Free Cisco 300-620 Practice Questions 2026 | Implementing Cisco Application Centric Infrastructure (300-620 DCACI)

\\\disable Limit IP Learning to Subnet

Explanation:
In an ACI Multi-Pod deployment, when the default gateway for a bridge domain resides outside the ACI fabric, the fabric should not act as the gateway. The Limit IP Learning to Subnet setting restricts the fabric to only learn endpoint IP addresses that match configured bridge domain subnets . Disabling this setting allows the fabric to learn endpoint IP addresses that fall outside the configured subnet, which is necessary when the gateway is external.

Correct Option:

A. disable Limit IP Learning to Subnet:
This is the correct configuration. When the default gateway is external, the fabric should learn IP addresses beyond the configured bridge domain subnets. Disabling this setting prevents the fabric from rejecting IP learning for addresses outside the configured subnet range .

Incorrect Option:

B. disable IP Data-plane Learning:
Disabling IP data-plane learning affects how endpoint IP information is updated through traffic forwarding. It does not specifically address the requirement for an external gateway scenario .

C. disable Unicast Routing:
Unicast Routing is the setting that makes the ACI fabric act as the default gateway for a bridge domain. Disabling it is appropriate when the gateway is external, but this setting alone does not control IP address learning scope .

D. disable Advertise Host Routes:
This setting controls whether host routes are advertised externally through L3Out. It is not related to the default gateway placement or IP learning scope.

Reference:
Cisco APIC Layer 2 Networking Configuration Guide — "Limit IP Learning to Subnet": When enabled, the fabric does not learn IP addresses from subnets other than those configured in the bridge domain. Disabling this setting allows the fabric to learn IP addresses outside the configured subnets, which is required when the default gateway is external .

The leaf switch drops the traffic that is destined to the endpoint.

Explanation:
When a Cisco ACI leaf switch has a stale endpoint entry in its local endpoint table, it believes the destination endpoint is reachable through a specific local port or remote leaf. However, if the endpoint has actually moved or is no longer present at that location, the traffic forwarded based on the stale entry will be sent to the wrong destination and ultimately dropped. The fabric does not automatically flood or redirect the traffic to correct the stale entry; it simply forwards based on the incorrect information, resulting in traffic loss.

Correct Option:

B. The leaf switch drops the traffic that is destined to the endpoint:
This is accurate. When the leaf switch forwards traffic based on a stale endpoint entry, the traffic is sent to the wrong location (either a local port where the endpoint no longer exists or a remote leaf that no longer hosts the endpoint). Since the endpoint is not actually there, the traffic is dropped. The stale entry must be aged out or corrected through control-plane updates (such as COOP) before traffic can be delivered correctly.

Incorrect Option:

A. The leaf switch does not learn the source endpoint through data plane learning:
Stale endpoint entries for the destination do not prevent the leaf from learning the source endpoint. Source endpoint learning is independent of destination endpoint state.

C. The leaf switch floods the traffic to the endpoint throughout the fabric:
ACI does not flood traffic when a stale endpoint entry exists. Flooding only occurs for unknown unicast traffic when the endpoint is not in the endpoint table at all, not when a stale entry is present.

D. The leaf switch sends the traffic to the wrong destination leaf:
While the traffic may be sent to the wrong leaf due to the stale entry, this is a consequence of the stale entry, not the final outcome. The traffic is ultimately dropped because the endpoint is not present at the destination leaf.

Reference:
Cisco ACI Fundamentals — "Endpoint Table and Stale Entries": When a stale endpoint entry exists, traffic is forwarded based on the outdated information and is dropped if the endpoint is no longer reachable at the recorded location. The entry is eventually aged out or corrected via COOP updates.

LLDP

Explanation:
In Cisco ACI VMM integration, the Link Layer Discovery Protocol (LLDP) is used between the ACI leaf switches and the compute hosts (hypervisors) to establish neighborship. This neighborship is essential for Immediate and On-Demand resolution immediacy modes. When a hypervisor is connected to the leaf switch, LLDP packets are exchanged, allowing the leaf to discover the hypervisor and trigger the APIC to push the VMM policies (such as VLANs and EPG configurations) to the leaf switch.

Correct Option:

B. LLDP:
LLDP is the protocol used for neighbor discovery between the ACI leaf and the compute host. For VMM domains with Immediate or On-Demand resolution immediacy, the leaf switch must form an LLDP neighborship with the hypervisor. Once the neighborship is established, the APIC downloads the VMM policies to the leaf switch. If LLDP neighborship is not formed, policies are not downloaded.

Incorrect Option:

A. VXLAN:
VXLAN is the data-plane encapsulation protocol used within the ACI fabric for overlay traffic. It is not used for policy resolution or neighbor discovery between the leaf and compute hosts.

C. ISIS:
IS-IS is the underlay routing protocol used within the ACI fabric for spine-leaf communication. It is not used between the leaf and compute hosts for VMM policy resolution.

Reference:
Cisco ACI Virtualization Guide — "VMM Resolution Immediacy": Immediate and On-Demand modes require an LLDP neighborship between the ACI leaf switch and the hypervisor host. The APIC pushes policies to the leaf only after the neighborship is established.

Option D

Explanation:
Cisco Nexus 2000 Series Fabric Extenders (FEX) in an ACI fabric must be connected to their parent leaf switch using a direct physical connection. The FEX cannot be connected to a spine switch, and the FEX must be dual-homed to the same leaf switch (or a pair of leaf switches in a vPC domain for redundancy). Option D shows the supported topology: each FEX is connected to a single leaf switch (Leaf 1 or Leaf 2), and the leaf switches are connected to the spines.

Correct Option:

D. Option D:
This topology shows FEX 101 connected to Leaf 1 and FEX 102 connected to Leaf 2. The leaf switches are connected to both spines. This is the correct and supported topology for Nexus 2000 Series FEX in ACI mode. Each FEX is homed to a leaf switch, and the leaf provides connectivity to the spine layer.

Incorrect Option:

A. Option A:
This topology shows the FEX devices connected to both leaf switches in a virtual port channel aggregation configuration. While this might appear redundant, ACI does not support FEX connected to multiple leaf switches in this manner. FEX must be homed to a single leaf switch (or a vPC pair of leaf switches, but not in this configuration).

B. Option B:
This topology shows the FEX devices connected directly to the spine switches. This is not supported. FEX devices must connect to leaf switches, not spine switches, in an ACI fabric.

C. Option C:
This topology shows a port channel aggregation connectivity between FEX and leaf switches, with connections that cross between the two leaves. This is not a supported FEX topology in ACI mode. FEX must be connected to a single leaf switch (or a vPC pair, but the connections must be properly configured).

Reference:
Cisco ACI and Nexus 2000 Series FEX Configuration Guide — "FEX Support in ACI": FEX devices connect to leaf switches, not spine switches. The supported topology is a FEX connected to a single leaf switch or a pair of leaf switches in a vPC domain. The FEX must be directly connected to the leaf; it cannot connect to the spine.

policy In the management tenant

Explanation:
In Cisco ACI, management access policies are configured within the mgmt tenant. The mgmt tenant contains the out-of-band management EPG and the management contract, which define the rules for accessing the APIC and fabric nodes. To limit access to a specific subnet and allow only SSH and HTTPS, you configure the appropriate filters and contracts in the mgmt tenant.

Correct Option:

A. policy In the management tenant:
The mgmt tenant is the correct location for configuring management access policies. You would create a contract with filters that permit only SSH (TCP 22) and HTTPS (TCP 443) from the NOC subnet, and apply this contract to the out-of-band management EPG. This restricts management access to the authorized subnet and protocols.

Incorrect Option:

B. policy on the management VLAN:
There is no policy configuration directly on the management VLAN. The management VLAN is part of the management connectivity configuration, but access control is enforced through contracts in the mgmt tenant.

C. ACL on the management interface of the APIC:
While ACLs can be applied to interfaces, the ACI-native way to control management access is through contracts in the mgmt tenant. Configuring an ACL directly on the APIC management interface is not the standard or recommended approach in ACI.

D. ACL on the console interface:
The console interface is used for direct physical console access to the APIC or switches. It is not used for network-based management access (SSH/HTTPS) and is not the correct place to configure management access policies.

Reference:
Cisco APIC Security Configuration Guide — "Management Tenant": The mgmt tenant contains the management EPG and contracts that control management access to the APIC and fabric nodes. Filters within the contract define which protocols and subnets are allowed.

iBGP

eBGP

Explanation:
Cisco ACI supports BGP for Layer 3 external connectivity (L3Out) to external networks. Both iBGP (Internal BGP) and eBGP (External BGP) are supported. OSPF and EIGRP are also supported, but the question specifically asks for the two dynamic routing protocols listed among the options that are supported for L3Out.

Correct Option:

A. iBGP:
Internal BGP is supported for L3Out peering with external routers that are in the same autonomous system (AS). This is a valid routing protocol for ACI L3Out connections.

E. eBGP:
External BGP is supported for L3Out peering with external routers in different autonomous systems. This is the most common routing protocol used for ACI L3Out connections to external networks.

Incorrect Option:

B. VXLAN:
VXLAN is the data-plane encapsulation protocol used within the ACI fabric for overlay traffic. It is not a dynamic routing protocol and is not used for L3Out peering.

C. IS-IS:
IS-IS is used as the underlay routing protocol within the ACI fabric for spine-leaf communication. It is not supported as an L3Out routing protocol for external connectivity.

D. RIPv2:
RIPv2 is an older distance-vector routing protocol. It is not supported for L3Out connections in Cisco ACI.

Reference:
Cisco APIC Layer 3 Networking Configuration Guide — "L3Out Routing Protocols": Cisco ACI supports BGP (eBGP and iBGP), OSPF, and EIGRP for L3Out connections. IS-IS is used for the fabric underlay, not for L3Out. RIPv2 is not supported.

Explanation:
The question states that the EPG containing the web servers requires an external Layer 3 cloud to initiate communication. In ACI contract terminology, the consumer is the entity that initiates communication, and the provider is the entity that receives it. Since the EPG needs to initiate communication to the external cloud, the EPG must be the consumer. The external Layer 3 cloud, represented by the L3Out, acts as the provider of the service that the EPG consumes.

Correct Option:

D. Configure the EPG as a consumer and L3 out as a provider of the contract:
This is correct. The EPG (web servers) initiates communication to the external Layer 3 cloud. The L3Out provides the service (or connectivity) that the EPG consumes. The contract is applied with the EPG as consumer and the L3Out as provider.

Incorrect Option:

A. Configure the EGP as a provider and L3 out as consumer of the contract:
This would mean the external cloud initiates communication to the EPG, which is the opposite of what the question describes. The question states the EPG requires the external cloud to initiate communication, meaning the EPG is the consumer.

B. Configure OSPF to exchange routes between the L3 out and EGP:
While OSPF may be needed for route exchange, it does not fulfill the contract requirement for TCP port 80 communication. The question is about contract direction, not routing protocol configuration.

C. Configure a taboo contract and apply it to the EPG:
A taboo contract is used to explicitly deny communication. This would prevent the required TCP port 80 communication, not enable it.

Reference:
Cisco APIC Basic Configuration Guide — "Contracts": A contract defines the communication rules between a provider and a consumer. The consumer initiates communication, and the provider receives it. When an EPG needs to initiate communication to an external network, the EPG is configured as the consumer and the L3Out as the provider.

Explanation
The VMM domain integration workflow in Cisco ACI follows a specific order:

Step 1 – APIC:
The dynamic VLAN pool is created first on the APIC. This pool provides the VLANs that will be used for the VMM domain's port groups and encapsulation.

Step 2 – APIC:
The VMware vCenter domain is created on the APIC. During this step, the APIC is configured with the vCenter credentials, the VLAN pool association, and the AEP association.

Step 3 – vCenter:
The vCenter/vShield controller is created on the vCenter side. This allows the APIC to communicate with vCenter and manage the virtual switching environment.

Step 4 – vCenter:
After the integration is complete, the administrator verifies in the vCenter user interface that the VMware vSphere Distributed Switch (vDS) has been created by the APIC. The APIC automatically creates the vDS and its port groups.

Correct Option

APIC:
Used for steps 1 and 2 (VLAN pool and VMM domain creation).

vCenter:
Used for steps 3 and 4 (controller creation and vDS verification).

UCS Manager:
Not used in this sequence. While UCS Manager may be involved in the physical server connectivity, the VMM domain integration workflow does not require configuration on UCS Manager.

Incorrect Option

UCS Manager:
While UCS Manager manages the UCS B-Series servers, it is not part of the VMM domain creation sequence. The VMM domain integration is performed on the APIC and vCenter, not on UCS Manager.

Reference
Cisco ACI Virtualization Guide — "Configuring VMM Domain Integration with VMware vCenter": The workflow begins with creating a VLAN pool on the APIC, then creating the VMM domain on the APIC, then creating the controller in vCenter, and finally verifying the vDS in vCenter.

Explanation:
In Cisco ACI, when external switches are connected to the fabric via an L2Out or EPG static path binding, the ACI fabric acts as a transparent bridge for STP BPDUs. The fabric does not run STP internally, but it floods BPDUs within the same encapsulation VLAN (the FD_VLAN associated with the EPG or L2Out). This means that BPDUs generated by one external switch are flooded to all other external switches that are members of the same Layer 2 domain, allowing them to participate in the spanning tree topology.

Correct Option:

B. STP BPDUs that are generated by Switch2 are received by Switch1 and Switch3:
This is correct. When Switch2 generates STP BPDUs, the ACI leaf switches receive them and flood them within the same encapsulation VLAN to all other ports that are members of the same Layer 2 domain. As a result, Switch1 and Switch3, which are connected to the same ACI fabric and part of the same Layer 2 domain, will receive the BPDUs from Switch2.

Incorrect Option:

A. Cisco ACI acts as the STP root for all three external switches:
This is incorrect. ACI does not participate in STP and does not act as the STP root. The external switches elect their own root based on the BPDUs they exchange through the fabric.

C. STP BPDUs that are generated by Switch1 are received only by Switch3:
This is incorrect. BPDUs generated by Switch1 would be flooded to all other external switches in the same Layer 2 domain, including Switch2, not just Switch3.

D. Cisco ACI fabric drops all STP BPDUs that are generated by the external switches:
This is incorrect. ACI does not drop STP BPDUs. It floods them within the encapsulation VLAN to allow external switches to maintain their spanning tree topology.

Reference:
Cisco ACI Layer 2 Networking Configuration Guide — "Spanning Tree Protocol BPDU Handling": The ACI fabric floods STP BPDUs within the encapsulation VLAN associated with the EPG or L2Out. This allows external switches to exchange BPDUs and participate in the spanning tree topology, while the fabric itself remains transparent to STP.

Explanation:
In the Cisco ACI fabric discovery process, the APIC first discovers the leaf switches that are directly connected to it. Once a leaf switch is discovered, the APIC then discovers the spine switches that are connected to that leaf. After the initial leaf (Leaf 1) is discovered, the next nodes to be discovered are the spine switches (Spine 1 and Spine 2) that are connected to Leaf 1. Once the spines are discovered, the remaining leaf switches are discovered through the spines.

Correct Option:

A. spine 1:
After Leaf 1 is discovered, the APIC discovers the spine switches connected to Leaf 1. Spine 1 is one of the two spines in the fabric and will be discovered next.

C. spine 2:
Similar to Spine 1, Spine 2 is also connected to Leaf 1 and will be discovered immediately after Leaf 1 is discovered.

Incorrect Option:

B. leaf 4:
Leaf 4 is not directly connected to Leaf 1. It will be discovered after the spine switches are discovered, as the discovery process cascades through the fabric topology.

D. leaf 3:
Leaf 3 is also not directly connected to Leaf 1. It will be discovered after the spines are discovered.

E. leaf 2:
Leaf 2 is another leaf switch that is not directly connected to Leaf 1. It will be discovered after the spine switches are discovered.

Reference:
Cisco APIC Getting Started Guide — "Fabric Discovery Process": The APIC discovers leaf switches first, starting with the leaf directly connected to the APIC. Once a leaf is discovered, the APIC discovers the spine switches connected to that leaf. The discovery then cascades to other leaf switches through the spines.