Cisco 300-620 Exam Questions
Implementing Cisco Application Centric Infrastructure (DCACI) (Page 5 )

Updated On: 17-May-2026

New ESXi hosts are procured in a data center compute expansion project. An engineer must update the configuration on the Cisco APIC controllers to support the addition of the new servers to the existing VMM domain. Which action should be taken to support this change?

  1. Create a range of internal VLANs in the associated VLAN pool.
  2. Set the encapsulation mode as VXLAN.
  3. Enable infrastructure VLAN in the associated AEP.
  4. Map the leaf interface selector to the AEP that is associated with the VMM domain.

Answer(s): D

Explanation:

Option D is correct because mapping the leaf interface selector to the AEP associated with the VMM domain ensures the new ESXi hosts’ NICs are properly associated to the correct AEP and VMM domain, allowing APIC to program MAC/IP/Encapsulation path updates for the new compute resources.
A) Creating a range of internal VLANs in the VLAN pool is not required for expanding a VMM domain; VLAN pools control scope of VLAN IDs but do not attach new hosts to a VMM domain.
B) Setting encapsulation to VXLAN is relevant for VXLAN fabric traffic, but VMM domain expansion relies on AEP/Leaf mapping, not encapsulation mode.
C) Enabling infrastructure VLAN in the AEP is not the mechanism to attach new servers to an existing VMM domain; it governs infra connectivity, not domain enrollment.



DRAG DROP (Drag and Drop is not supported)



Refer to the exhibit. A Cisco ACI fabric is newly deployed, and the security team requires more visibility of all inter EPG traffic flows. All traffic in a VRF must be forwarded to an existing firewall pair. During failover, the standby firewall must continue to use the same IP and MAC as the primary firewall. Drag and drop the steps from the left into the implementation order on the right to configure the service graph that meets the requirements. (Not all steps are used.)

Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:


Reference:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/3-x/L4- L7_services_deployment/3_2_1/b_L4L7_Deploy_321/b_L4L7_Deploy_321_chapter_01001.html



An engineer must advertise a selection of external networks learned from a BGP neighbor into the ACI fabric. Which L3Out subnet configuration option creates an inbound route map for route filtering?

  1. External Subnets for the External EPG
  2. Shared Route Control Subnet
  3. Import Route Control Subnet
  4. Shared Security Import Subnet

Answer(s): C

Explanation:

Option C is correct because Import Route Control Subnet enables the creation of an inbound route map for filtering routes learned from an external BGP neighbor into the ACI fabric via L3Out, allowing selective import policies. Incorrect — A: External Subnets for the External EPG defines which external subnets are associated with the EPG, not route-filtering inbound via a map. Incorrect — B: Shared Route Control Subnet is used for shared route control but does not specify an inbound route-map mechanism. Incorrect — D: Shared Security Import Subnet pertains to security import scope, not route filtering for L3Out.



An engineer must set up a Cisco ACI fabric to send Syslog messages related to hardware events, such as chassis line card failures. The messages should be sent to a dedicated Syslog server. Where in the Cisco APIC should the policy be configured to meet this requirement?

  1. uni/tn-common/monepg-default
  2. uni/infra/monifra-default
  3. uni/fabric/monfab-default
  4. uni/fabric/moncommon

Answer(s): C

Explanation:

Option C is correct because Syslog configuration for hardware events in an APIC-driven ACI fabric is applied under the fabric monitoring scope, specifically uni/fabric/monfab-default, which governs fabric-wide monitoring policies and destinations for event streams such as chassis/hardware faults to a dedicated Syslog server.
A) uni/tn-common/monepg-default is for tenant-level monitor/export policies, not fabric-wide hardware event Syslog targets.
B) uni/infra/monifra-default covers infrastructure monitoring at the infra level but not the fabric-wide Syslog destination.
D) uni/fabric/moncommon represents common fabric monitoring but is not the defined default for fabric-wide Syslog server destinations.



The existing network and ACI fabric have been connected to support workload migration. Servers will physically terminate at the Cisco ACI, but their gateway must stay in the existing network. The solution needs to adhere to Cisco's best practices. The engineer started configuring the relevant Bridge Domain and needs to complete the configuration. Which group of settings are required to meet these requirements?

  1. L2 Unknown Unicast: Hardware Proxy
    L3 Unknown Multicast Flooding: Flood
    Multi Destination Flooding: Flood in BD
    ARP Flooding: Enable
  2. L2 Unknown Unicast: Flood
    L3 Unknown Multicast Flooding: Flood
    Multi Destination Flooding: Flood in BD
    ARP Flooding: Enable
  3. L2 Unknown Unicast: Flood
    L3 Unknown Multicast Flooding: Optimize Flood
    Multi Destination Flooding: Flood in BD
    ARP Flooding: Disable
  4. L2 Unknown Unicast: Hardware Proxy
    L3 Unknown Multicast Flooding: Optimize Flood
    Multi Destination Flooding: Flood in BD
    ARP Flooding: Disable

Answer(s): B

Explanation:

Option B is correct because L2 Unknown Unicast: Flood is the appropriate default for bridging in an ACI-BD integration when host gateways reside outside but endpoints are in the BD; it ensures unknown unicast frames are flooded within the BD while keeping known unicast efficient handling for in-fabric paths.
A) Incorrect — Hardware Proxy is not required here; it offloads unknown unicast handling to endpoints and is not aligned with the described gateway separation or best practice for this scenario.
C) Incorrect — Repeats B with the same label; duplication not allowed in this context and does not change behavior.
D) Incorrect — Hardware Proxy is not applicable to this configuration as described; it does not reflect the needed flood behavior for unknown unicast in the BD.



An engineer must implement management policy and data plane separation in the Cisco ACI fabric. Which ACI object must be created in Cisco APIC to accomplish this goal?

  1. Application profile
  2. Tenant
  3. Contract
  4. Bridge domain

Answer(s): B

Explanation:

Option B is correct because a Tenant in Cisco ACI provides the top-level administrative boundary and isolation for management and data plane policies, enabling separation between different domains. Application profiles (A) define how endpoints consume services but do not by themselves enforce management/data plane separation. Contracts (C) control inter-EPG communication but sit under a tenant and do not establish isolation boundaries. Bridge domains (D) represent L2 forwarding domains within an EPG but not the overarching isolation boundary between management and data planes. INSUFFICIENT_KNOWLEDGE



An engineer is implementing a Cisco ACI environment that consists of more than 20 servers. Two of the servers support only Cisco Discovery Protocol with no other link discovery protocol. The engineer wants the servers to be discovered automatically by the Cisco ACI fabric when connected. Which action must be taken to meet this requirement?

  1. Create an override policy that enables Cisco Discovery Protocol after LLDP is enabled in the default policy group.
  2. Configure a higher order interface policy that enables Cisco Discovery Protocol for the interface on the desired leaf switch.
  3. Configure a lower order policy group that enables Cisco Discovery Protocol for the interface on the desired leaf switch.
  4. Create an interface profile for the interface that disables LLDP on the desired switch that is referenced by the interface policy group.

Answer(s): B

Explanation:

Option B is correct because Cisco ACI uses policy-based automation where higher-order interface policies can enable specific L2/L3 features like Cisco Discovery Protocol (CDP) for the interface on the leaf. Elevating the policy ensures CDP is active on the port to allow discovery of the servers that support only CDP.
A is incorrect because an override policy is not the correct mechanism to enable CDP at the interface level for automatic discovery; overrides are for exceptions, not standard auto-discovery activation.
C is incorrect because a lower-order policy group would not guarantee CDP activation when needed; policy precedence requires a higher-order config.
D is incorrect because disabling LLDP via an interface profile would not enable CDP-based discovery; LLDP affects LLDP, not CDP discovery behavior.



An engineer wants to monitor all configuration changes, threshold crossing, and link-state transitions in a Cisco ACI fabric. Which action must be taken to receive the required messages?

  1. Add Faults and Events to the monitor policy.
  2. Add Session Logs and Audit Logs to the monitor policy.
  3. Include Audit Logs and Events in the Syslog source policy.
  4. Include Events and Session Logs in the Syslog source policy.

Answer(s): C

Explanation:

Option C is correct because including Audit Logs and Events in the Syslog source policy ensures messages about configuration changes, threshold crossings, and link-state transitions are sent to the Syslog server for comprehensive monitoring in ACI.
A) Incorrect — Faults and Events in the monitor policy do not guarantee the full range of configuration-change and link-state transition messages; rely on Syslog for centralized logging.
B) Incorrect — Session Logs and Audit Logs alone do not map to the Syslog source policy for all event types described; Syslog policy is needed.
D) Incorrect — Events and Session Logs in the Syslog source policy do not cover all required audit and configuration-change messages as Audit Logs are essential.



Viewing page 5 of 50
Viewing questions 33 - 40 out of 389 questions


300-620 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!