Free Cisco 300-620 Practice Questions 2026 | Implementing Cisco Application Centric Infrastructure (300-620 DCACI)

Explanation:
To minimize traffic impact during an ACI fabric upgrade with 3 APIC controllers and servers dual-homed to vPC leaf switch pairs, the correct sequence must address both the APIC cluster and the leaf switches in a way that maintains fabric operations and avoids vPC domain disruption. Option A follows the recommended Cisco upgrade workflow.

Correct Option:

A. Option A: The sequence is:

Create two maintenance groups for the leaf switches: VPC left and VPC right.

Upgrade the APIC controllers.

Upgrade the first group of leaf switches.

Upgrade the second group of leaf switches.

This is correct because:
The APIC controllers should be upgraded first to ensure the new software version is running on the management plane before upgrading the switches. With 3 APICs, the cluster can maintain quorum during the rolling upgrade.

The leaf switches are divided into vPC left and vPC right groups. This ensures that when one group is upgraded, the other group remains active, so vPC pairs are not disrupted simultaneously. Servers dual-homed to vPC pairs maintain connectivity through the non-upgraded side.

Upgrading leaf switches in separate vPC groups minimizes traffic impact because at least one path remains available at all times.

Incorrect Option:

B. Option B:
This option upgrades the first group of switches before the APIC controllers. Upgrading switches before the APIC cluster is not recommended because the APIC must be running the target version to manage the upgraded switches properly. This can cause compatibility issues and management plane disruption.

C. Option C:
This option creates maintenance groups for the APIC controllers (VPC left and VPC right), which is incorrect. The vPC concept applies to leaf switch pairs, not APIC controllers. APIC controllers form a cluster and do not use vPC. Additionally, upgrading leaf switches before APIC controllers is not the recommended order.

D. Option D:
This option also creates maintenance groups for APIC controllers (VPC left and VPC right), which is invalid. The upgrade sequence also places APIC controller upgrades before leaf switches, but the grouping is wrong. vPC groups are for leaf switches, not APICs.

Reference:
Cisco APIC Upgrade and Downgrade Guide — "Upgrade Sequence": Cisco recommends upgrading the APIC cluster first, then upgrading leaf switches in maintenance groups that respect vPC pairing (e.g., vPC left and vPC right) to avoid simultaneous disruption of both sides of a vPC domain.

Explanation:
Extending an EPG out of the ACI fabric using static path binding maps a leaf port and VLAN to a specific EPG. All endpoints reachable through that external Layer 2 network on the configured VLAN are treated as members of the same EPG, regardless of whether they are directly connected or behind an external switch.

Correct Option:

D. External endpoints are in the same EPG as the directly attached endpoints:
When you configure a static path binding, you associate a leaf port and VLAN encapsulation with an EPG. Any endpoint traffic arriving on that port with the matching VLAN is classified into that EPG. This means external endpoints behind a Layer 2 switch are logically part of the same EPG as endpoints directly connected to the ACI leaf .

Incorrect Option:

A. Endpoints must connect directly to the ACI leaf port:
This is incorrect. Static path binding allows endpoints to be behind an external Layer 2 network, as long as the VLAN is extended to the ACI leaf port .

B. External endpoints are in a different bridge domain than the endpoints in the fabric:
This is incorrect. The EPG is associated with a bridge domain, and all endpoints in the EPG share that same bridge domain .

C. Endpoint learning encompasses the MAC address only:
This is incorrect. ACI learns both MAC and IP addresses for endpoints in an EPG, depending on the bridge domain's Layer 3 configuration .

Reference:
Cisco ACI Fundamentals — "Static Path Binding": When an EPG is deployed using static path binding, traffic received on the configured leaf port with the specified VLAN is mapped to that EPG, and the EPG policy is applied to all endpoints reachable through that Layer 2 domain .

Explanation:
Cisco ACI's Layer 3 multicast feature, which is required to forward multicast traffic over an L3Out, has specific interface support requirements. To meet the requirement of forwarding both unicast and multicast traffic, the L3Out must be configured using an interface type that supports PIM (Protocol Independent Multicast).

Correct Option:

A. Layer 3 routed port:
A Layer 3 routed interface is a supported configuration for multicast-enabled L3Outs. PIM can be enabled on routed interfaces to establish multicast adjacencies with external routers, allowing for the forwarding of multicast traffic .

D. Layer 3 routed subinterface:
Routed subinterfaces are explicitly listed as a supported interface type for L3Outs that require multicast routing. This allows the L3Out to carry both unicast and multicast traffic over the subinterface's VLAN encapsulation

Incorrect Option:

B. VPC with SVI:
While SVIs can support multicast, the specific combination of an SVI over a vPC is not supported for Layer 3 Multicast in ACI. Using an SVI in a vPC for multicast traffic will not work .

C. port channel with SVI:
Similar to option B, multicast is not supported on L3Out SVI interfaces that are part of a vPC. An SVI L3Out must not be in a vPC configuration for multicast to function .

E. Layer 3 floating SVI:
Floating SVIs are a feature used for specific multi-node L3Out deployments (like remote leaf or multi-site scenarios) to handle SVI migration. It is not the primary interface type used to enable multicast on a standard L3Out peering with a backbone network .

Reference:
Cisco APIC Layer 3 Networking Configuration Guide — "PIM is supported on Layer 3 Out routed interfaces and routed subinterfaces including Layer 3 port-channel interfaces. PIM is not supported on Layer 3 Out SVI interfaces" . Additionally, for multicast on SVIs: "Using SVIs over a vPC L3out is not supported for L3 Multicast" .

<

Explanation:

In Cisco ACI L4-L7 service insertion, each term has a specific role:

Concrete interfaces are the actual interfaces on the service device (firewall or load balancer) that are associated with logical interfaces. The APIC programs the VLAN encapsulations on these concrete interfaces based on their association with logical interfaces defined in the device cluster.

Service graph defines the sequence of service nodes that traffic must traverse.

It ensures reachability between Layer 3 domains by stitching together the VRFs and defining how traffic flows through the service devices.

Device cluster represents a group of service devices (such as firewalls or load balancers).

A device cluster can contain an active-standby pair of firewalls or load balancers, providing high availability.

VRF stitching is the process of connecting different VRFs (Layer 3 domains) together through a service device.

It is rendered with local resources that are available in the fabric, meaning the VRF stitching configuration is deployed on the leaf switches where the service devices are connected.

Reference:
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide — "Service Insertion Terms": Concrete interfaces are programmed with encapsulations based on logical interface associations. Service graphs ensure reachability between L3 domains. Device clusters contain active-standby pairs. VRF stitching is rendered with local fabric resources.

Explanation:
In Cisco ACI, in-band management IP addresses for APIC controllers, leaf switches, and spine switches are configured within the infra tenant. The infra tenant contains the necessary policies for fabric infrastructure, including the in-band management EPG and the associated IP address pools.

Correct Option:

B. infra:
The infra tenant is used to configure in-band management connectivity. It contains the in-band management EPG (mgmtInB) and the IP address pools used to assign in-band management addresses to fabric nodes. This tenant is pre-configured in the APIC and is specifically designed for infrastructure-related policies.

Incorrect Option:

A. default:
The default tenant is used for initial configuration and does not contain the in-band management EPG for fabric nodes.

C. common:
The common tenant is used for shared policies across tenants, such as VRF and bridge domain configurations. It does not contain the in-band management EPG for fabric infrastructure.

D. mgmt:
The mgmt tenant is used for out-of-band management configuration, not in-band management. Out-of-band management uses the management port on the switches, while in-band management uses the data plane.

Reference:
Cisco APIC Basic Configuration Guide — "In-Band Management": The in-band management configuration is performed in the infra tenant, which contains the in-band management EPG and IP address pools.

Explanation:
In Cisco ACI, every managed object has a unique identifier called a Distinguished Name (DN). The DN describes the object's position and path within the Management Information Tree (MIT), similar to how a fully qualified domain name identifies a host. It is used by the APIC REST API to uniquely reference and manipulate objects.

Correct Option:

D. distinguished name:
The DN is the unique identifier of an ACI object. It is a string that represents the full hierarchical path from the root of the MIT to the object, such as uni/tn-Cisco/ap-App1/epg-EPG1. Every object in the ACI object model has a unique DN.

Incorrect Option:

A. universal resource identifier (URI):
A URI is used in REST API calls to locate a resource, but it is not the unique identifier of the object itself. The URI typically contains the DN.

B. application programming interface:
An API is a set of protocols and tools for building software applications. It is not an identifier for an object.

C. management information tree:
The MIT is the hierarchical database that stores all managed objects in ACI. It is the structure that contains objects, not the unique identifier of an individual object.

Reference:
Cisco APIC REST API Configuration Guide — "Managed Objects and Distinguished Names": "Every managed object in the MIT has a unique distinguished name (DN) that identifies the object and its location in the tree."

Explanation:
In Cisco ACI, the BGP Route Reflector policy is defined at the fabric level. However, to actually enable the BGP process and apply this policy on the leaf switches, the policy must be associated with a Pod Policy Group, which is then applied via a Pod Policy Profile. This two-step association is what activates the route reflector function across the fabric.

Correct Option:

C. pod policy groups and profiles:
This is the correct configuration path. You first create a BGP Route Reflector policy (which specifies the ASN and spine nodes). Then, you create a Pod Policy Group and attach the BGP Route Reflector policy to it. Finally, you associate this Pod Policy Group with a Pod Policy Profile (e.g., default). This enables BGP on the leaf switches and establishes the route reflector sessions.

Incorrect Option:

A. spine fabric interface overrides and profiles:
These are used for physical interface configurations on spine switches, not for enabling BGP route reflector policies.

B. access policies and profiles:
These are used for configuring physical ports, VLANs, and interface policies (like LLDP, CDP, LACP), not for BGP Route Reflector policies.

D. leaf fabric interface overrides and profiles:
These are used for leaf switch interface configurations, not for fabric-wide BGP Route Reflector policy activation.

Reference:
Cisco APIC Basic Configuration Guide — "To enable route reflectors in the ACI fabric, you must... configure a BGP Route Reflector policy and associate it with a Pod Policy Group and Profile."

Explanation:
Cisco ACI uses SCP (Secure Copy Protocol) to securely export and import configuration backups to and from a remote location. SCP runs over SSH, providing encrypted authentication and data transfer, which meets the security requirement for saving configuration in a remote location.

Correct Option:

A. SCP:
SCP is the supported secure protocol for configuration export and import in Cisco ACI. When configuring a remote location for configuration backup, the APIC uses SCP over SSH to encrypt the configuration file during transfer. This ensures that sensitive configuration data is protected in transit.

Incorrect Option:

B. HTTPS:
While HTTPS is used for secure web access to the APIC GUI and REST API, it is not the protocol used for remote configuration backup and restore operations.

C. TFTP:
TFTP (Trivial File Transfer Protocol) does not provide encryption or authentication. It is not used for secure configuration backup in ACI.

D. FTP:
FTP (File Transfer Protocol) transmits data in plaintext without encryption. It is not a secure protocol and is not used for secure configuration backup in ACI.

Reference:
Cisco APIC Management, Monitoring, and Troubleshooting Guide — "Configuration Export and Import": The APIC supports exporting configuration to a remote location using SCP, which provides secure encrypted transfer.

Explanation:
The endpoint table on a Cisco ACI leaf switch stores the IP address, MAC address, and VXLAN/VLAN information for all endpoints learned in the fabric. This table is populated through data-plane learning and is used for forwarding decisions, including VXLAN encapsulation and decapsulation.

Correct Option:

A. endpoint:
The endpoint table (also known as the endpoint database or EPD) holds IP, MAC, and VXLAN/VLAN information for endpoints. When a leaf learns an endpoint, it records the MAC, IP, and the VXLAN VNID (or VLAN) associated with the bridge domain, along with the local interface or remote VTEP where the endpoint resides.

Incorrect Option:

B. adjacency:
The adjacency table stores Layer 3 next-hop information used for routing, such as IP-to-MAC bindings for next hops. It does not store VXLAN/VLAN information or the full endpoint details.

C. RIB:
The Routing Information Base (RIB) is the routing table that stores Layer 3 routes and next-hop information. It does not store MAC addresses or VXLAN/VLAN bindings.

D. ARP:
The ARP table stores IP-to-MAC address mappings for Layer 3 resolution. It does not contain VXLAN/VLAN information or the comprehensive endpoint data found in the endpoint table.

Reference:
Cisco ACI Fundamentals — "Endpoint Learning": The leaf switch maintains an endpoint table that contains IP address, MAC address, and VXLAN/VLAN information for endpoints. This table is used for forwarding and is populated through data-plane learning and COOP synchronization.