Cisco CCNP Data Center 300-620 Questions & Answers

• Question 21:

  What is the result of selecting the On Demand attribute in the Deploy Immediacy feature during VMM domain association to an EPG?

  A. The EPG policy is programmed in the hardware policy CAM as soon as the policy is downloaded in the leaf software.

  B. The EPG policy is downloaded to the leaf when a hypervisor is attached to a DVS, and CDP or LLDP adjacency is formed.

  C. The EPG policy is downloaded to the leaf when a hypervisor is connected, and a VM is placed in a port group.

  D. The EPG policy is programmed in the hardware policy CAM only when the first packet is received through the data path.

  Correct Answer: D

  The deployment immediacy option specifies that the policy should be programmed in the hardware policy cam only when the switch receives a packet through the data path. This setting helps optimize the hardware space.

• Question 22:

  A network administrator is configuring a Cisco ACI fabric to automatically take a snapshot of all the configurations once per week. The snapshot must be saved on a server that is located in the data center. Which configuration meets these requirements?

  A. Scope: Fabric Action: Create recurring snapshots Location: Create Remote Location

  B. Scope: Tenant Action: Create recurring snapshots Location: APIC

  C. Scope: Tenant Action: Take a snapshot Location: Create Remote Location

  D. Scope: Fabric Action: Take a snapshot Location: APIC

  Correct Answer: A

  All config snapshot = "Fabric" option, tenant as the name suggests is for a specific tenant

  Action should be set to "Recurring snapshots" aka not once, but continuous

  Location is "remote location" as it is stored in a server within the DC, instead of the APIC itself. Otherwise, the location would be set to "APIC" aka the UCS box hosting the APIC OS.

• Question 23:

  A Cisco ACI fabric is experiencing packet loss that originates from a bare metal server. The engineer must configure the syslog service to meet these requirements:

  1.

  The ACI syslog information must be collected with logging information from other network devices.

  2.

  The monitoring must only be performed on leaf 103 and leaf 104.

  Which set of actions accomplishes these goals?

  A. Configure the Syslog Monitoring Destination Group to remote server logging. Create an Access Monitoring policy for ingress and egress packet drops. Apply the Monitoring policy to the appropriate Switch Profile group.

  B. Configure the Syslog Monitoring Destination Group to Console logging. Create a Fabric-Wide Monitoring policy for ingress packet drops. Apply the Monitoring policy to the appropriate Switch Profile group.

  C. Configure the Syslog Monitoring Destination Group to Local File logging. Create a Fabric Monitoring policy for ingress and egress bytes. Apply the Monitoring policy to the appropriate Switch Profile group.

  D. Configure the Syslog Monitoring Destination Group to Console logging. Create an Access Monitoring policy for egress packet drops. Apply the Monitoring policy to the appropriate Switch Profile group.

  Correct Answer: A

  "The ACI syslog information must be collected with logging information from other network devices" could refer to a syslog server, so no local or console, but remote syslog server

• Question 24:

  A Cisco ACI fabric contains a tenant called Prod. User_1 must have written access to tenant Prod and full access to the fabric access policy. Which set of actions must be taken to meet these requirements?

  A. Associate User_1 to tenant Prod. Associate the security domain to the distinguished name of the fabric access policy. Create RBAC for the distinguished name of security domain.

  B. Associate User_1 to the distinguished name of the fabric access policy. Associate the security domain to RBAC. Create RBAC for the distinguished name of User_1.

  C. Associate User_1 to the fabric access policy. Associate the security domain to the fabric access policy. Create RBAC for the distinguished name of tenant Prod.

  D. Associate User_1 to the security domain. Associate the security domain to tenant Prod. Create RBAC for the distinguished name of fabric access policy.

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/5-x/security/cisco-apic-security-configuration-guide-50x/m-restricted-access-security-domains.html

• Question 25:

  A Cisco ACI fabric is connected to an external Cisco Catalyst switch. Which set of actions must be taken for Cisco ACI leaf and spine switches to be managed from the management port?

  A. Provide default/common contract by external management network under tenant mgmt. Consume default/common contract by out-of-band EPG.

  B. Provide default/mgmt contract by out-of-band EPG. Consume default/mgmt contract by external management network under tenant common.

  C. Provide default/mgmt contract by external management network under tenant common. Consume default/mgmt contract by out-of-band EPG.

  D. Provide default/common contract by out-of-band EPG. Consume default/common contract by external management network under tenant mgmt.

  Correct Answer: D

  1.

  All devices will need static OOB addresses (APIC controllers, leafs, and spines) that associate the IP address, NodeID, default GW, and management type (OOB, in this case).

  2.

  You'll need to configure a contract that will be consumed and provided to your OOB devices. The contract will allow the system to know what traffic is allowed. (In this use case, you will use the default/common contract to permit any traffic.)

  Step 1 – Providing the contract Tenant > Tenant mgmt > Node Management EPGs > Out-of-Band EPG default

  Under the “Provided Out-of-Band Contracts” in the policy window, provide the appropriate contract. (This could be a the default/common contract or a specific contract you have created and modified). Click Submit.

  Step 2 – Consuming the contract Tenant > Tenant mgmt > External Management Network Instance Profiles > YourInstanceProfile

  Consume the same contract that you provided in the previous step.

  Enter the subnets that are allowed to have access to the APIC. (0.0.0.0/0 will permit all).

• Question 26:

  Refer to the exhibit.

  

  A network engineer deploys Cisco APIC for the first time. Which connectivity type must be used to connect a Cisco ACI APIC node to connect to an out-of-band segment?

  A. 4. 1-Gb Ethernet dedicated management port

  B. 5. Serial port (RJ-45 connector)

  C. 9. VIC 1455 with external 10/25-Gigabit Ethernet ports

  D. 2. Dual 1-Gb/10-Gb Ethernet ports (LAN1 and LAN2)

  Correct Answer: D

  Out-of-band 1-Gb/10-Gb Ethernet management ports for management of APIC OS only

• Question 27:

  Refer to the exhibit.

  

  A syslog service was configured to capture different faults and events from a Cisco ACI tenant. The Cisco ACI fabric is missing any OOB capability. After some time, the administrator noticed that the syslog messages were not present on the

  APIC. Which two actions complete the configuration? (Choose two.)

  A. Change forwarding facility to local1.

  B. Ping the syslog server from the APIC.

  C. Reconfigure the UDP port settings.

  D. Change the minimum severity levels.

  E. Set the management EPG to default.

  Correct Answer: CD

  UDP Port 514

  When using Inband management for your ACI Fabric, the Inband management EPG DOES require the specific UDP Port 514 (Syslog) to be enabled.

  The severity level is set to Alert which is level 1. This would exclude levels 2-7.

• Question 28:

  For which type of endpoint entry does a Cisco ACI leaf switch keep the original TEP source address instead of rewriting the outer source IP address to its TEP address?

  A. local entry

  B. remote entry

  C. bounce entry

  D. COOP entry

  Correct Answer: C

  There are several scenarios in which an endpoint moves between two Cisco ACI leaf switches, such as a failover event or a virtual machine migration in a hypervisor environment. Cisco ACI data-plane endpoint learning detects these events quickly and updates the Cisco ACI endpoint database on a new leaf. In addition to data-plane learning, Cisco ACI uses bounce entries to manage the old endpoint information on the original leaf.

  The difference between a bounce entry and a remote endpoint is in whether or not the leaf rewrites the outer source IP address of the packet. When a packet uses a normal remote endpoint, the Cisco ACI leaf uses its own TEP address as the outer source IP address, so the remote leaf learns this packet with its own TEP. When a packet uses a bounce entry, the Cisco ACI leaf doesn't rewrite the outer source IP address, so the remote data-plane learning will behave as if the packet came from the originating leaf rather than the intermediate “bounce” leaf.

• Question 29:

  Refer to the exhibit.

  

  An engineer applies an OSPF L3Out between a Cisco ACI fabric and an external router. Router1 must receive a default route from the Cisco ACI via OSPF. Which action ensures that the ACI fabric is the Layer 3 gateway for Router1?

  A. A. Configure a default route leak policy in the L3Out.

  B. Apply an OSPF interface policy in the OSPF interface profile.

  C. Associate the external EPG with the appropriate contract.

  D. Include an OSPF route summarization policy in external EPG.

  Correct Answer: A

  For external connections to the fabric that only require a default route, there is support for originating a default route for OSPF, EIGRP, and BGP L3Out connections. If a default route is received from an external peer, this route can be

  redistributed out to another peer following the transit export route control as described earlier in this article. A default route can also be advertised out using a Default Route Leak policy. This policy supports advertising a default route if it is

  present in the routing table or it always supports advertising a default route. The Default Route Leak policy is configured in the L3Out connection.

  When creating a Default Route Leak policy, follow these guidelines:

  For BGP, the Always property is not applicable. When configuring the Scope property, choose Outside. For OSPF, the scope value Context creates a type-5 LSA while the Scope value Outside creates type-7 LSA. For EIGRP, when choosing

  the Scope property, you must choose Context.

• Question 30:

  Refer to the exhibit.

  

  A Cisco ACI fabric uses L3Out to connect with R1. The 192.168.1.0/24 subnet is received over the physical interface Eth1/1 of Leaf1 and Leaf2. Which set of actions must be taken to receive the 2001:db8::2:1 subnet over the interface Eth1/1 interface?

  A. Create a new interface profile. Mark the IPv6 subnet as the export route control subnet.

  B. Create a new interface profile. Mark the IPv6 subnet as the import route control subnet.

  C. Use the current interface profile. Mark the IPv6 subnet as the export route control subnet.

  D. Use the current interface profile. Mark the IPv6 subnet as the import route control subnet.

  Correct Answer: B

  https://community.cisco.com/t5/application-centric-infrastructure/l3out-with-ipv4-and-ipv6/td-p/4012784