Cisco CCNP Data Center 300-620 Questions & Answers

• Question 71:

  How is broadcast forwarded in Cisco ACI Multi-Pod after ARP flooding is enabled?

  A. Ingress replication is used on the spines to forward broadcast frames in the IPN infrastructure.

  B. Within a pod, the ingress leaf switch floods the broadcast frame on all fabric ports.

  C. Broadcast frames are forwarded inside the pod and across the IPN using the multicast address that is associated to the bridge domain.

  D. For the specific bridge domain, all spines forward the broadcast frames to IPN routers.

  Correct Answer: C

  Within ACI, all Bridge Domains are allocated a multicast address known as a Group IP Outer (or GIPo) address. All traffic that must be flooded within a Bridge Domain is flooded on this GIPo. https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policy-infrastructure-controller-apic/218013-troubleshoot-aci-intra-fabric-forwarding.html#anc23

• Question 72:

  What are two PBR characteristics of the Cisco ACI Active-Active Across Pods deployment mode in Cisco ACI Multi-Pod design? (Choose two.)

  A. Traffic is dynamically redirected to the firewall that owns the connection.

  B. Deployment occurs in transparent mode.

  C. The connection state is unsynchronized.

  D. Deployment occurs in go-to mode only.

  E. This mode causes the traffic to flow asymmetrically.

  Correct Answer: AD

  Active-active firewall cluster stretched across pods: beginning with Cisco ACI Release 3.2(4d), an active/active firewall cluster can be stretched across pods. When deploying Cisco ASA or Cisco Firepower firewall appliances, this deployment model takes the name of “split spanned EtherChannel” and ensures that all the nodes of the cluster “own” the same MAC/IP values so that the stretched firewall cluster appears as a single logical entity to the ACI Multi-Pod fabric. This deployment model removes any concern about the possible creation of asymmetric traffic paths for both east-west and north-south traffic flows, as traffic will be dynamically redirected to the specific firewall node owning the connection state for that specific traffic flow.

  https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739571.html

• Question 73:

  A company must connect three Cisco ACI data centers by using Cisco ACI Multi-Site. An engineer must configure the Inter-Site Network (ISN) between the existing sites. Which two configuration steps must be taken to implement the ISN? (Choose two.)

  A. Configure OSPF on subinterfaces on routers that are directly connected with spine nodes.

  B. Configure ISN site extension on Cisco routers in the network.

  C. Configure OSPF on all ISN routers.

  D. Configure BIDIR-PIM on all ISN routers.

  E. Configure encapsulation VLAN-4 between the routers and spine nodes.

  Correct Answer: AE

• Question 74:

  Refer to the exhibit.

  

  How are the STP BPDUs forwarded over Cisco ACI fabric?

  A. Cisco ACI acts as the STP root for all three external switches.

  B. STP BPDUs that are generated by Switch2 are received by Switch1 and Switch3.

  C. STP BPDUs that are generated by Switch1 are received only by Switch3.

  D. Cisco ACI fabric drops all STP BPDUs that are generated by the external switches.

  Correct Answer: C

  LEAF2 VLAN 10 is from other domain and other vlan pool, so BPDU's from SW1 are not flooded to SW2, only to SW3.

• Question 75:

  Refer to the exhibit.

  

  An administrator configures inter-VRF route leaking between Production:vrf-prod and Non-Production:vrf-nonprod. However, the route in the Non-Production:vrf-nonprod VRF to the production tenant is missing. Which action resolves the VRF route leaking issue?

  A. Change the contract scope to Global.

  B. Enable the Shared between VRFs option for the BD subnet in the production VRF.

  C. Enable the Shared between VRFs option for the EPG subnet in the non-production VRF.

  D. Export the contract from provider to consumer tenant.

  Correct Answer: B

• Question 76:

  Refer to the exhibit.

  

  The 0.0.0.0/0 is configured as a default static route on L3Out-1. Which action should be taken for the 0.0.0.0/0 prefix to advertise out on L3Out-2 OSPF?

  A. Enable Export Route Control Subnet.

  B. Enable Shared Security Import Subnet.

  C. Enable Shared Route Control Subnet.

  D. Enable Aggregate Export Subnet.

  Correct Answer: A

  Aggregate Export This option can be used only for 0.0.0.0/0 with “Export Route Control Subnet”. When both “Export Route Control Subnet” and “Aggregate Export” are enabled for 0.0.0.0/0, ACI creates an IP prefix-list with “0.0.0.0/0 le 32”, which matches any subnets. Thus, this option can be used when an L3Out needs to advertise (export) any routes to the outside.

• Question 77:

  A packet is routed between two endpoints on different Cisco ACI leaf switches. Which VXLAN VNID is applied to the packet?

  A. FD

  B. EPG

  C. VRF

  D. BD

  Correct Answer: C

  For each tenant VRF in the fabric, ACI assigns a single L3 VNID.

• Question 78:

  Refer to the exhibit.

  

  A company decided to decrease its routing footprint and remove RT-2 and RT-3 devices from its data center. Because of that, the exit point must be created from all the tenants by using the common tenant. Which two configuration tasks must be completed to meet these requirements? (Choose two.)

  A. Move subnets from all the bridge domains to the EPG level and mark them with flag Shared between VRFs.

  B. Update the L3Out ExtEPG subnet in the common tenant with flag Shared Route Control Subnet and Aggregate Shared Routes.

  C. Mark all subnets with flag Shared between VRFs and attach contract Ctr-3 as a provider to all the EPGs.

  D. Change contract Ctr-3 scope to Global, consume it by all EPGs, and flag all subnets with flag Shared between VRFs.

  E. Export contract Ctr-2 into the tenant TN-1 and attach it as a consumer to all the EPGs in the tenant TN-1.

  Correct Answer: BD

  Configure your VRF, Bridge Domains (BDs) and subnets under each user Tenant. Associate Bridge Domains (BDs) with the VRF in User tenants.

  1.

  Ensure the BDs are marked as both “advertised externally and shared.”

  2.

  Configure the Application Profile(s) under each user Tenant.

  3.

  Under each user Tenant, configure EPG and associate EPG with the BD configured in step 1

  4.

  Consume the contract from Tenant Common https://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/aci-configuring.pdf

• Question 79:

  A customer must deploy three Cisco ACI based data centers. Each site must be separated from the others. Which characteristic of Cisco ACI Multi-Pod makes it unsuitable for this deployment?

  A. creates a virtual pod in the remote location

  B. requires all pods to share the same Cisco APIC cluster

  C. has distance and scale limitations

  D. places leaf switches in the remote site that belong to the same fabric as at the headquarters site

  Correct Answer: B

  The Cisco® Application Centric Infrastructure (Cisco ACI™) Multi-Pod solution is an evolution of the stretched-fabric use case. Multiple pods provide intensive fault isolation in the control plane along with infrastructure cabling flexibility. As the name indicates, it connects multiple Cisco Application Policy Infrastructure Controller (APIC) pods using a Layer 3 interpod network (IPN).

  Note: Pod spine switches cannot be connected back to back. IPN supports only Open Shortest Path First (OSPF) connectivity between the IPN and the spine switches. Though each pod consists of its own spine and leaf switches, all the pods reside within the same fabric and are managed by a single APIC cluster. This approach provides a single management and policy domain across all pods for end-to-end policy enforcement. In the data plane, the Multi-Pod solution uses Multiprotocol Border Gateway Protocol (MP-BGP) Ethernet Virtual Private Network (EVPN) connectivity over the IPN between the spine switches from each pod for communication using Virtual Extensible LAN (VXLAN) encapsulation.

• Question 80:

  An engineer must configure a Layer 3 connection to the WAN router. The hosts in production VRF must access WAN subnets. The engineer associates EPGs in the production VRF with the external routed domain. Which action completes the task?

  A. Configure the Export Route Control Subnet scope for the external EPG.

  B. Configure the External Subnets for the External EPG scope for the external EPG.

  C. Configure the Import Route Control Subnet scope for the external EPG.

  D. Configure the Shared Route Control Subnet scope for the external EPG.

  Correct Answer: B

  External Subnets for the External EPG (also called Security Import Subnet) - This option does not control the movement of routing information into or out of the fabric. If you want traffic to flow from one external EPG to another external EPG or to an internal EPG, the subnet must be marked with this control. If you do not mark the subnet with this control, then routes learned from one EPG are advertised to the other external EPG, but packets are dropped in the fabric. The drops occur because the APIC operates in a allowed list model where the default behavior is to drop all data plane traffic between EPGs, unless it is explicitly permitted by a contract. The allowed list model applies to external EPGs and application EPGs. When using security policies that have this option configured, you must configure a contract and a security prefix.