300-620 Practice Questions

During the Cisco ACI fabric discovery process, the Application Policy Infrastructure Controller (APIC) relies on an internal VLAN to communicate with directly connected leaf switches and the entire fabric. This specific VLAN is officially known as the infrastructure VLAN (infra VLAN), which is chosen and assigned during the initial APIC setup. In the provided image_88894d.png CLI output, VLAN 3600 is mapped as the infrastructure VLAN (infra:default). The infrastructure VLAN facilitates DHCP-based IP address assignment for Tunnel Endpoints (TEPs), enables LLDP-based fabric discovery, and establishes the internal IS-IS routing necessary for the ACI underlay network.

A. Transit VLAN: This is utilized for Layer 2 and Layer 3 extensions to external networks and is not used for internal APIC-to-node fabric discovery.

C. Loopback VLAN: Loopbacks are associated with TEP IP addresses within the infrastructure VRF, but a loopback is a logical interface, not a Layer 2 discovery VLAN.

D. Fabric VLAN: While it operates over fabric ports, official Cisco documentation strictly designates the discovery and underlay bootstrapping VLAN as the infrastructure VLAN.

Cisco Application Centric Infrastructure Fundamentals, Release 6.0(x)," Cisco Systems, Document ID: cisco-aci-fundamentals-60x, Section: "Fabric Discovery,"

: "Cisco Application Centric Infrastructure (ACI) Design Guide," Cisco Systems, Document ID: cisco-application-centric-infrastructure-design-guide, Section: "Underlay Network,"

Extending an Endpoint Group (EPG) out of the ACI fabric using static path binding involves statically mapping a leaf port and a specific VLAN to an existing EPG. This configuration places the external endpoints connected via that path into the exact same EPG as the endpoints that are directly attached or dynamically learned within the fabric. Consequently, both external and internal endpoints share the same policy, bridge domain, and subnet configurations.

A. Endpoints must connect directly to the ACI leaf port: External endpoints can connect via an intermediate Layer 2 switch; they do not need to be directly attached to the ACI leaf port.

B. External endpoints are in a different bridge domain than the endpoints in the fabric: Because they are mapped to the same EPG, they are inherently tied to the same bridge domain as the internal endpoints.

C. Endpoint learning encompasses the MAC address only: ACI learns both MAC and IP addresses for endpoints in an EPG, including those connected via static path bindings.

- Cisco Systems. "Cisco APIC Basic Configuration Guide." Chapter: Endpoint Groups. Section: Statically Binding an EPG to a Port.

- Cisco Systems. "Cisco ACI Policy Model Guide." Section: EPGs and Static Paths.

A Cisco ACI Virtual Machine Manager (VMM) domain policy requires a VMM domain profile, which defines the connection parameters to the hypervisor manager (e.g., VMware vCenter). To make the VMM domain functional and provision network resources (such as creating port groups on a distributed virtual switch), the VMM domain must be associated with an Endpoint Group (EPG).

B. Static port bindings are used for physical bare-metal servers or unmanaged switches, not for dynamic VMM integration.

C. Layer 3 outside (L3Out) interfaces are used for external routing connectivity, not for VMM domain policy configuration.

D. IP address pool association is typically used for L4-L7 services or specific fabric configurations, not as a core requirement for basic VMM domain EPG association.

- Cisco ACI Virtualization Guide, Release 5.2(x), Chapter: "Virtual Machine Manager Domains", Section: "VMM Domain Profile", Paragraph 1.

- Cisco ACI Virtualization Guide, Release 5.2(x), Chapter: "Virtual Machine Manager Domains", Section: "Associating an EPG to a VMM Domain", Paragraph 1.

In a Cisco ACI architecture, Nexus 2000 Series Fabric Extenders (FEX) must be deployed using a straight-through topology, where each FEX is single-homed to one specific leaf switch. Additionally, the core ACI fabric must maintain a strict bipartite spine-leaf full-mesh topology, requiring every leaf to connect to every spine. Cisco ACI does not support dual-homing a single FEX to multiple leaf switches (Active-Active FEX or vPC-attached FEX), nor does it permit FEX devices or endpoints to connect directly to spine switches. Therefore, only the single-homed, straight-through FEX topology shown in option D strictly conforms to official Cisco ACI design and deployment guidelines.

A) It displays a dual-homed (Active-Active) FEX topology using vPC. While supported in standalone NX-OS mode, this design is explicitly unsupported in Cisco ACI mode.

B) It incorrectly depicts FEX modules connecting directly to spine switches. In an ACI architecture, all endpoints, including FEX devices, must connect exclusively to leaf switches.

C) It shows an invalid core fabric lacking required full-mesh connectivity between spine and leaf switches, while concurrently displaying the unsupported dual-homed FEX design.

Cisco Systems, Inc. "Cisco APIC Layer 2 Networking Configuration Guide, Release 5.2(x)." Chapter: Fabric Extender, Section: "FEX Supported Topologies." (Details strict requirement for single-homed, straight-through FEX connections in ACI and explicitly lists Active-Active FEX as unsupported).

Cisco Systems, Inc. "Cisco Application Centric Infrastructure (ACI) Design Guide." Section: ACI Fabric Topology and Hardware. (Provides architectural rules defining the full-mesh bipartite spine-leaf requirement and validates that spine switches cannot connect to FEX modules or endpoints).

The diagram depicts the logical dependency and containment hierarchy within a Cisco ACI Tenant.

1. VRF (Container 1): The Virtual Routing and Forwarding instance is the foundational Layer 3 networking context. It creates the unique IP address space for the tenant.
2. Bridge Domain (Container 2): The Bridge Domain (BD) represents a Layer 2 boundary (subnet) and must be associated with a VRF (Layer 3). Thus, it is placed below and linked to the VRF.
3. Application Profile (Container 3): The large enclosing box represents the Application Profile, which acts as a logical folder or container for grouping related endpoint configurations.
4. EPG (Container 4): The Endpoint Group (EPG) contains the actual endpoints (servers/VMs). EPGs reside inside an Application Profile and are linked to a Bridge Domain for network connectivity.

Cisco ACI Fundamentals Guide, Release 4.x, "The Policy Model" section.Confirms: "The application profile is a container for EPGs." and "A bridge domain... must be associated with a VRF."Cisco Application Centric Infrastructure (ACI) Design Guide, Chapter: "Main Concepts of Cisco ACI".Confirms: The hierarchy of Tenant $\rightarrow$ VRF $\rightarrow$ Bridge Domain $\rightarrow$ EPG.Cisco APIC Basic Configuration Guide, "Cisco ACI Object Model Definition".Confirms: The Management Information Tree (MIT) structure where EPG is a child of the Application Profile.

In Cisco ACI, a Remote Location profile is required to export or import configuration backups, firmware images, and tech support files. The APIC supports specific protocols to communicate with these remote servers. The officially supported protocols for remote locations in ACI are FTP, SCP, and SFTP. Therefore, from the provided options, FTP and SFTP are the correct protocols used to access backup files on a remote location.

A: TFTP is not a supported protocol for configuring remote locations in Cisco ACI.

D: SMB (Server Message Block) is not supported for ACI remote backup locations.

E: HTTPS is not a supported protocol for accessing remote backup files in ACI.

1. Cisco APIC Basic Configuration Guide, Release 4.x and 5.x. Chapter: "Managing Configuration Files", Section: "Creating a Remote Location".

2. Cisco Application Centric Infrastructure Fundamentals. Chapter: "Management and Operations", Section: "Configuration Backups".

When a Bridge Domain (BD) is configured with its default gateway residing outside the Cisco ACI fabric, the fabric acts as a Layer 2 transit network for that specific subnet. To support this Layer 2-only deployment model, Unicast Routing must be disabled on the BD. Disabling Unicast Routing prevents the ACI leaf switches from acting as the default gateway, stops the fabric from learning IP addresses for routing purposes within that BD, and ensures that all routing functions and ARP resolutions are deferred to the external gateway device.

A. disable Limit IP Learning to Subnet: This setting restricts IP learning to configured subnets; it does not address the fundamental requirement of disabling routing for an external gateway.

B. disable IP Data-plane Learning: While this stops data-plane IP learning, disabling Unicast Routing is the comprehensive and required setting for a purely Layer 2 BD.

D. disable Advertise Host Routes: This prevents host route advertisement to external peers, which is irrelevant if the BD is not performing routing in the first place.

1. Cisco APIC Layer 2 Networking Configuration Guide, "Bridge Domain Configuration" section.

2. Cisco Application Centric Infrastructure Design Guide, "Layer 2 Forwarding and Bridge Domains".

When extending an Endpoint Group (EPG) to an external network that contains the Layer 3 gateway, the ACI fabric acts as a Layer 2 transit switch. To ensure that ARP requests successfully reach the external gateway and that unknown MAC addresses are properly resolved, ARP Flooding must be enabled. Additionally, L2 Unknown Unicast must be set to Flood so that traffic destined for unlearned external MAC addresses is flooded out the Layer 2 extension rather than being dropped by the spine proxy.

A. Setting L2 Unknown Unicast to Hardware Proxy causes the fabric to drop traffic for unlearned MAC addresses, breaking connectivity to unknown external hosts.

C. Hardware Proxy drops unknown unicast, and disabled ARP flooding prevents ARP requests from reaching the external gateway, completely breaking Layer 3 resolution.

D. Disabling ARP flooding prevents broadcast ARP requests from reaching the external gateway, which breaks Layer 3 address resolution for the endpoints.

1. Cisco ACI Layer 2 Networking Configuration Guide, Release 5.2(x), Chapter: "Layer 2 Unknown Unicast", Section: "Flooding L2 Unknown Unicast".

2. Cisco APIC Layer 2 Networking Configuration Guide, Release 5.2(x), Chapter: "Extending the EPG Out of the ACI Fabric".

In Cisco ACI, restricting and securing out-of-band (OOB) management access requires establishing governed communication between specific external subnets and the fabric's management interfaces. This is achieved by first creating an OOB contract that specifies permitted management protocols, such as SSH or HTTPS. The designated Node Management OOB EPG provides this contract. To enforce the external subnet restrictions, an OOB External Management Network Instance Profile is configured to consume this contract. Finally, the specific allowed external subnets (10.0.0.0/24 and 192.168.20.0/25) are explicitly defined as subnet entries directly within the External Management Network Instance Profile.

Option A OOB management does not utilize an L3Out. L3Out configurations are exclusively used for In-Band management or standard tenant data plane external routing.

Option B Policy-Based Routing (PBR) service graphs redirect data plane traffic to Layer 4-7 devices. They are entirely inapplicable to foundational ACI node management access control.

Option D OOB management strictly relies on specialized Node Management EPGs and External Management Network Instance Profiles, not standard tenant EPGs and Bridge Domains.

Cisco Systems. Cisco APIC Basic Configuration Guide, Release 5.2(x). Chapter: Configuring Node Management. Section: "Configuring Out-of-Band Management using the GUI". Document ID: 1546282.

Cisco Systems. Cisco Application Centric Infrastructure Fundamentals. Chapter: "Management and Access". Section: "Out-of-Band Management Contract Configuration".

In Cisco ACI, interfaces use the default interface policy group and its associated default policies (where CDP is disabled and LLDP is enabled by default) unless explicitly configured otherwise. To enable CDP for only two specific servers without altering the fabric-wide default, the engineer must configure a specific CDP interface policy with the admin state set to "enabled". This explicitly configured policy is then applied to the specific leaf switch interfaces via an interface policy group and interface profile. In the ACI policy resolution model, explicitly applied interface policies have a higher order of precedence (higher priority) than default policies, effectively overriding the default behavior for those specific ports so the servers can be discovered.

Option A: ACI does not use a dedicated "override policy" object for interface discovery protocols; it relies on explicit policy assignment taking precedence over defaults.

Option C: Explicitly configured interface policies have a higher order of precedence (priority) over default policies, not a lower order.

Option D: Disabling LLDP on an interface profile does not automatically enable CDP; CDP must be explicitly enabled through a dedicated CDP interface policy.

1. Cisco Systems, Inc. Cisco APIC Basic Configuration Guide, Release 5.2(x). Chapter: "ACI Policy Model", Section: "Interface Policies and Policy Groups". Document ID: 10/10/2021.

2. Cisco Systems, Inc. Cisco Application Centric Infrastructure Fundamentals. Chapter: "Policy Model", Section: "Policy Resolution and Precedence". (Details how explicitly bound policies take higher precedence over default policies in the Management Information Tree).