Cisco 300-620 Online Practice Questions and Exam Preparation

Cisco 300-620 Online Questions & Answers

• Question 51:

  In-band is currently configured and used to manage the Cisco ACI fabric. The requirement is for leaf and spine switches to use out-of-band management for NTP protocol. Which action accomplishes this goal?

  A. Select Out-of-Band as Management EPG in the default DateTimePolicy.
  B. Create an Override Policy with NTP Out-of-Band for leaf and spine switches.
  C. Change the interface used for APIC external connectivity to ooband.
  D. Add a new filter to the utilized Out-of-Band-Contract to allow NTP protocol.
  A. Select Out-of-Band as Management EPG in the default DateTimePolicy.

  ---

  Explanation/Reference:

  In the Management EPG drop-down list, if the NTP server is reachable by all nodes on the fabric through out-of-band management, choose Out-of-Band. If you have deployed in-band management, see the details about In-Band Management

  NTP. Click OK.

  In-band IP addressing used within the ACI fabric is not reachable from anywhere outside the fabric. To leverage an NTP server external to the fabric with in-band management, construct a policy to enable this communication..

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/3-x/basic_config/b_APIC_Basic_Config_Guide_3_x/b_APIC_Basic_Config_Guide_3_x_chapter_0111.html

• Question 52:

  An engineer configured a bridge domain with the hardware-proxy option for Layer 2 unknown unicast traffic. What occurs in this configuration?

  A. The leaf switch drops the Layer 2 unknown unicast packet if it is unable to find the MAC address in the local forwarding tables.
  B. The Layer 2 unknown hardware proxy lacks support of the topology change notification.
  C. The leaf switch forwards the Layers 2 unknown unicast packets to all other leaf switches if it is unable to find the MAC address in its local forwarding tables.
  D. The spine switch drops the Layer 2 unknown unicast packet if it is unable to find the MAC address in the COOP database.
  D. The spine switch drops the Layer 2 unknown unicast packet if it is unable to find the MAC address in the COOP database.

  ---

  Explanation/Reference:

  When using hardware-proxy, you should consider enabling unicast routing and defining a subnet on the bridge domain. This is because with hardware-proxy on, if a MAC address has been aged out in the spine switch-proxy, traffic destined to this MAC address is dropped. Reference: https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-application-centric-infrastructure-design-guide.html#Usinghardwareproxytoreduceflooding

• Question 53:

  When configuring Cisco ACI VMM domain integration with VMware vCenter, which object is created in vCenter?

  A. datacenter
  B. VMware vSphere Standard vSwitch
  C. VMware vSphere Distributed Switch
  D. cluster
  C. VMware vSphere Distributed Switch

  ---

  Explanation/Reference:

  Creating a vCenter Domain Profile Using the Basic GUI Before You Begin Before you create a VMM domain profile, you must establish connectivity to external network using in-band management network on the APIC. Procedure Step 1 Login to the Basic Mode in the APIC GUI. Step 2 On the menu bar, choose VM NETWORKING > Inventory. Step 3 In the Navigation pane, right-click VMware and click Create vCenter Domain. Step 4 In the Create vCenter Domain dialog box, in the Virtual Switch Name field, enter a Name. Step 5 In the Virtual Switch field, verify that VMware vSphere Distributed Switch is selected https://www.cisco.com/c/dam/m/en_us/solutions/data-center-virtualization/application-centric-infrastructure/aci-virtualization-guide-chapter.pdf

• Question 54:

  A VM called App_1 belongs to VLAN 10. VM App_2 belongs to VLAN 20. Pool_1 contains VLAN 10 and Pool_2 contains VLAN 20. Currently, AP_1 is located on Server 1. The Cisco ACI fabric has these configurations:

  1.

  The two physical domains are called Phys_1 and Phys_2.

  2.

  The two VLAN pools are called Pool_1 and Pool_2.

  3.

  The two AAEPs are called AAEP_1 and AAEP_2.

  An engineer must replace App_1 with App_2. Which action under the VPC interface policy group accomplishes this goal?

  A. Configure Phys_2.
  B. Map VM App_2.
  C. Attach AAEP_2.
  D. Assign Pool_2.
  C. Attach AAEP_2.

  ---

  Explanation/Reference:

• Question 55:

  An application requires traffic between endpoint groups to be redirected through a firewall only when it matches specific L4-L7 rules, and the design must support scale-out across multiple firewalls. Which approach should be implemented?

  A. service graph with symmetric PBR
  B. service graph with unidirectional PBR
  C. static contract between the firewall and both EPGs
  D. preferred group with no service redirection
  A. service graph with symmetric PBR

  ---

  Explanation

  The correct answer is A because a service graph with symmetric PBR allows selective redirection based on policy and supports scalable firewall insertion across multiple devices. Option B is incorrect because unidirectional PBR does not satisfy the symmetric traffic-flow requirement for this design. Option C is incorrect because static contracts alone do not provide policy-based traffic redirection through L4-L7 devices. Option D is incorrect because preferred group removes the need for contracts between EPGs but does not insert firewall services.

• Question 56:

  New ESXi hosts are procured in a data center compute expansion project. An engineer must update the configuration on the Cisco APIC controllers to support the addition of the new servers to the existing VMM domain. Which action should be taken to support this change?

  A. Create a range of internal VLANs in the associated VLAN pool.
  B. Set the encapsulation mode as VXLAN.
  C. Enable infrastructure VLAN in the associated AEP.
  D. Map the leaf interface selector to the AEP that is associated with the VMM domain.
  D. Map the leaf interface selector to the AEP that is associated with the VMM domain.

• Question 57:

  Regarding the MTU value of MP-BGP EVPN control plane packets in Cisco ACI, which statement about communication between spine nodes in different sites is true?

  A. By default, spine nodes generate 9000-bytes packets to exchange endpoints routing information. As a result, the Inter-Site network should be able to carry 9000-bytes packets.
  B. By default, spine nodes generate 1500-bytes packets to exchange endpoints routing information. As a result, the Inter-Site network should be able to carry 1800-bytes packets.
  C. By default, spine nodes generate 1500-bytes packets to exchange endpoints routing information. As a result, the Inter-Site network should be able to carry 1500-bytes packets.
  D. By default, spine nodes generate 9000-bytes packets to exchange endpoints routing information. As a result, the Inter-Site network should be able to carry 9100-bytes packets.
  D. By default, spine nodes generate 9000-bytes packets to exchange endpoints routing information. As a result, the Inter-Site network should be able to carry 9100-bytes packets.

  ---

  Explanation/Reference:

  Maximum transmission unit (MTU) of Multiprotocol Border Gateway Protocol (MP-BGP) Ethernet Virtual Private Network (EVPN) control plane communication between spine nodes in different sites - By default, the spine nodes generate 9000-byte packets to exchange endpoint routing information. If that default value is not modified, the Inter Site Network (ISN) must support an MTU size of at least 9100 bytes. In order to tune the default value, modify the corresponding system settings in each APIC domain.

• Question 58:

  An engineer configures port-12 on Leaf-101 and Leaf-102 to connect to a new server called SVR-12. This server will belong to a new EPG-12 and needs to use Encapsulation VLAN-12. An already existing server, which is named SVR-10, is also connected to the same leaf switches. SVR-10 belongs to EPG-10 and also uses Encapsulation VLAN-12. Which step must the engineer take to configure connectivity for SVR-12 and EPG-12?

  A. Associate EPG-12 to the same BD as EPG-10.
  B. Enable port local VLAN scope.
  C. Disable native VLAN on both EPGs.
  D. Assign the IP address of SVR-12 to a different subnet.
  B. Enable port local VLAN scope.

  ---

  Explanation/Reference:

  To enable deploying multiple EPGs using the same encapsulation number, on a single leaf switch, use the following guidelines:

  EPGs must be associated with different bridge domains.

  EPGs must be deployed on different ports.

  Both the port and EPG must be associated with the same domain that is associated with a VLAN pool that contains the VLAN number.

  Ports must be configured with portLocal VLAN scope.

• Question 59:

  Refer to the exhibit.

  

  Two L3Outs have been created under the same VRF. S1 must communicate only with external IP

  128.10.24.32 through R2 and with all other IP addresses through R1. Which subnet must be marked as an external subnet for the external EPG to accomplish these goals?

  A. 128.10.24.32/32 under external EPG of HSS_LAB 0.0.0.0/0 under external EPG of CPN_L3
  B. 128.10.24.32/32 under external EPG of HSS_LAB 128.0.0.0/1 under external EPG of CPN_L3
  C. 128.0.0.0/2 under external EPG of HSS_LAB 0.0.0.0/0 under external EPG of CPN_L3
  D. 128.10.24.32/32 under external EPG of HSS_LAB 0.0.0.0/1 under external EPG of CPN L3
  A. 128.10.24.32/32 under external EPG of HSS_LAB 0.0.0.0/0 under external EPG of CPN_L3

• Question 60:

  A network engineer must design a method to allow the Cisco ACI to redirect traffic to the firewalls. Only traffic that matches specific L4-L7 policy rules should be redirected. The load must be distributed across multiple firewalls to scale the performance horizontally. Which action must be taken to meet these requirements?

  A. Configure ACI Service Graph with Unidirectional PBR.
  B. Implement ACI Service Graph with GIPo.
  C. Implement ACI Service Graph Two Nodes with GIPo.
  D. Configure ACI Service Graph with Symmetric PBR.
  D. Configure ACI Service Graph with Symmetric PBR.

  ---

  Explanation/Reference:

  One of the main features of the service graph is Policy-Based Redirect (PBR). With PBR, the Cisco ACI fabric can redirect traffic between security zones to L4-L7 devices, such as a firewall, Intrusion-Prevention System (IPS), or load balancer, without the need for the L4-L7 device to be the default gateway for the servers or the need to perform traditional networking configuration such as Virtual Routing and Forwarding (VRF) sandwiching or VLAN stitching https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html