Get 300-620 Products Practice Material for 300-620 Exam Question Preparation
Most Reliable Cisco 300-620 Training Materials
NEW QUESTION # 63
Which two protocols support accessing backup files on a remote location from the APIC? (Choose two.)
- A. TFTP
- B. FTP
- C. SFTP
- D. SMB
- E. HTTPS
Answer: B,C
Explanation:
The two protocols that support accessing backup files on a remote location from the APIC are FTP (File Transfer Protocol) and SFTP (SSH File Transfer Protocol). Both FTP and SFTP allow for the transfer of files to and from a remote location, but SFTP provides an additional layer of security by utilizing SSH.
NEW QUESTION # 64
Refer to the exhibit.
Refer to the exhibit. An engineer must disable the communication between the two backup servers in the backup EPG. Which action accomplishes this goal?
- A. Set Intra EPG Isolation to Enforced.
- B. Set Preferred Group Member to Excluded.
- C. Set the physical domain to None.
- D. Set a different static binding for the encap VLAN.
Answer: A
Explanation:
In Cisco ACI, Intra-EPG Isolation is a feature that prevents communication between endpoints within the same EPG. By default, endpoints in the same EPG can communicate freely without requiring contracts. To disable communication between two backup servers within the same EPG (e.g., in the "Backup EPG"), you need to enforce Intra-EPG Isolation.
NEW QUESTION # 65
A network engineer must design a method to allow the Cisco ACI to redirect traffic to the firewalls. Only traffic that matches specific L4-L7 policy rules should be redirected. The load must be distributed across multiple firewalls to scale the performance horizontally. Which action must be taken to meet these requirements?
- A. Implement ACI Service Graph with GIPo.
- B. Implement ACI Service Graph Two Nodes with GIPo.
- C. Configure ACI Service Graph with Symmetric PBR.
- D. Configure ACI Service Graph with Unidirectional PBR.
Answer: C
NEW QUESTION # 66
Drag and drop the Cisco ACI filter entry options from the left onto the correct categories on the right indicating what are required or optional parameters.
Answer:
Explanation:
NEW QUESTION # 67
An Cisco ACI leaf switch learns the source IP address of a packet that enters the front panel port of the switch. Which bridge domain setting is used?
- A. Unicast Routing
- B. L3 Unknown Multicast Flooding - Flood
- C. Unknown Unicast - Hardware proxy
- D. ARP Flooding
Answer: A
Explanation:
The "Hardware Proxy" setting optimizes unicast traffic by using a proxy to respond to ARP requests, reducing flooding. While it aids in endpoint management, it is not the setting that directly enables learning the source IP address from incoming packets.
Explanation:
The question asks which bridge domain setting is used when a Cisco ACI leaf switch learns the source IP address of a packet entering the front panel port. This involves understanding how ACI handles endpoint learning and IP address association within a bridge domain.
Requirement Analysis
When a packet enters a leaf switch's front panel port, ACI learns the source IP and MAC address of the endpoint to populate its endpoint table.
The bridge domain settings control how IP addresses are learned and routed, especially for Layer 3 traffic.
The correct setting must enable the leaf switch to associate the source IP with the endpoint.
Option Evaluation
A . Unicast Routing:
The "Unicast Routing" setting in a bridge domain enables Layer 3 routing and allows the leaf switch to learn the source IP address of a packet by associating it with the MAC address and VLAN. When enabled, the switch performs IP-to-MAC mapping and updates the endpoint database, which is the standard mechanism for learning source IP addresses from incoming traffic.
Reference:
B . L3 Unknown Multicast Flooding - Flood:
This setting controls how unknown multicast traffic is handled at Layer 3 (e.g., flooding or dropping). It is unrelated to learning the source IP address of a unicast packet entering the front panel port.
C . ARP Flooding:
ARP Flooding allows ARP requests to be flooded within the bridge domain, which helps resolve IP-to-MAC mappings for silent hosts or external devices. However, it is not the primary setting for learning the source IP of an active packet; it is a supplementary mechanism.
Final Answer Justification
A is correct because enabling "Unicast Routing" in the bridge domain allows the leaf switch to learn the source IP address of a packet entering the front panel port by associating it with the source MAC address and VLAN. This is the foundational setting for Layer 3 endpoint learning in ACI.
Primary Cisco Reference:
Cisco APIC Layer 3 Networking Configuration Guide, "Bridge Domain Unicast Routing." Cisco ACI Endpoint Group Configuration Guide, "IP Address Learning."
NEW QUESTION # 68
The unicast routing feature is enabled on the bridge domain. Which two conditions enable the Cisco ACI leaf to learn a source IP as a local endpoint? (Choose two.)
- A. Through VXLAN traffic received on the uplink.
- B. IP traffic routed through an SVI.
- C. IP traffic routed through a Layer 3 Out.
- D. Through Ethernet traffic received in a bridge domain.
- E. Through ARP received on an SVI.
Answer: D,E
Explanation:
With unicast routing enabled on the bridge domain, the two conditions that enable the Cisco ACI leaf to learn a source IP as a local endpoint are:
Through Ethernet traffic received in a bridge domain (Option A): The leaf switch learns the source IP address as a local endpoint when it receives Ethernet traffic within the bridge domain.
Through ARP received on an SVI (Option E): The leaf switch also learns the source IP address as a local endpoint when it receives an ARP request or reply on a Switched Virtual Interface (SVI) associated with the bridge domain.
These conditions allow the ACI fabric to maintain an accurate endpoint database for efficient routing and forwarding of traffic within the fabric.
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html
NEW QUESTION # 69
An engineer must perform a Cisco ACI fabric upgrade that minimizes the impact on user traffic and allows only permitted users to perform an upgrade.
Which two configuration steps should be taken to meet these requirements?
- A. Grant the fabric administrator role to a user who performs an upgrade.
- B. Grant tenant-ext-admin access to a user who performs an upgrade
- C. Divide switches into two or more maintenance groups.
- D. Combine all switches into an upgrade group.
- E. Divide Cisco APIC controllers into two or more maintenance groups.
Answer: A,C
NEW QUESTION # 70
An engineer must configure SNMP inside a Cisco ACI fabric. The engineer has created an SNMP Policy, called SNMP-policy and an SNMP Monitoring Group called SNMP-group1 that contains five trap receivers. Which configuration set completes the configuration?
- A. Create an OOB management contract.
Include the SNMP server in the OOB management EPG. - B. Edit oobbrc to permit traffic using UDP port 16.
Associate the client group policy to SNMP-group1. - C. Allow all OOB management traffic.
Configure three trap receivers on SNMP-group1. - D. Permit OOB management traffic using UDP port 161.
Associate client group policy with the OOB management EPG.
Answer: D
NEW QUESTION # 71
An engineer is troubleshooting fabric discovery in a newly deployed Cisco ACI fabric and analyzes this output:
Which ACI fabric address is assigned to interface lo1023?
- A. VXLAN tunnel endpoint
- B. Dynamic tunnel endpoint
- C. Fabric tunnel endpoint
- D. Physical tunnel endpoint
Answer: C
Explanation:
In Cisco ACI, the interface lo1023 is assigned as a fabric tunnel endpoint (FTEP). This is a pervasive address found on every leaf and it's always the same. It is used mostly for AVS (Application Virtual Switch) when the infra VXLAN is extended out of the fabric1. The FTEP is crucial for the internal operation of the fabric, particularly for scenarios where the infrastructure VXLAN needs to be extended outside of the ACI fabric.
Reference:
Default IP interfaces on Fabric nodes - Cisco Community1
NEW QUESTION # 72
Which table holds IP address, MAC address and VXLAN/VLAN information on a Cisco ACI leaf?
- A. endpoint
- B. ARP
- C. adjacency
- D. RIB
Answer: A
Explanation:
Section: ACI Fabric Infrastructure
Explanation/Reference: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric- infrastructure/white-paper-c11-739989.html
NEW QUESTION # 73
A Cisco ACI environment consists of multiple silent hosts that are often relocated between leaf switches. When the host is relocated, the bridge domain takes more than a few seconds to relearn the host's new location. The requirement is to minimize the relocation impact and make the ACI fabric relearn the new location of the host faster. Which action must be taken to meet these requirements?
- A. Configure ARP Flooding to Enabled.
- B. Set L2 Unknown Unicast to Hardware Proxy.
- C. Configure IP Data-Plane Learning to No.
- D. Set Unicast Routing to Enabled.
Answer: C
NEW QUESTION # 74
Which statement about ACI syslog is true or Which statement describes the ACI syslog?
- A. Notifications for different scopes of syslog objects can be sent only to one destination.
- B. Switches send syslog messages directly to the destinations.
- C. Syslog messages are sent to the destination through the spine.
- D. All syslog messages are sent to the destination through APIC.
Answer: D
Explanation:
The correct statement about ACI syslog is that all syslog messages are sent to the destination through APIC1. This centralized approach allows for consistent logging and monitoring across the ACI fabric1.
NEW QUESTION # 75
An engineer wants to configure Cisco ACI switches to use authenticated ZMQ when communicating with the proxy spine. Which configuration allows MD5 ZMQ messages only?
- A. COOP Group policy in compatible mode
- B. COOP Group policy in strict mode
- C. IS-IS password using MD5
- D. BGP password using MD5
Answer: B
Explanation:
There are 2 choices, Compatible Type and Strict Type. Compatible Type accepts both MD5 authenticated and non-authenticated ZMQ connections, whereas Strict Type only allows MD5 authenticated ZMQ connections.
NEW QUESTION # 76
Refer to the exhibit. An engineer configures a Layer 4 to Layer 7 device object. The device is a virtual firewall with a single network adapter and it must be deployed in routed mode. Which action completes the configuration of the device object?
- A. Change Function Type to GoTo.
- B. Change context awareness to Multiple.
- C. Add an outside interface to the cluster interfaces.
- D. Enable Promiscuous Mode.
Answer: A
NEW QUESTION # 77
An engineer configures an L3Out between BLeaf1 and Core1. A Cisco Nexus 9000 Series Switch runs in NX-OS mode, and the two devices must peer using OSPF. The devices in the network are configured as follows:
- BLeaf1 has been configured with the IP address 10.1.0.2/31 and the
router ID 0.0.0.2.
- Core1 has been configured with the IP address 10.1.0.3/31 and the
router ID 0.0.0.1.
- On Cisco ACI, the engineer has enabled OSPF using the default OSPF
settings.
- The engineer has configured OSPF on the NX-OS switch using the ip
router ospf ACI_peering area 1 command.
Which action brings up the OSPF adjacency?
- A. Change the MTU on Core1.
- B. Configure Area 1 on BLeaf1.
- C. Disable Hello Timer on BLeaf1.
- D. Set and Auth Key on Core1.
Answer: B
NEW QUESTION # 78
A company is implementing a new security policy to track system access, configuration, and changes. The network engineer must enable the log collection to track user login and logout attempts. In addition, any configuration changes such as a fabric node failure must be collected in the logs. The syslog policy is configured to send logs to the company SEIM appliance.
Which two log types must be enabled to meet the security requirements? (Choose two.)
- A. event
- B. health
- C. fault
- D. audit
- E. error
Answer: C,D
Explanation:
To meet the security requirements of tracking user login/logout attempts and configuration changes (including fabric node failures), the following log types must be enabled:
- Audit Logs
Audit logs track user authentication events, such as login and logout attempts.
They also log configuration changes made by users, including modifications to security policies, system settings, and permissions.
This log type is essential for compliance and security monitoring.
- Fault Logs
Fault logs capture hardware or software issues, including fabric node failures and critical system faults.
These logs provide detailed insights into system health and failures, making them crucial for security monitoring.
NEW QUESTION # 79
All nodes in a Cisco ACI fabric are raising NTP faults. The Date and Time policy is configured with the IP address of two NTP servers and both servers are reachable via the out-of-band management network. Also, the out-of-band EPG has been selected as the management EPG.
Which configuration clears the NTP faults?
- A. Configure and apply an out-of-band contract to the out-of-band EPG.
- B. Create a node management address policy that includes all nodes in the fabric.
- C. Directly attach both NTP servers to the Cisco ACI fabric via a leaf switch.
- D. Add the NTP server IPs to the external management instance profile.
Answer: A
NEW QUESTION # 80
Which tenant is used when configuring in-band management IP addresses for Cisco APICs, leaf nodes, and spine nodes?
- A. common
- B. infra
- C. default
- D. mgmt
Answer: B
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/ b_KB_Configuring_Static_Management_Access.html#concept_CFF63FEBE947424291B0F10E6F23DA7D
NEW QUESTION # 81
An engineer is extending an EPG out of the ACI fabric using static path binding. Which statement about the endpoints is true?
- A. Endpoints must connect directly to the ACI leaf port.
- B. Endpoint learning encompasses the MAC address only.
- C. External endpoints are in the same EPG as the directly attached endpoints.
- D. External endpoints are in a different bridge domain than the endpoints in the fabric.
Answer: B
Explanation:
Section: ACI Packet Forwarding
NEW QUESTION # 82
An engineer must connect Cisco ACI fabric using Layer 2 with external third-party switches. The third-party switches are configured using 802.1s protocol. Which two constructs are required to complete the task?
(Choose two.)
- A. MCP policy with PDU per VLAN enabled
- B. static binding of native VLAN in all existing EPGs
- C. MCP instance policy with administrative slate disabled
- D. spanning tree policy for mapping MST Instances to VLANs
- E. dedicated EPG for native VLAN
Answer: A,C
NEW QUESTION # 83
The company ESXi infrastructure is hosted on the Cisco UCS-B Blade Servers. The company decided to take advantage of ACI VMM integration to enable consistent enforcement of policies across virtual and physical workloads. The requirement is to prevent the packet loss between the distributed virtual switch and the ACI fabric. Which setting must be implemented on a vSwitch policy to accomplish this goal?
- A. LLDP
- B. MAC Pinning
- C. Static Channel
- D. LACP
Answer: B
NEW QUESTION # 84
Which class of ACI object is presented in this output?
- A. Tenant
- B. Contract
- C. Bridge Domain
- D. Endpoint
Answer: A
Explanation:
Create a tenant in the GUI
in the databse: Class tenant - Objects have a Relative Name (RN) and Distinguished Name (DN) ssh to the APIC go into bash shell moquery -c fvTenant
# fv.Tenant
name : Gaming-BU
annotation :
childAction :
descr : DCACI Book - Part II - Chapter 8 - ACI Lab creation
dn : uni/tn-Gaming-BU
extMngdBy :
lcOwn : local
modTs : 2022-06-28T11:10:50.506+02:00
monPolDn : uni/tn-common/monepg-default
nameAlias :
ownerKey :
ownerTag :
rn : tn-Gaming-BU
status :
uid : 15374
userdom : all
Reference:
ACI object moquery Cheat Sheet
https://community.cisco.com/t5/data-center-and-cloud-knowledge/aci-object-moquery-cheat- sheet/ta-p/3367801 moquery - Cisco's Mysterious Obscure ACI query utility
https://rednectar.net/2020/04/09/moquery-ciscos-mysterious-obscure-aci-query-utility/ Troubleshooting ACI
https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/BRKACI-2643.pdf
NEW QUESTION # 85
......
Each of these topics contains the specific technical skills that the candidates must master before attempting this test. They are as follows:
ACI Fabric Infrastructure: The learners need to demonstrate their ability to explain ACI hardware as well as topology; explain ACI Object Model; apply audit log, faults, event record; determine ACI fabric discovery; apply ACI policies such as fabric and access; apply ACI logical constructs (consumer, tenant, reverse port filter, filter, provider, VRF enforced; VRF; bridge domain, including unicast routing, Layer 2 unknown hardware proxy, ARP flooding; application profile; EPG endpoint groups).
ACI Packet Forwarding: The skills measured in this objective include describing endpoint learning; applying bridge domain configuration (ARP flooding; Layer 2 unidentified hardware proxy; unicast routing).
External Network Connectedness: In the framework of this section, the individuals are required to prove that they are capable of applying Layer 2 out (STP/MCP fundamentals) as well as applying Layer 3 out (excludes transit routing as well as VRF route leaking).
Integrations: This subject checks one’s ability to integrate VMware vCenter DVS; explain resolution immediateness within VMM; apply managed as well as unmanaged graph.
ACI Management: The domain covers your skills, such as applying out-of-band as well as in-band; applying syslog as well as snmp services; executing configuration backup (config or snapshot import export); executing AAA and RBAC; configuring an update.
ACI Anywhere: Within this topic area, the examinees should prove their competency in explaining multipod as well as determining multisite.
How to Prepare for Implementing Cisco Application Centric Infrastructure (300-620 DCACI)
Preparation Guide for Implementing Cisco Application Centric Infrastructure (300-620 DCACI)
Introduction for Implementing Cisco Application Centric Infrastructure (300-620 DCACI)
The Implementing Cisco Application Centric Infrastructure v1.0 (DCACI 300-620) exam is a 90-minute exam that is associated with the CCNP Data Center Certification and Cisco Certified Specialist - Data Center ACI Implementation certifications. This exam tests a candidate's knowledge of Cisco switches in ACI mode including configuration, implementation, and management. You will learn the essential skills, concepts, and technologies to be a contributing member of a cybersecurity operations center (SOC) including understanding the IT infrastructure, operations, and vulnerabilities.
Cisco ACI delivers an intent-based networking framework to enable agility in the data center. It captures higher-level business and user intent in the form of a policy and translates this intent into the network constructs necessary to dynamically provision the network, security, and infrastructure services. It uses a holistic systems-based approach, with tight integration between hardware and software and physical and virtual elements, an open ecosystem model, and innovative Cisco customer Application-Specific Integrated Circuits (ASICs) to enable unique business value for modern data centers. This unique approach uses a common policy-based operating model across the network, drastically reducing the cost and complexity of operating your network.
Before taking this exam, you should have the following knowledge and skills:
- ACI Management
- ACI Fabric Infrastructure
- Integrations
- ACI Anywhere
The following candidates can enroll for this exam:
- Systems Engineers
- Technical Solutions Architects
- Server Administrators
- Cisco Integrators/Partners
- Consulting Systems Engineers
- Network Administrators
- Cisco integrators and partners
LATEST 300-620 Exam Practice Material: https://braindumps2go.dumpstorrent.com/300-620-exam-prep.html