Cisco 300-620 Online Practice Questions and Exam Preparation

Cisco 300-620 Online Questions & Answers

• Question 341:

  An engineer must create a backup of the Cisco ACI fabric for disaster recovery purposes. The backup must be transferred over a secure and encrypted transport. The backup file must contain all user and password related information. The engineer also wants to process and confirm the backup file validity by using a Python script. This requires the data structure to have a format similar to a Python dictionary. Which configuration set must be used to meet these requirements?

  A. Under the Create Remote location settings, select Protocol: FTP Under the Export policy, select -Format: XML -Modify Global AES Encryption Settings: Enabled
  B. Under the Create Remote location settings, select Protocol: FTP Under the Export policy, select -Format: XML -Modify Global AES Encryption Settings: Disabled
  C. Under the Create Remote location settings, select Protocol: SCP Under the Export policy, select -Format: JSON -Modify Global AES Encryption Settings: Disabled
  D. Under the Create Remote location settings, select Protocol: SCP Under the Export policy, select -Format: JSON -Modify Global AES Encryption Settings: Enabled
  D. Under the Create Remote location settings, select Protocol: SCP Under the Export policy, select -Format: JSON -Modify Global AES Encryption Settings: Enabled

• Question 342:

  Which attribute should be configured for each user to enable RADIUS for external authentication in Cisco ACI?

  A. cisco-security domain
  B. cisco-auth-features
  C. cisco-aci-role
  D. cisco-av-pair
  D. cisco-av-pair

  ---

  Explanation/Reference:

  Reference:

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/Security_config/b_Cisco_APIC_Security_Configuration_Guide/ b_Cisco_APIC_Security_Guide_chapter_01011.html

• Question 343:

  Which endpoint learning operation is completed on the ingress leaf switch when traffic is received from a Layer 3 Out?

  A. The source MAC address of the traffic is learned as a local endpoint.
  B. The source MAC address of the traffic is learned as a remote endpoint.
  C. The source IP address of the traffic is learned as a remote endpoint.
  D. The source IP address of the traffic is learned as a local endpoint.
  A. The source MAC address of the traffic is learned as a local endpoint.

  ---

  Explanation/Reference:

  Local endpoint learning with an incoming packet from L3Out to Cisco ACI:

  Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint.

  Scenario 2

  Remote endpoint learning with an incoming packet from L3Out to Cisco ACI:

  No source MAC or IP address is learned as a new remote endpoint by a packet.*

  https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html

• Question 344:

  Refer to the exhibit.

  

  All nodes in the Cisco ACI fabric have been statically assigned out-of-band management IP addresses in the 10.100.180.0/24 range. An engineer is attempting to SSH into Leaf101 using a laptop with an IP address of 10.101.180.100/24. Which configuration change must be performed to allow the engineer to SSH using the laptop?

  A. Add a contract filter to oobbrc-default that allows SSH.
  B. Change the Leaf101 IP address to 10.101.180.101.
  C. Change the allowed subnets.
  D. Select the default QoS Class policy.
  C. Change the allowed subnets.

  ---

  Explanation/Reference:

• Question 345:

  A network engineer must configure a Cisco ACI system to detect network loops for untagged and tagged traffic. The loop must be detected and stopped by disabling an interface within 4 seconds. Which configuration must be used?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

  ---

  Explanation/Reference:

• Question 346:

  An engineer must adjust the time on a Cisco ACI fabric. The implementation must use a single external time server and the APIC management interfaces for the communication. Which action accomplishes this goal?

  A. Enable the Date and Time offset state in the system settings.
  B. Set the NTP provider minimum polling interval to 1.
  C. Set the NTP provider in default Date and Time policy.
  D. Create a contract in the management tenant to allow UDP port 123.
  C. Set the NTP provider in default Date and Time policy.

  ---

  Explanation/Reference:

• Question 347:

  Refer to the exhibit.

  

  A network engineer must improve the configuration backup process and the configuration restore process. The current ACI solution is integrated with VMMs and third-party L4-L7 devices. The process requires that no additional information be re-entered when importing the configuration for a fully-functional state. Which configuration configures the export policy?

  A. Configure a local snapshot.
  B. Enable the Global AES Encryption Setting.
  C. Select the JSON data format to be used when exporting.
  D. Create target DNs for all tenants.
  B. Enable the Global AES Encryption Setting.

  ---

  Explanation/Reference:

  With AES encryption disabled, passwords will not be exported.

• Question 348:

  An engineer needs to avoid loops in the ACI network and needs an ACI leaf switch to error-disable an interface if the interface receives an ACI-generated packet. Which action meets these requirements?

  A. Set Rogue EP Control in the Endpoint Controls Policy.
  B. Uncheck the Loop Protection Action check box in MCP Instance Policy.
  C. Enable the Loop Indication by MCP event in the Error Disabled Recovery Policy.
  D. Change the default administrative state of the global MCP Instance Policy.
  D. Change the default administrative state of the global MCP Instance Policy.

  ---

  Explanation/Reference:

  MisCabling Protocol (MCP) detects loops from external sources (i.e., misbehaving servers, external networking equipment running STP, etc.) and will err-disable the interface on which ACI receives its own packet. Enabling this feature is a best practice, and it should be enabled globally and on all interfaces, regardless of the end device.

  For MCP to be enabled, you need to have it enabled globally and on a per-interface basis. While MCP is enabled on all interfaces by default, it is not turned “on” until you also enable it globally. The global configuration knob for MCP can be enabled by configuring the global settings here: Fabric > Access Policies > Global Policies > MCP Instance Policy default.

  https://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/aci-guide-using-mcp-mis-cabling-protocol.pdf

• Question 349:

  Refer to the exhibit.

  

  An engineer is integrating a VMware vCenter with Cisco ACI VMM domain configuration. ACI creates port-group names with the format of "Tenant | Application | EPG". Which configuration option is used to generate port groups with names formatted as "Tenant=Application=EPG"?

  A. enable tag collection
  B. security domains
  C. delimiter
  D. virtual switch name
  C. delimiter

  ---

  Explanation/Reference:

  Step 8 Configuring the delimiter during VMM domain creation, perform the following actions:

  On the menu bar, choose VM NETWORKING > Inventory

  In the Navigation pane, right-click VMware and click Create vCenter Domain.

  In the Create vCenter Domain dialog box, enter a Name.

  Optional: In the Delimiter field, enter one of the following: |, ~, !, @, ^, +, or =. If you do not enter a symbol, the system default | delimiter will appear in the VMware PortGroup name.

• Question 350:

  An engineer must set up a Cisco ACI fabric to send Syslog messages related to hardware events, such as chassis line card failures. The messages should be sent to a dedicated Syslog server. Where in the Cisco APIC should the policy be configured to meet this requirement?

  A. uni/tn-common/monepg-default
  B. uni/infra/monifra-default
  C. uni/fabric/monfab-default
  D. uni/fabric/moncommon
  C. uni/fabric/monfab-default