Free Cisco 300-620 Practice Questions 2026 | Implementing Cisco Application Centric Infrastructure (300-620 DCACI)

Explanation:
The fault shown in the exhibit is a resolution-failed error (code F2044) on an L3Out interface profile. The affected object references a QoS policy (rsingressQosDppPol) that is trying to relate to a managed object (qosDppPol-default) that does not exist in the common tenant. This means the L3Out is configured to use a QoS policy that has not been created, so the relation cannot be resolved. Creating the missing custom QoS policy resolves the fault.

Correct Option:

C. Create a custom QoS policy:
The fault is caused by a missing QoS policy object. The L3Out interface profile is referencing a QoS policy (likely a custom Data Plane Policing policy) that does not exist in the common tenant. Creating the custom QoS policy with the correct name will satisfy the relation and clear the fault.

Incorrect Option:

A. Acknowledge the QoS-related error:
Acknowledging a fault does not resolve the underlying issue. The fault will remain or reappear until the missing QoS policy is created.

B. Associate a custom QoS class:
A QoS class is a component within a QoS policy, not the policy itself. Associating a class does not create the missing QoS policy that the L3Out is trying to reference.

D. Set the QoS policy to Level 3:
"Level 3" is not a valid QoS policy setting. QoS policies define data plane policing rates, not levels. This action would not resolve the missing policy reference.

Reference:
Cisco APIC Fault Code F2044: "Failed to form relation to MO qosDppPol-default of class qosDppPol in context." This indicates a missing QoS Data Plane Policing policy. The resolution is to create the required QoS policy so the relation can be formed.

Explanation:

The requirements are:

The data center core switches must connect to a pair of leaf switches (this implies a vPC connection for redundancy).

The external switch interface must use 802.1Q tagging (this requires a routed sub-interface).

Access to the internet must be through the L3Out (this requires a default route).

The routing protocol must have rapid convergence time and low CPU usage.

OSPF is a link-state routing protocol that provides rapid convergence and low CPU usage compared to protocols like BGP or EIGRP. It supports hierarchical design through areas (Area 0 is the backbone). A routed sub-interface is required for 802.1Q tagging. A vPC connection to a pair of leaf switches is supported for OSPF L3Out. The default network (0.0.0.0/0) is used to provide internet access through the L3Out.

Correct Option:

A. Configure the OSPF Protocol policy with an area of 0.
Set up the Routed External Network object and Node Profile and select OSPF. Create the Switch profile and select VPC with the appropriate interfaces. Create the default network and associate it with the Routed Outside object:

OSPF with Area 0: OSPF is a link-state protocol with rapid convergence and low CPU usage. Area 0 is the backbone area.

Routed External Network object and Node Profile: These are the L3Out constructs.

VPC with appropriate interfaces: Connects to a pair of leaf switches for redundancy.

Default network (0.0.0.0/0): Provides internet access through the L3Out.

Incorrect Option:

B. Configure the BGP Protocol policy with the appropriate Autonomous System number.
Configure an Interface policy and an External Bridged Domain. Create an External Bridged Network and use the configured VLAN pool. Build the Leaf profile and select the Routed sub-interface with the appropriate VLAN: This option uses BGP (not OSPF) and an External Bridged Domain (L2Out), which is not suitable for Layer 3 internet access. BGP is not known for low CPU usage compared to OSPF.

C. Implement the IS-IS Protocol policy with the selected Autonomous System number.
Create the Routed Outside object and Node Profile and select IS-IS. Configure the Interface profile and select the Routed Interface with the appropriate interfaces. Create the External Network object: IS-IS is not supported as an L3Out routing protocol in Cisco ACI. The fabric underlay uses IS-IS, but L3Out supports BGP, OSPF, and EIGRP.

D. Implement the EIGRP Protocol policy with the selected Autonomous System number.
Create Routed Outside object and Node Profile and select EIGRP as the routing protocol. Build the Interface profile and select SVI and the appropriate VPC. Configure the External Network object with a network of 0.0.0.0/0: EIGRP is a Cisco proprietary protocol with higher CPU usage than OSPF. It also uses an Autonomous System number, but the option mentions SVI, which does not support 802.1Q tagging in the way required (SVI is a Layer 3 interface on a VLAN, but the requirement specifies a routed sub-interface with 802.1Q tagging). EIGRP is not the best choice for rapid convergence and low CPU usage.

Reference:
Cisco APIC Layer 3 Networking Configuration Guide — "L3Out Routing Protocols": OSPF is a supported link-state protocol for L3Out with rapid convergence and low CPU usage. It supports routed sub-interfaces for 802.1Q tagging and vPC for redundancy. A default route (0.0.0.0/0) is used for internet access through the L3Out.

Explanation:
Cisco ACI Multi-Site is an architectural solution that interconnects and manages multiple independent ACI fabrics (sites). Each site retains its own dedicated APIC cluster domain, while a centralized Multi-Site Orchestrator (MSO) is used to define and push policies across all sites. This provides fault isolation between sites while enabling a single pane of glass for policy management.

Correct Option:

D. ACI Multi-Site is a solution that allows one APIC cluster to manage multiple ACI sites:
This is correct in the sense that the Multi-Site Orchestrator provides centralized policy management across multiple sites, acting as a single management plane. The MSO pushes policies to each site's APIC cluster, allowing one logical management entity to oversee multiple ACI fabrics.

E. ACI Multi-Site is a solution that supports a dedicated APIC cluster per site:
This is also correct. Each site in a Multi-Site deployment maintains its own independent APIC cluster. The Multi-Site Orchestrator does not replace the per-site APIC clusters; it coordinates policy across them. This preserves fault isolation and allows each site to operate independently if needed.

Incorrect Option:

A. The Inter-Site network routers should run OSPF to establish peering with the spines:
While OSPF can be used in the Inter-Site Network (ISN), it is not a requirement for ACI Multi-Site. The ISN must support MP-BGP EVPN for the control plane and VXLAN for the data plane, but OSPF is not mandatory for peering with spines.

B. The Multi-Site orchestrator must be directly attached to one ACI leaf:
This is incorrect. The Multi-Site Orchestrator only requires IP connectivity to the out-of-band management IP addresses of the APIC clusters. It does not need to be directly attached to an ACI leaf.

C. Routers in the Inter-Site network must run OSPF, DHCP relay, and MP-BGP:
This is incorrect. The ISN must support MP-BGP EVPN for control-plane communication between sites and VXLAN for data-plane traffic. OSPF and DHCP relay are not required components for ACI Multi-Site.

Reference:
Cisco ACI Multi-Site Fundamentals Guide: "Each site is an availability zone (APIC cluster domain)." "An inter-site policy manager, named Cisco ACI Multi-Site, is used to manage the different fabrics and to define inter-site policies." The MSO requires IP connectivity to the APIC OOB management addresses, not a direct leaf connection.

Explanation:
When configuring a service graph for policy-based redirect (PBR) to a transparent firewall, the service device must be defined in a way that is vendor-agnostic, meaning it can work with any firewall appliance. This requires setting the Service Type to Other (since no specific vendor template is used) and setting the Function Type to L2 (because a transparent firewall operates at Layer 2 and does not have IP addresses on its data interfaces).

Correct Option:

A. Set the Service Type to Other:
This is correct. When the firewall appliance is not a specific supported vendor device (or when you want a vendor-agnostic configuration), the Service Type is set to Other. This allows the service graph to be defined manually without relying on a vendor-specific device package.

C. Set Function Type to L2:
This is correct. A transparent firewall operates at Layer 2 and does not require IP addresses on its interfaces. Setting the Function Type to L2 tells the APIC that the service device is a Layer 2 device, which is appropriate for transparent firewalls. This also allows the firewall to be inserted into the traffic path without changing the IP addressing.

Incorrect Option:

B. Set Promiscuous Mode to True: Promiscuous mode is used for monitoring or intrusion detection scenarios, not for transparent firewall insertion. It is not required for PBR to a transparent firewall.

D. Set Managed to True:
The "Managed" setting indicates whether the APIC manages the device configuration. For a vendor-agnostic transparent firewall, the device is typically unmanaged (Managed = False), meaning the APIC does not push configuration to it.

E. Set Context Aware to Single:
Context Aware is used for service devices that support multiple contexts (such as virtual firewalls). A transparent firewall typically operates in a single context, but this setting is not the key requirement for vendor-agnostic PBR.

Reference:
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide — "Configuring a Service Graph for PBR with a Transparent Firewall": Set Service Type to Other for vendor-agnostic devices. Set Function Type to L2 for transparent firewalls. Promiscuous Mode and Managed settings are not required for this scenario.

Explanation:

The requirements are:

Securely export configuration snapshots to a secure offsite location.

Encrypted tunnel for transfer.

Platform-agnostic data format with namespace support.

TLS (Transport Layer Security) provides an encrypted tunnel for secure transfer of configuration data to a remote location. JSON (JavaScript Object Notation) is a platform-agnostic data format that uses key-value pairs and supports namespace-like hierarchical structuring. This combination meets all the stated requirements.

Correct Option:

B. Export Policy, Protocol: TLS, Format: JSON:

Export Policy: This indicates the policy is for exporting configuration snapshots, not importing.

Protocol: TLS: TLS provides an encrypted tunnel for secure transfer to the offsite location.

Format: JSON: JSON is a platform-agnostic data format that provides namespace support through its hierarchical key-value structure.

Incorrect Option:

A. Import Policy, Protocol:
TLS, Format: XML: This is an Import policy, not an Export policy. The requirement is to export configuration snapshots, not import them.

C. Import Policy, Protocol:
SCP, Format: JSON: This is an Import policy and uses SCP, which is not the encrypted tunnel protocol specified (TLS is required). SCP is a file transfer protocol, not a tunnel protocol.

D. Export Policy, Protocol:
SCP, Format: XML: While this is an Export policy, it uses SCP (Secure Copy Protocol) instead of TLS. SCP does provide encryption via SSH, but the requirement specifically asks for an encrypted tunnel, which is more precisely met by TLS. Additionally, XML is not described as platform-agnostic with namespace support in the same way JSON is in this context.

Reference:
Cisco APIC Management, Monitoring, and Troubleshooting Guide — "Configuration Export Policies": Export policies can use TLS for secure transfer. JSON is a platform-agnostic format with namespace support. Import policies are used for restoring configurations, not exporting them.

Explanation:
A silent host is an endpoint that does not initiate traffic and does not respond to ARP requests. Because App_2 on S2 is a silent host, the ACI fabric cannot learn its MAC address through normal data-plane learning or ARP gleaning. To force the fabric to learn App_2, the bridge domain must be configured to flood Layer 2 unknown unicast traffic. When S1 sends traffic destined for App_2, the leaf switch will flood the frame within the bridge domain, and when the frame reaches Leaf 2 (where S2 is connected), Leaf 2 will learn App_2's MAC address from the response or from the flooded traffic.

Correct Option:

C. Set L2 Unknown Unicast to Flood:
This is correct. When L2 Unknown Unicast is set to Flood, the leaf switch floods unknown unicast frames to all ports in the bridge domain. This allows the fabric to reach silent hosts and learn their MAC addresses when they respond or when traffic is forwarded to them.

Incorrect Option:

A. Set Multi-Destination Flooding to Drop:
This setting drops multi-destination traffic (broadcast, unknown multicast) and would prevent silent hosts from being reached. It would not help learn App_2.

B. Set Unicast Routing to Hardware Proxy:
Unicast Routing is a bridge domain setting that enables the fabric to act as the default gateway. Hardware Proxy is an L2 Unknown Unicast setting where the leaf forwards unknown unicast to the spine proxy instead of flooding. This would not force learning of a silent host on Leaf 2.

D. Set L3 Unknown Multicast to Optimized Flood:
This setting controls how Layer 3 unknown multicast traffic is handled. It is not related to learning silent Layer 2 endpoints.

Reference:
Cisco ACI Fundamentals — "Silent Host Detection": For silent hosts that do not initiate traffic or respond to ARP, the bridge domain must be configured with L2 Unknown Unicast set to Flood to ensure the fabric can reach and learn the endpoint. Hardware Proxy would not flood the traffic and would not force learning of the silent host.

Explanation:

The requirements are:

Encrypted data transfer to the remote server.

Resumable transfer if the connection is interrupted.

SFTP (SSH File Transfer Protocol) provides encrypted data transfer using SSH. It also supports resume capabilities for interrupted transfers, unlike FTP or TFTP. The format (XML or JSON) is secondary to the protocol requirement, but XML is a valid and commonly used format for APIC configuration exports. Therefore, SFTP is the correct protocol choice.

Correct Option:

D. Select protocol SFTP in Create Remote Location. Choose XML format in Configuration Export Policy:
Protocol SFTP: SFTP uses SSH encryption and supports resumable transfers, meeting both the encryption and resume requirements.

Format XML: XML is a supported format for APIC configuration exports. While the question does not specify a format requirement, XML is a valid choice.

Incorrect Option:

A. Select protocol HTTP in Create Remote Location. Choose JSON format in Configuration Export Policy:
HTTP does not provide encryption (HTTPS would) and does not support resumable transfers. It is not suitable for secure backup.

B. Select protocol TFTP in Create Remote Location. Choose JSON format in Configuration Export Policy:
TFTP is unencrypted and does not support resumable transfers. It is not suitable for secure backup.

C. Select protocol FTP in Create Remote Location. Choose XML format in Configuration Export Policy:
FTP is unencrypted and does not support resumable transfers. While FTP can transfer files, it does not meet the encryption requirement.

Reference:
Cisco APIC Management, Monitoring, and Troubleshooting Guide — "Remote Location for Configuration Backup": SFTP is a supported protocol for secure, encrypted configuration backup with resume capability. HTTP, TFTP, and FTP do not provide the required security and resume features.

Explanation:
In Cisco ACI, MP-BGP (Multiprotocol BGP) is used internally as the control-plane protocol to distribute routes and endpoint information across the fabric. Specifically, the VPNv4 address family (AF) is used to propagate L3Out routes that are learned from external routers by a border leaf switch. The border leaf redistributes these external routes into MP-BGP, which then advertises them to the spine switches (route reflectors). The spines reflect these routes to all other leaf switches in the fabric, enabling internal endpoints to reach external networks.

Correct Option:

A. MP-BGP VPNv4 AF is used to propagate L3Out routes that are received from a border leaf to the fabric:
This is correct. The border leaf learns external routes via L3Out (using OSPF, BGP, or EIGRP) and then redistributes them into MP-BGP VPNv4. The spine route reflectors propagate these routes to all leaf switches, allowing the entire fabric to have reachability to external networks.

Incorrect Option:

B. MP-BGP VPNv4 AF is used between spines in an ACI Multi-Pod fabric to propagate the endpoint:
In ACI Multi-Pod, MP-BGP EVPN (Layer 2 VPN EVPN AF) is used between spines in different pods to propagate endpoint information, not VPNv4 AF. VPNv4 is used for L3Out routes, not endpoint reachability.

C. MP-BGP VPNv4 AF is used as protocol on L3Out between a border leaf and an external router:
MP-BGP can be used as the routing protocol on an L3Out between a border leaf and an external router, but this is not the primary purpose of MP-BGP within the ACI fabric. The question asks about MP-BGP usage in the ACI fabric, which refers to its internal role.

D. MP-BGP Layer 2 VPN EVPN AF is used to propagate L3Out routes that are received from a border leaf:
The Layer 2 VPN EVPN AF is used for endpoint (MAC/IP) reachability and for Multi-Pod/Multi-Site communication, not for propagating L3Out routes. L3Out routes are propagated using the VPNv4 AF.

Reference:
Cisco ACI Fundamentals — "MP-BGP in ACI": MP-BGP VPNv4 AF is used internally to propagate L3Out routes from border leaf switches to the rest of the fabric via spine route reflectors. MP-BGP EVPN AF is used for endpoint reachability and inter-pod/inter-site communication.

Explanation:
In Cisco ACI, to redirect traffic to a firewall using Policy-Based Redirect (PBR) for a one-armed service insertion, the engineer must create a Service Graph. The service graph defines the sequence of service nodes (in this case, the firewall) that traffic must traverse. The service graph is then associated with a contract (in this case, All_Traffic_Allowed). When the contract is applied between EPGs, the traffic is redirected through the service graph to the firewall. Without a service graph, the PBR policy and device objects alone do not redirect traffic.

Correct Option:

D. Configure a service graph.
Associate the service graph with All_Traffic_Allowed: This is correct. The service graph is the object that ties together the L4-L7 device, the PBR policy, and the contract. Associating the service graph with the contract (All_Traffic_Allowed) enables the traffic redirection to the firewall for the EPGs that use that contract.

Incorrect Option:

A. Configure a policy-based redirect subject.
Associate the policy-based redirect subject with All_Traffic_Allowed: A PBR subject is not a valid ACI object. The PBR policy is a separate object, but it must be referenced within a service graph, not directly associated with a contract.

B. Configure a firewall bridge domain.
Associate the bridge domain with FW-Device: A bridge domain is not used to redirect traffic to a firewall. The firewall is associated with the service graph, not directly with a bridge domain.

C. Configure a device interface policy.
Associate the device interface policy with FW-Device: A device interface policy is used to define the interface configuration for the service device, but it does not redirect traffic. The service graph is required to redirect traffic.

Reference:
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide — "Service Graph Configuration": A service graph defines the service node sequence and is associated with a contract. The contract is applied to EPGs to redirect traffic through the service graph. The PBR policy and device are referenced within the service graph.

Explanation:
The goal is to upgrade the ACI fabric with minimal disruption. The fabric consists of 3 APICs, 2 spines, and 4 leaves (2 with 1-Gb copper ports for bare metal servers, and 2 with 10-Gb SFP ports for storage). To minimize disruption, the upgrade should be performed in a way that maintains redundancy and service availability.

Correct Option:

C. Upgrade the APIC controllers by selecting the desired firmware and choosing Upgrade Now.
Divide the switches into two upgrade groups with one spine, one 1-Gb switch, and one 10-Gb switch per group. Start the firmware upgrade on the first upgrade group and when it finishes, start the second upgrade group:

APIC Upgrade: The APIC controllers should be upgraded first as a cluster (with 3 APICs, they can be upgraded one at a time or as a group with minimal disruption, but the option says "Upgrade Now" which is acceptable).

Switch Groups: Dividing the switches into two groups with one spine, one 1-Gb leaf, and one 10-Gb leaf per group ensures that each group contains a mix of switch types and that redundancy is maintained. When one group is upgraded, the other group remains active, so servers and storage can still communicate through the non-upgraded switches.

Sequential Upgrade: Starting with one group and then proceeding to the second group after the first completes ensures that at least one spine and one leaf of each type remain operational at all times, minimizing disruption.

Incorrect Option:

A. Upgrade the APIC controllers by selecting the desired firmware and choosing Upgrade Now.
Divide the switches into two upgrade groups: spines and leaves. Start the firmware upgrade on the spine upgrade group and then proceed with the leaf upgrade group: This option groups all spines together and all leaves together. Upgrading all spines at once would eliminate spine redundancy, potentially causing a fabric-wide disruption if the spines go down. Similarly, upgrading all leaves at once would disrupt all server and storage connectivity.

B. Upgrade the APIC controllers by initiating the upgrade process that uses the most recent uploaded firmware.
Divide the switches into three upgrade groups: spines, 1-Gb switches, and 10-Gb switches. Start the firmware upgrade on the spine upgrade group and then proceed with the other two groups: This option also groups all spines together and separates the leaves by port type. Upgrading all spines at once eliminates spine redundancy. Separating the leaves by type means that during the upgrade of one type, all switches of that type are down, disrupting all servers or all storage.

D. Upgrade the APIC controllers as a single group by selecting the firmware and choosing Upgrade Now.
Divide the switches into four upgrade groups with one switch per group. Start the firmware upgrade on each upgrade group in succession until all four are complete: Upgrading the APICs as a single group could cause a brief management-plane outage. Dividing the switches into four groups with one switch per group is too granular and would result in unnecessary delays. While this approach minimizes disruption, it does not provide the balanced, redundancy-preserving approach of option C.

Reference:
Cisco APIC Upgrade and Downgrade Guide — "Fabric Upgrade Best Practices": Upgrade the APIC cluster first, then upgrade switches in maintenance groups that preserve redundancy. Each group should contain a mix of switch roles (spine/leaf) to maintain fabric operations.