Free 300-620 exam questions in PDF & AI Tutor

QUESTION: 41

An ACI engineer is implementing a Layer 3 Out inside the Cisco ACI fabric that must meet these requirements:

The data center core switch must be connected to one of the leaf switches with a single 1G link.

The routes must be exchanged using a link-state routing protocol that supports hierarchical network design.

The data center core switch interface must be using 802.1Q tagging, and each VLAN will be configured with

a dedicated IP address.

Which set of steps accomplishes this goals?

Set up the EIGRP Protocol policy with the selected Autonomous System number.
Create the Routed Outside object and Node Profile, selecting EIGRP.
Configure the Interface profile, selecting Routed Interface and the appropriate interfaces.
Create the External Network object with a network of 0.0.0
.
Set up the EIGRP Protocol policy with the selected Autonomous System number.
Set up the Routed External Network object and Node Profile, selecting EIGRP.
Create the Switch profile, selecting Port-channel and the appropriate interfaces.

Create the default network and associate it with the Routed Outside object.
Set up the BGP Protocol policy with the Autonomous System number of 0.
Configure an Interface policy and an External Bridged Domain.
Create an External Bridged Network using the configured VLAN pool.
Build the Leaf profile, selecting Routed sub-interface and the appropriate VLAN.
Configure the OSPF Protocol policy with an area of 0.
Create Routed Outside object and Node Profile, selecting OSPF as the routing protocol.
Build the Interface profile, selecting Routed Sub-interface and the appropriate VLAN.
Configure the External Network object with a network of 0 0.0
.

Answer(s): D

Explanation:

Option D is correct because the scenario requires a link-state protocol that supports hierarchical network design for L3 Out in ACI, and OSPF is the appropriate protocol policy for external routed connections with an area of 0 in ACI External Routed domains. A) and B) identical incorrect options claim EIGRP policy but EIGRP is not a standard in ACI for L3Out with OSPF hierarchical design. C) BGP policy with AS 0 is invalid for this L3Out use case and does not align with the required hierarchical link-state design. D) correctly specifies OSPF with area 0 to meet the requirements.

Show Answer Next Question

QUESTION: 42

An engineer is in the process of discovering a new Cisco ACI fabric consisting of two spines and four leaf switches. The discovery of leaf 1 has just been completed. Which two nodes are expected to be discovered next? (Choose two.)

leaf 2
leaf 4
spine 1
leaf 3
spine 2

Answer(s): C,E

Explanation:

Option C is correct because initial fabric discovery progresses from the first leaf to discover its neighboring spine nodes, establishing control-plane connectivity with spine devices. In a two-spine, four-leaf ACI fabric, after leaf 1, the two spines (spine 1 and spine 2) are discovered next to form the fabric’s backbone before full leaf-to-leaf or leaf-to-leaf spine adjacencies are completed. Option E is correct for the same reason: the second spine (spine 2) is discovered next to spine 1 to complete the spine pair for the fabric’s control plane. Incorrect — A, B, D describe other leaves; discovery of additional leaves typically follows spine discovery, not preceding it. Incorrect — Leaf 2, leaf 4, and any order of their discovery is contingent on spine readiness, not required immediately after leaf 1.

Reference:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/GSG/ b_APIC_Getting_Started_Guide_Rel_2_x/b_APIC_Getting_Started_Guide_Rel_2_x_chapter_0100.pdf

Show Answer Next Question

QUESTION: 43

A bridge domain for an EPG called "Web Servers" must be created in the Cisco APIC. The configuration must meet these requirements:

Only traffic to known MAC addresses must be allowed to reduce noise.

The multicast traffic must be limited to the ports that are participating in multicast routing.

The endpoints within the bridge domain must be kept in the endpoint table for 20 minutes without any

updates.

Which set of steps configures the bridge domain that satisfies the requirements?

Switch L2 Unknown Unicast to Flood.
Select the default Endpoint Retention Policy and set the Local Endpoint Aging to 20 minutes.
Set Multicast Destination Flooding to Flood in Encapsulation.
Set L2 Unknown Unicast to Hardware Proxy.
Configure L3 Unknown Multicast Flooding to Optimized Flood.
Create an Endpoint Retention Policy with a Local Endpoint Aging Interval of 1200 seconds.
Multicast Destination Flooding should be set to Flood in BD.
Set L3 Unknown Multicast Flooding to Flood.
Select the default Endpoint Retention Policy with a Local Endpoint Aging Interval of 1200 seconds.
Select the ARP Flooding checkbox.
Create an Endpoint Retention Policy with a Remote Endpoint Aging Interval of 20 minutes.
Set L3 Unknown Multicast Flooding to Optimized Flooding.

Answer(s): B

Explanation:

Option B
A) Incorrect — L2 Unknown Unicast should be set to Hardware Proxy is not the mechanism for enforcing explicit known-MAC filtering or controlling multicast behavior in this scenario.
B) Correct — Setting L2 Unknown Unicast to Hardware Proxy aligns with restricting traffic to known MAC addresses and leverages APIC/BD policies to constrain unknown traffic, meeting noise reduction while preserving endpoint learn/aging semantics.
C) Incorrect — Multicast Destination Flooding to Flood in BD does not address known-MAC enforcement or endpoint aging requirements; it governs multicast flood behavior only.
D) Incorrect — ARP Flooding checkbox is unrelated to controlling unknown unicast, endpoint retention, or multicast port-eligibility in this context.

Show Answer Next Question

QUESTION: 44

An engineer is troubleshooting fabric discovery in a newly deployed Cisco ACI fabric and analyzes this output:

Which ACI fabric address is assigned to interface lo1023?

VXLAN tunnel endpoint
Physical tunnel endpoint
Fabric tunnel endpoint
Dynamic tunnel endpoint

Answer(s): C

Explanation:

Option C is correct because lo1023 is shown as a fabric tunnel endpoint in the ACI fabric discovery output, which identifies the ACI fabric IP addressing for inter-node control-plane and data-path encapsulation within the fabric. Incorrect — A) VXLAN tunnel endpoint refers to endpoint for VXLAN encapsulated traffic but not the fabric discovery address specifically. Incorrect — B) Physical tunnel endpoint is not a standard ACI term for fabric discovery addressing. Incorrect — D) Dynamic tunnel endpoint is not a defined ACI construct for fabric discovery addressing.

Show Answer Next Question

QUESTION: 45

The company's Cisco ACI fabric hosts multiple customer tenants. To meet a service level agreement, the company is constantly monitoring the Cisco ACI environment. Syslog is one of the methods used for monitoring. Only events related to leaf and spine environmental information without specific customer data should be logged. To which ACI object must the configuration be applied to meet these requirements?

infra tenant
access policy
switch profile
fabric policy

Answer(s): D

Explanation:

Option D is correct because fabric policies in Cisco ACI govern global fabric behavior, including environmental logging settings at the fabric level, which apply across tenants and do not expose specific tenant data. This aligns with logging leaf/spine environmental information without per-tenant data.
A) infra tenant — Incorrect — infra is an internal tenant for fabric infrastructure objects, but environmental logging scope at the fabric level is not restricted to infra tenant data and requires fabric-wide policy.
B) access policy — Incorrect — access policies control contract and endpoint access behavior, not fabric-wide environmental logging configuration.
C) switch profile — Incorrect — switch profiles configure switch-level features and policies, but the question requires a fabric-wide logging scope independent of individual switches.

Show Answer Next Question

QUESTION: 46

Refer to the exhibit. A client is configuring a new Cisco ACI fabric. All VLANs will be extended during the migration phase using the VPC connections on leaf switches 3, 4 and leaf switches 5, 6 toward the legacy network. The migration phase has these requirements:

The legacy switches must be able to transfer BPDUs through the ACI fabric.

If the legacy switches fail to break a loop, Cisco ACI must break the loop.

Which group settings must be configured on VPC interface policy groups ipg_vpc-legacy_1 and ipg_vpc- legacy_2 to meet these requirements?

MCP: enabled
BPDU Guard: disabled
BPDU Filter: disabled
MCP: disabled
BPDU Guard: enabled
BPDU Filter: enabled
MCP: enabled
BPDU Guard: enabled
BPDU Filter: disabled
MCP: disabled
BPDU Guard: disabled
BPDU Filter: enabled

Answer(s): A

Explanation:

Option A is correct because MCP (MAC Pinning Control) must be enabled to allow the legacy switches to forward BPDUs through the ACI fabric via VPC without mislearning or loop protection interference. Enabling MCP ensures consistent MAC pinning behavior across the VPC peers, which helps preserve BPDU traversal while still allowing ACI to detect and break loops if a legacy device creates one.
B, C, D are incorrect because they imply different MCP states or configurations that do not provide the required balance of BPDU forwarding and loop protection in the migration scenario. Specifically, enabling MCP is the necessary condition to support stable BPDU passthrough in VPC legacy connections.

Show Answer Next Question

QUESTION: 47

A Cisco ACI fabric is connected to an external Cisco Catalyst switch. Which set of actions must be taken for Cisco ACI leaf and spine switches to be managed from the management port?

Provide default/common contract by external management network under tenant mgmt.

Consume default/common contract by out-of-band EPG.
Provide default/mgmt contract by out-of-band EPG.
Consume default/mgmt contract by external management network under tenant common.
Provide default/mgmt contract by external management network under tenant common.
Consume default/mgmt contract by out-of-band EPG.
Provide default/common contract by out-of-band EPG.
Consume default/common contract by external management network under tenant mgmt.

Answer(s): D

Explanation:

Option D is correct because managing ACI leaf/spine from the management port requires exposing the default/common contract via the out-of-band (OOB) EPG, enabling management-plane access independent of tenant networks. A) and C) incorrectly reference the external management network under tenant mgmt/common, which is not the standard approach for OOB management in this scenario. B) incorrectly uses the default/mgmt contract by the OOB EPG alone, but the key requirement is the default/common contract, not default/mgmt, when using the management port for out-of-band access. E and F are not present in the question.

Show Answer Next Question

QUESTION: 48

A Cisco ACI fabric contains a tenant called Prod. User_1 must have write access to tenant Prod and full access to the fabric access policy. Which set of actions must be taken to meet these requirements?

Associate User_1 to tenant Prod.
Associate the security domain to the distinguished name of the fabric access policy.
Create RBAC for the distinguished name of security domain.
Associate User_1 to the distinguished name of the fabric access policy.
Associate the security domain to RBAC.
Create RBAC for the distinguished name of User_1.
Associate User_1 to the fabric access policy.
Associate the security domain to the fabric access policy.
Create RBAC for the distinguished name of tenant Prod.
Associate User_1 to the security domain.
Associate the security domain to tenant Prod.
Create RBAC for the distinguished name of fabric access policy.

Answer(s): D

Explanation:

Option D is correct because assigning User_1 to the security domain ensures they inherit the necessary RBAC permissions scoped to that domain, granting them write access to the Prod tenant and full access to the fabric access policy via domain-level authorization in ACI RBAC.
A) Incorrect — Associating User_1 to the tenant Prod only grants tenant scope, not the required RBAC or fabric-access-policy domain linkage to enforce write and full access across the fabric.
B) Incorrect — Associating to the distinguished name of the fabric access policy confers policy-level access, but does not establish the necessary domain RBAC or tenant-scoped permissions for User_1.
C) Incorrect — Directly associating to the fabric access policy yields policy-level permissions but bypasses the security-domain RBAC linkage needed for proper Tenant and Fabric policy enforcement.

Show Answer Next Question

What the 300-620 Exam Tests and How to Pass It

The 300-620 Implementing Cisco Application Centric Infrastructure (DCACI) exam is a critical certification exam designed for network engineers, data center administrators, and systems architects who are responsible for deploying, managing, and troubleshooting Cisco's ACI fabric. This certification validates a candidate's ability to transition from traditional, CLI-based networking environments to a policy-driven, software-defined networking model that is increasingly common in modern enterprise data centers. Professionals who hold this Cisco certification are highly sought after by organizations that rely on Cisco's data center portfolio to automate network provisioning, enhance security through micro-segmentation, and simplify the management of complex, multi-site environments. By passing this exam, you demonstrate that you possess the technical proficiency required to maintain the integrity and performance of a high-availability data center infrastructure, which is a foundational requirement for businesses operating at scale.

What the 300-620 Exam Covers

The scope of the 300-620 exam is comprehensive, requiring a deep understanding of how the ACI fabric infrastructure operates from the ground up, including the physical and logical components that form the foundation of the network. Candidates must demonstrate proficiency in ACI packet forwarding, which involves understanding how traffic is encapsulated, routed, and switched within the fabric using protocols like VXLAN and COOP. Furthermore, the exam tests your ability to configure external network connectivity, ensuring that the ACI fabric can communicate effectively with legacy networks and the outside world through L2 and L3 out configurations. You will also be evaluated on your knowledge of various integrations, such as connecting virtual machine managers or integrating with cloud services, as well as your ability to manage the fabric effectively using the APIC controller. Finally, the exam covers ACI Anywhere, which addresses the complexities of extending the fabric across multiple pods or sites, a critical skill for modern, distributed data center architectures. Our practice questions are designed to mirror these domains, ensuring that you are tested on the specific technical concepts that you will encounter during your actual exam preparation.

Among these domains, ACI packet forwarding and fabric infrastructure often present the most significant challenges for candidates because they require a fundamental shift in how one perceives network traffic flow. Unlike traditional networking where you might trace a hop-by-hop path, ACI relies on a leaf-and-spine architecture where the control plane and data plane are decoupled, necessitating a solid grasp of how the APIC manages endpoint learning and policy enforcement. Candidates must be able to articulate how the fabric handles unknown unicast, broadcast, and multicast traffic, as well as how the policy model dictates the forwarding behavior between endpoint groups. This level of technical depth requires more than just surface-level knowledge; it demands an understanding of the underlying protocols and the specific mechanisms that Cisco ACI uses to maintain loop-free, high-performance connectivity. Mastering these concepts is essential, as they form the basis for troubleshooting almost any issue that might arise in a production ACI environment.

Are These Real 300-620 Exam Questions?

Our platform provides practice questions that are sourced and verified by the community, consisting of IT professionals and recent test-takers who have sat for the actual exam. Because these questions are contributed by individuals who have experienced the testing environment firsthand, our questions reflect what appears on the real exam because they are sourced from the community. If you've been searching for 300-620 exam dumps or braindump files, our community-verified practice questions offer something more valuable, each question is verified and explained by IT professionals who recently passed the exam. We prioritize accuracy and educational value over simple memorization, ensuring that you are engaging with content that is relevant to the current Cisco certification standards. By focusing on community-verified content, we provide a reliable study resource that helps you gauge your readiness for the actual certification exam without relying on unauthorized or unreliable materials.

The community verification process is the cornerstone of our platform's reliability, as it involves a collaborative effort where users actively discuss answer choices and provide context for why a specific option is correct or incorrect. When a question is flagged or debated, experienced members of our community step in to provide technical explanations, cite official Cisco documentation, and share insights from their own recent exam experiences. This iterative process ensures that the questions remain accurate and up-to-date, reflecting any changes in the exam's focus or technical requirements. By participating in these discussions, you gain a deeper understanding of the subject matter, as you are exposed to different perspectives and troubleshooting methodologies that you might not have considered on your own. This collaborative environment is what makes our practice questions a superior tool for your exam preparation, as it transforms static questions into a dynamic learning experience.

How to Prepare for the 300-620 Exam

Effective exam preparation for the 300-620 requires a balanced approach that combines theoretical study with hands-on experience, preferably in a lab or sandbox environment where you can configure ACI policies and observe the results. You should prioritize understanding the core concepts of the ACI policy model, such as EPGs, contracts, and bridge domains, rather than attempting to memorize specific configuration steps. Every practice question includes a free AI Tutor explanation that breaks down the reasoning behind the correct answer, so you understand the concept, not just the answer. We recommend building a consistent study schedule that allows you to dedicate time to each of the major topic areas, ensuring that you are not rushing through complex subjects like external connectivity or multi-site integration. Utilizing official Cisco documentation alongside your hands-on practice will provide the most accurate and reliable information, helping you build a solid foundation of knowledge that will serve you well beyond the exam.

A common mistake candidates make when preparing for this certification exam is relying too heavily on rote memorization, which often fails when faced with the scenario-based questions that Cisco is known for. These questions require you to apply your knowledge to specific, often complex, network topologies, meaning you must understand the "why" behind a configuration, not just the "how." Another frequent error is neglecting time management during your study sessions, which can lead to difficulty when you are under pressure during the actual exam. To avoid this, practice answering questions under timed conditions to build your speed and confidence. By focusing on applying your knowledge to real-world scenarios and utilizing the AI Tutor to clarify any concepts you find difficult, you will be much better prepared to handle the nuances of the 300-620 exam.

What to Expect on Exam Day

On the day of your 300-620 exam, you should expect a rigorous testing environment that is typically administered through a professional testing center or via an online proctored format, such as Pearson VUE. The exam format generally includes a variety of question types, including multiple-choice, multiple-response, and scenario-based questions that require you to analyze network diagrams or configuration outputs to determine the correct solution. You will be given a set amount of time to complete the exam, and it is crucial to manage your time effectively, as some questions may require more analysis than others. Cisco certification exams are designed to test your ability to think critically and apply your technical skills to solve problems, so you should be prepared to encounter questions that challenge your understanding of ACI architecture and operations. Being familiar with the exam interface and the types of questions you will face is a key part of your overall exam preparation, helping to reduce anxiety and allow you to focus on demonstrating your expertise.

Who Should Use These 300-620 Practice Questions

These practice questions are intended for data center engineers, network administrators, and cloud architects who are actively pursuing their Cisco certification and want to validate their skills in implementing ACI. Whether you are a professional with several years of experience in traditional networking looking to pivot into software-defined data centers, or an existing ACI administrator aiming to formalize your knowledge, these resources are designed to support your professional growth. Passing this exam is a significant milestone that can open doors to advanced roles in network architecture and data center management, making it a valuable investment in your career. By using our platform, you are engaging in a structured form of exam preparation that is tailored to the specific requirements of the 300-620 exam, helping you to achieve your certification goals more efficiently. We encourage you to use these resources as a primary study aid to ensure you are fully prepared for the challenges of the certification exam.

To get the most out of these practice questions, you should treat each one as a learning opportunity rather than just a test of your current knowledge. Do not simply read the answer; engage with the AI Tutor explanation to understand the underlying logic, and read the community discussions to see how other professionals approach the same problem. If you get a question wrong, take the time to flag it and revisit it later, ensuring that you have fully grasped the concept before moving on to new material. By actively engaging with the content and utilizing the community-verified insights, you will build the confidence and competence needed to succeed. Browse the questions above and use the community discussions and AI Tutor to build real exam confidence.

Cisco 300-620 Exam Actual Questions Implementing Cisco Application Centric Infrastructure (DCACI) (Page 7 )

QUESTION: 41

Explanation:

QUESTION: 42

Explanation:

Reference:

QUESTION: 43

Explanation:

QUESTION: 44

Explanation:

QUESTION: 45

Explanation:

QUESTION: 46

Explanation:

QUESTION: 47

Explanation:

QUESTION: 48

Explanation:

What the 300-620 Exam Tests and How to Pass It

What the 300-620 Exam Covers

Are These Real 300-620 Exam Questions?

How to Prepare for the 300-620 Exam

What to Expect on Exam Day

Who Should Use These 300-620 Practice Questions

Cisco 300-620 Exam Actual Questions
Implementing Cisco Application Centric Infrastructure (DCACI) (Page 7 )