Cisco CCNP Data Center 300-620 Questions & Answers

• Question 111:

  A network administrator configures AAA inside the Cisco ACI fabric. The authentication goes through the local users if the TACACS+ server is not reachable. If the Cisco APIC is out of the cluster, the access must be granted through the fallback domain. Which configuration set meets these requirements?

  A. Ping Check: True Default Authentication Realm: Local Fallback Check: True

  B. Ping Check: True Default Authentication Realm: TACACS+ Fallback Check: False

  C. Ping Check: False Default Authentication Realm: Local Fallback Check: False

  D. Ping Check: False Default Authentication Realm: TACACS+ Fallback Check: True

  Correct Answer: B

  Unclear what is supposed be the ping check Anyway Default Authentication Realm hall be TACACS+ and you shall not put fallback check on if required working fallback local authentication Note: Make sure to leave/set the Fallback Check property to false. Setting the Fallback Check property to true may cause local logins to fail. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/b_KB_ACI-TACACS-config.html

• Question 112:

  A Cisco ACI environment consists of multiple silent hosts that are often relocated between leaf switches. When the host is relocated, the bridge domain takes more than a few seconds to relearn the host's new location. The requirement is to minimize the relocation impact and make the ACI fabric relearn the new location of the host faster. Which action must be taken to meet these requirements?

  A. Set Unicast Routing to Enabled.

  B. Configure ARP Flooding to Enabled.

  C. Set L2 Unknown Unicast to Hardware Proxy.

  D. Configure IP Data-Plane Learning to No.

  Correct Answer: C

  Hardware Proxy By default, Layer 2 unknown unicast traffic is sent to the spine proxy. This behaviour is controlled by the hardware proxy option associated with a bridge domain: if the destination is not known, send the packet to the spine proxy; if the spine proxy also does not know the address, discard the packet (default mode).

  The advantage of the hardware proxy mode is that no flooding occurs in the fabric. The potential disadvantage is that the fabric has to learn all the endpoint addresses.

  With Cisco ACI, however, this is not a concern for virtual and physical servers that are part of the fabric: the database is built for scalability to millions of endpoints. However, if the fabric had to learn all the IP addresses coming from the Internet, it would clearly not scale.

• Question 113:

  A customer must upgrade the Cisco ACI fabric to use a feature from the new code release. However, there is no direct path from the current release to the desired one. Based on the Cisco APIC Upgrade/Downgrade Support Matrix, the administrator must go through one intermediate release.

  Which set of steps must be taken to upgrade the fabric to the new release?

  A. 1. Upgrade the APICs to an interim release.

  2.

  Upgrade the switches to an interim release.

  3.

  Upgrade the APICs to the targeted release.

  4.

  Upgrade the leaf and spine switches to the targeted release.

  B. 1. Upgrade the APICs to an interim release and then switches to an interim release.

  2.

  When all switches are operational, upgrade leaf switches to the targeted release.

  3.

  Upgrade the spine switches to the targeted release.

  4.

  Upgrade the APICs to the targeted release.

  C. 1. Upgrade the APICs to an interim release.

  2.

  Upgrade the leaf switches directly to the targeted release.

  3.

  Upgrade the spine switches directly to the targeted release.

  4.

  Upgrade the APICs to the targeted release.

  D. 1. Upgrade the APICs directly to the targeted release.

  2.

  Upgrade the switches to an interim release.

  3.

  When all switches are operational, upgrade the leaf switches to the targeted release.

  4.

  Upgrade the spine switches to the targeted release.

  Correct Answer: A

  Get files from Cisco onto a HTTP/SCP server and then uploaded to APIC Get APICs upgraded Wait for things to stabilise. Get Leaf/Spines upgraded Wait for things to stabilise.

  When upgrading or downgrading to a release that does not have a direct path from your current release, you must upgrade or downgrade all the APICs and switches to an intermediate supported release to which there is a direct path, then upgrade or downgrade from that release to your desired release. Sometimes, you must move through multiple intermediate releases before being able to get to your desired release, upgrading or downgrading both the APICs and switches to the same release each time.

• Question 114:

  Refer to the exhibit.

  

  An engineer configures an L3Out but receives the error presented. Which action clears the fault?

  A. Acknowledge the QoS-related error.

  B. Associate a custom QoS class.

  C. Create a custom QoS policy.

  D. Set the QoS policy to Level 3.

  Correct Answer: A

  Because performing those actions will prevent the fault from appearing again in the future, but will not clear the fault that is already present.

• Question 115:

  Refer to the exhibit.

  

  VM1 and VM2 are in Cisco ACI POD1 and communication takes place. Which event is triggered when VM2 is live migrated from POD1 to POD2?

  A. Leaf 102 installs a bounce entry for VM2 pointing to the PTEP address of leaf 201.

  B. Leaf 201 creates a tunnel with leaf 102 because of the bounced traffic that is destined to VM2.

  C. Spines from POD2 send an MP-BGP EVPN update to the leaves in POD1 about the new location of VM2.

  D. An MP-BGP EVPN update is received by spines in POD1 announcing the reachability of VM2 via the proxy VTEP address of the spines in POD2.

  Correct Answer: C

  1.

  The VM migrates between Pod1 and Pod2.

  2.

  Once the migration is completed, the leaf node in Pod2 discovers EP2 as locally connected and sends a COOP update message to the local spines.

  3.

  The spine node that receive the COOP message updates EP2's info in the COOP database, replicates the information to the other local spines and sends a MP-BGP EVPN update to the spines in remote Pods.

  4.

  The spines in the remote Pods receive the EVPN update and add the information to the local COOP database that EP2 is now reachable via the Proxy VTEP address identifying the spines in Pod2 (“Proxy B”).

  5.

  The spine sends a control plane message to Leaf 4 as it was the old known location for EP2. Leaf 4 as a consequence installs a bounce entry for EP2 pointing to the local spines Proxy VTEP address.

  https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737855.html

• Question 116:

  DRAG DROP

  An engineer must use a Cisco ACI backup process to back up the entire data center fabric configuration.

  Drag and drop the configuration snippets onto the boxes to back up the configuration, including hashed secure properties to the FTP server.

  Not all configuration snippets are used.

  Select and Place:

  

  Correct Answer:

  

• Question 117:

  DRAG DROP

  An engineer is configuring a VRF for a tenant named Cisco. Drag and drop the child objects on the left onto the correct containers on the right for this configuration.

  Select and Place:

  

  Correct Answer:

  

• Question 118:

  DRAG DROP

  Drag and drop the Cisco ACI filter entry options from the left onto the correct categories on the right indicating what are required or optional parameters.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_01000.html

• Question 119:

  DRAG DROP

  Drag and drop the Cisco ACI Layer 4 to Layer 7 service insertion terms on the left to the correct descriptions on the right.

  Select and Place:

  

  Correct Answer:

  

• Question 120:

  DRAG DROP Refer to the exhibit. A Cisco ACI fabric is newly deployed, and the security team requires more visibility of all inter EPG traffic flows. All traffic in a VRF must be forwarded to an existing firewall pair. During failover, the standby firewall must continue to use the same IP and MAC as the primary firewall. Drag and drop the steps from the left into the implementation order on the right to configure the service graph that meets the requirements. (Not all steps are used.)

  

  Select and Place:

  

  Correct Answer:

  

  Reference:

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/L4- L7_Services_Deployment/guide/b_L4L7_Deploy_ver201/b_L4L7_Deploy_ver201_chapter_010100.ht ml#id_71564

  Create a service bridge domain and a layer 4 to layer 7 device within one cluster interface.