View Full Cisco CCNP Data Center 300-620 Exam Dumps and Practice Test Dumps.

 

Question 1

Which component is the central management and policy-control point of a Cisco ACI fabric?

1. Spine switch
2. Leaf switch
3. APIC
4. Border leaf

Correct Answer: 3

Explanation

The Application Policy Infrastructure Controller, or APIC, is the centralized management and policy-control platform for a Cisco ACI fabric. It provides the interface through which administrators define tenants, application profiles, bridge domains, endpoint groups, contracts, and other policies. APIC communicates with the fabric switches and programs the required behavior according to the configured policies. Leaf and spine switches provide the forwarding infrastructure, while border leaf switches provide connectivity toward external networks. APIC does not normally carry application data traffic itself. Instead, it manages and programs the fabric so that forwarding behavior follows the policies defined by the administrator.

Question 2

Which two types of switches form the primary ACI fabric topology?

1. Leaf and spine
2. Core and distribution
3. Access and aggregation
4. Border and core

Correct Answer: 1

Explanation

Cisco ACI uses a leaf-and-spine architecture as its fundamental fabric topology. Leaf switches provide connectivity for endpoints, servers, external networks, and other connected devices. Spine switches provide the high-speed transit layer between leaf switches. Every leaf connects to every spine, creating a predictable and scalable topology. Endpoint traffic normally enters through a leaf and crosses the fabric through the spine layer when communication with another leaf is required. This architecture provides consistent latency and simplifies scaling because additional leaf or spine switches can be introduced while maintaining the basic fabric design. APIC manages the policies applied across this infrastructure.

Question 3

In the ACI object model, which object represents an isolated administrative and policy boundary?

1. Bridge domain
2. Tenant
3. Endpoint group
4. Contract

Correct Answer: 2

Explanation

A tenant in Cisco ACI provides an administrative and policy boundary for organizing network and application configurations. Within a tenant, administrators can create objects such as VRFs, bridge domains, application profiles, endpoint groups, and contracts. Tenants help separate policies and resources between different organizational groups or applications. A bridge domain represents a Layer 2 forwarding domain, while an endpoint group groups endpoints according to application requirements. Contracts define communication rules between endpoint groups. Understanding the tenant hierarchy is essential when building ACI policies because most logical networking objects are created within a tenant or associated with one.

Question 4

Which ACI object provides a Layer 2 forwarding domain and can provide default gateway functionality for endpoints?

1. Contract
2. Application profile
3. Bridge domain
4. Endpoint group

Correct Answer: 3

Explanation

A bridge domain in Cisco ACI represents a Layer 2 forwarding domain. It can be associated with a subnet that provides default gateway functionality for endpoints within the bridge domain. Bridge domains also contain important forwarding settings, including options related to unicast routing, unknown unicast handling, and ARP behavior. An application profile organizes endpoint groups, while contracts define communication rules between EPGs. An endpoint group groups endpoints based on application requirements. Proper bridge-domain configuration is important because these settings influence how traffic is forwarded and how endpoints communicate within the ACI fabric.

Question 5

Which ACI object groups endpoints according to their application or policy requirements?

1. Endpoint Group
2. VRF
3. Tenant
4. Contract

Correct Answer: 1

Explanation

An Endpoint Group, or EPG, is a fundamental ACI object used to group endpoints that share common application or policy requirements. Endpoints in an EPG can include physical servers, virtual machines, and other connected devices. Contracts determine communication relationships between EPGs, while the VRF provides the Layer 3 routing context. A tenant provides a broader administrative boundary. EPGs allow administrators to apply consistent policies to groups of endpoints rather than configuring each endpoint independently. This application-centric approach is one of the central concepts of ACI because policy follows the application requirements rather than relying only on traditional network location.

Question 6

What is the primary purpose of a contract in Cisco ACI?

1. To define switch hardware topology
2. To control communication between EPGs
3. To assign APIC administrators
4. To create a spine switch

Correct Answer: 2

Explanation

An ACI contract defines communication rules between endpoint groups. It specifies which types of traffic are permitted between a provider EPG and a consumer EPG through filters and related policy settings. By default, EPGs do not automatically communicate simply because they exist within the same tenant. Appropriate contracts must be used to establish the required policy relationships. Contracts can therefore provide application-centric security and segmentation. Hardware topology is defined by the physical fabric, administrator access is managed separately, and spine switches are physical fabric components. Understanding provider and consumer relationships is essential when troubleshooting inter-EPG connectivity.

Question 7

Which ACI object provides the Layer 3 routing context for bridge domains?

1. Application profile
2. Contract
3. VRF
4. Endpoint group

Correct Answer: 3

Explanation

A VRF, or Virtual Routing and Forwarding instance, provides the Layer 3 routing context within Cisco ACI. Multiple bridge domains can be associated with the same VRF, allowing them to participate in a common routing domain. VRFs can also provide logical separation between different environments. An application profile organizes EPGs, contracts define communication policy, and EPGs group endpoints. Understanding the relationship between VRFs, bridge domains, and EPGs is fundamental to ACI design. When configuring routing, administrators must ensure that bridge domains are associated with the appropriate VRF and that required policies are correctly applied.

Question 8

Which ACI component provides physical connectivity for endpoints such as servers and external devices?

1. Spine switch
2. Leaf switch
3. APIC
4. Controller cluster

Correct Answer: 2

Explanation

Leaf switches provide the primary physical connectivity point for endpoints in a Cisco ACI fabric. Servers, virtualized workloads, external networks, and other devices typically connect to leaf switches through appropriate access policies and interface configurations. Spine switches provide transit between leaf switches and do not normally connect directly to endpoints. APIC provides centralized management and policy control rather than serving as the normal data-plane connection point. The leaf layer is therefore critical for endpoint attachment and policy enforcement. Administrators configure access policies, interface policies, VLAN or encapsulation settings, and EPG bindings to establish endpoint connectivity.

Question 9

What is the primary role of spine switches in an ACI fabric?

1. Provide centralized APIC management
2. Connect directly to most endpoints
3. Provide high-speed transit between leaf switches
4. Define tenant policies

Correct Answer: 3

Explanation

Spine switches provide the high-speed transit layer between leaf switches in an ACI fabric. The ACI architecture uses a leaf-and-spine design in which each leaf connects to the spine layer. This provides predictable paths and scalable connectivity across the fabric. Leaf switches normally provide endpoint connectivity, while APIC manages policies and fabric configuration. Tenant policies are logical constructs configured through APIC rather than physical spine functions. Spine switches are therefore essential to the fabric’s forwarding architecture, but administrators generally do not connect servers directly to them. The separation of leaf and spine roles simplifies scaling and maintains consistent fabric behavior.

Question 10

Which ACI policy relationship allows one EPG to consume services provided by another EPG?

1. Consumer-provider contract relationship
2. Leaf-spine relationship
3. Tenant-VRF relationship
4. APIC-spine relationship

Correct Answer: 1

Explanation

In ACI, a contract establishes a policy relationship between consumer and provider EPGs. The provider EPG offers a service or communication policy, while the consumer EPG requests access to that service through the contract. Filters within the contract define which traffic is permitted. This model allows administrators to express application communication requirements explicitly. Leaf and spine relationships describe the physical fabric topology, while tenant and VRF relationships organize logical networking objects. APIC manages the policies but does not itself act as a provider or consumer EPG. Correctly defining contract relationships is important for achieving the intended inter-EPG connectivity.

Question 11

Which ACI feature allows administrators to view faults affecting fabric components and policies?

1. Fault Manager
2. Endpoint Group
3. Bridge Domain
4. Contract Filter

Correct Answer: 1

Explanation

ACI provides fault information that administrators can use to identify problems affecting fabric components, policies, and connectivity. The APIC interface presents faults and related information that can help administrators determine the source and severity of an issue. Faults can be associated with different managed objects throughout the ACI object hierarchy. Endpoint groups, bridge domains, and contract filters are policy objects rather than dedicated fault-management features. When troubleshooting ACI, administrators should review fault information together with event records, audit logs, and health information. This provides a broader view of both current problems and changes that may have contributed to an issue.

Question 12

Which bridge domain setting determines whether the bridge domain performs Layer 3 routing?

1. ARP flooding
2. Unicast routing
3. Endpoint retention
4. STP mode

Correct Answer: 2

Explanation

The unicast routing setting on an ACI bridge domain determines whether Layer 3 routing is enabled for that bridge domain. When routing is enabled and a subnet is configured, the bridge domain can provide Layer 3 gateway functionality for connected endpoints. ARP flooding is a separate setting that controls how ARP requests are handled. Endpoint retention concerns endpoint information, while STP behavior is related to external Layer 2 connectivity rather than directly determining whether the bridge domain performs Layer 3 routing. Administrators should configure bridge-domain routing behavior according to the application’s connectivity requirements and overall ACI design.

Question 13

What does an ACI application profile primarily contain?

1. Physical spine interfaces
2. Endpoint groups associated with an application
3. License information
4. APIC cluster members

Correct Answer: 2

Explanation

An application profile is a logical ACI object used to organize endpoint groups that belong to an application or related application components. For example, an application profile can contain separate EPGs representing web, application, and database tiers. Contracts can then define the permitted communication between those EPGs. Application profiles do not define physical spine interfaces, licensing information, or APIC cluster membership. This organizational model allows administrators to represent application relationships directly in the ACI policy model. By grouping related EPGs under an application profile, administrators can maintain a clearer structure for application-centric policy and troubleshooting.

Question 14

Which ACI capability is used to extend Layer 3 connectivity from the fabric to an external routed network?

1. L3Out
2. EPG
3. Bridge Domain
4. VMM Domain

Correct Answer: 1

Explanation

An L3Out provides Layer 3 connectivity between the ACI fabric and an external routed network. It defines the external connectivity required to exchange routes and forward traffic between internal ACI endpoints and external networks. L3Out configuration involves external routed connections, logical node profiles, interface profiles, and appropriate routing configuration. An EPG groups endpoints, a bridge domain provides a forwarding domain, and a VMM domain integrates ACI with virtualization infrastructure. Correct L3Out configuration is essential when applications in ACI need access to external networks, services, or other routed environments.

Question 15

What is the purpose of an L2Out in Cisco ACI?

1. To provide Layer 2 connectivity to an external network
2. To create an APIC cluster
3. To configure a VRF
4. To define a search domain

Correct Answer: 1

Explanation

An L2Out provides Layer 2 connectivity between an ACI fabric and an external Layer 2 network. It allows an ACI bridge domain or EPG to extend connectivity outside the fabric while maintaining the required Layer 2 forwarding behavior. L3Out is instead used for routed external connectivity. VRFs provide Layer 3 routing contexts, while APIC clusters provide centralized management of the fabric. When implementing an L2Out, administrators must consider external switch connectivity, EPG bindings, VLAN encapsulation, and Layer 2 control protocols. Proper configuration ensures that endpoints can communicate across the ACI boundary as required.

Question 16

Which ACI integration is commonly used to connect APIC with VMware virtual networking infrastructure?

1. VMware VDS
2. HSRP
3. EtherChannel
4. OSPF

Correct Answer: 1

Explanation

Cisco ACI can integrate with VMware vCenter through the VMware Virtual Distributed Switch, or VDS, integration. This allows ACI policy to be coordinated with virtualized workloads managed through VMware infrastructure. The integration can associate virtual machines and virtual networking constructs with ACI endpoint groups and policies. HSRP, EtherChannel, and OSPF are networking technologies but do not provide the same VMware VMM integration function. Administrators implementing VMM integration must configure the required APIC and vCenter relationships and ensure that the appropriate domains, EPGs, and networking policies are correctly associated with the virtual environment.

Question 17

Which ACI object is used to define traffic rules within a contract?

1. Tenant
2. Filter
3. VRF
4. Application Profile

Correct Answer: 2

Explanation

A filter defines the traffic characteristics permitted by an ACI contract. It can specify parameters such as protocols and Layer 4 ports that determine which traffic matches the contract. The contract then uses the filter to establish communication policy between consumer and provider EPGs. A tenant provides an administrative boundary, a VRF provides a routing context, and an application profile organizes EPGs. Filters therefore play an important role in implementing precise application communication policies. Administrators should ensure that filters match the intended traffic requirements because overly broad or restrictive filters can produce unexpected connectivity results.

Question 18

What is the purpose of endpoint learning in an ACI fabric?

1. To identify endpoint location and information for forwarding decisions
2. To create APIC administrator accounts
3. To assign license pools
4. To configure external DNS

Correct Answer: 1

Explanation

Endpoint learning allows the ACI fabric to identify endpoints and associate endpoint information with the appropriate fabric locations. This information is used by the forwarding infrastructure when determining how traffic should reach a destination endpoint. Endpoint information can include addresses and attachment details that help the fabric build an accurate view of connected workloads. Endpoint learning is therefore an important part of ACI packet forwarding. It is separate from administrative account configuration, licensing, and DNS settings. Administrators troubleshooting connectivity should consider endpoint learning and verify that the expected endpoint information is present and associated with the correct leaf and EPG.

Question 19

Which ACI management method uses a dedicated management network rather than the production data path?

1. In-band management
2. Out-of-band management
3. VXLAN forwarding
4. Endpoint learning

Correct Answer: 2

Explanation

Out-of-band management uses a dedicated management network that is separate from the production data path. In Cisco ACI, this approach can provide management connectivity to infrastructure components even when production forwarding is experiencing problems. In-band management, by contrast, uses the ACI fabric and production-related network infrastructure for management communication. VXLAN is part of the ACI forwarding architecture, while endpoint learning identifies connected endpoints. Administrators can choose management methods according to operational and availability requirements. Understanding the distinction between in-band and out-of-band management is important when designing resilient access to APIC and fabric infrastructure.

Question 20

Which ACI feature can forward monitoring information such as events or faults to an external monitoring system using SNMP?

1. SNMP service
2. Bridge domain
3. Contract
4. Application profile

Correct Answer: 4

Explanation

ACI supports monitoring integration through services such as SNMP, allowing monitoring information to be communicated to external management systems. Administrators can configure monitoring services to help external tools receive relevant information about the ACI environment. Bridge domains, contracts, and application profiles are policy objects rather than external monitoring services. SNMP-based monitoring can complement the APIC interface and other operational tools by providing centralized visibility for network-management platforms. Administrators should configure appropriate destinations, credentials, and monitoring parameters according to their environment. Combining SNMP with other monitoring mechanisms can provide a broader operational view of fabric health and events.