Cisco CCNP Data Center 300-620 Questions & Answers

• Question 91:

  When a pre-provision immediacy is used, when is the policy downloaded to the Cisco ACI leaf switch?

  A. The policy is downloaded and programmed in the hardware policy CAM when the change is implemented on the Cisco APIC.

  B. The policy is programmed in the hardware policy CAM when the policy is downloaded in the leaf software.

  C. The policy is programmed in the hardware policy CAM when the first packet is received through the data path.

  D. The policy is downloaded to the associated leaf switch software when the ESXi host is attached to a DVS.

  Correct Answer: A

• Question 92:

  Which two protocols are used for fabric discovery in ACI? (Choose two.)

  A. LLDP

  B. OSPF

  C. CDP

  D. DHCP

  E. ISIS

  Correct Answer: AD

  The APIC startup topology auto discovery, automated configuration, and infrastructure addressing uses these industry-standard protocols: Intermediate System-to-Intermediate System (IS-IS), Link Layer Discovery Protocol (LLDP), and Dynamic Host Configuration Protocol (DHCP).

  The ACI fabric is brought up in a cascading manner, starting with the leaf nodes that are directly attached to the APIC. LLDP and control-plane IS-IS convergence occurs in parallel to this boot process. The ACI fabric uses LLDP- and DHCP-based fabric discovery to automatically discover the fabric switch nodes, assign the infrastructure VXLAN tunnel endpoint (VTEP) addresses, and install the firmware on the switches. Prior to this automated process, a minimal bootstrap configuration must be performed on the Cisco APIC controller. After the APIC controllers are connected and their IP addresses assigned, the APIC GUI can be accessed by entering the address of any APIC controller into a web browser. The APIC GUI runs HTML5 and eliminates the need for Java to be installed locally.

  Reference: https://www.dclessons.com/aci-fabric-discovery

• Question 93:

  What is the purpose of the Overlay Multicast TEP in a Cisco ACI Multi-Site deployment?

  A. to source and receive unicast VXLAN data plane traffic

  B. to establish MP-BGP EVPN adjacencies with the spine nodes in remote sites

  C. to encapsulate multicast traffic in a common multicast group

  D. to perform head-end replication for BUM traffic

  Correct Answer: D

  Overlay Multicast TEP (O-MTEP): This common anycast address is shared by all the spine nodes in the same site and is used to perform head-end replication for BUM traffic. BUM traffic is sourced from the O-UTEP address defined on the local spine nodes and destined for the O-MTEP of remote sites to which the given bridge domain is being stretched.

  https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739609.html

• Question 94:

  As part of a migration, legacy non-ACI switches must be connected to the Cisco ACI fabric. All non-ACI switches run per-VLAN RSTP. After the non-ACI switches are connected to Cisco ACI, the STP convergence caused a microloop and significant CPU spike on all switches. Which configuration on the interfaces of the external switches that face the Cisco ACI fabric resolves the problem?

  A. BPDU guard

  B. aggressive STP timers

  C. BPDU filtering

  D. STP type link shared

  Correct Answer: D

• Question 95:

  Which two IP address types are available for transport over the ISN when they are configured from Cisco ACI Multi-Site Orchestrator? (Choose two.)

  A. Management IP of APICs

  B. Management IP of the MSO Node

  C. Anycast Overlay Multicast TEP

  D. MP-BGP EVPN Router-ID

  E. Common Pervasive Gateway

  Correct Answer: CD

  As shown in Figure 60, the EVPN-RID, O-UTEP, and O-MTEP addresses are the only prefixes that must be exchanged across sites to enable the intersite EVPN control plane and the VXLAN data plane. Consequently, they are the only prefixes that should be learned in the ISN routing domain. This implies that those IP addresses must be globally routable across the ISN, which should normally not be a problem, because they are independent of the original TEP pools associated to each fabric and assigned separately on Cisco Nexus Dashboard Orchestrator at the time of Multi-Site deployment.

• Question 96:

  An engineer deploys a two-pod Cisco ACI Multi-Pod environment. Why should no more than two Cisco APIC controllers be deployed in the same pod?

  A. to enable equal capacity to scale in each pod

  B. to avoid losing all replicas of a shard if a pod fails

  C. to avoid hair-pinning traffic that is destined for the primary APIC controller between pods

  D. to ensure that all nodes in all pods have local access to a controller

  Correct Answer: B

  "To ensure that a total loss of a given pod does not result in the loss of all shards for a given attribute, Cisco recommends that no more than two APICs be placed in a single pod." https://www.ciscopress.com/articles/article.asp?p=3150964andseqNum=4v

• Question 97:

  Refer to the exhibit.

  

  An engineer configures communication between the EPGs in different tenants. Which action should be taken to create the subnet?

  A. Change Scope to Shared between VRFs.

  B. Leave Scope set to Private to VRF.

  C. Add the L3Out for Route Profile value.

  D. Change Scope to Advertised Externally.

  Correct Answer: A

  Private to VRF = This subnet will only be routed internal to the ACI fabric. This is to say it won't be advertised via any L3outs.

  Advertise Externally = The opposite of Private. This means you want this subnet to participate in any associated L3outs.

  Shared Between VRFs = This is used when you want to do route leaking between different VRFs

  Please note that Shared Services term which is widely used in most of the documents is nothing but about Inter VRF/Tenant Communication.

  Define the subnets at BD level for both the EPGs in both VRF and mark them as Shared between VRFs.

• Question 98:

  Refer to the exhibit.

  

  An engineer must divert the traffic between VM-1 and VM-2 by using a Multi-Node service graph. The solution should prevent an insufficient number of available Layer 4 to Layer 7 devices in the first cluster. Which configuration set accomplishes this goal?

  A. PBR node tracking tracking threshold with action bypass symmetric PBR resilient hashing

  B. PBR node tracking tracking threshold with action permit unidirectional PBR resilient hashing

  C. PBR node tracking tracking threshold with action permit symmetric PBR resilient hashing

  D. PBR node tracking tracking threshold with action deny symmetric PBR unidirectional PBR

  Correct Answer: C

  1.

  PBR node tracking: This allows PBR to track the status of the Layer 4 to Layer 7 devices in the service graph.

  2.

  Tracking threshold with action permit: This sets the threshold for device availability and permits traffic redirection to the available devices.

  3.

  Symmetric PBR: This ensures that both inbound and outbound traffic is redirected through the same set of Layer 4 to Layer 7 devices in the service graph.

  4.

  Resilient hashing: This load-balancing algorithm ensures that traffic is distributed evenly across all available devices, preventing any one device from becoming overloaded.

• Question 99:

  Refer to the exhibit.

  

  A Cisco ACI environment hosts two e-commerce applications. The default contract from a common tenant between different application tiers is used, and the applications work as expected. The customer wants to move to more specific contracts to prevent unwanted traffic between EPGs. A network administrator creates the app-to-db contract to meet this objective for the application and database tiers. The application EPGs must communicate only with their respective database EPGs. How should this contract be configured to meet this requirement?

  A. Set the app-to-db scope to Global.

  B. Set the app-to-db scope to Application Profile.

  C. Implement the app-to-db scope as VRF.

  D. Implement the app-to-db as a Taboo contract.

  Correct Answer: B

  A contract will only program rules between EPGs that are defined within the same application profile. Use of the same contract across other application profile EPGs will not allow for crosstalk between them.

• Question 100:

  Refer to the exhibit.

  

  An engineer configured subnets on the external EPG called L3OUT_CORE. The external endpoints in the 10.1.0.0/24 subnet can reach internal endpoints, but the external endpoints in the 172.16.1.0/24 subnet are unreachable. Which set of actions enables the connectivity?

  A. Delete both external EPG subnets. Create the 0.0.0.0/1 subnet.

  B. Delete the external EPG subnet 0.0.0.128/1. Create the 128.0.0.0/1 subnet.

  C. Delete both external EPG subnets. Create the 0.0.0.0/0 subnet.

  D. Delete the external EPG subnet 0.0.0.0/0. Create the 0.0.0.0/128 subnet.

  Correct Answer: B

  The 0.0.0.0/0 matches every IP address, whereas 0.0.0.0/1 only matches half of them (0.0.0.0-127.255.255.255) and requires 128.0.0.0/1 as its pair to match the rest (128.0.0.0-255.255.255.255).

  https://serverfault.com/questions/1100250/what-is-the-difference-between-0-0-0-0-0-and-0-0-0-0-1