Refer to the exhibit.Malware software is detected on endpoints in EPG-1001. As a result, the infected endpoints must be isolated. The EPG was configured for intra-EPG isolation, and the EPG is associated with VMware/west VMM Domain.However, endpoints are seen in the uSeg EPG.Which set of actions completes the configuration?
Answer(s): D
For VMware uSeg EPG isolation to work in ACI, the VMM domain must have micro-segmentation enabled.VMware micro-segmentation with ACI also requires private VLAN mapping, which uses both a primary VLAN and a secondary VLAN. Without both settings, endpoints can appear in the uSeg EPG, but the required isolation behavior is not enforced.
An EPG is associated with a VMM domain. Which option must be set to allow the bridge domain and the VRF of the EPG to be instantiated on the leaf only when the virtual switch is associated with a hypervisor and a VMNIC connected to the leaf switch?
On-Demand Deployment immediacy causes the bridge domain and VRF policy related to the EPG to be programmed on a leaf only when the associated virtual switch is actually in use on a hypervisor connected through that leaf. This matches the requirement to avoid instantiating those objects until the VMNIC and virtual switch are present on the leaf.
Refer to the exhibit.A network engineer must configure connectivity for 10 ESXi hosts on a Cisco Application Centric Infrastructure (ACI) fabric. Each ESXi interface is a trunk port carrying traffic for 200 virtual LANs. Another engineer already created the necessary access policies and 200 endpoint groups (EPGs) with domain association. To streamline operations, connectivity must be established without configuring a static port in each EPG for each ESXi interface.Which action completes the configuration?
Answer(s): B
Integrating ACI with the VMware virtual environment allows EPG connectivity to be automated through the VMM domain instead of requiring static path bindings for every EPG on every ESXi trunk. Using a dynamic VLAN pool lets ACI allocate and program the VLANs for the 200 EPGs across the ESXi hosts automatically, which is the scalable way to provide this connectivity.
Which statement about ACI syslog is true?
Option D is correct because in ACI, switches send syslog messages directly to external destinations (e.g., SIEM) without routing through APIC for normal switch-level syslog flow. Incorrect — A: ACI allows multiple syslog destinations; there is no restriction to a single destination per scope. Incorrect — B: Syslog delivery does not traverse the spine as a dedicated path for this purpose. Incorrect — C: Not all syslog information is funneled through APIC; switches generate and send their own syslog to configured destinations.
A data center administrator is upgrading an ACI fabric. There are 3 APIC controllers in the fabric and all the servers are dual-homed to pairs of leaf switches configured in VPC mode. How should the fabric be upgraded to minimize possible traffic impact during the upgrade?
Answer(s): C
Option C is correct because coordinating maintenance in two groups for leaf switches (in a VPC topology) minimizes traffic disruption by preserving partial fabric connectivity during upgrades, ensuring dual-homing paths remain active. This approach aligns with Cisco ACI guidance to keep APICs and critical control paths available while upgrading leaf-layer components in staged groups.A) Incorrect — mentions APIC controllers, not leaf switches; maintenance groups for APICs would risk control-plane disruption and is not the recommended staged leaf upgrade strategy.B) Incorrect — repeats misnaming APIC controllers in the maintenance plan; not addressing leaf-layer upgrade sequencing.D) Incorrect — suggests leaf switches as separate groups but uses “VPC left/right” without aligning to the proper two-group leaf upgrade strategy in this scenario.
Which protocol does ACI use to securely sane the configuration in a remote location?
Answer(s): A
Option A is correct because ACI uses SCP (Secure Copy Protocol) to securely transfer and save configuration to a remote location, ensuring encryption in transit. B) Incorrect — HTTPS is used for encrypted web-based API access, not specifically for securely saving configuration to a remote location in ACI. C) Incorrect — TFTP is insecure (no authentication/encryption) and not used for secure remote configuration in ACI. D) Incorrect — FTP lacks encryption; not suitable for secure remote configuration storage in ACI.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/ b_KB_Using_Import_Export_to_Recover_Config_States.html
Which two protocols support accessing backup files on a remote location from the APIC? (Choose two.)
Answer(s): B,C
Option B is correct because FTP is used for transferring files to and from remote backups in APIC backup/restore workflows, and Option C is correct because SFTP provides secure file transfer for backups, both supported by APIC for remote backup locations.A) Incorrect — TFTP is typically insecure and not used for remote APIC backup/restore in modern deployments.B) Correct — FTP is supported for remote backup access.C) Correct — SFTP offers secure remote backup access.D) Incorrect — SMB is not used by APIC for remote backup access in DCACI.E) Incorrect — HTTPS is for API/GUI access, not for remote backup file access.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/troubleshooting/ b_APIC_Troubleshooting/b_APIC_Troubleshooting_appendix_010011.html
Which attribute should be configured for each user to enable RADIUS for external authentication in Cisco ACI?
Option D is correct because cisco-av-pair is the attribute used in RADIUS to pass ACI authorization information (AV-Pairs) that map to user roles and permissions in Cisco ACI for external authentication.A) Incorrect — cisco-security domain is not the RADIUS attribute used for external authentication mapping in Cisco ACI.B) Incorrect — cisco-auth-features is not the standard RADIUS AV-pair attribute for ACI authorization.C) Incorrect — cisco-aci-role is not the recognized RADIUS attribute name for external authentication integration in ACI.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/Security_config/ b_Cisco_APIC_Security_Configuration_Guide/b_Cisco_APIC_Security_Guide_chapter_01011.html
Post your Comments and Discuss Cisco 300-620 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 300-620 content, but please register or login to continue.