300-620 Implementing Cisco Application Centric Infrastructure (DCACI) Practice Questions
Prepare for 300-620 with more than an answer.
Unlock the full exam and previous versions
- v1Version 1 162 questions Current
- 300-630Legacy Implementing Cisco Application Centric Infrastructure - Advanced (DCACIA) 201 questions Locked
- Exam fee
- $300 USD
- Level
- Professional
- Valid for
- 3 years
Domains covered on the exam 6
- ACI Fabric Infrastructure20%
- ACI Packet Forwarding15%
- External Network Connectivity20%
- Integrations15%
- ACI Management20%
- ACI Anywhere10%
- 1
An ACI fabric is connected to an external Layer 2 network via a vPC on a pair of border leaf switches. The administrator needs to ensure that the ACI fabric does not participate in the external network's Spanning Tree Protocol, but can still detect and prevent loops. Which feature should be enabled on the L2Out?
Show answer details
Correct answer: C
Mis-Cabling Protocol (MCP) is a Cisco proprietary feature designed for ACI to detect loops on ports connected to external Layer 2 devices without running STP. When MCP is enabled on an interface, it sends MCP packets. If it receives its own MCP packet back, it assumes a loop exists and puts the port into an err-disabled state. This allows ACI to protect itself from external L2 loops without participating in the external STP domain.
- 2
What is a key difference between resolution immediacy 'Immediate' and 'On-Demand' when configuring a VMM domain integration?
Show answer details
Correct answer: B
'Immediate' resolution means that the APIC will push the necessary policies and create the port group on the DVS as soon as the EPG is associated with the VMM domain. This pre-provisions the network. 'On-Demand' resolution is a more scalable approach where the APIC only pushes the policy and creates the port group when the first VM is actually connected to it by the vCenter administrator. This conserves resources on the hypervisor and switches.
- 3
A fault with code F0467 and a cause 'flt-rule-hit' is repeatedly appearing for a contract between two EPGs. An engineer needs to identify the specific traffic that is matching the filter in this contract to trigger this fault. Which tool is specifically designed for this purpose?
APIC# show faults code F0467 Severity Code Cause Ack Last Transition Dn -------- ------- --------------- --- -------------------- ----------------------------------------------------- info F0467 flt-rule-hit no 2024-05-10T11:22:33 uni/tn-Prod/ap-App1/epg-Web/ctrct-WebToDB/subj-allow-sqlShow answer details
Correct answer: C
The fault code F0467 indicates that a contract filter rule has been hit, and logging was enabled for that rule. To see the actual source/destination IPs and packet counts for the traffic matching this rule, the Atomic Counter tool is used. It can be triggered directly from the fault or configured manually on the contract, providing layer 4 visibility into the flows that are being permitted or denied by that specific contract filter.
- 4
The Distinguished Name (DN) 'uni/tn-Finance/ap-Billing/epg-Invoices' represents a specific object in the ACI Management Information Tree (MIT). What does the 'ap-Billing' portion of this DN signify?
Show answer details
Correct answer: B
In the ACI object model, the Distinguished Name (DN) is a unique path to an object in the MIT. The path is built from the top down. 'uni/' is the root. 'tn-Finance' is the Tenant. 'ap-Billing' is the Application Profile, which is a container for EPGs. 'epg-Invoices' is the Endpoint Group. Therefore, 'ap-Billing' is the Relative Name (RN) of the Application Profile object.
- 5
An engineer has configured a bridge domain with unicast routing enabled and a subnet of 192.168.10.1/24. Endpoints in this BD are successfully using 192.168.10.1 as their default gateway. Where does this gateway IP and its corresponding MAC address exist in the ACI fabric?
Show answer details
Correct answer: C
The subnet configured under a bridge domain creates a pervasive (or anycast) gateway. This gateway is instantiated on every leaf switch where an endpoint belonging to that BD exists. This allows an endpoint to use its local leaf switch as its default gateway, optimizing L2/L3 forwarding and eliminating the need for traffic to hairpin to a centralized gateway router.
- 6
A network architect is designing a Cisco ACI Multi-Pod fabric connected over a DWDM network that does not support multicast. The Inter-Pod Network (IPN) must be configured to handle the BGP EVPN control plane traffic, which relies on multicast for VTEP discovery. Which configuration on the IPN devices is required to ensure proper control plane operation between pods?
Show answer details
Correct answer: B
When the Inter-Pod Network (IPN) does not support multicast, the ACI fabric must be configured to use ingress replication for BUM (Broadcast, Unknown Unicast, Multicast) traffic between pods. This is configured on the spine switches, which then use unicast to replicate and send the BUM traffic to all other remote pod VTEPs, bypassing the need for multicast in the IPN.
- 7
During a security audit, an administrator is tasked with ensuring that all configuration changes made via the APIC GUI, CLI, and API are logged for traceability. The solution must support long-term archival. Which two ACI features must be configured to meet this requirement? (Select TWO)
Show answer details
Correct answer: C, D
The Audit Log in ACI records all user-initiated configuration changes, providing traceability. A monitoring policy is required to define how these logs are handled.
To meet the long-term archival requirement, the audit logs must be sent to an external server. Configuring a Syslog destination within the monitoring policy is the standard method for exporting these logs.
- 8
A consultant is deploying a service graph to insert a firewall between a Web EPG and an App EPG. The firewall is managed by APIC (managed mode). After deploying the service graph, traffic is not passing through the firewall. The consultant verifies that the device package is installed and the firewall is in a stable state. What is the most likely cause of the issue?
Show answer details
Correct answer: B
A common mistake when deploying a service graph is failing to associate it with the contract that governs the traffic flow between the consumer (Web EPG) and provider (App EPG). The service graph template must be applied to the contract subject for the APIC to orchestrate the policy-based redirect (PBR) and steer the traffic through the service device.
- 9
An engineer needs to configure a bridge domain where the default gateway for its subnets resides outside the ACI fabric. Endpoints within this bridge domain must be able to communicate with their external gateway. Which bridge domain configuration is required?
Show answer details
Correct answer: C
When the default gateway for a BD exists outside the ACI fabric, the BD should be configured for Layer 2 extension only. This is achieved by not defining a subnet under the BD (which would create a pervasive gateway) and associating the BD with an L2Out policy. This allows Layer 2 frames to be forwarded out of the fabric to the external gateway.
- 10
True or False: In a Cisco ACI fabric, a single Endpoint Group (EPG) can be associated with multiple bridge domains.
Show answer details
Correct answer: B
A fundamental rule in the ACI object model is that an EPG must be associated with exactly one bridge domain. The bridge domain defines the Layer 2 forwarding context for the endpoints within that EPG. To have endpoints in different Layer 2 domains, you must create different EPGs.
