Free Cisco 300-620 Practice Questions 2026 | Implementing Cisco Application Centric Infrastructure (300-620 DCACI)

Explanation:
The exhibit shows a configuration for an External Bridged Network (L2Out) connection. According to Cisco documentation, when creating a Layer 2 external connection, the configuration requires the creation of a VRF and a Bridge Domain to define the Layer 3 context and the Layer 2 domain that will be extended outside the fabric . The bridge domain is associated with the L2Out, and the VRF provides the routing context.

Correct Option:

C. bridge domain:
The bridge domain is a required object for L2Out configuration. It defines the Layer 2 domain that is being extended to the external network. The L2Out is associated with a specific bridge domain, allowing endpoints in that BD to communicate with external devices .

E. VRF:
The VRF (Virtual Routing and Forwarding) instance is also created as part of this configuration. The bridge domain references the VRF to provide the Layer 3 context for the tenant network. The VRF defines the routing domain for the endpoints in the bridge domain .

Incorrect Option:

A. application profile:
While an application profile is a common construct in ACI, it is not a direct result of creating an L2Out connection. Application profiles are used to group EPGs and define contracts, but the L2Out configuration itself does not create an application profile.

B. attachable AEP:
An Attachable Entity Profile (AEP) is used for access policies to define which VLANs and policies are applied to physical ports. While an AEP may be referenced or created for the physical connectivity of the L2Out, it is not a direct object created by the L2Out configuration itself .

D. endpoint group:
While an External EPG (l2extInstP) is created as part of the L2Out configuration, the option "endpoint group" typically refers to a standard application EPG. The L2Out creates an External Network object (External EPG), not a standard EPG. The question asks for objects created as a result of the configuration, and the core objects are the VRF and Bridge Domain.

Reference:
Cisco APIC REST API Configuration Guide — "Tenant External Bridged Networks": The configuration requires creating a VRF and a bridge domain. The bridge domain element subnets reference the corresponding Layer 3 context (VRF)

Explanation:
In the Cisco ACI VMM domain configuration, the Delimiter field allows you to define the character that separates the Tenant, Application, and EPG names when port groups are created on the VMware vSphere Distributed Switch. The default delimiter is a pipe character (|), so port groups are named Tenant | Application | EPG. If you change the delimiter to an equals sign (=), the port group names become Tenant=Application=EPG.

Correct Option:

C. delimiter:
This is the configuration option used to change the separator between the tenant, application profile, and EPG names in the port group naming format. Setting the delimiter to = produces the required Tenant=Application=EPG format.

Incorrect Option:

A. enable tag collection:
This option enables the collection of tags from the VM controller for use in uSeg EPGs and attribute-based policies. It does not affect port group naming.

B. security domains:
Security domains are used for RBAC (Role-Based Access Control) to restrict user access to specific tenants or objects. They do not influence port group naming.

D. virtual switch name:
The virtual switch name is the name of the VDS (VMware vSphere Distributed Switch) that is created or referenced in the VMM domain. It does not determine the port group naming format.

Reference:
Cisco APIC Virtualization Guide — "VMM Domain Delimiter": The delimiter is used to separate the tenant, application, and EPG names in the port group name. The default delimiter is |. It can be changed to other characters such as =.

Explanation:
In a Cisco ACI Multi-Pod architecture, different Pods are connected through an Inter-Pod Network (IPN). Communication between Pods is established via the spine switches of each Pod, which connect to the IPN. The spine switches use MP-BGP EVPN as the control-plane protocol to exchange endpoint and multicast information across Pods.

Correct Option:

C. over Layer 3 IPN connectivity via spines:
This is accurate. Spine switches connect to the IPN and establish MP-BGP EVPN sessions with spines in remote Pods. The IPN provides Layer 3 connectivity that enables Pod-to-Pod communication, including endpoint reachability and data plane traffic.

Incorrect Option:

A. over Layer 3 directly connected back-to-back spines:
While back-to-back spine connections are supported for two-Pod fabrics starting with APIC release 5.2(3), this is a specific option and not the general method for Pod-to-Pod communication in Multi-Pod.

B. over Layer 3 Out connectivity via border leafs:
L3Out connections are used for external routing to networks outside the ACI fabric, not for inter-Pod communication within a Multi-Pod fabric.

D. over Layer 3 IPN connectivity via border leafs:
The IPN connects to spine switches, not border leafs. Spines are the designated devices for Inter-Pod connectivity.

Reference:
Cisco APIC Layer 3 Networking Configuration Guide — "Multi-Pod uses MP-BGP EVPN as the control-plane communication protocol between the ACI spines in different pods".

Explanation:
In Cisco ACI, external RADIUS authentication for users requires configuring a specific attribute on the RADIUS server. This attribute, known as a Cisco AV pair, uses the format shell:domains to define the user's Role-Based Access Control (RBAC) roles and privileges, such as security domains and read/write permissions. Without this attribute, the APIC cannot determine the user's authorization level.

Correct Option:

cisco-av-pair:
This is the vendor-specific attribute (VSA) that carries the authorization information. The APIC administrator must configure the shell:domains value on the RADIUS server (e.g., shell:domains = all/aaa/read-all) so the APIC knows which security domain and roles to assign to the authenticated user .

Incorrect Option:

cisco-security domain:
This is not a valid attribute name. Security domains are ACI constructs (objects like common or solar) that are referenced within the cisco-av-pair value, not the attribute itself .

cisco-auth-features:
This is not a recognized RADIUS attribute for ACI authentication. It does not exist in Cisco documentation for this purpose.

cisco-aci-role:
While conceptually related, this is not the actual attribute name. The correct attribute is cisco-av-pair, which contains the role information inside the shell:domains string .

Reference:
Cisco APIC Security Configuration Guide, Release 6.2(x): "To configure users on RADIUS servers, the APIC administrator must configure the required attributes (shell:domains) using the cisco-av-pair attribute" .

Explanation:
The exhibit shows a Cisco ACI AAA configuration with a fallback login configured to radius realm. When both RADIUS servers are unavailable, the fallback mechanism will attempt to authenticate against the RADIUS servers again, which will fail. To ensure authentication during a RADIUS outage, the fallback login must be changed to local so that the APIC falls back to its local user database.

Correct Option:

B. Set the fallback login to local:
The current configuration has aaa authentication login fallback realm radius. This means if the primary RADIUS authentication fails, the system tries the fallback method, which is also RADIUS. Changing the fallback realm to local ensures that when RADIUS servers are unreachable, the APIC authenticates users against its local database instead.

Incorrect Option:

A. Adjust the priority of server 10.1.1.1 to 1:
Changing server priority does not help when both servers are unavailable. Priority only determines the order in which servers are tried when they are reachable.

C. Assign the user to the default role:
The aaa user default-role-no-login command sets the default role for users who do not have an assigned role, and it prevents login. This does not provide fallback authentication when RADIUS is unavailable.

D. Set the default login realm to LDAP:
Changing the realm to LDAP would require an LDAP server to be configured and available. It does not solve the problem of RADIUS server unavailability for local fallback.

Reference:
Cisco APIC Security Configuration Guide — "AAA Fallback": The fallback login realm can be set to local, radius, or tacacs. When set to local, the APIC uses its local user database if the primary authentication method fails.

Explanation:
The Cisco ACI System Faults page allows filtering by fault lifecycle stages. Active faults are those that are currently present in the fabric. A fault becomes active when it is Raised and remains active until it is Clearing. Therefore, to view only active faults, the filter must include both the Raised and Clearing lifecycle stages.

Correct Option:

A. Raised:
This lifecycle stage indicates that a fault has been raised and is currently active. Selecting this stage includes faults that have been newly raised and are present in the fabric.

D. Raised, Clearing:
This option combines both the Raised and Clearing stages. The Clearing stage indicates that the fault condition is still present but is in the process of being cleared. Both stages represent active faults that have not yet been fully resolved.

Incorrect Option:

B. Retaining:
This stage indicates that the fault condition has cleared, but the fault is being retained for a period before being deleted. It is not an active fault.

C. Soaking, Clearing:
Soaking is a stage where the fault is active but has not yet been raised (it is being suppressed for a period). Clearing is active, but Soaking alone is not considered an active raised fault. This combination does not correctly represent all active faults.

E. Soaking:
This stage represents a fault condition that is being monitored but has not yet been raised. It is not an active fault on the System Faults page.

Reference:
Cisco APIC Faults, Events, and Audit Log Management Guide — "Fault Lifecycle": Faults transition through stages including Soaking, Raised, Clearing, and Retaining. Active faults are those in the Raised or Clearing stages.

Explanation:
In a Cisco ACI fabric, spine switches are configured as BGP Route Reflectors to propagate MP-BGP EVPN routes between leaf switches. The leaf switches act as BGP clients and establish iBGP sessions with the spines. The APIC controllers are not part of the BGP route reflection architecture. Therefore, the two spine switches shown in the exhibit are the correct components to be configured as route reflectors.

Correct Option:

A. Spine1:
Spine switches serve as BGP route reflectors in the ACI fabric. They receive EVPN routes from leaf switches and reflect them to other leaf switches, enabling endpoint reachability information to be distributed across the fabric.

C. Spine2:
Like Spine1, Spine2 also acts as a BGP route reflector. ACI fabrics typically use two or more spines for redundancy, and all spines are configured as route reflectors to ensure high availability.

Incorrect Option:

B. apic1:
APIC controllers are management and policy controllers. They do not participate in the BGP EVPN control plane as route reflectors.

D. Leaf1:
Leaf switches are BGP clients that establish sessions with spine route reflectors. They do not act as route reflectors.

E. Leaf2:
Same as Leaf1, leaf switches are clients, not route reflectors.

F. apic2:
APIC controllers are not part of the BGP route reflection architecture.

Reference:
Cisco ACI Fundamentals — "Spine switches act as BGP route reflectors to distribute EVPN routes between leaf switches."

Explanation:
When a RADIUS user authenticates to Cisco ACI, the Cisco AV Pair attribute is used to resolve the user's role and privileges. The value of the cisco-av-pair attribute (specifically the shell:domains portion) maps to a security domain in ACI. Security domains are logical groupings of tenants and other objects that define the scope of a user's administrative access.

Correct Option:

B. security domain:
The Cisco AV Pair resolves to a security domain. For example, a typical AV Pair value is shell:domains=all/aaa/read-all, where all is the security domain name, aaa is the role, and read-all is the privilege level. The security domain determines which tenants and objects the user can access.

Incorrect Option:

A. tenant:
While security domains can contain tenants, the AV Pair resolves to a security domain, not directly to a tenant. A security domain is a broader scope that can include multiple tenants.

C. primary Cisco APIC:
The primary APIC is a cluster role, not an object that the AV Pair resolves to. The AV Pair defines the user's authorization scope, not which APIC they connect to.

D. managed object class:
While the AV Pair is stored on a managed object (the user object), it does not resolve to a managed object class. It resolves to a security domain for RBAC purposes.

Reference:
Cisco APIC Security Configuration Guide — "Cisco AV Pair": The cisco-av-pair attribute is used to assign a role and security domain to a RADIUS-authenticated user. The format is shell:domains=//.

Explanation
The server team has two specific requirements: the network switches must initiate LACP negotiation, and traffic must be evenly distributed across both 10 Gigabit Ethernet links. The LACP Mode determines which side initiates negotiation, while the Load Balancing (LB) Mode determines how traffic is distributed across the links in the LAG group.

Correct Option

C. LB Mode:
Source and Destination MAC Address: This load balancing method uses a hash of the source and destination MAC addresses to distribute traffic across the links. It is a common choice for server connectivity because it provides an even distribution of traffic flows across all available links in the LAG, satisfying the requirement for even traffic distribution.

E. LACP Mode:
LACP Active: In LACP Active mode, the ACI leaf switch initiates the LACP negotiation by sending LACPDUs. This directly meets the requirement that the network switches (not the servers) initiate LACP negotiation. In LACP Passive mode, the switch would wait for the server to initiate negotiation.

Incorrect Option

A. LACP Mode:
LACP Standby: LACP Standby is not a valid LACP mode in Cisco ACI. The available modes are Active and Passive. Standby mode is not supported for LACP on ACI leaf switches.

B. LB Mode:
Destination IP Address and TCP/UDP Port: This load balancing method uses destination IP and TCP/UDP port information. It is less effective for traffic distribution when a single client communicates with a single server, as all traffic would use the same link. It does not provide the even distribution required.

D. LB Mode:
Source IP Address and TCP/UDP Port: This method uses source IP and TCP/UDP port information. Similar to option B, it can result in uneven distribution when traffic originates from a single source, and it does not guarantee even distribution across all links.

Reference
Cisco APIC Virtualization Guide — Enhanced Lag Policy: LACP Active mode initiates LACP negotiation from the ACI side. Load Balancing modes such as Source and Destination MAC Address provide even distribution of traffic across the LAG member links.

Explanation:
In Cisco ACI, when the Layer 2 Unknown Unicast policy is changed from Flood to Hardware Proxy, the leaf switch no longer floods unknown unicast frames within the bridge domain. Instead, it forwards the frame to a spine switch, which acts as a proxy. The spine switch performs a lookup in its local endpoint table (populated by COOP) and forwards the frame only to the leaf where the destination endpoint resides.

Correct Option:

A. It is forwarded to one of the spines to perform as a spine proxy:
This is accurate. With Hardware Proxy enabled, the leaf switch sends unknown unicast traffic to a spine switch that serves as the proxy. The spine uses the COOP database to locate the destination endpoint and forwards the traffic only to the appropriate leaf switch, reducing unnecessary flooding.

Incorrect Option:

B. It is flooded within the whole fabric:
This describes the behavior when the policy is set to Flood, not Hardware Proxy. In Flood mode, the leaf floods the frame to all other leaf switches in the bridge domain.

C. It is dropped by the leaf when the destination endpoint is not present in the endpoint table:
The leaf switch does not drop the frame; it forwards it to the spine for proxy lookup. Dropping would only occur if the destination endpoint is not found after the proxy attempt.

D. It is forwarded to one of the APICs to perform as a proxy:
The APIC controllers are management and policy controllers. They do not participate in data plane forwarding or endpoint proxying. The proxy function is performed by the spine switches.

Reference:
Cisco ACI Fundamentals — "L2 Unknown Unicast: Hardware Proxy": The leaf switch forwards unknown unicast frames to the spine proxy, which performs the endpoint lookup and forwards the traffic only to the leaf where the destination is located.