Cisco 300-620 Online Practice Questions and Exam Preparation

Cisco 300-620 Online Questions & Answers

• Question 291:

  An engineer configures a one-armed policy-based redirect service Insertion for an unmanaged firewall. The engineer configures these Cisco ACI objects:

  1.

  a contract named All_Traffic_Allowed

  2.

  a Layer 4 to Layer 7 device named FW-Device

  3.

  a policy-based redirect policy named FW-1Arm-Policy-Based RedirectPolicy

  Which configuration set redirects the traffic to the firewall?

  A. Configure a policy-based redirect subject. Associate the policy-based redirect subject with All_Traffic_Allowed.
  B. Configure a firewall bridge domain. Associate the bridge domain with FW-Device.
  C. Configure a device interface policy. Associate the device interface policy with FW-Device.
  D. Configure a service graph. Associate the service graph with All_Traffic_Allowed.
  D. Configure a service graph. Associate the service graph with All_Traffic_Allowed.

  ---

  Explanation/Reference:

• Question 292:

  Which two actions extend a Layer 2 domain beyond the ACI fabric? (Choose two.)

  A. extending the routed domain out of the ACI fabric
  B. creating a single homed Layer 3 Out
  C. creating an external physical network
  D. extending the bridge domain out of the ACI fabric
  E. extending the EPG out of the ACI fabric
  D. extending the bridge domain out of the ACI fabric
  E. extending the EPG out of the ACI fabric

• Question 293:

  Refer to the exhibit.

  

  An engineer is deploying a Cisco ACI environment but experiences a STP loop between switch1 and switch2. Which configuration step is needed to break the STP loop?

  A. Configure a Layer 2 external bridged network on the interfaces facing the MST switches.
  B. Enable the native VLAN on the interfaces facing the MST switches using static ports in a dedicated EPG.
  C. Enable BPDU filter under the STP interface policy on the interfaces facing the MST switches.
  D. Configure the STP instance to VLAN mapping under the switch STP policy.
  B. Enable the native VLAN on the interfaces facing the MST switches using static ports in a dedicated EPG.

  ---

  Explanation/Reference:

  BPDU frames in MST are sent on the Native Vlan (these are sent untagged), and not on a per-vlan basis as is the case with RPVST and PVST. This means we will have to make configuration specifically to accommodate for these differences

  in the ACI Fabric.

  To deal with the untagged MST BPDUs, you’ll need to configure a couple of things differently than what you do when dealing with RPVST or PVST.

  Create a Switch Policy Group for your MST region – Under Fabric Access Policies, you’ll need to create a Switch Policy Group (note – I’m not talking about Interface Policy Groups). For this Policy Group, you’ll create a Spanning-tree policy

  and add in information about your MST region.

  Native Vlan EPG – For ACI, in your Tenant where you Layer-2 connection resides, you will need to create a specific EPG to carry the MST BPDUs. The static path bindings for your Legacy switches will be configured as dot1p (native). Failure

  to do this could very likely result in a loop.

• Question 294:

  Refer to the exhibit.

  

  A Cisco ACI fabric is configured using a VPC protection group with a setting of consecutive. Also, these ACI objects have been created:

  1. Access policy group Acc_Pol_Grp.

  2. STP policy STP_Pol

  Which action set must be taken to disable Eth1/1 when receiving BPDU from SW2?

  A. Enable BPDU guard on STP_Pol. Assign STP_Pol to Acc_Pol_Grp. Assign STP_Pol to Eth1/1.
  B. Enable BPDU guard on STP_Pol. Assign STP_Pol to Acc_Pol_Grp. Assign Acc_Pol_Grp to Eth1/1.
  C. Enable BPDU guard on Acc_Pol_Grp. Assign STP_Pol to Acc_Pol_Grp. Assign STP_Pol to Eth1/1.
  D. Enable BPDU guard on Acc_Pol_Grp. Assign STP_Pol to Acc_Pol_Grp. Assign Acc_Pol_Grp to Eth1/1.
  B. Enable BPDU guard on STP_Pol. Assign STP_Pol to Acc_Pol_Grp. Assign Acc_Pol_Grp to Eth1/1.

• Question 295:

  A Cisco ACI fabric is integrated with VMware VDS. The fabric must apply a security policy to check the integrity of traffic out of the network adapter. Which action must be taken to drop the packet when the ESXi host discovers a mismatch between the actual source MAC address transmitted by the guest operating system and the effective MAC address of the virtual machine adapter?

  A. Reject MAC changes.
  B. Reject forged transmits.
  C. Accept MAC changes.
  D. Accept forged transmits.
  B. Reject forged transmits.

• Question 296:

  Refer to the exhibit.

  

  How are the STP BPDUs forwarded over Cisco ACI fabric?

  A. Cisco ACI acts as the STP root for all three external switches.
  B. STP BPDUs that are generated by Switch2 are received by Switch1 and Switch3.
  C. STP BPDUs that are generated by Switch1 are received only by Switch3.
  D. Cisco ACI fabric drops all STP BPDUs that are generated by the external switches.
  C. STP BPDUs that are generated by Switch1 are received only by Switch3.

  ---

  Explanation/Reference:

  LEAF2 VLAN 10 is from other domain and other vlan pool, so BPDU's from SW1 are not flooded to SW2, only to SW3.

• Question 297:

  An engineer must ensure that Cisco ACI flushes the appropriate endpoints when a topology change notification message is received in an MST domain. Which three steps are required to accomplish this goal? (Choose three.)

  A. Enable the BPDU interface controls under the spanning tree interface policy.
  B. Configure a new STP interface policy.
  C. Bind the spanning tree policy to the switch policy group.
  D. Associate the STP interface policy to the appropriate interface policy group.
  E. Create a new region policy under the spanning tree policy.
  F. Map VLAN range to MST instance number.
  C. Bind the spanning tree policy to the switch policy group.
  E. Create a new region policy under the spanning tree policy.
  F. Map VLAN range to MST instance number.

  ---

  Explanation/Reference:

  https://learnduty.com/cisco-aci/cisco-aci-and-mst-interaction/

• Question 298:

  Refer to the exhibit.

  

  A load balancer is connected to the Cisco ACI fabric using a single interface. The load balancer is performing source and destination NAT. A service graph is configured on the Cisco ACI. Which action must be taken to allow traffic from host A to pass through the load balancer before reaching host B?

  A. Apply PBR on contract between the load balancer and application EPGs.
  B. Disable unicast routing on the bridge domain BD_2.
  C. Configure limit IP learning to subnet on BD_3.
  D. Set the default gateway for host B on the load balancer.
  A. Apply PBR on contract between the load balancer and application EPGs.

  ---

  Explanation/Reference:

  https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html

• Question 299:

  How is an EPG extended outside of the ACI fabric?

  A. Create an external bridged network that is assigned to a leaf port.
  B. Create an external routed network that is assigned to an EPG.
  C. Enable unicast routing within an EPG.
  D. Statically assign a VLAN ID to a leaf port in an EPG.
  D. Statically assign a VLAN ID to a leaf port in an EPG.

  ---

  Explanation/Reference:

  Reference: https://www.dclessons.com/l2-external-network-with-aci

• Question 300:

  A 200-node Cisco ACI fabric with dual-homed servers is being affected by a newly discovered vulnerability and must be upgraded within 15 days with minimum downtime.

  Which two actions accomplish this goal? (Choose two.)

  A. Set the concurrent capacity of the update/maintenance group to 0.
  B. Deregister the Cisco Nexus switches from the APIC and upgrade.
  C. Configure multiple schedulers to upgrade two update groups per evening.
  D. Automate the upgrade by upgrading the leaf switches directly bypassing the APIC.
  E. Divide the ACI nodes into multiple odd/even update groups that contain no more than 10 nodes.
  C. Configure multiple schedulers to upgrade two update groups per evening.
  E. Divide the ACI nodes into multiple odd/even update groups that contain no more than 10 nodes.