Cisco 300-620 Online Practice Questions and Exam Preparation

Cisco 300-620 Online Questions & Answers

• Question 1:

  

  Refer to the exhibit. A network engineer must configure a Cisco ACI fabric that meets these requirements:

  The interface Eth1/2 must accept traffic only from EP2.

  The interface Eth1/1 must accept traffic from EP1 and EP2.

  EP1 and EP2 must authenticate independently on Eth1/1.

  Which 802.1x host modes must be configured to meet these requirements?

  A. Single-host on Eth1/1 Multi-auth on Eth1/2
  B. Single-host on Eth1/1 Multi-domain on Eth1/2
  C. Multi-auth on Eth1/1 Multi-domain on Eth1/2
  D. Multi-auth on Eth1/1 Single-host on Eth1/2
  D. Multi-auth on Eth1/1 Single-host on Eth1/2

• Question 2:

  Which tunnel endpoint is shown in this output from interface Io0?

  

  A. physical
  B. fabric
  C. dynamic
  D. headend replication
  A. physical

  ---

  Explanation/Reference:

• Question 3:

  The existing network and ACI fabric have been connected to support workload migration. Servers will physically terminate at the Cisco ACI, but their gateway must stay in the existing network. The solution needs to adhere to Cisco's best practices. The engineer started configuring the relevant Bridge Domain and needs to complete the configuration. Which group of settings are required to meet these requirements?

  A. L2 Unknown Unicast: Hardware Proxy L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enable
  B. L2 Unknown Unicast: Flood L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enable
  C. L2 Unknown Unicast: Flood L3 Unknown Multicast Flooding: Optimize Flood Multi Destination Flooding: Flood in BD ARP Flooding: Disable
  D. L2 Unknown Unicast: Hardware Proxy L3 Unknown Multicast Flooding: Optimize Flood Multi Destination Flooding: Flood in BD ARP Flooding: Disable
  B. L2 Unknown Unicast: Flood L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enable

• Question 4:

  Which feature should be disabled on a bridge domain when a default gateway for endpoints is on an external device instead of a Cisco ACI bridge domain SVI?

  A. unknown unicast flooding
  B. ARP flooding
  C. unicast routing
  D. proxy ARP
  C. unicast routing

  ---

  Explanation/Reference:

• Question 5:

  A Cisco ACI fabric with an ARP packet must ensure detection of silent hosts with an ARP packet. The current bridge domain is configured with hardware proxy and unicast routing. Which step must be taken on the bridge domain to complete the configuration?

  A. Set Optimized Flood for L3 Unknown Multicast.
  B. Enable Flood in the bridge domain for Multi Destination Flooding.
  C. Set L2 Unknown Unicast to Flood.
  D. Enable ARP Flooding in the bridge domain.
  D. Enable ARP Flooding in the bridge domain.

  ---

  Explanation/Reference:

  The difference of enabling and disabling the ARP flooding option appears once ACI learns a silent host IP. One of the benefits of enabling ARP flooding is to be able to detect a silent IP that moved from one location to another without notifying an ACI leaf. Because the ARP request is flooded within the BD, even if the ACI leaf still thinks the IP is at the old location, the host with the silent IP would respond appropriately so that the ACI leaf can update its entry accordingly. If ARP flooding is disabled, the ACI leaf would keep forwarding the ARP request only to the old location until the IP endpoint ages out. On the other hand, the benefit of disabling ARP flooding is to be able to optimize traffic flow by sending the ARP request directly to the location of the target IP, assuming no endpoint moves without notifying its movement via GARP and such. https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html#Silenthostsconsiderations

• Question 6:

  Refer to the exhibit.

  

  An engineer configures an L3Out but receives the error presented. Which action clears the fault?

  A. Acknowledge the QoS-related error.
  B. Associate a custom QoS class.
  C. Create a custom QoS policy.
  D. Set the QoS policy to Level 3.
  A. Acknowledge the QoS-related error.

  ---

  Explanation/Reference:

  Because performing those actions will prevent the fault from appearing again in the future, but will not clear the fault that is already present.

• Question 7:

  What is the result of selecting the On Demand attribute in the Deploy Immediacy feature during VMM domain association to an EPG?

  A. The EPG policy is programmed in the hardware policy CAM as soon as the policy is downloaded in the leaf software.
  B. The EPG policy is downloaded to the leaf when a hypervisor is attached to a DVS, and CDP or LLDP adjacency is formed.
  C. The EPG policy is downloaded to the leaf when a hypervisor is connected, and a VM is placed in a port group.
  D. The EPG policy is programmed in the hardware policy CAM only when the first packet is received through the data path.
  D. The EPG policy is programmed in the hardware policy CAM only when the first packet is received through the data path.

  ---

  Explanation/Reference:

  The deployment immediacy option specifies that the policy should be programmed in the hardware policy cam only when the switch receives a packet through the data path. This setting helps optimize the hardware space.

• Question 8:

  An engineer is implementing a connection that represents an external bridged network. Which two configurations are used? (Choose two.)

  A. Layer 2 remote fabric
  B. Layer 2 outside
  C. Layers 2 internal
  D. Static path binding
  E. VXLAN outside
  B. Layer 2 outside
  D. Static path binding

  ---

  Explanation/Reference:

  Extend the bridge domain out of the ACI fabric - Another option to extend the layer 2 domain is to create a layer 2 outside connection (or external bridged network, as called in the APIC GUI) for a given bridge domain. It effectively extends the bridge domain to the outside network.

  The following sections explain these three options in greater detail.

  Extend the EPG Out of the ACI Fabric

  The user can extend an EPG beyond an ACI leaf by statically assigning a leaf port (along with a VLAN ID) to an EPG. After doing so, all the traffic received on this leaf port with the configured VLAN ID will be mapped to the EPG and the configured policy for this EPG will be enforced. The endpoints need not be directly connected to the ACI leaf port. They can be behind a layer 2 network as long as the VLAN associated with the EPG is enabled within the layer 2 network that connects the remote endpoint to the ACI fabric.

  To statically assign port to an EPG, go to menu TenantàApplication ProfilesàEPGàStatic Binding (Paths).

• Question 9:

  A virtualization administrator integrates VMware vCenter with Cisco ACI and wants APIC to create port groups in vCenter automatically. Which vCenter object is created by this integration?

  A. datacenter
  B. VMware vSphere Distributed Switch
  C. ESXi cluster
  D. standard vSwitch
  B. VMware vSphere Distributed Switch

  ---

  Explanation

  The correct answer is B because Cisco ACI VMM integration with VMware creates and manages a VMware vSphere Distributed Switch for policy-driven port-group creation. Option A is incorrect because the datacenter object is not created by this ACI workflow. Option C is incorrect because ACI does not create the ESXi cluster itself. Option D is incorrect because the integration uses a distributed switch rather than a standard vSwitch.

• Question 10:

  Refer to the exhibit.

  

  What must be configured in the service graph to redirect HTTP traffic between the EPG client and EPG server to go through the Cisco ASA firewall?

  A. precise filter to allow only HTTP traffic
  B. permit-all contract filter
  C. contract with no filter
  D. contract filter to allow ARP and HTTP.
  A. precise filter to allow only HTTP traffic

  ---

  Explanation/Reference:

  ARP and other bcast and mcast traffic should never be redirected to PBR device.