Explanation:
Cisco ACI configuration import policies support two modes: Best-effort and Atomic. The key distinction lies in error handling. In Atomic mode, the configuration is applied on a per-shard basis, and a single error causes the entire shard to roll back to its original state. If the imported configuration is incompatible with the existing system, the import terminates.

Correct Option:

Atomic:
This mode applies configuration by whole shards. If any error occurs during import, the entire shard is rolled back and the import process terminates. This ensures that an incompatible configuration cannot partially apply, leaving the system in an inconsistent state. The question specifically requires the import to "terminate" upon incompatibility, which is exactly what Atomic mode does.
Incorrect Option:

Merge:
This is an import type, not a mode. Merge applies archive content on top of the existing configuration without deleting anything. It does not inherently determine termination behavior on incompatibility.

Best effort:
This mode applies each Managed Object (MO) individually and skips invalid MOs rather than terminating. The import continues even if some objects cannot be configured.

Replace:
Like Merge, this is an import type. Replace overwrites the existing configuration with the imported content and is only supported with Atomic mode, but it does not by itself control termination on incompatibility.

Reference:
Cisco ACI Configuration Files: Import and Export — "Atomic mode: configuration is applied by whole shards. A single error causes whole shard to be rolled back to its original state."

subinterface with 802.1Q tagging

E. Switch Virtual Interface

Explanation:
Cisco ACI border leaf switches support specific interface types for establishing Layer 3 external connections (L3Out) to external routers. According to Cisco documentation, the supported interfaces for external Layer 3 Outside connections include Layer 3 Routed Interface, Subinterface with 802.1Q tagging, and Switched Virtual Interface (SVI). The question specifically asks for two types, and options B and E match these supported interface types.

Correct Option:

B. subinterface with 802.1Q tagging:
Subinterfaces enable a single physical interface to provide Layer 3 outside connections for multiple private networks by using VLAN tagging. This is a standard and supported interface type for L3Out on border leaf switches.

E. Switch Virtual Interface (SVI):
An SVI allows the same physical interface to support both Layer 2 and Layer 3 traffic. It is commonly used when a physical connection needs to be shared for Layer 2 and Layer 3 outside connections. SVIs can be configured on physical ports, port channels, or vPC port channels.

Incorrect Option:

A. subinterface with VXLAN tagging:
VXLAN is the fabric encapsulation used internally within ACI for overlay traffic. External routers do not use VXLAN tagging for L3Out connections. This is not a supported interface type for external connectivity.

C. FEX host interface:
FEX (Fabric Extender) host interfaces are used to connect servers and endpoints to the ACI fabric, not for connecting to external routers for Layer 3 outside connectivity.

D. out of band interface:
Out-of-band (OOB) interfaces are dedicated management interfaces used for APIC and switch management access. They are not used for data plane Layer 3 external routing connections.

Reference:
Cisco APIC Layer 3 Networking Configuration Guide — "External Layer 3 Outside Connection Types": The external Layer 3 Outside connections are supported on these interfaces: Layer 3 Routed Interface, Subinterface with 802.1Q tagging, and Switched Virtual Interface (SVI)

The APIC uses an internal IP address from a pool to communicate with the nodes.

Explanation:
During initial fabric discovery, the APIC uses DHCP to assign internal Tunnel Endpoint (TEP) addresses from a pre-configured TEP address pool. These addresses are used for communication between APIC controllers and fabric nodes over the infrastructure VLAN. The TEP pool is configured during the initial APIC setup script and provides the internal addressing needed for fabric operations.

Correct Option:

A. The APIC uses an internal IP address from a pool to communicate with the nodes:
This is accurate. The APIC assigns TEP addresses from the configured TEP address pool via DHCP. The leaf switch sends DHCP Discover on the infrastructure VLAN, and once registered, the APIC responds with an IP address from the TEP pool. This internal address enables communication with other APIC controllers and fabric nodes.

Incorrect Option:

B. Every switch is assigned a unique AV by the APIC:
The term "AV" is not a standard ACI discovery concept. APIC assigns node IDs, TEP addresses, and other identifiers, but "AV" is not part of the discovery process.

C. The APIC discovers the IP address of the other APIC controllers by using Cisco Discovery Protocol:
APIC controllers discover each other through LLDP (Link Layer Discovery Protocol), not CDP. LLDP packets from APIC1 contain special TLVs with infrastructure VLAN information and APIC role details, which leaf switches use to program the infrastructure VLAN on APIC-facing ports.

D. The ACI fabric is discovered starting with the spine switches:
Fabric discovery actually starts with leaf switches, not spines. Each APIC instance first discovers directly-connected leaf switches. Once a leaf is registered, the APIC then discovers spine switches connected to that leaf. The process cascades through the fabric topology.

Reference:
Cisco APIC Getting Started Guide — "Fabric Initialization and Switch Discovery": The discovery workflow begins with APIC1 sending LLDP, leaf switches programming the infra VLAN, leaf sending DHCP Discover, and APIC responding with TEP address from the configured pool.

Forwarding: Custom
L2 Unknown Unicast: Flood
L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP
Flooding: Disabled

Explanation:
When an EPG is extended to an external Layer 2 network where the default gateway resides outside the ACI fabric, the bridge domain must behave like a traditional Layer 2 switch. The fabric should not act as the gateway; instead, it must flood unknown unicast and ARP traffic to ensure endpoints can reach the external gateway and other hosts on the same broadcast domain.

Correct Option:

D. Forwarding:
Custom, L2 Unknown Unicast: Flood, L3 Unknown Multicast Flooding: Flood, Multi Destination Flooding: Flood in BD, ARP Flooding: Disabled: This configuration enables flooding behavior for unknown unicast traffic, which is required when the gateway is external. ARP flooding is disabled because unicast routing is not enabled on the BD (the fabric is not the gateway). This matches the standard Layer 2 extension design where the fabric provides pure Layer 2 bridging.

Incorrect Option:

A: Uses Hardware Proxy for L2 Unknown Unicast, which is used when the ACI fabric acts as the Layer 3 gateway. This is incorrect when the gateway is external.

B: Sets ARP Flooding:
Enabled while also flooding unknown unicast. When the gateway is external and unicast routing is disabled on the BD, ARP flooding is implicitly enabled anyway. However, the explicit ARP flooding setting is not the primary distinguishing factor; the key requirement is the L2 flooding mode.

: Uses Hardware Proxy for L2 Unknown Unicast and ARP Flooding:
Disabled. This is incorrect because Hardware Proxy is designed for scenarios where the fabric is the gateway, not for external gateway designs.

Reference:
Cisco Live ACI Lab – Layer 2 Bridge Domain Configuration for External Gateway.

Switches send syslog messages directly to the destinations.

Explanation:
ACI syslog is policy-driven, and the APIC pushes syslog configuration to every fabric node. Once configured, leaf and spine switches generate and forward syslog messages directly to the remote destination server, rather than routing them through the APIC or spine. This ensures efficient, direct logging even if the APIC is unavailable.

Correct Option:

D. Switches send syslog messages directly to the destinations:
The APIC acts as the policy controller that pushes syslog settings to all nodes. Each leaf and spine switch then sends its own syslog messages directly to the configured remote destination. The destination is reached via the management EPG (out-of-band or in-band) specified in the configuration.

Incorrect Option:

A. Notifications for different scopes of syslog objects can be sent only to one destination:
Incorrect. A destination group can contain multiple remote destinations, each with its own severity, facility, and transport settings. Different monitoring policy scopes can also reference different destination groups.

B. Syslog messages are sent to the destination through the spine:
Incorrect. Spine switches are not intermediaries for syslog traffic. Each node (APIC, leaf, or spine) sends its messages directly to the destination

C. All syslog messages are sent to the destination through APIC:
Incorrect. The APIC is only the management and policy controller. It does not relay syslog messages from switches; switches send them independently and directly.

Reference:
Cisco ACI Syslog Configuration Guide — "All syslog configuration is performed through APIC policies, and APIC automatically pushes the policy to every fabric node." "Each ACI node (APIC or switch) acts as a TLS client and initiates an outgoing connection to the Syslog Server."

Endpoint information is not exchanged across sites unless COOP protocol is used.

Explanation:
In Cisco ACI Multi-Site, endpoint reachability information is not shared between sites by default. Endpoints are learned locally and stored in each site's COOP database. Cross-site advertisement of endpoint MAC/IP information only occurs when an inter-site policy is configured, which triggers the exchange of EVPN Type-2 routes between the sites.

Correct Option:

B. Endpoint information is not exchanged across sites unless a policy is configured to allow communication across sites:
This is accurate. The ACI Multi-Site architecture follows a "policy-driven" model. Endpoint information remains local to each site until an inter-site policy (configured via Nexus Dashboard Orchestrator) is pushed to the sites. This policy triggers the exchange of Type-2 EVPN updates containing endpoint host route information across sites.

Incorrect Option:

A. Endpoint information is not exchanged across sites unless COOP protocol is used:
COOP is the internal protocol used within a single ACI fabric to distribute endpoint information to spine nodes. It is not the protocol used for cross-site advertisement; EVPN Type-2 routes are used for that purpose.

C. Endpoint information is exchanged across sites as soon as the endpoint is discovered in one site:
This is incorrect. Without an inter-site policy in place, no endpoint information is exchanged across sites. The default behavior is isolation.

D. Endpoint information is exchanged across sites when the endpoints are discovered in both sites:
This is incorrect. The trigger for cross-site advertisement is the configuration of an inter-site policy, not the simultaneous discovery of endpoints in both sites.

Reference:
Cisco ACI Multi-Site White Paper: "The creation of the intersite policy triggers Type-2 EVPN updates across sites to exchange host route information. At this point no information is exchanged across sites for EP1 and EP2 EPGs, because there is no policy in place yet indicating a need for those endpoints to communicate."

extending the bridge domain out of the ACI fabric

extending the EPG out of the ACI fabric

Explanation:
Cisco ACI provides two primary methods to extend Layer 2 connectivity beyond the fabric boundary. The first is extending a specific EPG through static port binding with VLAN encapsulation to a directly connected external switch. The second is creating a Layer 2 Outside connection (L2Out), which extends the entire bridge domain to an external network, allowing all EPGs within that BD to communicate externally.

Correct Option:

D. extending the bridge domain out of the ACI fabric:
This is accomplished through a Layer 2 Outside connection (External Bridged Network). It extends the whole bridge domain—including all associated EPGs and subnets—to an external Layer 2 network. This is the recommended approach when you need to stretch an entire broadcast domain beyond the fabric.

E. extending the EPG out of the ACI fabric:
This is achieved by configuring static port bindings on a border leaf interface with VLAN encapsulation, mapping that external VLAN to a specific EPG. The EPG is then connected to an external Layer 2 switch, allowing endpoints behind that switch to be part of the EPG.

Incorrect Option:

A. extending the routed domain out of the ACI fabric:
This describes Layer 3 Outside (L3Out) connections, which extend routed connectivity, not Layer 2 domains. L3Out is used for routing traffic between the ACI fabric and external routers.

B. creating a single homed Layer 3 Out:
A Layer 3 Out is a routed connection to an external network. It does not extend a Layer 2 domain; it establishes Layer 3 peering and route exchange.

C. creating an external physical network:
This is a vague description and not a specific ACI configuration action. The term "external physical network" does not correspond to a defined ACI feature for extending L2 connectivity.

Reference:
Cisco Community — "Connecting ACI to Outside Layer 2 and Layer 3 Networks": "Another way to extend the layer 2 domain beyond the ACI fabric is to create layer 2 outside connections... A layer 2 outside connection is associated with a bridge domain and it is designed to extend the whole bridge domain (not an individual EPG under bridge domain) to the outside network."

VMM domain profile

EPG association

Explanation:
A Cisco ACI VMM domain policy requires several components, but the two most essential for defining the domain and connecting virtual workloads are the VMM domain profile and the EPG association. The profile groups VM controllers and defines how APIC communicates with them, while the EPG association regulates connectivity and visibility among virtual endpoints by pushing port groups to the controller.

Correct Option:

A. VMM domain profile:
The VMM domain profile is the core policy that groups VM controllers with similar networking policy requirements. It contains the controllers (such as VMware vCenter) and the credentials required for the APIC to interact with them .

E. EPG association:
The EPG association is how the VMM domain regulates connectivity and visibility among endpoints. The APIC pushes these EPGs as port groups into the VM controller, and a single EPG can span multiple VMM domains .

Incorrect Option:

B. EPG static port binding:
This is a method of binding an EPG to a physical port, not an essential component of a VMM domain policy. VMM domains use dynamic or static binding depending on the deployment.

C. Layer 3 outside interface association:
L3Out is a separate configuration for external routing connectivity. It is not part of the VMM domain policy components.

D. IP address pool association:
IP address pools are not a listed component of VMM domain policies. VMM domains use VLAN pools for encapsulation, not IP pools.

Reference:
Cisco APIC Layer 2 Networking Configuration Guide — "Virtual Machine Manager Domain Main Components": The main components include VMM Domain Profile, EPG Association, Attachable Entity Profile Association, VLAN Pool Association, Credential, and Controller .

MAC Pinning+

Explanation:
For blade servers without LACP bonding support, MAC Pinning is the required port channel mode in ACI. This configuration allows the APIC to program the VMware VDS with the teaming policy "Route based on originating virtual port," which is essential for environments where LACP cannot be used.

Correct Option:

D. MAC Pinning+:
This is the correct mode for blade servers that lack bonding support. According to Cisco documentation, when MAC Pinning is configured on the Port-Channel Policy, the VDS port groups are automatically set to "Route based on the originating virtual port" teaming mode. This allows individual links to operate independently without requiring LACP negotiation, which is ideal for UCS Fabric Interconnect topologies.

Incorrect Option:

A. Static Channel – Mode On:
This mode configures the VDS to use "Route based on IP hash" for load balancing, not "Route based on originating virtual port".

B. MAC Pinning-Physical-NIC-load:
This mode uses "Route based on physical NIC load" as the teaming algorithm, which is different from the required originating virtual port policy.

C. LACP Passive:
This requires LACP support on the server side, which the blade server in the scenario does not have. LACP modes result in "Route based on IP hash".

E. LACP Active:
Similar to LACP Passive, this mode requires LACP bonding support and uses IP hash load balancing, making it unsuitable for the described environment.

Reference:
Cisco ACI Virtualization Guide — Port Channel and vSwitch Policy: When MAC Pinning is configured as the Port-Channel Policy, this will show as "Route based on the originating virtual port" teaming configuration on the VDS port groups.

Explanation:
This setting is a Bridge Domain (BD) level configuration that restricts endpoint IP address learning to only those IPs that match the subnets configured on that specific BD. When enabled, the fabric will not learn or maintain IP information for endpoints whose IP addresses fall outside of the configured BD subnet, preventing the learning of remote networks not intended to be part of that Layer 2 domain .

Correct Option:

A. enable Limit IP Learning to Subnet:
This option correctly identifies the feature. By enabling "Limit IP Learning to Subnet" within the Bridge Domain settings, Cisco ACI enforces a check that prevents the learning of Endpoint IP addresses that do not belong to any of the subnets defined on the BD . This is the standard mechanism to prevent the fabric from learning IPs from remote networks that are not configured on the bridge domain.

Incorrect Option:

B. enable Unicast Routing:
Enabling Unicast Routing on a Bridge Domain provides the default gateway function and allows routing between subnets. It does not, by itself, restrict the learning of IP addresses to specific subnets .

C. enable IP Data-plane Learning:
This setting controls whether the fabric learns IP addresses from the data plane traffic. Disabling it stops data-plane IP learning but does not enforce a subnet match check. The "Limit IP Learning to Subnet" setting is the specific control for subnet matching .

D. enable ARP Flooding to BD:
Enabling ARP Flooding controls how ARP requests are handled (flooded vs. unicast). It is related to traffic handling but does not prevent the learning of IP addresses outside the configured subnet .

Reference:
Cisco Application Centric Infrastructure ACI Endpoint Learning Best Practices: "For optimal Fabric operations, we recommend configurations that cause ACI to only learn IP addresses, which are configured on a BD Subnet... BD-level configurations- Limit IP Learning to Subnet should be Enabled" .