Free Cisco 300-620 Practice Questions 2026 | Implementing Cisco Application Centric Infrastructure (300-620 DCACI)

Explanation:
In a Cisco ACI fabric with a Layer 2 Out (L2Out) connection to an external Layer 2 network, MCP (Mis-Cabling Protocol) is the loop-prevention protocol used within ACI. MCP detects loops and mis-cabling by sending and receiving MCP PDUs on fabric ports and L2Out external interfaces. Enabling MCP on the ACI fabric prevents Layer 2 loops from forming across the L2Out boundary.

Correct Option:

A. Enable MCP on the ACI fabric:
MCP is enabled globally on the fabric and on the external interfaces associated with the L2Out. When MCP detects a loop, it can take action (such as disabling the port) to prevent traffic loops between the ACI fabric and the external Layer 2 network.

Incorrect Option:

B. Disable STP in the external network:
Disabling STP in the external network is not a valid ACI configuration action and would not prevent loops. It would likely increase the risk of loops.

C. Disable STP on the ACI fabric:
ACI does not run STP internally; disabling it is not applicable. MCP is the correct protocol for loop prevention within ACI.

D. Enable STP on the ACI fabric:
ACI does not use STP for loop prevention. Enabling STP on the fabric is not a supported configuration. MCP is the correct mechanism.

Reference:
Cisco ACI Layer 2 Networking Configuration Guide — "MCP Configuration for L2Out": MCP is used to prevent loops and mis-cabling when connecting the ACI fabric to external Layer 2 networks. MCP must be enabled on the fabric and on the L2Out external interfaces.

Explanation:
In a Cisco ACI service graph, the Adjacency Type defines how traffic is forwarded between the service node and the next hop. When the client endpoint and the service node interface are in different subnets, Layer 3 routing is required between them. The Routed adjacency type enables the service node to route traffic between different subnets.

Correct Option:

A. Routed:
This adjacency type is used when the service node interface and the client endpoint (or the next hop) are in different subnets. The service node acts as a Layer 3 gateway, routing traffic between the subnets. This requires the service node to have interfaces in both subnets or to have a route to reach the remote subnet.

Incorrect Option:

B. Unicast:
This is not a valid adjacency type in ACI service graphs. The correct adjacency types are Routed and Bridged.

C. L3Out:
L3Out is a construct used for external Layer 3 connectivity, not an adjacency type within a service graph.

D. L3:
While "L3" is related to Layer 3, the actual adjacency type value in the APIC GUI is Routed, not "L3".

Reference:
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide — "Service Graph Adjacency Types": The adjacency type can be set to Routed or Bridged. Routed is used when the service node and the connected endpoint are in different subnets, requiring Layer 3 routing.

Explanation:
When exporting an ACI fabric configuration for disaster recovery purposes, the configuration backup must include all sensitive parameters, including passwords, secrets, and certificates. To include these encrypted parameters in the export, the administrator must enable AES encryption for the configuration export. Without AES encryption enabled, sensitive data such as passwords and keys are not included in the backup, and restoring the fabric would not fully recover the previous state.

Correct Option:

A. enabled AES encryption:
Enabling AES encryption during configuration export ensures that all configuration parameters, including sensitive information (passwords, secrets, certificates, and keys), are included in the backup file. This is required for a full disaster recovery restore where the fabric must be returned to its exact previous state.

Incorrect Option:

B. generated a tech-support file:
A tech-support file is used for troubleshooting and contains logs, show command outputs, and diagnostic data. It does not contain the full configuration and cannot be used to restore a fabric to a previous state.

C. encrypted export destination:
Encrypting the export destination (e.g., using HTTPS or SFTP) protects the backup file in transit, but it does not ensure that all configuration parameters (especially sensitive ones) are included in the export. The AES encryption setting is what controls whether sensitive data is included.

D. enabled JSON format export:
Exporting in JSON format is a file format choice. It does not control whether sensitive configuration parameters are included in the backup. The AES encryption option is what enables the inclusion of encrypted secrets.

Reference:
Cisco APIC Management, Monitoring, and Troubleshooting Guide — "Configuration Export and Import": To export all configuration parameters, including passwords and secrets, you must enable AES encryption during the export. Without this setting, sensitive data is not included in the backup file.

Explanation:
In a Cisco ACI Multi-Pod fabric, the Inter-Pod Network (IPN) connects spine switches across different pods. The IPN must meet specific requirements to support control-plane and data-plane communication between pods. Two key requirements are the use of a dedicated VLAN and a dynamic routing protocol.

Correct Option:

D. VLAN ID 4:
The IPN must carry the infrastructure VLAN, which is VLAN 4 by default. This VLAN is used for control-plane communication between spine switches in different pods, including COOP, IS-IS, and MP-BGP EVPN sessions. The IPN must be configured to transport VLAN 4 (or the configured infrastructure VLAN) between pods.

E. OSPF routing:
The IPN must support a dynamic routing protocol to exchange routes between pods. OSPF is a supported and commonly used routing protocol for the IPN in Multi-Pod deployments. It is used to establish reachability between the spine switches' TEP addresses across pods.

Incorrect Option:

A. EIGRP routing:
EIGRP is not a supported routing protocol for the IPN in ACI Multi-Pod. The supported protocols are OSPF and BGP (for specific scenarios), but not EIGRP.

B. PIM ASM multicast routing:
For Multi-Pod, the IPN must support PIM Bidirectional (Bidir) for BUM traffic replication, not PIM ASM (Any Source Multicast). PIM ASM is not the required multicast mode for Multi-Pod.

C. BGP routing:
While BGP can be used for the underlay in some Multi-Pod designs, OSPF is the more common and traditionally validated routing protocol for the IPN underlay. BGP is used for the overlay (MP-BGP EVPN) between spines, not typically for the IPN underlay in standard Multi-Pod deployments.

Reference:
Cisco ACI Multi-Pod Design Guide — "IPN Requirements": The IPN must carry VLAN 4 (infrastructure VLAN) and support a dynamic routing protocol such as OSPF for underlay reachability. PIM Bidir is required for BUM traffic.

Explanation:
When creating a subnet within a bridge domain in Cisco ACI, the scope option controls the network visibility of the subnet. It determines whether the subnet is advertised externally (public) or kept private within the fabric. The scope setting directly affects how the subnet is leaked or advertised to external networks via L3Out and how it is handled within the fabric.

Correct Option:

B. scope: The scope of a subnet defines its visibility. The available options are:

Private to VRF: The subnet is only visible within the VRF and is not advertised externally. It cannot be leaked to other VRFs or advertised through L3Out.

Advertised Externally: The subnet is advertised externally through L3Out connections, making it reachable from outside the fabric.

Shared between VRFs: The subnet can be shared with other VRFs through route leaking.

This option directly controls the network visibility of the subnet.

Incorrect Option:

A. limit IP learning to subnet:
This option, when enabled, restricts endpoint IP address learning to only those IPs that belong to the configured subnets of the bridge domain. It prevents the fabric from learning IP addresses outside the subnet range. It does not control the visibility of the subnet itself.

C. gateway IP:
The gateway IP is the default gateway address for the subnet, typically the anycast gateway address used by endpoints in that subnet. It does not control network visibility.

D. subnet control:
This option allows you to enable or disable specific control-plane behaviors for the subnet, such as No Default Gateway, Querier IP, or ND RA. It does not control the network visibility or advertisement scope of the subnet.

Reference:
Cisco APIC Basic Configuration Guide — "Subnet Scope": The scope of a subnet determines its visibility and advertisement behavior. Options include Private to VRF, Advertised Externally, and Shared between VRFs.

Explanation:
To allow SNMP traffic to reach the APIC controller, you must configure a contract under the mgmt tenant. The mgmt tenant contains the out-of-band management EPG and the management contract that defines which protocols (such as SNMP, HTTPS, SSH) are permitted to access the APIC and switches. The contract must include the SNMP service and be applied to the management EPG.

Correct Option:

B. contract under tenant mgmt:
The mgmt tenant provides the management contract that controls access to the APIC and fabric nodes for management protocols. To allow SNMP traffic, the SNMP service must be enabled in the management contract, and the contract must be applied to the out-of-band management EPG. This permits SNMP polling and traps to reach the APIC.

Incorrect Option:

A. out-of-band management interface:
While the out-of-band management interface provides the physical connectivity for management access, it does not by itself allow SNMP traffic. The contract under the mgmt tenant is required to permit SNMP.

C. SNMP relay policy:
There is no SNMP relay policy in ACI. SNMP traffic is either permitted or denied by the management contract.

D. out-of-band bridge domain:
The out-of-band bridge domain is part of the management connectivity but does not control which protocols are allowed. The contract under the mgmt tenant is the object that defines permitted management protocols.

Reference:
Cisco APIC Basic Configuration Guide — "Management Access": To enable SNMP access to the APIC, configure the SNMP service in the management contract under the mgmt tenant and apply it to the out-of-band management EPG.

Explanation:
When Cisco ACI connects to an external Layer 2 network, it acts as a full-duplex hub for spanning tree. STP Bridge Protocol Data Units (BPDUs) are flooded within the fabric encapsulation VLAN (also called the FD_VLAN or fabric_encap VNID) that is associated with the EPG path where the BPDUs were received. This prevents BPDUs from leaking into other Layer 2 domains and ensures they are contained within the correct EPG's flood domain.

Correct Option:

C. within the access encap VLAN:
BPDU flooding occurs within the VLAN ID (FD_VLAN) defined on the EPG path, and a VXLAN VNID (fabric_encap) is allocated for forwarding across leaf switches . When a leaf receives a BPDU, it floods it within that same encapsulation VLAN across the fabric, effectively scoping the BPDU to the EPG where it originated .

Incorrect Option:

A. within the bridge domain:
While a bridge domain can contain multiple EPGs, BPDUs are not flooded at the bridge domain level. They are scoped more narrowly to the encapsulation VLAN (EPG level) to prevent loops and unintended traffic between logically separated segments within the same BD .

B. within the APIC:
The APIC is the management and policy controller and does not participate in data-plane BPDU flooding. BPDU forwarding is handled entirely by the leaf switches .

D. between all the spine and leaf switches:
BPDUs are flooded to all leaf switches where the specific EPG/VLAN is deployed, but not to all spine and leaf switches in the fabric. The flooding is scoped to the fabric_encap VNID associated with that EPG, ensuring it only reaches the relevant leaf ports .

Reference:
Cisco APIC Layer 2 Networking Configuration Guide — "Transmission of Spanning Tree Protocol BPDU": "BPDU flooding occurs within the VLAN ID (FD_VLAN) defined on an EPG path, and VXLAN VNIDs are allocated for forwarding across leaf switches" .

Explanation:
When the Layer 2 Unknown Unicast policy is set to Hardware Proxy in a bridge domain, the leaf switch forwards unknown unicast frames to the spine proxy instead of flooding them. The spine performs an endpoint lookup in its COOP database and forwards the frame only to the leaf where the destination endpoint resides. If the endpoint is not found, the frame is dropped. A known limitation of this mode is that Topology Change Notification (TCN) is not supported.

Correct Option:

B. The Layer 2 unknown hardware proxy lacks support of the topology change notification:
This is accurate. Cisco documentation explicitly states that the Hardware Proxy mode does not support TCN (Topology Change Notification). When Hardware Proxy is enabled, the fabric does not generate or process TCN messages the same way as in Flood mode. This is a documented limitation of the Hardware Proxy feature.

Incorrect Option:

A. The leaf switch drops the Layer 2 unknown unicast packet if it is unable to find the MAC address in the local forwarding tables:
This is incorrect. The leaf switch does not drop the frame; it forwards it to the spine proxy for lookup. The spine drops the frame only if the endpoint is not found in the COOP database.

C. The leaf switch forwards the Layer 2 unknown unicast packets to all other leaf switches if it is unable to find the MAC address in its local forwarding tables:
This describes the Flood mode, not Hardware Proxy. In Hardware Proxy mode, the leaf forwards to the spine, not to all other leaf switches.

D. The spine switch drops the Layer 2 unknown unicast packet if it is unable to find the MAC address in the proxy database:
While the spine does drop the frame if the endpoint is not found, this is not the statement that best describes the configuration. The question asks about the configuration's true statement, and the documented limitation regarding TCN is the most specific and accurate answer.

Reference:
Cisco ACI Bridge Domain Configuration Guide — "L2 Unknown Unicast: Hardware Proxy": "The hardware proxy mode does not support Topology Change Notification (TCN)."

Map the leaf interface selector to the AEP that is associated with the VMM domain

Explanation:
When adding new ESXi hosts to an existing VMM domain, the physical leaf switch ports that connect to the new servers must be configured to allow the necessary VLANs and policies. This is done by associating the leaf interface selector with the Attachable Entity Profile (AEP) that is already associated with the VMM domain. The AEP contains the interface policies (such as LLDP, CDP, LACP, and VLAN pools) required for the VMM domain integration.

Correct Option:

D. Map the leaf interface selector to the AEP that is associated with the VMM domain:
By mapping the leaf interface selector (which defines the physical ports on the leaf switches) to the AEP associated with the VMM domain, the new ESXi host ports inherit the correct interface policies and VLAN configurations. This allows the APIC to dynamically deploy the VMM domain policies on those ports and enables the ESXi hosts to participate in the VMM domain.

Incorrect Option:

A. Create a range of internal VLANs in the associated VLAN pool:
The VLAN pool associated with the VMM domain already contains the necessary VLAN ranges for the virtualized workloads. Creating additional internal VLANs is not required for adding new ESXi hosts to an existing VMM domain.

B. Set the encapsulation mode as VXLAN:
VXLAN is the encapsulation used within the ACI fabric for overlay traffic. The VMM domain uses VLAN encapsulation for port groups on the VDS. Changing the encapsulation mode to VXLAN is not applicable for VMM domain integration.

C. Enable infrastructure VLAN in the associated AEP:
The infrastructure VLAN is used for fabric internal communication (such as APIC-to-switch communication and VXLAN tunneling). It is not related to adding ESXi hosts to a VMM domain. Enabling it on the AEP would not support the new servers.

Reference:
Cisco APIC Virtualization Guide — "Adding ESXi Hosts to an Existing VMM Domain": To add new ESXi hosts, the leaf interfaces connecting to the hosts must be associated with the AEP that is linked to the VMM domain. This ensures the correct VLANs and policies are applied to those ports.

“Limit IP learning to subnet” setting within the bridge domain

Explanation:
In Cisco ACI, the Limit IP Learning to Subnet setting is a bridge domain-level configuration. When enabled, it prevents the fabric from learning endpoint IP addresses that do not belong to any of the subnets configured on that specific bridge domain. This ensures that only IP addresses within the defined subnet scope are learned, preventing the endpoint table from being populated with IPs from remote networks that are not configured on the BD.

Correct Option:

D. "Limit IP learning to subnet" setting within the bridge domain:
This is the correct setting. It is configured on the bridge domain and restricts IP endpoint learning to only those IP addresses that fall within the subnets defined on the bridge domain. Any endpoint IP address outside of the configured subnets will not be learned.

Incorrect Option:

A. "Limit IP learning to network" setting within the bridge domain:
The correct setting name is "Limit IP Learning to Subnet," not "network." This option is a distractor with an incorrect setting name.

B. "Limit IP learning to subnet" setting within the EPG:
The setting is configured on the bridge domain, not the EPG. The EPG does not have this setting.

C. "Limit IP learning to network" setting within the EPG:
This option has both an incorrect setting name ("network" instead of "subnet") and an incorrect location (EPG instead of bridge domain).

Reference:
Cisco APIC Basic Configuration Guide — "Limit IP Learning to Subnet": This bridge domain setting restricts IP address learning to subnets configured on the bridge domain. When enabled, endpoints with IP addresses outside the configured subnets are not learned.