Refer to the exhibit.Two L3Outs have been created under the same VRF. S1 must communicate only with external IP 128.10.24.32 through R2 and with all other IP addresses through R1. Which subnet must be marked as an external subnet for the external EPG to accomplish these goals?
Answer(s): A
Defining 128.10.24.32/32 on the HSS_LAB L3Out's external-EPG ensures that only that exact host is learned via R2.Defining 0.0.0.0/0 on the CPN_L3 L3Out's external-EPG catches all other prefixes and sends them via R1.The ACI fabric uses longest-prefix-match, so the /32 route to R2 takes precedence for .32 and the default route handles everything else via R1.
Refer to the exhibit.A Cisco ACI administrator noticed a fault raised that affects the receipt of the external subnet. Which action clears the fault?
Answer(s): D
The fault "resolution-failed" on the relation to prof-Import_Policy_192.168.1.1 indicates that the named import profile doesn't exist. Defining (creating) the routemap/profile Import_Policy_192.168.1.1 under the L3Out will satisfy the missing-target and clear the fault.
Refer to the exhibit.A network engineer must configure a Cisco ACI fabric for the External Bridged network to communicate with L3Out. Which action accomplishes this goal?
The external-bridged EPG (CCDM_EPG) isn't currently part of the Test_Contract-APP-WEB topology - only the Test-APP-EPG and the L3Out EPG (MSP_EPG) are. To let the bridged network speak out the L3Out, you simply add CCDM_EPG as a consumer of the existing APP-WEB contract so that traffic can be allowed from the external bridge into the L3Out.
Refer to the exhibit.An engineer is implementing a policy-based redirect service insertion for a firewall. The engineer completed the bridge domain configuration for the firewall on the inside interface with these settings:Hardware proxy: EnabledARP flooding: EnabledUnicast routing: EnabledFurthermore, the bridge domain is associated with a subnet with the IP address of 172.16.100.254/24. The requirement is to allow communication between EPG-1 and external-EPG-1.Which configuration set completes the configuration?
For policy-based redirect with a routed firewall interface, the bridge domain on the inside must use the inside subnet, which is 10.0.0.254/24. Disabling endpoint data plane learning prevents the fabric from incorrectly learning the firewall as a regular endpoint in the redirect path, which is the recommended behavior for this service insertion design.
Refer to the exhibit.Two L3Outs have been created under the same VRF and a route map called Any_Route_RtCtrl. The fabric is deployed as follows:The two L3Outs received a default route.Both External EPGs imported the route map.R1 and the firewall advertise private RFC summarized subnets to ACI.A design change is needed to allow the traffic to bypass the firewall and use R1 before reaching subnet 10.16.29.0/28.Which action set meets this requirement?
Answer(s): B
To make traffic for 10.16.29.0/28 bypass the firewall, ACI must import the summarized private route 10.0.0.0/8 from the GiDNS_CPN_L3Out so that traffic toward that destination follows R1. Setting the default route from GiDNS_CPN_L3Out with a lower local preference preserves the firewall as the preferred path for generic default-route traffic, while the imported private summary through R1 is used for the specific private destination.
Refer to the exhibit.Two VRFs hosted on the ACI are secured by an external firewall. L3Outs and BGP have been configured toward the firewall, but VMs still cannot communicate.Which BGP control must be enabled to allow traffic between both VRFs?
The firewall learns routes from one VRF and advertises them back toward the other VRF with the ACI fabric ASN still present in the AS path. By default, ACI rejects routes that contain its own ASN to prevent loops.Enabling Allow Self AS lets ACI accept those routes, which is required for communication between the two VRFs through the external firewall.
Refer to the exhibit.An engineer must configure a routed connection in a Cisco ACI fabric using OSPF. The requirement is for the link to R1 to be preferred over the link to R2.Which set of actions accomplishes this goal?
Answer(s): C
To prefer R1 over R2 with OSPF, the path toward R1 must have a lower OSPF interface cost than the path toward R2. In ACI, that cost is applied through the OSPF interface policy that is attached to each OSPF interface profile. Using one L3Out with separate logical interface profiles for each router allows independent OSPF cost control for the two routed links.
Refer to the exhibit. An engineer is integrating a VMware vCenter with Cisco ACI VMM domain configuration. ACI creates port-group names with the format of "Tenant | Application | EPG". Which configuration option is used to generate port groups with names formatted as "Tenant=Application=EPG"?
Option C is correct because the delimiter setting defines how ACI formats port-group names when integrating with VMware, enabling the structure Tenant=Application=EPG instead of the default Tenant | Application | EPG. Incorrect — A) enable tag collection: relates to VLAN/tag information, not port-group naming format. Incorrect — B) security domains: governs scope of policies/security boundaries between tenants, not port-group name formatting. Incorrect — D) virtual switch name: controls the ESXi vSwitch naming, not the ACI port-group name structure.
Post your Comments and Discuss Cisco 300-620 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 300-620 content, but please register or login to continue.