Free Sales Ending Soon - 100% Valid 300-620 Exam Dumps with 391 Questions
Verified 300-620 dumps Q&As on your CCNP Data Center Exam Questions Certain Success!
NEW QUESTION # 167
A data center administrator is upgrading an ACI fabric. There are 3 APIC controllers in the fabric and all the servers are dual-homed to pairs of leaf switches configured in VPC mode. How should the fabric be upgraded to minimize possible traffic impact during the upgrade?
- A. 1. Create two maintenance groups for the leaf switches: VPC left and VPC right.
2.Upgrade the APIC controllers.
3.Upgrade the first group of leaf switches.
4.Upgrade the second group of leaf switches. - B. 1. Create two maintenance groups for APIC controllers: VPC left and VPC right.
2.Upgrade the leaf switches.
3.Upgrade the first group of controllers.
4.Upgrade the second group of controllers. - C. 1. Create two maintenance groups for the APIC controllers: VPC left and VPC right.
2.Upgrade the first group of controllers.
3.Upgrade the second group of controllers.
4.Upgrade the leaf switches. - D. 1. Create two maintenance groups for the leaf switches: VPC left and VPC right.
2.Upgrade the first group of switches.
3.Upgrade the second group of switches.
4.Upgrade the APIC controllers.
Answer: A
NEW QUESTION # 168
An organization has encountered many STP-related issues in the past due to failed hardware components. They are in the process of long-term migration to a newly deployed ACI fabric. Senior engineers are worried that spanning-tree loops in the existing network may be extended to the ACI fabric. Which feature must be enabled on the ACI leaf ports to protect the fabric from spanning-tree loops?
- A. Storm Control
- B. BPDU Guard
- C. BPDU Filter
- D. per-VLANMCP
Answer: B
NEW QUESTION # 169
Refer to the exhibit. An engineer must implement the inter-tenant service graph. Which set of actions must be taken to accomplish this goal?
- A. - Define the contract in the provider tenant and export it to the provider tenant.
- Define the L4-L7 device and service graph template in the provider tenant and the ASA bridge domains in the consumer tenant. - B. - Define the contract in the provider tenant and export it to the consumer tenant.
- Define the L4-L7 device, service graph template, and ASA bridge domains in the provider tenant. - C. - Define the contract in the provider tenant and export it to the provider tenant.
- Define the L4-L7 device, service graph template, and ASA bridge domains in the consumer tenant. - D. - Define the contract in the provider tenant and export it to the consumer tenant.
- Define the L4-L7 device and service graph template in the provider tenant and the ASA bridge domains in the consumer tenant.
Answer: B
NEW QUESTION # 170
What must be configured to redistribute externally learned OSPF routes within the ACI fabric?
- A. BGP Route Reflector
- B. PIM Sparse Mode
- C. BGP Inter-leak Route Map
- D. Route Control Profile
Answer: D
NEW QUESTION # 171
When Layer 3 routed traffic is destined to a Cisco ACI fabric, which mechanism does ACI use to detect silent hosts?
- A. ARP gleaning
- B. gratuitous ARP
- C. proxy ARP
- D. inverse ARP
Answer: A
Explanation:
The question asks about the mechanism Cisco ACI uses to detect silent hosts when Layer 3 routed traffic is destined to the ACI fabric. A "silent host" refers to an endpoint that does not initiate traffic or send ARP requests, making detection challenging without specific mechanisms. Let's evaluate the options based on Cisco ACI documentation and best practices.
Requirement Analysis
Layer 3 routed traffic implies that the ACI fabric is handling IP routing, and the detection mechanism must work within the context of the bridge domain and endpoint learning.
Silent hosts require passive detection methods since they do not generate active traffic (e.g., ARP requests).
The solution must align with ACI's endpoint learning and proxy mechanisms.
Option Evaluation
A . Gratuitous ARP:
Gratuitous ARP (GARP) is a mechanism where a host announces its IP-to-MAC mapping to update network devices. However, this requires the host to send the GARP, which a silent host does not do. ACI can use GARP when hosts are active, but it is not the primary method for silent hosts.
Reference:
B . Inverse ARP:
Inverse ARP is used in Frame Relay or ATM networks to map DLCI/VPI-VCI to IP addresses. It is not applicable to ACI's IP-based Layer 3 routing or silent host detection.
C . ARP Gleaning:
ARP gleaning is a passive mechanism in ACI where the fabric learns the IP-to-MAC binding of a silent host by inspecting ARP traffic destined to or from other devices (e.g., routers or proxies) within the same bridge domain. When Layer 3 routed traffic passes through the ACI fabric, the leaf switches can glean the silent host's information from ARP responses or related traffic, even if the host itself is silent.
D . Proxy ARP:
Proxy ARP is used by ACI to respond to ARP requests on behalf of silent hosts when the hardware proxy feature is enabled. While this helps with connectivity, it is a response mechanism, not a detection method. Detection still relies on gleaning or other passive learning.
Final Answer Justification
C is correct because ARP gleaning is the specific mechanism ACI uses to detect silent hosts when Layer 3 routed traffic is involved. The fabric passively learns the host's IP and MAC addresses from ARP traffic generated by other devices (e.g., routers or active hosts) within the bridge domain, which is particularly effective in routed environments.
Primary Cisco Reference:
Cisco APIC Layer 3 Networking Configuration Guide, "Endpoint Learning with ARP Gleaning." Cisco ACI Best Practices, "Silent Host Detection in Routed Networks."
NEW QUESTION # 172
The company's Cisco ACI fabric hosts multiple customer tenants. To meet a service level agreement, the company is constantly monitoring the Cisco ACI environment. Syslog is one of the methods used for monitoring. Only events related to leaf and spine environmental information without specific customer data should be logged. To which ACI object must the configuration be applied to meet these requirements?
- A. switch profile
- B. infra tenant
- C. fabric policy
- D. access policy
Answer: C
Explanation:
To ensure that only events related to leaf and spine environmental information are logged without including specific customer data, the configuration should be applied to the fabric policy. The fabric policy in Cisco ACI is used to define global settings that apply to the entire fabric, such as syslog settings, which can be configured to filter and forward only the desired types of system messages12.
NEW QUESTION # 173
Engineer must configure SNMP inside a Cisco ACI fabric. The engineer has created an SNMP Policy, called SNMP-policy and an SNMP Monitoring Group called SNMP-group1 that Contains five trap receivers. Which configuration set completes the configuration?
- A. Allow all OOB management traffic. Configure three trap receivers on SNMP-group1.
- B. Permit OOB management traffic using UDP port 161. Associate client group policy with the OOB management EPG.
- C. Create an OOB management contract. Include the SNMP server in the OOB management EPG.
- D. Edit oobbrc to permit traffic using UDP port 16. Associate the client group policy to SNMP-group1.
Answer: B
NEW QUESTION # 174
A customer implements RBAC on a Cisco APIC using a Windows RADIUS server that is configured with network control policies. The APIC is as follows:
Tenant = TenantX
Security Domain = Tenantx-SD
User = X
The customer requires User X to have access to TenantX only, without any extra privilege in the Cisco ACI fabric domain. Which Cisco AV pair must be implemented on the RADIUS server to meet these requirement?
- A. shell:domains = TenantX-SD/fabric-admin/,common//read-all
- B. shell:domains = TenantX-SD/tenant-ext-admin/,common//read-all
- C. shell:domains = TenantX-SD/tenant-admin/,common//read-all
- D. shell:domains = TenantX-SD/tenant-admin
Answer: D
Explanation:
To restrict User X to have access only to TenantX without any extra privileges in the Cisco ACI fabric domain, the Cisco AV pair that must be implemented on the RADIUS server is shell:domains = TenantX-SD/tenant-admin. This AV pair assigns User X the role of tenant admin within the security domain of TenantX, ensuring that the user has the necessary permissions to manage resources within TenantX and no additional privileges outside of this scope.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/Security_config/b_Cisco_APIC_Security_Guide/b_Cisco_APIC_Security_Guide_chapter_0100.html
NEW QUESTION # 175
An engineer must configure a Cisco ACI bridge domain to prevent flooding from unknown unicast frames. Which action must be configured in Cisco ACI to accomplish this goal?
- A. Set Disable Remote EP Learn in the Fabric Wide Setting Policy.
- B. Configure the bridge domain to operate in optimized mode.
- C. Set the bridge domain option to Flood in Encapsulation.
- D. Configure Clear Remote MAC Entries in the bridge domain mode.
Answer: B
Explanation:
A bridge domain can be set to operate in flood mode for unknown unicast frames or in an optimized mode that eliminates flooding for these frames. When operating in flood mode, Layer 2 unknown unicast traffic is flooded over the multicast tree of the bridge domain (GIPo). For the bridge domain to operate in optimized mode you should set it to hardware-proxy. In this case, Layer 2 unknown unicast frames are sent to the spine-proxy anycast VTEP address.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/L2- configuration/Cisco-APIC-Layer-2-Configuration-Guide-411/Cisco-APIC-Layer-2-Configuration- Guide-
411_chapter_0101.html#:~:text=A%20bridge%20domain%20can%20be,spine%2Dproxy%20any cast%20VTEP%20address.
NEW QUESTION # 176
An engineer must advertise a bridge domain subnet out of the ACI fabric to an OSPF neighbor. Which two configuration steps are required? (Choose two.)
- A. Create Route Control Profile with the export direction under External EPG.
- B. Add L30ut profile to the bridge domain using Associated L30uts section
- C. Add External Subnet for External EPG flag under External EPG.
- D. Configure the Subnet under the EPG level.
- E. Configure Subnet scope to Advertised Externally
Answer: B,E
NEW QUESTION # 177
A network engineer is integrating a new Hyperflex storage duster into an existing Cisco ACI fabric The Hyperflex cluster must be managed by vCenter so a new vSphere Distributed switch must be created In addition the hardware discovery must be performed by a vendor-neutral discovery protocol Which set of steps meets these requirements'?
- A. Option B
- B. Option A
- C. Option D
- D. Option C
Answer: A
Explanation:
To integrate a new Hyperflex storage cluster into an existing Cisco ACI fabric and manage it with vCenter, the following steps should be taken:
Create a new vSphere Distributed Switch (vDS): This is done within the vCenter interface. The vDS acts as a single virtual switch across all associated hosts in the data center, providing centralized management and monitoring of the network configuration1.
Configure the vDS for the Hyperflex cluster: This involves setting up the correct port groups, VLANs, and uplink profiles to ensure proper network segmentation and performance2.
Enable hardware discovery using a vendor-neutral protocol: This could involve using protocols like LLDP (Link Layer Discovery Protocol) or CDP (Cisco Discovery Protocol), which are supported by vCenter and can help in identifying and managing physical network devices3.
Integrate the Hyperflex cluster with ACI using the Application Policy Infrastructure Controller (APIC): This involves creating the necessary policies and profiles in ACI to manage the Hyperflex storage traffic effectively4.
Reference:
Cisco HyperFlex Systems Installation Guide for VMware ESXi1
Cisco HyperFlex Virtual Server Infrastructure 3.0 with Cisco ACI 3.2 and VMware vSphere 6.52 How to Set Up Networking with vSphere Distributed Switches - VMware Docs3 Tutorial: How to integrate HyperFlex and ACI with VMM (VMware) and UCSM4
NEW QUESTION # 178
A Solutions Architect is asked to design two data centers based on Cisco ACI technology that can extend L2/ L3, VXLAN, and network policy across locations. ACI Multi-Pod has been selected. Which two requirements must be considered in this design? (Choose two.)
- A. ACI Multi-Pod does not support Firewall Clusters across Pods. Firewall Clusters should always be local.
- B. ACI underlay protocols, i.e. COOP, IS-IS and MP-BGP, spans across pods. Create QoS policies to make sure those protocols have higher priority.
- C. Multi-Pod requires multiple APIC Controller Clusters, one per pod. Make sure those clusters can communicate to each other through a highly available connection.
- D. ACI Multi-Pod requires an IP Network supporting PIM-Bidir.
- E. A single APIC Cluster is required in a Multi-Pod design. It is important to place the APIC Controllers in different locations in order to maximize redundancy and reliability.
Answer: B,C
Explanation:
Section: ACI Anywhere
NEW QUESTION # 179
Which action sets Layer 2 loop migration in an ACI Fabric with a Layer 2 Out configured?
- A. Disable STP on the ACI fabric.
- B. Enable STP on the ACI fabric.
- C. Enable MCP on the ACI fabric.
- D. Disable STP in the external network.
Answer: C
Explanation:
https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-aci-best-practices-quick- summary.html#_Toc97911120
NEW QUESTION # 180
A customer must upgrade the Cisco ACI fabric to use a feature from the new code release. However, there is no direct path from the current release to the desired one. Based on the Cisco APIC Upgrade/Downgrade Support Matrix, the administrator must go through one intermediate release.
Which set of steps must be taken to upgrade the fabric to the new release?
- A. Upgrade the APICs to an interim release.
Upgrade the switches to an interim release.
Upgrade the APICs to the targeted release.
Upgrade the leaf and spine switches to the targeted release. - B. Upgrade the APICs to an interim release.
Upgrade the leaf switches directly to the targeted release.
Upgrade the spine switches directly to the targeted release.
Upgrade the APICs to the targeted release. - C. Upgrade the APICs directly to the targeted release.
Upgrade the switches to an interim release.
When all switches are operational, upgrade the leaf switches to the targeted release.
Upgrade the spine switches to the targeted release. - D. Upgrade the APICs to an interim release and then switches to an interim release.
When all switches are operational, upgrade leaf switches to the targeted release.
Upgrade the spine switches to the targeted release.
Upgrade the APICs to the targeted release.
Answer: A
Explanation:
When upgrading the Cisco ACI fabric through an intermediate release, the following steps should be taken:
Upgrade the APICs to an interim release: This is the first step to ensure that the APICs are running a stable version that is compatible with both the current and the targeted release1.
Upgrade the switches to an interim release: After the APICs are upgraded, the next step is to upgrade the leaf and spine switches to the same interim release. This ensures that the entire fabric is running on a compatible version before moving to the targeted release1.
Upgrade the APICs to the targeted release: Once the fabric is stable on the interim release, the APICs can be upgraded to the targeted release. It's important to verify that the APICs are fully operational before proceeding to upgrade the switches1.
Upgrade the leaf and spine switches to the targeted release: The final step is to upgrade the leaf and spine switches to the targeted release. This should be done after the APICs have been successfully upgraded and are stable on the targeted release1.
By following these steps, the customer can successfully upgrade the Cisco ACI fabric to the new code release that includes the desired feature.
NEW QUESTION # 181
Refer to the exhibit.
Refer to the exhibit. How are the STP BPDUs forwarded over Cisco ACI fabric?
- A. STP BPDUs that are generated by Switch2 are received by Switch1 and Switch3
- B. Cisco ACI acts as the STP root for all three external switches.
- C. Cisco ACI fabric drops all STP BPDUs that are generated by the external switches.
- D. STP BPDUs that are generated by Switch1 are received only by Switch3.
Answer: A
NEW QUESTION # 182
A company is implementing a new security policy to track system access, configuration, and changes. The network engineer must enable the log collection to track user login and logout attempts. In addition, any configuration changes such as a fabric node failure must be collected in the logs. The syslog policy is configured to send logs to the company SEIM appliance.
Which two log types must be enabled to meet the security requirements? (Choose two.)
- A. health
- B. error
- C. fault
- D. audit
- E. event
Answer: C,D
NEW QUESTION # 183
A packet is routed between two endpoints on different Cisco ACI leaf switches. Which VXLAN VNID is applied to the packet?
- A. VRF
- B. EPG
- C. BD
- D. FD
Answer: C
Explanation:
In Cisco ACI, when a packet is routed between two endpoints on different leaf switches, the VXLAN VNID that is applied to the packet corresponds to the Bridge Domain (BD). The BD VNID is used to encapsulate the packet for Layer 2 transport across the fabric. This VNID ensures that the packet is delivered to the correct bridge domain, maintaining the segmentation and policy enforcement required by the ACI fabric.
Reference:
Cisco ACI Fabric Forwarding White Paper
Cisco ACI Basic Configuration Guide
NEW QUESTION # 184
......
300-620 Exam Dumps - 100% Marks In 300-620 Exam: https://www.actual4dumps.com/300-620-study-material.html
Exam Dumps Use Real CCNP Data Center Dumps With 391 Questions: https://drive.google.com/open?id=1p1KEwogfmWdUpgeHQgVzdu39cMwzYZCd