Cisco CCNP 300-620 Questions & Answers

• Question 21:

  What is the result of selecting the On Demand attribute in the Deploy Immediacy feature during VMM domain association to an EPG?

  A. The EPG policy is programmed in the hardware policy CAM as soon as the policy is downloaded in the leaf software.

  B. The EPG policy is downloaded to the leaf when a hypervisor is attached to a DVS, and CDP or LLDP adjacency is formed.

  C. The EPG policy is downloaded to the leaf when a hypervisor is connected, and a VM is placed in a port group.

  D. The EPG policy is programmed in the hardware policy CAM only when the first packet is received through the data path.

  Correct Answer: D

  The deployment immediacy option specifies that the policy should be programmed in the hardware policy cam only when the switch receives a packet through the data path. This setting helps optimize the hardware space.

• Question 22:

  All nodes in a Cisco ACI fabric are raising NTP faults. The Date and Time policy is configured with the IP address of two NTP servers and both servers are reachable via the out-of-band management network. Also, the out-of-band EPG has been selected as the management EPG. Which configuration clears the NTP faults?

  A. Add the NTP server IPs to the external management instance profile.

  B. Create a node management address policy that includes all nodes in the fabric.

  C. Configure and apply an out-of-band contract to the out-of-band EPG.

  D. Directly attach both NTP servers to the Cisco ACI fabric via a leaf switch.

  Correct Answer: A

• Question 23:

  A network administrator is configuring a Cisco ACI fabric to automatically take a snapshot of all the configurations once per week. The snapshot must be saved on a server that is located in the data center. Which configuration meets these requirements?

  A. Scope: Fabric Action: Create recurring snapshots Location: Create Remote Location

  B. Scope: Tenant Action: Create recurring snapshots Location: APIC

  C. Scope: Tenant Action: Take a snapshot Location: Create Remote Location

  D. Scope: Fabric Action: Take a snapshot Location: APIC

  Correct Answer: A

  All config snapshot = "Fabric" option, tenant as the name suggests is for a specific tenant

  Action should be set to "Recurring snapshots" aka not once, but continuous

  Location is "remote location" as it is stored in a server within the DC, instead of the APIC itself. Otherwise, the location would be set to "APIC" aka the UCS box hosting the APIC OS.

• Question 24:

  An engineer must configure a service graph for the policy-based redirect to redirect traffic to a transparent firewall. The policy must be vendor-agnostic to support any firewall appliance. Which two actions accomplish these goals? (Choose two.)

  A. Set Context Aware to Single.

  B. Set the Service Type to Other.

  C. Set Promiscuous Mode to True.

  D. Set Function Type to L2.

  E. Set Managed to True.

  Correct Answer: BD

• Question 25:

  A Cisco ACI fabric is experiencing packet loss that originates from a bare metal server. The engineer must configure the syslog service to meet these requirements:

  1.

  The ACI syslog information must be collected with logging information from other network devices.

  2.

  The monitoring must only be performed on leaf 103 and leaf 104.

  Which set of actions accomplishes these goals?

  A. Configure the Syslog Monitoring Destination Group to remote server logging. Create an Access Monitoring policy for ingress and egress packet drops. Apply the Monitoring policy to the appropriate Switch Profile group.

  B. Configure the Syslog Monitoring Destination Group to Console logging. Create a Fabric-Wide Monitoring policy for ingress packet drops. Apply the Monitoring policy to the appropriate Switch Profile group.

  C. Configure the Syslog Monitoring Destination Group to Local File logging. Create a Fabric Monitoring policy for ingress and egress bytes. Apply the Monitoring policy to the appropriate Switch Profile group.

  D. Configure the Syslog Monitoring Destination Group to Console logging. Create an Access Monitoring policy for egress packet drops. Apply the Monitoring policy to the appropriate Switch Profile group.

  Correct Answer: A

  "The ACI syslog information must be collected with logging information from other network devices" could refer to a syslog server, so no local or console, but remote syslog server

• Question 26:

  A Cisco ACI fabric contains a tenant called Prod. User_1 must have written access to tenant Prod and full access to the fabric access policy. Which set of actions must be taken to meet these requirements?

  A. Associate User_1 to tenant Prod. Associate the security domain to the distinguished name of the fabric access policy. Create RBAC for the distinguished name of security domain.

  B. Associate User_1 to the distinguished name of the fabric access policy. Associate the security domain to RBAC. Create RBAC for the distinguished name of User_1.

  C. Associate User_1 to the fabric access policy. Associate the security domain to the fabric access policy. Create RBAC for the distinguished name of tenant Prod.

  D. Associate User_1 to the security domain. Associate the security domain to tenant Prod. Create RBAC for the distinguished name of fabric access policy.

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/5-x/security/cisco-apic-security-configuration-guide-50x/m-restricted-access-security-domains.html

• Question 27:

  A Cisco ACI fabric is connected to an external Cisco Catalyst switch. Which set of actions must be taken for Cisco ACI leaf and spine switches to be managed from the management port?

  A. Provide default/common contract by external management network under tenant mgmt. Consume default/common contract by out-of-band EPG.

  B. Provide default/mgmt contract by out-of-band EPG. Consume default/mgmt contract by external management network under tenant common.

  C. Provide default/mgmt contract by external management network under tenant common. Consume default/mgmt contract by out-of-band EPG.

  D. Provide default/common contract by out-of-band EPG. Consume default/common contract by external management network under tenant mgmt.

  Correct Answer: D

  1.

  All devices will need static OOB addresses (APIC controllers, leafs, and spines) that associate the IP address, NodeID, default GW, and management type (OOB, in this case).

  2.

  You'll need to configure a contract that will be consumed and provided to your OOB devices. The contract will allow the system to know what traffic is allowed. (In this use case, you will use the default/common contract to permit any traffic.)

  Step 1 – Providing the contract Tenant > Tenant mgmt > Node Management EPGs > Out-of-Band EPG default

  Under the “Provided Out-of-Band Contracts” in the policy window, provide the appropriate contract. (This could be a the default/common contract or a specific contract you have created and modified). Click Submit.

  Step 2 – Consuming the contract Tenant > Tenant mgmt > External Management Network Instance Profiles > YourInstanceProfile

  Consume the same contract that you provided in the previous step.

  Enter the subnets that are allowed to have access to the APIC. (0.0.0.0/0 will permit all).

• Question 28:

  For which type of endpoint entry does a Cisco ACI leaf switch keep the original TEP source address instead of rewriting the outer source IP address to its TEP address?

  A. local entry

  B. remote entry

  C. bounce entry

  D. COOP entry

  Correct Answer: C

  There are several scenarios in which an endpoint moves between two Cisco ACI leaf switches, such as a failover event or a virtual machine migration in a hypervisor environment. Cisco ACI data-plane endpoint learning detects these events quickly and updates the Cisco ACI endpoint database on a new leaf. In addition to data-plane learning, Cisco ACI uses bounce entries to manage the old endpoint information on the original leaf.

  The difference between a bounce entry and a remote endpoint is in whether or not the leaf rewrites the outer source IP address of the packet. When a packet uses a normal remote endpoint, the Cisco ACI leaf uses its own TEP address as the outer source IP address, so the remote leaf learns this packet with its own TEP. When a packet uses a bounce entry, the Cisco ACI leaf doesn't rewrite the outer source IP address, so the remote data-plane learning will behave as if the packet came from the originating leaf rather than the intermediate “bounce” leaf.

• Question 29:

  Refer to the exhibit.

  

  A syslog service was configured to capture different faults and events from a Cisco ACI tenant. The Cisco ACI fabric is missing any OOB capability. After some time, the administrator noticed that the syslog messages were not present on the

  APIC. Which two actions complete the configuration? (Choose two.)

  A. Change forwarding facility to local1.

  B. Ping the syslog server from the APIC.

  C. Reconfigure the UDP port settings.

  D. Change the minimum severity levels.

  E. Set the management EPG to default.

  Correct Answer: CD

  UDP Port 514

  When using Inband management for your ACI Fabric, the Inband management EPG DOES require the specific UDP Port 514 (Syslog) to be enabled.

  The severity level is set to Alert which is level 1. This would exclude levels 2-7.

• Question 30:

  Refer to the exhibit.

  

  A network engineer deploys Cisco APIC for the first time. Which connectivity type must be used to connect a Cisco ACI APIC node to connect to an out-of-band segment?

  A. 4. 1-Gb Ethernet dedicated management port

  B. 5. Serial port (RJ-45 connector)

  C. 9. VIC 1455 with external 10/25-Gigabit Ethernet ports

  D. 2. Dual 1-Gb/10-Gb Ethernet ports (LAN1 and LAN2)

  Correct Answer: D

  Out-of-band 1-Gb/10-Gb Ethernet management ports for management of APIC OS only