Free Cisco 300-620 Practice Questions 2026 | Implementing Cisco Application Centric Infrastructure (300-620 DCACI)

Explanation:
In Cisco ACI, the Fault Severity Assignment Policy is used to change or suppress the severity of specific faults, including those generated when a port goes down. By configuring this policy, an administrator can set the fault's severity to "squelched" or "ignored" , which prevents the fault from being raised or appearing in the fault list.

Correct Option:

C. fault severity assignment:
This policy type allows you to override the default severity of a fault based on its fault code and the affected object. When a port goes down, it generates a fault (such as link-down). A Fault Severity Assignment Policy can be created to squelch this specific fault, effectively suppressing it so it does not appear in the APIC UI or affect the health score.

Incorrect Option:

A. fault lifecycle assignment:
This term is not a valid policy type in Cisco ACI. Faults have lifecycle stages (soaking, raised, clearing, retaining), but there is no policy called "fault lifecycle assignment."

B. event lifecycle assignment:
This is not a valid ACI policy type. Events have their own lifecycle, but it is not configured through a policy with this name.

D. event severity assignment:
This is not a valid ACI policy type. Events are separate from faults, and there is no "event severity assignment" policy. Fault suppression is handled through fault severity assignment.

Reference:
Cisco APIC Faults, Events, and Audit Log Management Guide — "Fault Severity Assignment Policies": The fault severity assignment policy enables you to change the severity of a fault or squelch it entirely. When a fault is squelched, it is not raised and does not appear in the fault list.

Explanation:
In Cisco ACI, the Dynamic Endpoint Attach feature allows firewall ACLs to be configured automatically when new endpoints are attached to an EPG. When this feature is enabled, the APIC communicates with the firewall (via the L4-L7 service device's API) to dynamically create or update ACLs based on the endpoint information learned in the EPG. This eliminates the need for manual ACL configuration each time a new endpoint is added.

Correct Option:

B. dynamic endpoint attach:
This feature enables the APIC to automatically notify the L4-L7 service device (such as a firewall) when endpoints are attached to or detached from an EPG. The firewall can then dynamically update its ACLs to permit or deny traffic based on the current endpoint membership. This is part of the Cisco ACI L4-L7 service insertion framework and is supported with certain firewall vendors.

Incorrect Option:

A. ARP gleaning:
ARP gleaning is a technique used for IP address learning, particularly in scenarios where the fabric learns IP addresses from ARP traffic. It does not configure firewall ACLs automatically.

C. hardware proxy:
Hardware proxy is a bridge domain setting that controls how unknown unicast traffic is handled. It is not related to automatic firewall ACL configuration.

D. network-stitching:
Network stitching (such as VRF stitching or network-stitching for service graphs) is used to connect different network domains or VRFs through service devices. It does not automatically configure firewall ACLs when endpoints attach.

Reference:
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide — "Dynamic Endpoint Attach": This feature allows the APIC to push endpoint attachment information to the L4-L7 service device, enabling the device to automatically configure ACLs for new endpoints.

Explanation:
In an application-centric ACI design, a bridge domain often contains multiple EPGs, each mapped to a different VLAN. When migrating from a legacy network that typically uses a one-VLAN-per-bridge-domain model, this can cause instability because multi-destination traffic (broadcast, unknown unicast, multicast) from the legacy network could be incorrectly flooded across all EPGs in the ACI bridge domain, leaking traffic between logical segments. Configuring the bridge domain to Flood in BD ensures that multi-destination traffic is flooded to all ports in the bridge domain, which mimics the behavior of the legacy network and prevents the traffic from being unexpectedly isolated or mishandled during the migration.

Correct Option:

A. Set Multi-Destination Flooding to Flood in BD:
This setting makes the ACI bridge domain flood multi-destination traffic to all endpoints in the bridge domain. During a migration, the legacy Layer 2 trunk and the ACI fabric are interconnected; this behavior ensures that broadcast and unknown traffic from the legacy side reaches all necessary ACI endpoints without being confined to a single VLAN, which would otherwise cause connectivity issues and instability.

Incorrect Option:

B. Enable Flood in Encapsulation:
This option configures the bridge domain to flood multi-destination traffic only within the same VLAN encapsulation. While this is useful for preventing traffic leakage between EPGs in an application-centric design, it is not the correct choice during a migration from a legacy environment. The legacy environment expects a single broadcast domain, and restricting flooding to individual encapsulations can break connectivity for protocols that rely on broadcast traffic reaching all endpoints.

C. Set Multi-Destination Flooding to Flood in Encapsulation:
This is functionally the same as option B and is incorrect for the same reason. It restricts flooding to specific VLANs, which can cause instability during a migration when the legacy network expects a broader flooding scope.

D. Disable Endpoint Dataplane Learning:
This feature is used for specific scenarios like Policy-Based Redirect (PBR) to prevent incorrect endpoint learning. It is not related to managing multi-destination flooding during a migration and would not address the instability described in the question.

Reference:
Cisco ACI Layer 2 Networking Configuration Guide: "Multi-Destination Flooding" settings in the bridge domain define how broadcast, unknown unicast, and multicast traffic is handled, with "Flood in BD" being the appropriate choice to maintain traditional Layer 2 flooding behavior during brownfield migrations.

Explanation:
An EPG is extended outside of the ACI fabric by using static path binding, which maps a leaf switch port and a VLAN ID to a specific EPG. This allows external endpoints connected to that port (or behind an external Layer 2 switch on that VLAN) to be logically included in the EPG, receiving the same policies and contracts as internal endpoints.

Correct Option:

D. Statically assign a VLAN ID to a leaf port in an EPG:
This is the correct method for extending an EPG outside the fabric. In the EPG's configuration, you create a static path binding that associates a leaf switch interface (or port channel) and a VLAN encapsulation with the EPG. Any device reachable through that port and VLAN becomes a member of the EPG.

Incorrect Option:

A. Create an external bridged network that is assigned to a leaf port:
An external bridged network (L2Out) is used to extend an entire bridge domain outside the fabric, not a single EPG. While it involves assigning a leaf port to the external network, this is not the method used to extend a specific EPG.

B. Create an external routed network that is assigned to an EPG:
An external routed network (L3Out) is used to extend Layer 3 routing outside the fabric. It does not extend an EPG as a Layer 2 construct and is not the correct answer for extending an EPG outside the fabric.

C. Enable unicast routing within an EPG:
Unicast routing is a bridge domain setting that enables the fabric to act as the default gateway for subnets. It does not extend an EPG outside the fabric.

Reference:
Cisco APIC Basic Configuration Guide — "Static Path Binding": Static path binding is used to bind an EPG to a leaf port and VLAN, extending the EPG to external endpoints connected to that port.

Explanation:
When configuring Cisco ACI VMM domain integration with VMware vCenter, the APIC creates a VMware vSphere Distributed Switch (VDS) in vCenter. The VDS is the virtual switch that spans multiple ESXi hosts and is managed centrally through vCenter. The APIC creates the VDS and then creates port groups on it for each EPG that is associated with the VMM domain.

Correct Option:

C. VMware vSphere Distributed Switch:
The APIC creates a VDS (also called a vSphere Distributed Switch) in vCenter when a VMM domain is configured with a VMware vCenter controller. The VDS is the recommended virtual switch type for ACI VMM integration because it supports the advanced networking features required for ACI policy enforcement, such as PVLAN, NetFlow, and port mirroring. The APIC manages the VDS and its port groups.

Incorrect Option:

A. datacenter:
A datacenter is a vCenter object that serves as a container for hosts, clusters, and virtual machines. It is not created by the APIC during VMM domain integration; it must already exist in vCenter.

B. VMware vSphere Standard vSwitch:
A Standard vSwitch is a host-level virtual switch that is configured per ESXi host. It is not created or managed by the APIC, and it does not support the centralized management required for ACI VMM integration.

D. cluster:
A cluster is a vCenter object that groups ESXi hosts. It is not created by the APIC during VMM domain integration; it must already exist in vCenter.

Reference:
Cisco APIC Virtualization Guide — "VMware vSphere Distributed Switch": When you create a VMM domain for VMware vCenter, the APIC creates a vSphere Distributed Switch (VDS) in vCenter. The VDS is used to provide network connectivity for virtual machines and to enforce ACI policies.

Explanation:
In Cisco ACI, the Access (802.1p) mode is used for legacy host connectivity. On modern switches (like the 9396PX and 9336PQ mentioned), this mode is functionally equivalent to Access (Untagged). On egress, the leaf switch removes the VLAN tag from the traffic before sending it out the port, so the endpoint receives untagged frames.

Correct Option:

B. from leaf ports untagged:
For second-generation switches (like the 9396PX with an -EX or later suffix), the Access (802.1p) and Access (Untagged) modes are identical. In this mode, the port is configured as an access port with a native VLAN. When traffic exits the leaf switch from the EPG, the VLAN tag is stripped, and the traffic is sent untagged to the host.

Incorrect Option:

A. from leaf ports tagged as VLAN 0:
This behavior is specific to first-generation switches (e.g., original Nexus 9300 series without an -EX/FX suffix). On those older switches, if a port had multiple EPGs (one in 802.1p mode and others tagged), traffic from the 802.1p EPG could exit tagged with VLAN 0. However, for the hardware specified in the question, this does not apply.

C. from leaf ports tagged as VLAN 4094:
VLAN 4094 is a reserved VLAN used for internal fabric functions, not for user traffic from an EPG. This is not a valid option for EPG egress traffic.

D. from leaf ports tagged as VLAN 1:
While VLAN 1 is often the default native VLAN, ACI does not specifically use VLAN 1 as a tag for 802.1p traffic. The traffic is simply sent untagged, regardless of what the native VLAN ID is on the port.

Reference:
Cisco ACI Fundamentals — Policy Model: "Second-generation switches or later do not distinguish between the Access (Untagged) and Access (802.1p) modes... For an EPG deployed on a second-generation port configured as untagged or 802.1p, on egress, the traffic is always untagged on the node where it is deployed."

Explanation:
A bridge domain in Cisco ACI represents a Layer 2 forwarding construct within a tenant. It defines a broadcast domain and controls how Layer 2 traffic is forwarded between endpoints. Each bridge domain is associated with a VRF for Layer 3 routing and contains one or more subnets. It is the ACI equivalent of a VLAN in traditional networking, but with additional capabilities such as integrated routing and bridging (IRB) and distributed anycast gateway.

Correct Option:

B. Layer 2 forwarding construct:
A bridge domain is the ACI object that defines a Layer 2 broadcast domain. It provides the forwarding logic for Layer 2 traffic, including MAC address learning, unknown unicast flooding, and ARP handling. It is the fundamental Layer 2 construct in the ACI policy model.

Incorrect Option:

A. Layer 3 cloud:
A Layer 3 cloud is not a defined ACI object. Layer 3 functionality in ACI is provided by VRFs and L3Outs, not by bridge domains.

C. tenant:
A tenant is a logical container for all ACI policies and objects. A bridge domain is an object within a tenant, not the tenant itself.

D. physical domain:
A physical domain is an ACI construct used to define the physical network connectivity for an EPG, such as VLAN pools and attachable entity profiles. It is not the same as a bridge domain.

Reference:
Cisco APIC Basic Configuration Guide — "Bridge Domain": A bridge domain represents a Layer 2 forwarding construct within the fabric. It is associated with a VRF and contains subnets that define the Layer 3 gateway addresses for endpoints.

Explanation:
When configuring in-band management in Cisco ACI, the administrator must create a new VLAN pool for the in-band management network. This VLAN pool provides the VLAN encapsulation for the in-band management EPG and is associated with the in-band management bridge domain. While the mgmt tenant already exists, and the management contract and bridge domain are pre-configured, the VLAN pool must be created specifically for the in-band management EPG.

Correct Option:

A. VLAN pool:
A new VLAN pool is required for in-band management configuration. The VLAN pool is used to allocate VLANs for the in-band management EPG. It is created in the infra tenant and associated with the in-band management bridge domain. Without a VLAN pool, the in-band management EPG cannot be deployed on the leaf switches.

Incorrect Option:

B. management contract:
The management contract is pre-configured in the mgmt tenant. It defines the rules for management access (HTTP, HTTPS, SSH, SNMP, etc.) and is reused for in-band management. It does not need to be created anew.

C. management tenant:
The mgmt tenant is pre-existing and contains the out-of-band management configuration. For in-band management, the configuration is done in the infra tenant, not by creating a new management tenant.

D. bridge domain:
The in-band management bridge domain is pre-configured in the infra tenant (named mgmtInB). It does not need to be created; it only needs to be associated with the new VLAN pool.

Reference:
Cisco APIC Basic Configuration Guide — "In-Band Management": To configure in-band management, you must create a VLAN pool in the infra tenant and associate it with the in-band management bridge domain. The mgmt tenant, management contract, and bridge domain are pre-existing.

Explanation:
When connecting Cisco ACI to external third-party switches running 802.1s (MSTP), you must configure MCP (Mis-Cabling Protocol) to prevent loops and mis-cabling. MCP is ACI's loop-prevention protocol. Because the external switches are not running ACI's native loop prevention, MCP must be configured to interoperate with the external STP domain. The MCP instance policy must be created, and the administrative state must be disabled to allow the external switches to participate in spanning tree without MCP blocking the ports. Additionally, PDU per VLAN must be enabled to send MCP PDUs on a per-VLAN basis, which is required for interoperability with MSTP.

Correct Option:

B. MCP policy with PDU per VLAN enabled:
Enabling PDU per VLAN allows MCP to send and receive MCP PDUs on a per-VLAN basis. This is required when connecting to external switches running MSTP, as it allows MCP to detect loops per VLAN while coexisting with the external spanning tree.

C. MCP instance policy with administrative state disabled:
The MCP instance policy must be configured with the administrative state disabled on the ports connected to the external switches. This prevents MCP from blocking the ports and allows the external MSTP to control the topology. MCP still monitors for loops but does not actively block.

Incorrect Option:

A. spanning tree policy for mapping MST Instances to VLANs:
ACI does not support MSTP natively and does not use spanning tree policies for VLAN-to-MST mapping. ACI uses MCP for loop prevention, not STP.

D. dedicated EPG for native VLAN:
While a dedicated EPG for the native VLAN may be a design choice, it is not a strict requirement for Layer 2 connectivity with MSTP switches. The key requirement is MCP configuration.

E. static binding of native VLAN in all existing EPGs:
Static binding of the native VLAN in all EPGs is not required. The native VLAN is typically handled by a dedicated EPG or by the L2Out configuration, not by binding it to every EPG.

Reference:
Cisco ACI Layer 2 Networking Configuration Guide — "Connecting ACI to External Layer 2 Networks with MSTP": MCP must be configured with PDU per VLAN enabled and the administrative state disabled on the external-facing ports to interoperate with MSTP.

Explanation:
In-band management in Cisco ACI uses the leaf access ports (also called fabric ports or data ports) to carry management traffic. The in-band management EPG is deployed on leaf switches, and management traffic enters and exits through the leaf access ports using the data plane. This is in contrast to out-of-band management, which uses the dedicated management ports on the switches and APICs.

Correct Option:

C. leaf access port:
In-band management traffic is carried over the data plane through leaf access ports. The in-band management EPG is configured in the infra tenant and is deployed on leaf switches. Management traffic from external networks enters the fabric through these leaf ports and reaches the APIC and switches via the in-band management IP addresses.

Incorrect Option:

A. spine switch port:
While spine switches carry in-band management traffic internally between leaf switches, the actual entry/exit point for external management traffic is the leaf access port. Spine ports are not the primary interface for in-band management connectivity to external networks.

B. APIC console port:
The APIC console port is a physical serial port used for direct console access to the APIC controller. It is not used for in-band management.

D. management port:
The management port (also called out-of-band management port) is a dedicated physical port on the switch or APIC used for out-of-band management. It is separate from the data plane and is not used for in-band management.

Reference:
Cisco APIC Basic Configuration Guide — "In-Band Management": In-band management uses the leaf access ports to carry management traffic over the data plane. The in-band management EPG is configured in the infra tenant and deployed on leaf switches.