP Passive is also a protocol option but does not provide the MAC Pinning functionality needed for ACI.
- D. MAC Pinning-Physical-NIC-load is not a standard vSwitch port channel policy option.
Question 32
An engineer must implement management policy and data plane separation in the Cisco ACI fabric. Which ACI object must be created in Cisco APIC to accomplish this goal?
Show answer and explanation
Correct answer: B. Tenant
A Tenant must be created in Cisco APIC to accomplish management policy and data plane separation. Tenants are the primary isolation boundary in ACI, allowing administrators to create separate administrative domains where management policies, network policies, and data plane configurations can be independently managed and isolated from one another.
Why the other options are wrong
- A. Application Profile is used to group EPGs and their policies within a tenant, not to separate management and data planes at the fabric level.
- C. Contract defines communication policies between EPGs but does not provide the administrative isolation needed for management and data plane separation.
- D. Bridge Domain provides Layer 2 and Layer 3 connectivity but is not the object used to separate management and data plane administrative domains.
Question 33
A network engineer must allow secure access to the Cisco ACI out-of-band (OOB) management only from external subnets 10.0.0.0/24 and 192.168.20.0/25. Which configuration set accomplishes this goal?
Show answer and explanation
Correct answer: D. Create an OOB contract that allows the required ports. Provide the contract from the OOB EPG. Consume the contract by the OOB External Management Network Instance Profile. Create two subnet entries in the External Management Network Profile with the required subnets.
To restrict OOB management access to specific external subnets, create an OOB contract allowing required management ports, have the OOB EPG provide the contract, and configure the External Management Network Instance Profile to consume it. Two subnet entries in the External Management Network Profile define the allowed source subnets (10.0.0.0/24 and 192.168.20.0/25), implementing network-level access control for secure OOB management.
Why the other options are wrong
- A. L3Out configuration is for external routing but does not properly control management access to the OOB network.
- B. PBR service graphs and external firewall redirection are overly complex and not the standard method for OOB access control.
- C. Creating an EPG and BD in OOB VRF does not establish the External Management Network Profile restrictions needed for the specific subnets.
Question 34
An engineer must connect Cisco ACI fabric using Layer 2 with external third-party switches. The third-party switches are configured using 802.1s protocol. Which two constructs are required to complete the task? (Choose two.)
Show answer and explanation
Correct answer: A, D. spanning tree policy for mapping MST Instances to VLANs; dedicated EPG for native VLAN
To connect Cisco ACI fabric using Layer 2 with external third-party switches configured with 802.1s (Multiple Spanning Tree), two constructs are required. First, a spanning tree policy for mapping MST Instances to VLANs allows ACI to properly coordinate with the external MST configuration. Second, a dedicated EPG for native VLAN is required because the native VLAN (typically VLAN 1) must be explicitly managed to prevent VLAN tag mismatches and ensure proper Layer 2 connectivity across the ACI-to-external-switch boundary. MCP policies are for loop detection, not MST coordination.
Why the other options are wrong
- B. MCP policy with PDU per VLAN is for loop detection and does not address MST Instance mapping requirements.
- C. MCP instance policy configuration is not required for 802.1s MST interoperability with external switches.
- E. Static binding of native VLAN in all existing EPGs is not necessary; only a dedicated EPG for the native VLAN is required.
Question 35
When does the Cisco ACI leaf learn a source IP or MAC as a remote endpoint?
Show answer and explanation
Correct answer: D. When VXLAN traffic arrives on a leaf fabric port from the spine and inner source IP is in the bridge domain subnets range.
A leaf learns remote endpoints by examining VXLAN encapsulated traffic arriving from the spine on fabric ports. The inner source IP of the VXLAN packet (the actual endpoint IP) is compared against the bridge domain subnets to determine if it represents a remote endpoint. If the inner source IP matches a subnet within the bridge domain, the leaf records this as a remote endpoint with the outer IP identifying which remote leaf has learned it. The outer source IP indicates the remote leaf's location, not the endpoint's network association.
Why the other options are wrong
- A. The outer source IP corresponds to the remote leaf, not the endpoint itself, and should be compared against bridge domain subnets, not Layer 3 Out ranges.
- B. While the outer source IP arrives from the spine, it is not the relevant criterion for endpoint identification; the inner IP must match bridge domain subnets.
- C. Layer 3 Out EPG subnets are for external routes, not for learning remote endpoints within the fabric.
Question 36
A network engineer configures the Cisco ACI fabric to connect to vCenter with these requirements: • Port groups must be automatically created on the distributed virtual switch. • Port groups must use the VLAN allocation in the range between 20-30. • The deployment must optimize the CAM space on the leaf switches. Which set of actions meets these criteria?
Show answer and explanation
Correct answer: A. Create a dynamic VLAN pool with the VLAN range of 20-30. Create a VMM domain and associate it with the VLAN pool. Create the EPG and associate the domain. Set the deployment immediacy to On Demand.
To automatically create port groups on a distributed virtual switch, you must use a VMM domain (not physical domain). A dynamic VLAN pool allows flexible VLAN allocation within the specified range (20-30). Setting deployment immediacy to On Demand optimizes CAM space on leaf switches by downloading policies only when needed, rather than provisioning all VLANs immediately, which conserves hardware resources.
Why the other options are wrong
- B. Physical domains are used for bare-metal and non-virtualized infrastructure, not vCenter integration which requires VMM domains.
- C. Static VLAN pools require pre-allocation of all VLANs and Immediate deployment loads all policies into CAM immediately, wasting space.
- D. While VMM domain is correct, static VLAN pools and Immediate deployment do not optimize CAM space as they provision all VLANs upfront.
Question 37
An engineer must limit management access to the Cisco ACI fabric that originates from a single subnet where the NOC operates. Access should be limited to SSH and HTTPS only. Where should the policy be configured on the Cisco APIC to meet the requirements?
Show answer and explanation
Correct answer: A. policy in the management tenant
Management access policies in Cisco ACI are configured within the management tenant. This is where you define fabric access policies that control who can access the APIC and fabric management, including restrictions by source subnet and allowed protocols like SSH and HTTPS. The management tenant provides the centralized policy framework for administrative access control to the entire fabric.
Why the other options are wrong
- B. Console interface ACLs are for physical console port access, not for network-based management access restrictions.
- C. While the management interface exists on the APIC, access policies are configured at the tenant level in the fabric policy, not as interface-level ACLs.
- D. Management VLAN configuration handles network connectivity but does not provide the policy-based access control needed to restrict protocols and sources.
Question 38
An engineer created two interface protocol policies called Pol_CDP40275332 and Pol_LLDP46783451. The policies must be used together in a single policy. Which ACI object must be used?
Show answer and explanation
Correct answer: A. interface policy group
An interface policy group is the ACI object designed to bundle multiple interface policies together for application to ports. Since the engineer has created two separate interface protocol policies (CDP and LLDP) that must be used together on a single interface, they must be combined within an interface policy group, which then gets associated with interface selectors.
Why the other options are wrong
- B. Switch policy groups are used for switch-level policies, not interface-level protocol policies.
- C. Switch profiles are used to assign policies to switches, not to combine interface policies.
- D. Interface profiles are used to select which interfaces receive policies, but they do not bundle multiple policies together.
Question 39
An engineer is extending an EPG out of the ACI fabric using static path binding. Which statement about the endpoints is true?
Show answer and explanation
Correct answer: D. External endpoints are in the same EPG as the directly attached endpoints.
When an EPG is extended outside the ACI fabric using static path binding, external endpoints that are statically bound to the EPG are considered part of the same EPG as the directly attached endpoints. This allows consistent policy application and communication between fabric and external endpoints as members of the same application group, regardless of their physical location.
Why the other options are wrong
- A. External endpoints connected via static path binding do not need to connect directly to ACI leaf ports; they connect through external infrastructure.
- B. External endpoints are in the same bridge domain as fabric endpoints when statically bound to the EPG, not a different one.
- C. Endpoint learning encompasses both MAC and IP addresses, not MAC address only, when configured for the EPG.
Question 40
Which action sets Layer 2 loop migration in an ACI Fabric with a Layer 2 Out configured?
Show answer and explanation
Correct answer: A. Enable MCP on the ACI fabric.
Enabling MCP (Micro Segmentation Control Protocol) on the ACI fabric sets Layer 2 loop migration when Layer 2 Out is configured. MCP provides loop detection and mitigation capabilities for Layer 2 external connections, ensuring proper handling of spanning tree topology changes.
Why the other options are wrong
- B. Disabling STP in the external network does not trigger L2 loop migration in ACI; MCP handles this function.
- C. Disabling STP on the ACI fabric would not enable loop migration; ACI does not use traditional STP.
- D. Enabling STP on the ACI fabric is not necessary or recommended; MCP serves this purpose in ACI.
Question 41
What is the minimum number of APICs does Cisco recommend to deploy in a production cluster?
Show answer and explanation
Correct answer: B. 3
Cisco recommends a minimum of three APICs in a production cluster to provide high availability and fault tolerance. Three controllers allow for cluster quorum even if one controller fails, ensuring the fabric remains operational and management decisions can continue.
Why the other options are wrong
- A. A single APIC creates a single point of failure and is not recommended for production.
- C. While four or more APICs can be deployed, three is the minimum recommended.
- D. Five APICs exceeds the minimum requirement.
Question 42
Which two protocols support accessing backup files on a remote location from the APIC? (Choose two.)
Show answer and explanation
Correct answer: B, C. FTP; SFTP
FTP and SFTP are the two protocols supported by ACI for accessing and transferring backup files to and from remote locations. SFTP provides secure encrypted transfer while FTP provides standard file transfer. Both allow APIC to retrieve or store backup files on remote servers.
Why the other options are wrong
- A. TFTP is not supported for ACI backup file operations; it is unencrypted and limited in functionality.
- D. SMB is not a supported protocol for APIC backup file transfers to remote locations.
- E. HTTPS is used for management API access but not for dedicated backup file transfer protocols.
Question 43
A Solutions Architect is asked to design two data centers based on Cisco ACI technology that can extend L2/L3, VXLAN, and network policy across locations. ACI Multi-Pod has been selected. Which two requirements must be considered in this design? (Choose two.)
Show answer and explanation
Correct answer: B, C. A single APIC Cluster is required in a Multi-Pod design. It is important to place the APIC Controllers in different locations in order to maximize redundancy and reliability; ACI Multi-Pod requires an IP Network supporting PIM-Bidir.
A Multi-Pod design requires a single APIC cluster with controllers distributed across different locations to provide redundancy and reliability while maintaining a unified management plane. Additionally, the design must support PIM-Bidir multicast to enable proper control plane communication across pods. These architectural choices ensure both management redundancy and proper multicast-based replication for control traffic.
Why the other options are wrong
- A. While underlay protocols do span pods, creating QoS policies with higher priority is not a stated requirement or best practice for Multi-Pod.
- D. Firewall Clusters can be deployed across pods in ACI Multi-Pod; they are not restricted to local-only placement.
- E. Multi-Pod uses a single APIC cluster with geographically distributed controllers, not multiple separate clusters per pod.
Question 44
An engineer must deploy Cisco ACI across 10 geographically separated data centers. Which ACI site deployment feature enables the engineer to control which bridge domains contain Layer 2 flooding?
Show answer and explanation
Correct answer: B. Multi-Site
Multi-Site is the ACI feature designed for geographically separated data centers that enables control over Layer 2 flooding behavior. It allows engineers to configure which bridge domains replicate Layer 2 traffic across sites, providing granular control over inter-site flooding policies.
Why the other options are wrong
- A. GOLF is not a recognized ACI deployment feature.
- C. Multi-Pod is designed for pods within a single data center or campus, not for geographically separated data centers.
- D. Stretched Fabric is not a standard ACI deployment term for controlling L2 flooding across multiple data centers.
Question 45
The Application team reports that a previously existing port group has disappeared from vCenter. An engineer confirms that the VMM domain association for the EPG is no longer present. Which action determines which user is responsible for the change?
Show answer and explanation
Correct answer: A. Check the EPG audit logs for the “deletion” action and compare the affected object and user.
The EPG audit logs record all configuration changes with timestamps, user information, and the specific action performed. By examining the audit logs for a deletion action on the EPG and cross-referencing the user field, the engineer can definitively identify which user removed the VMM domain association from the EPG.
Why the other options are wrong
- B. Faults indicate problems but do not provide user attribution for configuration changes.
- C. Health scores show object status but do not track who made changes or when.
- D. Server login logs show access but do not correlate specific configuration deletions to individual users.
Question 46
Which two dynamic routing protocols are supported when using Cisco ACI to connect to an external Layer 3 network? (Choose two.)
Show answer and explanation
Correct answer: A, E. iBGP; eBGP
Cisco ACI supports iBGP and eBGP for connecting to external Layer 3 networks. Both variants of BGP allow the ACI fabric to learn routes from and advertise routes to external networks. BGP is the primary dynamic routing protocol supported for Layer 3 Out connectivity in ACI. VXLAN is an encapsulation protocol, not a routing protocol. IS-IS and RIPv2 are not supported for Layer 3 Out in ACI.
Why the other options are wrong
- B. VXLAN is a tunneling and encapsulation mechanism, not a dynamic routing protocol.
- C. IS-IS is not supported as a dynamic routing protocol for Layer 3 Out in Cisco ACI.
- D. RIPv2 is not supported for external routing connectivity in Cisco ACI deployments.
Question 47
When configuring Cisco ACI VMM domain integration with VMware vCenter, which object is created in vCenter?
Show answer and explanation
Correct answer: C. VMware vSphere Distributed Switch
When Cisco ACI integrates with VMware vCenter through VMM domain configuration, a VMware vSphere Distributed Switch (VDS) is created in vCenter. This distributed switch is the object that ACI uses to manage virtual networking for the hypervisors, allowing ACI to push network policies and manage VM connectivity through the VMM domain.
Why the other options are wrong
- A. A datacenter is a pre-existing vCenter construct, not created by ACI VMM integration.
- B. Standard vSwitch is a legacy construct; ACI VMM integration specifically creates Distributed Switches for policy management.
- D. A cluster is a pre-existing vCenter construct for organizing hosts, not created by ACI VMM integration.
Question 48
A Cisco ACI bridge domain and VRF are configured with a default data-plane learning configuration. Which two endpoint attributes are programmed in the leaf switch when receiving traffic? (Choose two.)
Show answer and explanation
Correct answer: D, F. Local MAC, IP; Remote IP
When a leaf switch receives traffic with default data-plane learning in a bridge domain and VRF, it programs both Remote IP and Remote MAC attributes. Remote endpoints are learned from traffic received on the interface, establishing the IP and MAC address mappings for endpoints located on remote leaves, which enables proper forwarding of return traffic and inter-leaf communication.
Why the other options are wrong
- A. While Remote MAC and IP are learned, this option is incomplete as it excludes other correctly learned attributes.
- B. Remote Subnet is not programmed as an individual endpoint attribute; subnets are configured separately.
- C. Local IP without MAC is incomplete; endpoints are learned with both MAC and IP attributes.
- E. Local Subnet is not programmed as an endpoint attribute in data-plane learning.
Question 49
Which description regarding the initial APIC cluster discovery process is true?
Show answer and explanation
Correct answer: A. The APIC uses an internal IP address from a pool to communicate with the nodes.
During initial APIC cluster discovery, the APIC uses an internal IP address from a pool to communicate with the nodes in the fabric. This allows the controllers to establish connectivity with leaf and spine switches for fabric registration and management.
Why the other options are wrong
- B. Switches are assigned node IDs, not AVs, during the discovery process.
- C. CDP is used for neighbor discovery but APIC controllers discover each other through the configured cluster configuration, not CDP.
- D. Fabric discovery occurs across all switches simultaneously or through the spine as intermediaries, not strictly starting with spines.
Question 50
An engineer configured Layer 2 extension from the ACI fabric and changed the Layer 2 unknown unicast policy from Flood to Hardware Proxy. How does this change affect the flooding of the L2 unknown unicast traffic?
Show answer and explanation
Correct answer: A. It is forwarded to one of the spines to perform as a spine proxy.
When changing L2 unknown unicast policy from Flood to Hardware Proxy, unknown unicast traffic is forwarded to one of the spine switches which performs proxy operations. The spine switch then handles endpoint lookups and reduces unnecessary flooding throughout the fabric.
Why the other options are wrong
- B. Hardware Proxy prevents flooding throughout the whole fabric; instead traffic is forwarded to the spine.
- C. Hardware Proxy does not simply drop the traffic; it forwards it to the spine for intelligent handling.
- D. APICs are management controllers and do not perform Layer 2 proxy operations for data plane traffic.
Question 51
Which tenant is used when configuring in-band management IP addresses for Cisco APICs, leaf nodes, and spine nodes?
Show answer and explanation
Correct answer: D. mgmt
The mgmt tenant is the designated tenant used when configuring in-band management IP addresses for Cisco APICs, leaf nodes, and spine nodes. This tenant provides the management address space and associated network constructs for infrastructure device management.
Why the other options are wrong
- A. The default tenant is for general application traffic, not infrastructure management addressing.
- B. The infra tenant is for fabric infrastructure policies, not in-band management IP configuration.
- C. The common tenant is for shared policies across tenants, not specific for management IP addressing.
Question 52
What is the purpose of the Overlay Multicast TEP in a Cisco ACI Multi-Site deployment?
Show answer and explanation
Correct answer: D. to perform head-end replication for BUM traffic
The Overlay Multicast TEP (Tunnel Endpoint) in ACI Multi-Site performs head-end replication for BUM (Broadcast, Unknown, Multicast) traffic. Instead of relying on native IP multicast across the ISN, the overlay multicast TEP replicates BUM frames to all remote sites, ensuring reliable delivery without requiring multicast infrastructure between sites.
Why the other options are wrong
- A. Unicast VXLAN traffic uses the standard overlay unicast TEP, not the multicast TEP.
- B. MP-BGP EVPN adjacencies are established between spine nodes directly, not through the multicast TEP.
- C. While multicast traffic is encapsulated, the primary purpose is head-end replication for BUM flooding, not general multicast group encapsulation.
Question 53
What are two descriptions of ACI Multi-Site? (Choose two.)
Show answer and explanation
Correct answer: D, E. ACI Multi-Site is a solution that supports a dedicated APIC cluster per site; The Inter-Site network routers should run OSPF to establish peering with the spines
ACI Multi-Site is a solution that supports a dedicated APIC cluster per site, with each site managing its own infrastructure independently while coordinating policies across sites. The Inter-Site network routers should run OSPF to establish peering with the spines in each ACI fabric, enabling proper routing and communication between sites. The Multi-Site orchestrator is a separate component (not attached to a single leaf), and while MP-BGP and DHCP relay may be useful, they are not required for all Multi-Site deployments, nor are they fundamental defining characteristics.
Why the other options are wrong
- A. OSPF and MP-BGP are not required on all Inter-Site routers; OSPF is recommended for spine peering, but MP-BGP and DHCP relay are not mandated.
- B. Multi-Site does not allow one APIC cluster to manage multiple sites; each site has its own dedicated APIC cluster.
- C. The Multi-Site orchestrator is not directly attached to a leaf; it is a separate management entity that coordinates across sites.
Question 54
Which two types of interfaces are supported on border leaf switches to connect to an external router? (Choose two.)
Show answer and explanation
Correct answer: B, E. subinterface with 802.1Q tagging; Switch Virtual Interface
Border leaf switches support two main interface types for connecting to external routers: subinterfaces with 802.1Q tagging (B) for traditional VLAN-based connectivity, and Switch Virtual Interfaces (E) for routing. Subinterfaces with VXLAN tagging are used within the fabric, not for external connections. FEX host interfaces are used for connecting to Cisco Fabric Extenders, not external routers. Out of band interfaces are management interfaces, not used for data plane external routing.
Why the other options are wrong
- A. VXLAN tagging on subinterfaces is used for fabric-internal communication, not external router connections.
- C. FEX host interfaces connect to Fabric Extenders, which are part of the ACI fabric infrastructure.
- D. Out of band interfaces serve management purposes and are not data plane interfaces for external routing.
Question 55
What does a bridge domain represent?
Show answer and explanation
Correct answer: B. Layer 2 forwarding construct
A bridge domain represents a Layer 2 forwarding construct in Cisco ACI. It is equivalent to a VLAN in traditional networking and defines the broadcast domain for endpoints connected to it.
Why the other options are wrong
- A. Layer 3 cloud refers to the VRF (Virtual Routing and Forwarding) construct, not the bridge domain.
- C. A tenant is a higher-level organizational construct that contains bridge domains and other resources.
- D. A physical domain defines physical ports and connectivity, not the forwarding behavior of a bridge domain.
Question 56
What must be configured to allow SNMP traffic on the APIC controller?
Show answer and explanation
Correct answer: B. contract under tenant mgmt
A contract under the tenant mgmt must be configured to allow SNMP traffic on the APIC controller. This contract defines the communication policy between SNMP clients and the APIC management interface, enabling SNMP monitoring and management functionality.
Why the other options are wrong
- A. The out-of-band management interface is a separate management path; SNMP access is controlled through contracts, not interface configuration alone.
- C. An SNMP relay policy is not the primary construct for allowing SNMP traffic to the APIC itself.
- D. An out-of-band bridge domain is related to out-of-band management networking, not the permission structure for SNMP access.
Question 57
An engineer must advertise a selection of external networks learned from a BGP neighbor into the ACI fabric. Which L3Out subnet configuration option creates an inbound route map for route filtering?
Show answer and explanation
Correct answer: C. Import Route Control Subnet
Import Route Control Subnet is the L3Out subnet configuration option that creates an inbound route map for route filtering. This subnet type is specifically used to control which external routes learned from BGP neighbors are imported into the ACI fabric, allowing the engineer to filter and advertise a selection of external networks.
Why the other options are wrong
- A. External Subnets for the External EPG defines the subnets that belong to the external network, not the route filtering mechanism.
- B. Shared Route Control Subnet is used for outbound route filtering and export policies, not inbound filtering.
- D. Shared Security Import Subnet applies security policies to imported routes rather than performing route filtering and control.
Question 58
Which Cisco APIC configuration prevents a remote network that is not configured on the bridge domain from being learned by the fabric?
Show answer and explanation
Correct answer: A. enable Limit IP Learning to Subnet
The 'Limit IP Learning to Subnet' setting on a bridge domain restricts IP address learning to only those addresses that belong to the configured subnet. This prevents the fabric from learning IP addresses from remote networks that are not configured on the bridge domain, providing security and stability by ensuring only expected subnets are learned as endpoints.
Why the other options are wrong
- B. Unicast Routing enables routing between subnets but does not prevent learning of remote network addresses.
- C. IP Data-plane Learning controls whether IP learning occurs from data plane traffic, but does not restrict it by subnet match.
- D. ARP Flooding to BD controls ARP flood behavior but does not prevent learning of non-matching subnets.
Question 59
What do Pods use to allow Pod-to-Pod communication in a Cisco ACI Multi-Pod environment?
Show answer and explanation
Correct answer: D. over Layer 3 IPN connectivity via spines
In ACI Multi-Pod environments, pod-to-pod communication occurs over Layer 3 through the IPN (Inter-Pod Network) via spines. The spine nodes in each pod connect to the IPN and facilitate the inter-pod traffic exchange, enabling VXLAN overlay connectivity and policy synchronization across pods.
Why the other options are wrong
- A. Spines are not directly connected back-to-back; they connect through an intermediary IP network.
- B. Border leafs handle Layer 3 Out connectivity to external networks, not pod-to-pod communication.
- C. While the IPN is involved, communication occurs via spines, not border leafs for pod-to-pod traffic.
Question 60
When Cisco ACI connects to an outside Layers 2 network, where does the ACI fabric flood the STP BPDU frame?
Show answer and explanation
Correct answer: C. within the access encap VLAN
When Cisco ACI connects to an external Layer 2 network, STP BPDU frames are flooded within the access encap VLAN. The access encap VLAN is the VLAN that carries the Layer 2 traffic between the ACI fabric and external switches. BPDUs are restricted to this encapsulation VLAN to maintain proper spanning tree operation across the fabric boundary while isolating BPDU traffic from other VLANs and traffic types.
Why the other options are wrong
- A. Bridge domains are logical constructs within ACI; STP BPDUs are flooded at the VLAN level in the access encapsulation.
- B. The APIC is a controller and does not participate in data plane BPDU flooding.
- D. STP BPDUs are not flooded between spine and leaf switches; they remain within the access encap VLAN on the fabric edge.
Question 61
An engineer must ensure that Cisco ACI flushes the appropriate endpoints when a topology change notification message is received in an MST domain. Which three steps are required to accomplish this goal? (Choose three.)
Show answer and explanation
Correct answer: C, E, F. Bind the spanning tree policy to the switch policy group; Create a new region policy under the spanning tree policy; Map VLAN range to MST instance number.
To ensure proper endpoint flushing upon topology change notifications in an MST domain, three steps are required: Create a new region policy under the spanning tree policy to define the MST region configuration, Associate the STP interface policy to the appropriate interface policy group to enable BPDU processing on interfaces, and Map VLAN range to MST instance number to properly associate VLANs with MST instances so topology changes trigger appropriate endpoint learning updates.
Why the other options are wrong
- A. Enabling BPDU interface controls is part of the configuration but is not a separate required step; it is incorporated within the STP interface policy configuration.
- B. Configuring a new STP interface policy alone is insufficient without associating it to the appropriate interface policy group.
- D. Binding the spanning tree policy to the switch policy group affects fabric-wide STP behavior but is not a specific requirement for MST endpoint flushing on topology changes.
Question 62
A Cisco APIC is configured with RADIUS authentication as the default. The network administrator must ensure that users can access the APIC GUI with a local account if the RADIUS server is unreachable. Which action must be taken to accomplish this goal?
Show answer and explanation
Correct answer: B. Reference the “local” realm in the fallback domain
To ensure local account access when RADIUS is unavailable, the fallback domain must be configured to reference the local realm. The fallback domain provides an alternative authentication method when the primary authentication server is unreachable, allowing administrators to maintain access to the APIC GUI using local credentials.
Why the other options are wrong
- A. Console authentication uses the console realm, not RADIUS, and doesn't address GUI fallback access.
- C. Creating an additional login domain is unnecessary; fallback configuration within existing domains is the proper approach.
- D. The fallback check alone does not specify which realm to use; it must be paired with explicit local realm configuration.
Question 63
A bridge domain for a new endpoint group in the Cisco ACI fabric must meet these requirements: • The bridge domain must function as the default gateway for the subnet so that routing remains within the Cisco ACI fabric. • ARP requests must be managed via Layer 3 unicast packets or be dropped to reduce excessive broadcast traffic. • The impact of misconfigured virtual machines must be kept to a minimum by preventing IP addresses outside of the configured subnet from being routed. Which set of actions must be taken?
Show answer and explanation
Correct answer: A. Disable ARP Flooding. Enable Limit IP Learning to Subnet. Enable Unicast Routing on the bridge domain and configure a subnet.
To meet the requirements, Disable ARP Flooding so ARP requests are managed via unicast Layer 3 packets rather than broadcast, preventing excessive broadcast traffic. Enable Limit IP Learning to Subnet to prevent IP addresses outside the configured subnet from being routed, minimizing impact from misconfigured VMs. Enable Unicast Routing on the bridge domain and configure a subnet so the bridge domain functions as the default gateway with routing remaining within the ACI fabric.
Why the other options are wrong
- B. Setting Multi-Destination Flooding to Flood in BD increases broadcast traffic, which contradicts the requirement to reduce excessive broadcast traffic through ARP management.
- C. Enabling ARP Flooding would increase broadcast traffic instead of managing ARP via unicast, contradicting the stated requirement to reduce excessive broadcast traffic.
- D. Setting L2 Unknown Unicast to Flood increases unnecessary traffic flooding, and disabling Endpoint Retention Policy is not necessary to meet the stated requirements.
Question 64
An engineer is implementing Cisco ACI at a large platform-as-a-service provider using APIC controllers, 9396PX leaf switches, and 9336PQ spine switches. The leaf switch ports are configured as IEEE 802.1p ports. Where does the traffic exit from the EPG in IEEE 802.1p mode in this configuration?
Show answer and explanation
Correct answer: A. from leaf ports tagged as VLAN 0
In IEEE 802.1p mode on Cisco ACI leaf switches, traffic exits from EPG ports tagged with VLAN 0. VLAN 0 is used in 802.1p priority tagging where only the priority bits are set without a VLAN ID, allowing QoS prioritization without explicit VLAN assignment.
Why the other options are wrong
- B. Untagged ports do not apply the 802.1p tagging mechanism which requires VLAN tag presence.
- C. VLAN 4094 is used in specific contexts but not for standard 802.1p EPG traffic egress.
- D. VLAN 1 is the default VLAN but is not the designated tag for 802.1p mode traffic in ACI.
Question 65
In the context of VMM, which protocol between ACI leaf and compute hosts ensures that the policies are pushed to the leaf switches for immediate and on demand resolution immediacy?
Show answer and explanation
Correct answer: B. LLDP
LLDP (Link Layer Discovery Protocol) is the protocol used between ACI leaf nodes and compute hosts to ensure policies are pushed to leaf switches for immediate and on-demand resolution immediacy in VMM domain configurations. LLDP provides the discovery mechanism that triggers policy download.
Why the other options are wrong
- A. VXLAN is an encapsulation protocol for overlay networks, not a discovery mechanism for policy push.
- C. IS-IS is an interior gateway protocol used for routing, not for VM discovery or policy distribution.
- D. STP is a bridge protocol for loop prevention, unrelated to VMM policy distribution.
Question 66
Which protocol does ACI use to securely sane the configuration in a remote location?
Show answer and explanation
Correct answer: A. SCP
ACI uses SCP (Secure Copy Protocol) to securely save and transfer configuration backups to remote locations. SCP operates over SSH, providing encryption for both authentication and data transfer, making it the secure method for configuration export and backup operations.
Why the other options are wrong
- B. HTTPS is used for web interface access and API communication but not specifically for configuration backup transfer protocols.
- C. TFTP is an unencrypted, insecure protocol inappropriate for sensitive configuration data.
- D. FTP is unencrypted and insecure, not suitable for configuration backup purposes.
Question 67
An engineer must configure a Layer 3 connection to the WAN router. The hosts in production VRF must access WAN subnets. The engineer associates EPGs in the production VRF with the external routed domain. Which action completes the task?
Show answer and explanation
Correct answer: B. Configure the External Subnets for the External EPG scope for the external EPG.
To enable hosts in the production VRF to access WAN subnets through an external routed domain, the External Subnets must be configured for the external EPG with appropriate scope settings. This allows the ACI fabric to advertise and route traffic to the WAN subnets through the external domain connection.
Why the other options are wrong
- A. Export Route Control Subnet scope controls what routes are advertised outbound, not the import of external subnets into the VRF.
- C. Import Route Control Subnet scope is used for route filtering on import, but the primary configuration for external subnets is via the External Subnets configuration.
- D. Shared Route Control Subnet scope is used for shared routing scenarios, not for the standard Layer 3 external connectivity pattern described.
Question 68
An engineer must perform a Cisco ACI fabric upgrade that minimizes the impact on user traffic and allows only permitted users to perform an upgrade. Which two configuration steps should be taken to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: D, E. Grant the fabric administrator role to a user who performs an upgrade; Divide switches into two or more maintenance groups
Dividing switches into multiple maintenance groups allows staggered upgrades that minimize traffic impact by ensuring continuous fabric operation during the upgrade process. Granting the fabric administrator role ensures only authorized users can perform upgrades, meeting both the minimization of traffic impact and access control requirements.
Why the other options are wrong
- A. Tenant-ext-admin is a tenant-level role and does not provide the necessary fabric-wide upgrade permissions.
- B. APIC maintenance groups control APIC upgrades, not switch upgrades; switch maintenance groups are required for staged switch upgrades.
- C. Combining all switches into a single upgrade group would upgrade all switches simultaneously, maximizing traffic impact rather than minimizing it.
Question 69
Which table holds IP address, MAC address and VXLAN/VLAN information on a Cisco ACI leaf?
Show answer and explanation
Correct answer: A. endpoint
The endpoint table on a Cisco ACI leaf switch holds IP addresses, MAC addresses, and VXLAN/VLAN information. This table tracks all known endpoints and their network encapsulation details for proper forwarding.
Why the other options are wrong
- B. The adjacency table tracks neighboring switches and devices, not endpoint IP and MAC mappings.
- C. The RIB (Routing Information Base) is for Layer 3 route information, not comprehensive endpoint data.
- D. The ARP table stores only IP-to-MAC mappings, not VXLAN/VLAN information.
Question 70
A bridge domain for an EPG called “Web Servers” must be created in the Cisco APIC. The configuration must meet these requirements: • Only traffic to known MAC addresses must be allowed to reduce noise. • The multicast traffic must be limited to the ports that are participating in multicast routing. • The endpoints within the bridge domain must be kept in the endpoint table for 20 minutes without any updates. Which set of steps configures the bridge domain that satisfies the requirements?
Show answer and explanation
Correct answer: B. Set L2 Unknown Unicast to Hardware Proxy. Configure L3 Unknown Multicast Flooding to Optimized Flood. Create an Endpoint Retention Policy with a Local Endpoint Aging Interval of 1200 seconds.
To restrict traffic to known MAC addresses, L2 Unknown Unicast must be set to Hardware Proxy rather than flooding. For multicast, Optimized Flood limits multicast to participating ports. The endpoint retention requirement of 20 minutes equals 1200 seconds, which is configured in a custom Endpoint Retention Policy with Local Endpoint Aging Interval set to 1200 seconds.
Why the other options are wrong
- A. Setting L2 Unknown Unicast to Flood allows traffic to unknown MAC addresses, violating the requirement.
- C. Flood in BD and Flood settings allow unknown unicast to propagate, increasing noise.
- D. ARP Flooding checkbox and Remote Endpoint Aging are not the correct mechanisms; Local Endpoint Aging is required.
Question 71
Which endpoint learning operation is completed on the egress leaf switch when traffic is received from an L3Out?
Show answer and explanation
Correct answer: C. No source MAC or IP address of the traffic is learned as a remote endpoint.
When traffic is received from an L3Out on the egress leaf switch, no source MAC or IP address is learned as an endpoint. This is by design because L3Out traffic represents external routing domains beyond the fabric's direct control. The fabric does not treat external L3 sources as local managed endpoints, avoiding endpoint database pollution and maintaining proper boundary between fabric-managed and external network domains.
Why the other options are wrong
- A. L3Out sources are not learned as local endpoints; they remain external to the fabric's endpoint management.
- B. L3Out sources are not learned as remote endpoints within the fabric's endpoint database.
- D. L3Out traffic does not result in IP address learning as remote endpoints; no endpoint learning occurs from L3Out sources.
Question 72
A customer must upgrade the Cisco ACI fabric to use a feature from the new code release. However, there is no direct path from the current release to the desired one. Based on the Cisco APIC Upgrade/Downgrade Support Matrix, the administrator must go through one intermediate release. Which set of steps must be taken to upgrade the fabric to the new release?
Show answer and explanation
Correct answer: A. 1. Upgrade the APICs to an interim release. 2. Upgrade the switches to an interim release. 3. Upgrade the APICs to the targeted release. 4. Upgrade the leaf and spine switches to the targeted release.
When no direct upgrade path exists, the correct sequence is: upgrade APICs first to the interim release, then upgrade switches to the interim release, followed by upgrading APICs to the target release, and finally upgrading switches to the target release. This ensures APIC and fabric compatibility is maintained throughout the multi-stage upgrade process.
Why the other options are wrong
- B. Upgrading leaf and spine switches separately to the target release before finishing the interim release creates version mismatches.
- C. Attempting to upgrade leaf and spine switches directly to the target release skips the required interim release step.
- D. Upgrading APICs directly to the target release before an interim release step is not supported by the upgrade matrix.
Question 73
An engineer deploys a two-pod Cisco ACI Multi-Pod environment. Why should no more than two Cisco APIC controllers be deployed in the same pod?
Show answer and explanation
Correct answer: B. to avoid losing all replicas of a shard if a pod fails
In Cisco ACI Multi-Pod, the APIC cluster uses sharding to replicate data across controllers. Limiting each pod to no more than two APIC controllers ensures that no single pod contains more than two replicas of any shard. If a pod fails, at least one replica of each shard remains available in other pods, preventing complete data loss and maintaining cluster availability.
Why the other options are wrong
- A. APIC capacity scaling is not directly related to the number of controllers per pod; this addresses availability, not scaling.
- C. Hair-pinning of traffic to primary APIC is not a concern with multiple controllers per pod since traffic routing is optimized regardless.
- D. Local controller access is important but is achieved through proper placement; the two-controller limit is specifically about data redundancy, not universal local access.
Question 74
A network administrator configures AAA inside the Cisco ACI fabric. The authentication goes through the local users if the TACACS+ server is not reachable. If the Cisco APIC is out of the cluster, the access must be granted through the fallback domain. Which configuration set meets these requirements?
Show answer and explanation
Correct answer: D. Ping Check: False Default Authentication Realm: TACACS+ Fallback Check: True
Setting Ping Check to False, Default Authentication Realm to TACACS+, and Fallback Check to True meets the requirements: TACACS+ is the primary authentication method, ping check is disabled so it won't block attempts, and fallback check is enabled to allow the local domain to authenticate users when the APIC cluster is unavailable.
Why the other options are wrong
- A. Setting Default Authentication Realm to Local contradicts the requirement for TACACS+ as primary.
- B. Setting Fallback Check to False prevents fallback to local authentication when the APIC is out of cluster.
- C. Setting Default Authentication Realm to Local makes it primary rather than TACACS+.
Question 75
An engineer is extending EPG connectivity to an external network. The external network houses the Layer 3 gateway and other end hosts. Which ACI bridge domain configuration should be used?
Show answer and explanation
Correct answer: B. Forwarding: Custom L2 Unknown Unicast: Flood L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enabled
When extending EPG connectivity to an external network with a Layer 3 gateway, the bridge domain must use Flood mode for L2 unknown unicast to allow proper ARP and host discovery across the external interface. ARP flooding must be enabled to support ARP resolution for the external gateway and hosts. Hardware Proxy mode restricts flooding to the spine level, which is inappropriate for external connectivity where full fabric flooding may be needed.
Why the other options are wrong
- A. Hardware Proxy for L2 unknown unicast is not appropriate for external network extension where ARP needs to reach the external gateway.
- C. Hardware Proxy mode and disabled ARP flooding would prevent proper communication with external hosts and gateways.
- D. Disabling ARP flooding prevents the necessary ARP resolution for external network connectivity.
Question 76
Which method does the Cisco ACI fabric use to load-balance multi-destination traffic?
Show answer and explanation
Correct answer: A. forwarding tag trees
Cisco ACI uses forwarding tag trees to load-balance multi-destination traffic across the fabric. Forwarding tags create spanning tree-like topologies for specific traffic flows, allowing ACI to efficiently distribute broadcast, multicast, and flooded traffic while avoiding loops.
Why the other options are wrong
- B. PIM routing is a multicast routing protocol but not the primary mechanism ACI uses for load-balancing multi-destination traffic.
- C. While spanning trees conceptually relate to loop prevention, ACI uses forwarding tag trees rather than traditional STP.
- D. Shortest-path trees are used in multicast protocols but not the load-balancing method for multi-destination traffic in ACI.
Question 77
An engineer configures a Multi-Pod system with the default getaway residing outside of the ACI fabric for a bridge domain. Which setting should be configured to support this requirement?
Show answer and explanation
Correct answer: A. disable Limit IP Learning to Subnet
When the default gateway for a bridge domain resides outside the ACI fabric, you must disable 'Limit IP Learning to Subnet'. This setting allows the ACI fabric to learn and route traffic to IP addresses outside the configured subnet, enabling communication with external gateways beyond the fabric boundaries.
Why the other options are wrong
- B. Disabling IP Data-plane Learning affects how endpoints are learned but does not specifically enable external gateway support.
- C. Disabling Unicast Routing would prevent routing entirely, which is not the requirement; routing must remain enabled.
- D. Disabling Advertise Host Routes affects route advertisement but does not directly support external gateway scenarios.
Question 78
What represents the unique identifier of an ACI object?
Show answer and explanation
Correct answer: D. distinguished name
The distinguished name (DN) is the unique identifier of an ACI object within the Management Information Tree (MIT). The DN is a hierarchical path that uniquely identifies every object in the ACI fabric and is used for object reference in APIs and policies.
Why the other options are wrong
- A. A URI (Universal Resource Identifier) is a web addressing concept; while ACI uses URIs in REST APIs, the DN is the unique object identifier.
- B. An API is a communication interface, not an identifier for ACI objects.
- C. The Management Information Tree (MIT) is the hierarchical structure containing objects, not the identifier itself.
Question 79
How is broadcast forwarded in Cisco ACI Multi-Pod after ARP flooding is enabled?
Show answer and explanation
Correct answer: C. Broadcast frames are forwarded inside the pod and across the IPN using the multicast address that is associated to the bridge domain.
After ARP flooding is enabled, broadcast frames in Multi-Pod deployments are forwarded within a pod and across the IPN using the multicast address associated with the bridge domain, enabling efficient broadcast distribution across the fabric infrastructure.
Why the other options are wrong
- A. Ingress replication on spines is not the mechanism used when ARP flooding is enabled; multicast is the preferred method.
- B. Within-pod flooding on fabric ports does not account for cross-IPN broadcast forwarding requirements.
- D. Spines forwarding directly to IPN routers is not the correct broadcast forwarding model for bridge domain multicast.
Question 80
An engineer wants to filter the System Faults page and view only the active faults that are present in the Cisco ACI fabric. Which two lifecycle stages must be selected for filtering? (Choose two.)
Show answer and explanation
Correct answer: A, E. Raised; Soaking
To view only active faults in the System Faults page, the lifecycle stages 'Raised' and 'Soaking' must be selected. A fault that is 'Raised' is actively occurring, and 'Soaking' indicates the fault condition is being monitored and verified. These two stages represent faults that are currently present in the fabric, whereas 'Clearing' indicates a fault is resolving and 'Retaining' relates to fault history retention.
Why the other options are wrong
- B. Retaining is a lifecycle stage related to how long faults are retained in history, not indicative of active faults.
- C. Clearing indicates a fault is resolving and is not an active fault condition; Soaking alone is only half of the active state.
- D. Clearing indicates a fault is resolving, not that it is currently active in the fabric.
Question 81
A Cisco ACI endpoint group must have its gateway address migrated out of the ACI fabric. An engineer configures EPG-TEST with a static port binding and configures the encap VLAN with the required VLAN. Which configuration set must be used on the bridge domain to meet these requirements?
Show answer and explanation
Correct answer: C. L2 Unknown Unicast: Flood Unicast Routing: Disabled ARP Flooding: Enabled
When the gateway address is migrated outside the ACI fabric, Unicast Routing must be Disabled on the bridge domain since the ACI fabric is no longer the gateway. L2 Unknown Unicast should be set to Flood to allow packets destined for the external gateway to be flooded on the static port binding. ARP Flooding must be Enabled so ARP requests for the external gateway are flooded to reach the external device.
Why the other options are wrong
- A. Hardware Proxy and Enabled Unicast Routing are incorrect; when the gateway is external, unicast routing should be disabled on the bridge domain.
- B. Disabling ARP Flooding prevents ARP requests from reaching the external gateway, making this configuration unable to support external gateway communication.
- D. Enabled Unicast Routing is incorrect when the gateway resides outside the fabric; the bridge domain should not route internally in this scenario.
Question 82
Which two statements regarding ACI Multi-Site are true? (Choose two.)
Show answer and explanation
Correct answer: C, E. ACI Multi-Site is a solution that supports a dedicated APIC cluster per site; The Inter-Site network routers should run OSPF to establish peering with the spines.
ACI Multi-Site supports a dedicated APIC cluster per site, allowing independent management and control while still enabling coordinated policies and endpoint information exchange across sites. Additionally, OSPF is used in the Inter-Site network to establish routing connectivity; routers in the inter-site network run OSPF to peer with spine nodes and establish connectivity, not MP-BGP or DHCP relay as those are not part of the Inter-Site network protocol requirements.
Why the other options are wrong
- A. The Multi-Site orchestrator does not require direct attachment to a single leaf; it communicates through standard management interfaces.
- B. DHCP relay and MP-BGP are not required on Inter-Site network routers; OSPF is the primary requirement for connectivity.
- D. Multi-Site requires separate APIC clusters per site, not a single APIC cluster managing multiple sites.
Question 83
Which statement regarding ACI Multi-Pod and TEP pool is true?
Show answer and explanation
Correct answer: B. A different TEP pool must be assigned to each Pod.
Each Pod in an ACI Multi-Pod fabric must be assigned a unique and different TEP (Tunnel Endpoint) pool. This ensures that tunnel endpoints across different pods have distinct, non-overlapping addresses, preventing conflicts and allowing proper pod-to-pod communication through the IPN network.
Why the other options are wrong
- A. IPN network IP addresses must not overlap with any TEP pool to maintain routing integrity and prevent address conflicts.
- C. The TEP pool is not split across pods; instead, each pod receives its own complete and unique TEP pool assignment.
- D. Each Pod must have its own distinct TEP pool, not a shared pool used across all pods.
Question 84
An engineer wants to monitor all configuration changes, threshold crossing, and link-state transitions in a Cisco ACI fabric. Which action must be taken to receive the required messages?
Show answer and explanation
Correct answer: C. Include Audit Logs and Events in the Syslog source policy.
To receive messages about configuration changes (Audit Logs), threshold crossing, and link-state transitions (Events), the engineer must include Audit Logs and Events in the Syslog source policy. This configuration directs the appropriate log sources to the Syslog destination, ensuring all required event types are captured and forwarded to the monitoring system.
Why the other options are wrong
- A. Adding Faults and Events to the monitor policy does not include Audit Logs, which are necessary to capture configuration changes.
- B. Session Logs track user sessions and are not needed for the specific monitoring requirements of configuration changes and link-state transitions.
- D. Session Logs are unnecessary for this use case; Audit Logs and Events are the correct combination for the specified requirements.
Question 85
What must be configured to redistribute externally learned OSPF routes within the ACI fabric?
Show answer and explanation
Correct answer: B. BGP Route Reflector
ACI distributes external routes learned on a border leaf to other leaves using MP-BGP. The spines act as BGP route reflectors, so a BGP Route Reflector policy must be configured. Without it, externally learned OSPF routes stay on the border leaf.
Why the other options are wrong
- A. Route control profiles filter routes but do not provide the fabric-wide distribution mechanism.
- C. The inter-leak route map is created automatically, and on its own does not distribute routes to other leaves.
- D. PIM Sparse Mode is for multicast and has nothing to do with distributing OSPF routes.
Question 86
An application team tells the Cisco ACI network administrator that it wants to monitor the statistics of the unicast and BUM traffic that are seen in a certain EPG. Which statement describes the collection statistics?
Show answer and explanation
Correct answer: D. The collection of statistics is enabled on the EPG level by enabling the statistics for unicast and BUM traffic.
In Cisco ACI, statistics collection for unicast and BUM (Broadcast, Unknown unicast, Multicast) traffic is controlled at the EPG level. An administrator can enable these statistics individually on each EPG to monitor the specific traffic types needed without affecting all EPGs in the tenant.
Why the other options are wrong
- A. Statistics do not require all EPGs in a tenant to be enabled; collection can be selective per EPG.
- B. ACI does capture statistics at the EPG level independent of contracts; traffic statistics are available at the EPG source and destination.
- C. EPG statistics collection is not restricted to VMM domains only; physical domain EPGs also support statistics collection.
Question 87
A customer creates Layer 3 connectivity to the outside network. However, only border leaf switches start receiving destination updates to other networks from the newly created L3Out. The updates must also be propagated to other Cisco ACI leaf switches. The L3Out is linked with the EPGs via a contract. Which action must be taken in the pod policy group to accomplish this goal?
Show answer and explanation
Correct answer: A. Apply a BGP route reflector policy.
A BGP route reflector policy applied to the pod policy group enables border leaf switches to propagate learned external routes to other leaf switches within the fabric. This allows all leaf switches to receive and use the destination updates from the L3Out, not just the border leaves.
Why the other options are wrong
- B. COOP policy manages endpoint learning and mobility, not route propagation from external sources.
- C. IS-IS policy controls internal fabric routing but does not address propagation of L3Out routes to all leaves.
- D. Access management policy deals with user and device authentication, not route propagation.
Question 88
An engineer needs to deploy a leaf access port policy group in ACI Fabric to support the following requirements: • Control the amount of application data flowing into the system • Allow the newly connected device to auto-negotiate link speed with the leaf switch Which two ACI policies must be configured to achieve these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. link level policy; ingress data plane policing policy
To control application data flow into the system, an ingress data plane policing policy (D) must be configured to rate-limit incoming traffic. To allow auto-negotiation of link speed, a link level policy (A) must be configured, which contains settings for speed negotiation and other physical layer parameters. These two policies together fulfill both requirements when added to the access port policy group.
Why the other options are wrong
- B. L2 interface policy controls Layer 2 parameters like VLAN handling but not link speed negotiation or traffic policing.
- C. Slow drain policy addresses congestion management on egress, not ingress data policing or link speed negotiation.
- E. Ingress control plane policing policy manages control plane traffic, not application data plane traffic.
Question 89
In a Cisco ACI Multi-Site fabric, the Inter-Site BUM Traffic Allow option is enabled in a specific stretched bridge domain. What is used to forward BUM traffic to all endpoints in the same broadcast domain?
Show answer and explanation
Correct answer: A. ingress replication on the spines in the source site
In Cisco ACI Multi-Site deployments with Inter-Site BUM Traffic Allow enabled, broadcast, unknown unicast, and multicast traffic is forwarded using ingress replication on the spine switches in the source site. The source spine replicates BUM traffic to all remote sites through the Inter-Pod Network (IPN), ensuring all endpoints in the stretched bridge domain receive the traffic regardless of their location.
Why the other options are wrong
- B. Egress replication on destination leaf switches is not the mechanism used for inter-site BUM traffic forwarding in ACI Multi-Site.
- C. While source leaves may participate in local replication, egress replication on source leaves does not forward BUM traffic across sites.
- D. Ingress replication on destination site spines receives traffic but does not originate the inter-site BUM forwarding decision.
Question 90
What is MP-BGP used for in Cisco ACI fabric?
Show answer and explanation
Correct answer: C. MP-BGP VPNv4 AF is used to propagate L3Out routes that are received from a border leaf to the fabric
MP-BGP with the VPNv4 address family is used within the ACI fabric (specifically between border leafs and the spine fabric) to propagate Layer 3 Out routes that are learned from external routers back into the fabric. This allows the fabric to distribute external routes and maintain routing consistency across the infrastructure. MP-BGP is not used as the protocol on the L3Out itself with external routers; instead, standard BGP or OSPF is used there. MP-BGP Layer 2 VPN EVPN is used for endpoint information, not routes, and Multi-Pod uses different mechanisms.
Why the other options are wrong
- A. MP-BGP VPNv4 is not the protocol used directly between a border leaf and external routers; standard BGP is used there.
- B. MP-BGP Layer 2 VPN EVPN is used for endpoint and MAC/IP information propagation, not for L3Out routes.
- D. MP-BGP VPNv4 is not the mechanism used between spines in Multi-Pod; Multi-Pod uses different fabric peering mechanisms.
Question 91
Which statement about ACI syslog is true?
Show answer and explanation
Correct answer: D. Switches send syslog messages directly to the destinations.
In ACI, switches send syslog messages directly to configured syslog destinations without requiring mediation through the spine or APIC controllers. This direct delivery model reduces latency and dependency on fabric components, allowing leaf and spine switches to independently forward syslog events to remote logging servers.
Why the other options are wrong
- A. Multiple syslog destinations can be configured, and different scopes can be sent to different destinations.
- B. Syslog messages are sent directly from switches to destinations, not routed through spine switches.
- C. APIC does not act as an intermediary for syslog message delivery; switches communicate directly with syslog servers.
Question 92
An engineer is implementing a connection that represents an external bridged network. Which two configurations are used? (Choose two.)
Show answer and explanation
Correct answer: B, D. Layer 2 outside; Static path binding
Implementing a connection representing an external bridged network requires Layer 2 Outside (L2Out) configuration to define the external Layer 2 domain and Static Path Binding to map specific external ports or port channels to the EPG. Together, these enable proper bridging between ACI and external Layer 2 networks.
Why the other options are wrong
- A. Layer 2 remote fabric is not a standard ACI configuration option for external bridged networks.
- C. Layer 2 internal relates to internal ACI fabric connectivity, not external bridged network connections.
- E. VXLAN outside is not a standard configuration; external connectivity uses Layer 2 Outside, not VXLAN-based mechanisms.
Question 93
What is the advantage of implementing an active-active firewall cluster that is stretched across separate pods when anycast services are configured?
Show answer and explanation
Correct answer: D. The local pod anycast node is preferred by the local spines.
When anycast services are configured with an active-active firewall cluster stretched across pods, the local pod anycast node is preferred by local spines, ensuring that traffic from endpoints in a pod preferentially flows through the firewall instance in that same pod, reducing inter-pod traffic and optimizing performance.
Why the other options are wrong
- A. Transparent mode deployment across pods is a characteristic of the deployment method, not an advantage of anycast services.
- B. Different MAC/IP combinations per pod are configured at the firewall level independently, not as an advantage of anycast.
- C. Load balancing between clustered firewalls within a pod is not the primary advantage; preference for local nodes is the key benefit.
Question 94
An engineer must advertise a bridge domain subnet out of the ACI fabric to an OSPF neighbor. Which two configuration steps are required? (Choose two.)
Show answer and explanation
Correct answer: B, E. Configure Subnet scope to Advertised Externally; Add L3Out profile to the bridge domain using Associated L3Outs section
To advertise a bridge domain subnet out of the fabric via OSPF, two steps are required: first, configure the subnet scope to Advertised Externally on the subnet object to mark it for external advertisement, and second, create a Route Control Profile with export direction under the External EPG to define the export policy and control which routes are advertised to external neighbors.
Why the other options are wrong
- A. The External Subnet flag is not the correct mechanism; subnet scope configuration is used instead.
- C. Configuring the subnet under EPG level is incorrect; it must be under the bridge domain.
- D. An L3Out profile association is not required for route advertisement; Route Control Profile with proper direction handles this.
Question 95
On which two interface types should a user configure storm control to protect against broadcast traffic? (Choose two.)
Show answer and explanation
Correct answer: B, D. port channel on a single leaf switch; endpoint-facing trunk interface
Storm control should be configured on port channels on individual leaf switches and on endpoint-facing trunk interfaces. These are the interfaces where endpoints connect and where broadcast storms are most likely to originate. Port channels on leaf switches provide protection for local endpoints, while endpoint-facing trunk interfaces directly connect to end-user devices or access networks. APIC-facing and fabric uplink interfaces should not have storm control enabled as they are control and infrastructure paths.
Why the other options are wrong
- A. APIC-facing interfaces carry management and control traffic and should not have storm control applied.
- C. Configuring storm control on all leaf interfaces would impact critical fabric traffic and is not recommended.
- E. Fabric uplink interfaces carry spine-leaf control plane traffic and should not have storm control restrictions applied.
Question 96
The company ESXi infrastructure is hosted on the Cisco UCS-B Blade Servers. The company decided to take advantage of ACI VMM integration to enable consistent enforcement of policies across virtual and physical workloads. The requirement is to prevent the packet loss between the distributed virtual switch and the ACI fabric. Which setting must be implemented on a vSwitch policy to accomplish this goal?
Show answer and explanation
Correct answer: B. MAC Pinning
MAC Pinning is the vSwitch policy setting that prevents packet loss between a distributed virtual switch and the ACI fabric. MAC Pinning ensures that traffic from a specific VM is consistently transmitted through a particular physical NIC in a consistent manner, avoiding packet reordering and loss that could occur if traffic from the same source is load-balanced across multiple uplinks unpredictably. This provides the stable, deterministic forwarding path required for ACI policy enforcement consistency.
Why the other options are wrong
- A. Static Channel is not a standard vSwitch policy setting in this context.
- C. LACP creates a port channel but does not inherently prevent packet loss from unbalanced distribution across links.
- D. LLDP is a discovery protocol and does not affect packet forwarding behavior.
Question 97
How is an EPG extended outside of the ACI fabric?
Show answer and explanation
Correct answer: D. Statically assign a VLAN ID to a leaf port in an EPG.
An EPG is extended outside the ACI fabric by statically assigning a VLAN ID to a leaf port in an EPG. This allows external devices connected to that port to participate in the EPG and receive its policies.
Why the other options are wrong
- A. External bridged networks are a different construct and are not the primary method for extending EPGs outside the fabric.
- B. External routed networks are used for Layer 3 connectivity outside the fabric, not for extending EPGs themselves.
- C. Enabling unicast routing within an EPG is a Layer 3 function and does not extend the EPG outside the fabric.
Question 98
Which type of port is used for in-band management within ACI fabric?
Show answer and explanation
Correct answer: C. leaf access port
Leaf access ports are used for in-band management within the ACI fabric. These ports connect to servers and endpoints and carry both data traffic and management traffic through the fabric itself. In-band management uses the same network infrastructure as data traffic, flowing through leaf and spine switches, unlike out-of-band management which uses dedicated management ports or interfaces.
Why the other options are wrong
- A. Spine switch ports carry fabric traffic between spines and leaves, not in-band management specifically.
- B. APIC console ports are physical serial/console connections for out-of-band management, not in-band.
- D. Management ports are dedicated out-of-band interfaces separate from the ACI fabric data path.
Question 99
An engineer must configure a group of servers with a contract that uses TCP port 80. The EPG that contains the web servers requires an external Layer 3 cloud to initiate communication. Which action must be taken to meet these requirements?
Show answer and explanation
Correct answer: A. Configure the EPG as a provider and L3 out as consumer of the contract.
To allow external networks to initiate communication with internal servers, the EPG containing the web servers must be configured as the provider of the contract, while the L3Out is configured as the consumer. This contract direction allows inbound traffic from external sources through the L3Out to reach the web server EPG on TCP port 80.
Why the other options are wrong
- B. OSPF route exchange is for dynamic routing information, not for contract-based communication policy.
- C. Taboo contracts are used to deny traffic, which is opposite to the requirement of allowing communication.
- D. Configuring the EPG as consumer and L3Out as provider reverses the required direction and would block inbound traffic from external sources.
Question 100
A customer must deploy three Cisco ACI based data centers. Each site must be separated from the others. Which characteristic of Cisco ACI Multi-Pod makes it unsuitable for this deployment?
Show answer and explanation
Correct answer: B. requires all pods to share the same Cisco APIC cluster
Cisco ACI Multi-Pod requires all pods to share the same Cisco APIC cluster, meaning the pods are part of a single fabric and cannot be completely separated from each other. This makes Multi-Pod unsuitable for a deployment where three data centers must be completely separated, as each site would need its own independent APIC cluster and fabric.
Why the other options are wrong
- A. Multi-Pod does not create virtual pods; all pods share the same APIC cluster and fabric infrastructure.
- C. While distance and scale limitations exist, the primary unsuitability for this use case is the requirement to share the same APIC cluster.
- D. Leaf switches in remote sites being part of the same fabric is actually the intended behavior, not the disqualifying factor for the stated requirement of complete site separation.
Question 101
Which two actions extend a Layer 2 domain beyond the ACI fabric? (Choose two.)
Show answer and explanation
Correct answer: D, E. extending the bridge domain out of the ACI fabric; extending the EPG out of the ACI fabric
Extending a Layer 2 domain beyond the ACI fabric requires extending the bridge domain out of the fabric through external Layer 2 connectivity, and extending the EPG out of the fabric to allow endpoint membership beyond the fabric boundaries. A bridge domain represents the Layer 2 forwarding domain, and the EPG defines which endpoints can communicate. Both must be extended to truly extend Layer 2 connectivity outside ACI. Routed domains and Layer 3 Out are Layer 3 constructs that do not extend Layer 2. Creating an external physical network is a configuration step but not itself an extension mechanism.
Why the other options are wrong
- A. Routed domains operate at Layer 3, not Layer 2, and do not extend Layer 2 domains.
- B. Layer 3 Out is a Layer 3 mechanism for routing traffic outside the fabric, not for extending Layer 2 domains.
- C. Creating an external physical network is a prerequisite configuration, not the action that extends Layer 2 domains themselves.
That was 101 of 404.
The full Cisco 300-620 DCACI pack has all 404 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 180 free as one PDF by email. Get the Half Pack →