Cisco 300-620 Online Practice Questions and Exam Preparation

Cisco 300-620 Online Questions & Answers

• Question 141:

  DRAG DROP

  Drag and drop the Cisco ACI Layer 4 to Layer 7 service insertion terms on the left to the correct descriptions on the right.

  Select and Place:

  

  

  ---

  Explanation/Reference:

• Question 142:

  A Cisco ACI fabric is integrated with a Cisco ASA firewall using a service graph under the tenant called Operations. The fabric must permit the firewall used on tenant Operations to be referenced by the tenant called Management. Which export action must be used to accomplish this goal?

  A. device selection policies
  B. service graph template
  C. router configurations
  D. Layer4-Layer7 device
  D. Layer4-Layer7 device

  ---

  Explanation/Reference:

  L4-L7 device can't be referenced from other tenants. If you want to share an L4-L7 device with other tenants, you need to export the L4-L7 device to other tenants. It will appear as an imported device in the other tenants

• Question 143:

  Which two actions does the Cisco ACI take when a bridge domain is configured with a subnet and unicast routing is enabled? (Choose two.)

  A. enables routing to and from that subnet
  B. disables the ARP flooding feature
  C. learns MAC and IP addresses
  D. stops remote endpoint learning
  E. discovers endpoints from data plane learning only
  A. enables routing to and from that subnet
  C. learns MAC and IP addresses

  ---

  Explanation/Reference:

  The Layer 3 Configurations tab of the bridge domain panel allows the administrator to configure the following parameters:

  Unicast Routing: If this setting is enabled and a subnet address is configured, the fabric provides the default gateway function and routes the traffic. Enabling unicast routing also instructs the mapping database to learn the endpoint IP-to-VTEP mapping for this bridge domain. The IP learning is not dependent upon having a subnet configured under the bridge domain.

  Subnet Address: This option configures the SVI IP addresses (default gateway) for the bridge domain.

  Limit IP Learning to Subnet: This option is similar to a unicast reverse-forwarding-path check. If this option is selected, the fabric will not learn IP addresses from a subnet other than the one configured on the bridge domain.

  Unicast Routing feature in ACI allows the Leaf Switches to learn the IP addresses associated with the Endpoint which are connected to ACI Fabric.

  The Unicast Routing feature also enables IP Routing under the bridge domain ( Similar to IP Routing Command in Nexus-OS/ Catalyst OS).

• Question 144:

  Refer to the exhibit.

  

  An engineer must migrate the web servers and backup servers from the legacy network to a Cisco ACI environment in the corresponding EPGs. The requirement is to allow communication between the servers in the web EPG and the backup EPG without creating contracts. Which action meets the requirements?

  A. Configure the Enforced Bridge Domain status flag.
  B. Set the direction of Policy Enforcement to Egress.
  C. Set IP Data-plane learning to Enabled.
  D. Set Policy Control Enforcement to Unenforced.
  D. Set Policy Control Enforcement to Unenforced.

  ---

  Explanation/Reference:

  Tenant > Networking > VRFs > VRF_name > Policy > Policy Control Enforcement Preference https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#Unenforcedmode

• Question 145:

  What controls communication between EPGs?

  A. Inter-EPG communication is controlled by BGP.
  B. Inter-EPG communication is controlled by contracts.
  C. Inter-EPG communication is controlled by IS-IS.
  D. Inter-EPG communication is controlled by VXLAN.
  B. Inter-EPG communication is controlled by contracts.

  ---

  Explanation/Reference:

• Question 146:

  An engineer must limit management access to the Cisco ACI fabric that originates from a single subnet where the NOC operates. Access should be limited to SSH and HTTPS only. Where should the policy be configured on the Cisco APIC to meet the requirements?

  A. policy in the management tenant
  B. ACL on the console interface
  C. ACL on the management interface of the APIC
  D. policy on the management VLAN
  A. policy in the management tenant

  ---

  Explanation/Reference:

  Reference:

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/cli/nx/cfg/b_APIC_NXOS_CLI_User_Guide/ b_APIC_NXOS_CLI_User_Guide_chapter_01000.html

• Question 147:

  A server connected to a leaf switch sends traffic into an ACI bridge domain that has unicast routing enabled. Which endpoint information is learned locally from valid routed traffic?

  A. source IP only
  B. source MAC only
  C. source MAC and source IP
  D. destination MAC and destination IP
  C. source MAC and source IP

  ---

  Explanation

  The correct answer is C because with the default data-plane learning behavior and unicast routing enabled, the leaf can learn both the local source MAC and source IP for the endpoint. Option A is incorrect because learning is not limited to source IP only in this case. Option B is incorrect because routed endpoint learning is not limited to MAC only for this scenario. Option D is incorrect because endpoint learning is based on source information, not destination fields.

• Question 148:

  A user wants a Cisco ACI policy that allows workloads in multiple EPGs within the same VRF to communicate without creating many pairwise contracts. Which feature should be used?

  A. preferred group
  B. static path binding
  C. remote leaf
  D. attachable access entity profile
  A. preferred group

  ---

  Explanation

  The correct answer is A because preferred group simplifies communication among selected EPGs in the same VRF without requiring many separate contracts. Option B is incorrect because static path binding maps endpoints to an EPG on an interface and does not replace policy relationships. Option C is incorrect because remote leaf is an ACI Anywhere construct for extending the fabric. Option D is incorrect because an AEP is used in access policy deployment, not east-west policy simplification.

• Question 149:

  Refer to the exhibit.

  

  A client is configuring a new Cisco ACI fabric. All VLANs will be extended during the migration phase using the VPC connections on leaf switches 3, 4 and leaf switches 5, 6 toward the legacy network. The migration phase has these requirements:

  1.

  The legacy switches must be able to transfer BPDUs through the ACI fabric.

  2.

  If the legacy switches fail to break a loop, Cisco ACI must break the loop.

  Which group settings must be configured on VPC interface policy groups ipg_vpc-legacy_1 and ipg_vpc-legacy_2 to meet these requirements?

  A. MCP: enabled BPDU Guard: disabled BPDU Filter: disabled
  B. MCP: disabled BPDU Guard: enabled BPDU Filter: enabled
  C. MCP: enabled BPDU Guard: enabled BPDU Filter: disabled
  D. MCP: disabled BPDU Guard: disabled BPDU Filter: enabled
  A. MCP: enabled BPDU Guard: disabled BPDU Filter: disabled

  ---

  Explanation/Reference:

  MCP detects loops from external sources and will err-disable the interface on which ACI receives its own packet. Enabling this feature is a best practice and it should be enabled globally and on all interfaces, regardless of the end device. MCP works to stop Layer-2 loops, it should be enabled right away on an ACI Fabric prior to connecting Layer-2 devices for migration purposes.

  As explained in this article, ACI Operation with L2 Switches and Spanning-tree Link Types, by default, the STP link type on Legacy switches is P2P. ACI acts as a hub for BPDUs. By configuring the STP link type as Shared for your external switch interfaces which connect to ACI, you ensure that you allow the switches to take their time with the STP transition process, thereby protecting your environment from potential STP loop formation. Even though ACI does not generate STP BPDUs, ACI switches will forward STP BPDUs across EPGs on which they are received. This allows the externally connected switches to maintain a loop-free topology and avoid broadcast storms and other nastiness that goes hand-inhand when layer-2 loops form!

• Question 150:

  

  Refer to the exhibit. A Cisco ACI fabric has an L3Out OSPF connectivity with router R1. The Cisco ACI fabric must have only subnet 192.168.1.0/24 installed in the routing table. Which two configurations must be selected to accomplish this goal? (Choose two.)

  A. Shared Security Import Subnet
  B. Import Route Control Enforcement
  C. Import Route Control Subnet
  D. Export Route Control Subnet
  E. External Subnets for the External EPG
  B. Import Route Control Enforcement
  C. Import Route Control Subnet