[CISCO] 300-620 - Application Centric Infra (ACI) Exam Dumps & Study Guide

Free [CISCO] 300-620 - Application Centric Infra (ACI) Practice Questions Preview

• Question 1

  An engineer is implementing a Cisco ACI data center network that includes Cisco Nexus 2000 Series 10G fabric extenders. Which physical topology is supported?
  A.
  
  B.
  
  C.
  
  D.
  
  

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer of D.
  Reasoning:
  The correct answer is D because Cisco ACI with Nexus 2000 Fabric Extenders (FEX) requires a single-homed connection from the FEX to a parent switch (ACI Leaf). Dual-homing a FEX to two different Leaf switches is not a supported topology in ACI, especially with vPC, as it can cause forwarding loops and control plane issues. The FEX architecture is designed to extend the parent switch fabric, and a single connection provides a clear and simple forwarding path.
  Why other options are incorrect:
  A, B, and C all depict dual-homed or multi-homed connections for the FEX, which are not supported in the ACI environment. Specifically, connecting a FEX to two different Leaf switches, especially in a vPC setup (as implied by some diagrams), breaks the intended operational model and creates potential instability. The FEX is meant to be an extension of a single parent switch.
  Citations:

  • Cisco Nexus 2000 Series Fabric Extender Data Sheet, https://www.cisco.com/c/en/us/products/collateral/switches/nexus-2000-series-fabric-extenders/data_sheet_c78-685008.html
  • Configuring Cisco Nexus 2000 Series Fabric Extenders, https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus2000/configuration/guide/rel_6_0_2_N1_1/b_Cisco_Nexus_2000_Series_Fabric_Extender_Configuration_Guide_602N11/b_Cisco_Nexus_2000_Series_Fabric_Extender_Configuration_Guide_602N11_chapter_010.html

• Question 2

  An ACI administrator notices a change in the behavior of the fabric. Which action must be taken to determine if a human intervention introduced the change?
  

  • A. Inspect event records in the APIC UI to see all actions performed by users.
  • B. Inspect /var/log/audit_messages on the APIC to see a record of all user actions.
  • C. Inspect audit logs in the APIC UI to see all user events.
  • D. Inspect the output of show command history in the APIC CLI.

  Correct Answer: C

  Explanation:

  The AI agrees with the suggested answer.
  
  The suggested answer is C: Inspect audit logs in the APIC UI to see all user events.
  
  Reasoning:
  The question asks how to determine if human intervention introduced a change in the ACI fabric's behavior. The audit logs in the APIC UI specifically track user events and configuration changes. By inspecting these logs, an administrator can see a record of all user-initiated actions, which helps in identifying whether a human intervention caused the change in behavior. This aligns directly with the purpose of audit logs in security and network management.
  
  Why other options are not the best choice:

  • Option A: Inspecting event records in the APIC UI might show various system events, but it may not specifically highlight user-initiated actions and configuration changes as clearly as the audit logs.
  • Option B: Inspecting /var/log/audit_messages on the APIC is a valid approach, but it requires CLI access to the APIC, which is less convenient than using the GUI. Additionally, the APIC UI provides a more user-friendly interface for reviewing audit logs.
  • Option D: Inspecting the output of 'show command history' in the APIC CLI will only show the commands executed in the CLI and will not capture all user events or configuration changes made through the GUI.

  Citations:

  • Cisco ACI Security Best Practices, https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737924.html

• Question 3

  An engineer is creating a configuration import policy that must terminate if the imported configuration is incompatible with the existing system. Which import mode achieves this result?
  

  • A. merge
  • B. atomic
  • C. best effort
  • D. replace

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer.
  The recommended answer is B. atomic.
  
  Reasoning:
  The question asks for an import mode that terminates if the imported configuration is incompatible with the existing system. Based on Cisco documentation, the "atomic" import mode ensures that the entire configuration import either succeeds or fails as a single unit. If any part of the imported configuration is incompatible, the entire import is rolled back, and the system remains in its original state. This behavior aligns with the requirement of terminating the import if incompatibility is detected.
  
  Why other options are not correct:
  

  • A. merge: Merge mode attempts to integrate the imported configuration with the existing configuration. It does not guarantee termination upon incompatibility; it might proceed with importing compatible parts while potentially causing issues with incompatible ones.
  • C. best effort: Best effort mode tries to import as much of the configuration as possible, even if some parts are incompatible. It does not terminate the import upon encountering errors.
  • D. replace: Replace mode overwrites the existing configuration with the imported configuration. While it effectively replaces the old with the new, it doesn't inherently terminate if there's an incompatibility; instead, it will likely lead to a broken or unstable system if the configurations aren't fully compatible.

  
  

  Therefore, the most appropriate answer is B (atomic), as it is the only mode that guarantees termination and rollback in case of incompatibility.

  
  

  Citations:

  • Cisco Configuration Import Modes, https://www.cisco.com/ (Example URL - Replace with actual Cisco documentation link if available)

• Question 4

  Which components must be configured for the BGP Route Reflector policy to take effect?
  

  • A. spine fabric interface overrides and profiles
  • B. access policies and profiles
  • C. pod policy groups and profiles
  • D. leaf fabric interface overrides and profiles

  Correct Answer: C

  Explanation:

  The AI agrees with the suggested answer, which is C (pod policy groups and profiles).
  
  The reason for choosing option C is that BGP Route Reflector policies within Cisco ACI are configured under Pod Policy Groups. This is because route reflectors are typically deployed and managed at the pod level within the ACI fabric.
  
  The reasons for excluding the other options are:

  • Option A (spine fabric interface overrides and profiles): While spine interfaces are crucial for the ACI fabric, BGP route reflector policies are not directly tied to spine interface configurations. Spine interfaces primarily handle the transport of traffic, and the route reflector configuration is a separate logical entity.
  • Option B (access policies and profiles): Access policies govern how external devices connect to the ACI fabric. They are not directly involved in configuring the internal BGP route reflector functionality.
  • Option D (leaf fabric interface overrides and profiles): Leaf interfaces connect to endpoints. While BGP might be used to advertise routes learned from these endpoints, the route reflector configuration itself is not tied to specific leaf interface overrides.

  According to Cisco documentation and best practices, configuring BGP Route Reflector policies requires modifying the pod policy group and profiles within the ACI fabric. These policies dictate how the route reflector behaves and which routes it advertises.

  • Configuring BGP Route Reflector in ACI, https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737030.html

• Question 5

  Which type of policy configures the suppression of faults that are generated from a port being down?
  

  • A. fault lifecycle assignment
  • B. event lifecycle assignment
  • C. fault severity assignment
  • D. event severity assignment

  Correct Answer: C

  Explanation:

  The AI agrees with the suggested answer, which is C. fault severity assignment.
  
  Reasoning:
  The correct policy to configure the suppression of faults generated from a port being down is a fault severity assignment policy. This type of policy allows administrators to change the severity of a fault, which in effect, can suppress or minimize the impact of a fault being reported.
  
  The discussion points to "Fault Severity Assignment Policies" as the mechanism within Cisco APIC for modifying fault severities. By adjusting the severity, faults can be effectively suppressed, meaning they either don't generate alerts or are classified at a lower, less impactful level.
  
  Reasons for not choosing the other answers:

  • A. fault lifecycle assignment: While fault lifecycle management is important, it primarily deals with the stages a fault goes through (e.g., creation, acknowledgement, resolution) rather than suppressing the initial fault generation.
  • B. event lifecycle assignment: Similar to fault lifecycle, event lifecycle management focuses on the progression of events, not the suppression or severity modification of faults.
  • D. event severity assignment: This option deals with events, not faults. Faults are distinct from events in Cisco ACI. Faults typically indicate a failure or error condition, while events are more general notifications.

• Question 6

  Which type of profile needs to be created to deploy an access port policy group?
  

  • A. attachable entity
  • B. Pod
  • C. module
  • D. leaf interface

  Correct Answer: D

  Explanation:

  The AI suggests that the correct answer is A. attachable entity.
  
  Reasoning: The question asks about the type of profile needed to deploy an access port policy group. The consensus from the discussion is that an Attachable Entity Profile (AEP) is essential for deploying an access port policy group. An AEP is a profile that groups similar endpoints and is necessary for applying policies to them in Cisco ACI. The discussion emphasizes that the question specifically refers to an access policy group, which requires an AEP to be attached for the policy to function correctly.
  
  Reasons for not choosing other options:
  

  • B. Pod: A Pod is a collection of nodes (switches) and is not directly related to access port policy groups.
  • C. Module: A module usually refers to a physical component or line card in a switch, and not a profile type.
  • D. leaf interface: While leaf interfaces are involved in access policies, interface profiles are used to map interface selectors to access profiles, and are not directly necessary for creating the access policy group itself; furthermore, the primary profile needed is the AEP to apply policies to endpoints connected to these interfaces.

  
  Therefore, the attachable entity profile (AEP) is the most appropriate answer.

  Citations:

  • Cisco ACI Configuration Guide - Cisco, https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737030.html

• Question 7

  A situation causes a fault to be raised on the APIC. The ACI administrator does not want that fault to be raised because it is not directly relevant to the environment. Which action should the administrator take to prevent the fault from appearing?
  

  • A. Under System -> Faults, right-click on the fault and select Acknowledge Fault so that acknowledged faults will immediately disappear.
  • B. Create a stats threshold policy with both rising and falling thresholds defined so that the critical severity threshold matches the squelched threshold.
  • C. Under System -> Faults, right-click on the fault and select Ignore Fault to create a fault severity assignment policy that hides the fault.
  • D. Create a new global health score policy that ignores specific faults as identified by their unique fault code.

  Correct Answer: C

  Explanation:

  The AI also suggests that the correct answer is C.
  
  Reasoning:
  Option C suggests using the "Ignore Fault" option within the APIC GUI to create a fault severity assignment policy. This is the most direct and appropriate method for preventing a specific fault from appearing. By ignoring the fault, the administrator effectively suppresses it from being displayed in fault reports and status dashboards. This aligns with the question's requirement of preventing the fault from appearing because it's deemed irrelevant to the environment. According to Cisco's documentation, APIC allows users to change the severity of a fault type or ignore a particular fault so it is suppressed from fault reports or status dashboards.
  
  Why other options are incorrect:
  * **Option A:** Acknowledging a fault simply acknowledges that the fault has been seen and understood. It doesn't prevent the fault from being raised again if the underlying issue persists. Acknowledged faults typically remain visible, perhaps with a different status. * **Option B:** Stats threshold policies are used to trigger faults based on performance metrics crossing defined thresholds. While they can indirectly influence fault generation, they are not the correct tool to suppress a specific, existing fault. Also, trying to match critical and squelched thresholds may lead to unexpected behavior or mask genuine critical issues. * **Option D:** Global health score policies are designed to influence the overall health score of the ACI fabric. While they might be able to factor out certain faults from the overall score calculation, they don't directly prevent the fault from being raised and appearing in fault lists. The fault would still be present, even if it's not impacting the global health score significantly.

  Citations:

  • Cisco APIC Fault Management, https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-policy-infrastructure-controller-apic/white-paper-c11-737904.html

• Question 8

  A RADIUS user resolves its role via the Cisco AV Pair. What object does the Cisco AV Pair resolve to?
  

  • A. tenant
  • B. security domain
  • C. primary Cisco APIC
  • D. managed object class

  Correct Answer: D

  Explanation:

  The AI assistant suggests another answer other than the suggested answer D.
  The AI assistant suggests that the correct answer is B: security domain.
  Reasoning:
  The Cisco AV Pair in RADIUS is primarily used for authentication and authorization, and it directly resolves to a security domain within the Cisco ACI framework. The security domain defines the scope of access and the set of permissions a user has. When a user authenticates via RADIUS and has a Cisco AV Pair attribute, this attribute maps them to a specific security domain, which in turn determines what resources and managed objects they can access. The AV pair defines role and that role is part of a security domain.
  Why other options are incorrect:

  • A: tenant - While users ultimately interact with resources within a tenant, the AV Pair directly assigns the user to a security domain, which is a finer-grained access control mechanism within the tenant.
  • C: primary Cisco APIC - The AV Pair doesn't resolve to a specific APIC controller but rather to a logical construct (security domain) that is enforced by the APIC.
  • D: managed object class - While roles are mapped to managed object classes, the Cisco AV Pair directly associates a user with a security domain, which subsequently governs access to managed object classes. The AV Pair assigns the user to a security domain, and the security domain then determines the access rights to managed object classes.

• Question 9

  DRAG DROP -
  An engineer is configuring a VRF for a tenant named Cisco. Drag and drop the child objects on the left onto the correct containers on the right for this configuration.
  Select and Place:
  
  

  Correct Answer: See interactive view.

  Explanation:

  The AI agrees with the suggested answer.
  The correct drag-and-drop configuration, based on the object hierarchy in Cisco ACI, is as follows: VRF -> Bridge Domain (BD) -> EPG -> Application Profile. This reflects the parent-child relationship and dependencies between these objects.
  
  Reasoning:
  The hierarchy in Cisco ACI is structured with parent-child relationships. The VRF (Virtual Routing and Forwarding instance) is a container for routing and forwarding tables. Bridge Domains (BDs) reside within VRFs, providing Layer 2 forwarding capabilities. EndPoint Groups (EPGs) are then associated with Bridge Domains, and Application Profiles contain the EPGs. Therefore, it's crucial to understand this hierarchy to successfully configure VRFs and related components.
  
  

  • VRF (Virtual Routing and Forwarding): Acts as a container for routing and forwarding tables, isolating traffic within the ACI fabric.
  • Bridge Domain (BD): Represents a Layer 2 forwarding domain within a VRF. It defines the broadcast domain and subnet for endpoints.
  • Endpoint Group (EPG): A collection of endpoints that share common policy requirements. EPGs are associated with Bridge Domains.
  • Application Profile: A logical grouping of EPGs that represent an application.

  
  Why other arrangements are incorrect:
  Reversing or mixing up the order would violate the established parent-child relationships in ACI. For example, placing an EPG directly under a VRF or an Application Profile under a Bridge Domain would be incorrect and would not allow the ACI fabric to properly enforce policies and forward traffic. The application profile is the highest level of abstraction.
  

  • Cisco ACI Object Model, https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737924.html

• Question 10

  Which feature dynamically assigns or modifies the EPG association of virtual machines based on their attributes?
  

  • A. vzAny contracts
  • B. standard contracts
  • C. application EPGs
  • D. uSeg EPGs

  Correct Answer: D

  Explanation:

  The AI concurs with the suggested answer.
  The suggested answer is D (uSeg EPGs).
  Reasoning: uSeg EPGs, or micro-segmented EPGs, are specifically designed to dynamically assign or modify EPG associations of virtual machines based on their attributes. This dynamic assignment is a core feature of microsegmentation, allowing for fine-grained control and security policies based on VM characteristics.
  Reasons for not choosing other options:

  • A. vzAny contracts: vzAny contracts provide connectivity to any EPG, but do not dynamically assign EPG membership based on attributes.
  • B. Standard contracts: Standard contracts define communication rules between EPGs but don't handle dynamic EPG assignment.
  • C. Application EPGs: Application EPGs represent a group of application components, and while they are fundamental to ACI, they don't dynamically assign EPG membership based on VM attributes in the same way that uSeg EPGs do.