Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the Cisco CCNP Data Center 300-620 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 300-620 Premium Access

View all detail and faqs for the 300-620 exam

Go to Exam

785 Students Passed

87% Average Score

95% Same Questions

Viewing page 2 out of 8 pages

Viewing questions 11-20 out of questions

Questions # 11:

Question # 11

Refer to the exhibit. The EPG-100 must be extended to the vCenter as a port group with a tagged VLAN ID of 100. Which set of actions accomplishes this goal?

Options:

Define a static VLAN range (from 100-200) under a VLAN pool that is associated with the dc1vcdev domain.

Associate the dc1vcdev domain with EPG and select these settings:

Untagged VLAN Access: unselected

VLAN Mode: Static with Encap: 100

Define a static VLAN range (from 100-200) under a VLAN pool that is associated with the dc1vcdev domain.

Associate the dc2vcdev domain with EPG and select these settings:

Untagged VLAN Access: selected

VLAN Mode: Static with Encap: 100

Define a dynamic VLAN range (from 100-200) under a VLAN pool that is associated with the del vdev domain.

Associate the dc1vcdev domain with EPG and select these settings:

Untagged VLAN Access: unselected

VLAN Mode: Static with Encap: 100

Define a dynamic VLAN range (from 100-200) under a VLAN pool that is associated with the dc1vdev domain.

Associate the dc2vcdev domain with EPG and select these settings:

Untagged VLAN Access: selected

VLAN Mode: Static with Encap: 100

Questions # 12:

An engineer created a monitoring policy called Test in a Cisco ACI fabric and had to change the severity level of the monitored object Call home source. Which set of actions prevent the event from appearing in event reports?

Options:

Select Event Severity Assignment Policies. Set severity level to cleared.

Select Faults Severity Assignment Policies. Set severity level to cleared.

Select Event Severity Assignment Policies. Set severity level to squelched.

Select Faults Severity Assignment Policies. Set severity level to squelched.

Questions # 13:

The Application team reports that a previously existing port group has disappeared from vCenter. An engineer confirms that the VM domain association for the EPG is no longer present. Which action determines which user is responsible for the change?

Options:

Check the EPG audit logs for the 'deletion' action and compare the affected object and user.

Evaluate the potential faults that are raised for that EPG.

Examine the health score and drill down to an object that affects the EPG combined score.

Inspect the server logs to see who was logging in to the APIC during the last few hours.

Questions # 14:

Which statement regarding ACI Multi-Pod and TEP pool is true?

Options:

The IP addresses used in the IPN network can overlap TEP pool of the APIC.

A different TEP pool must be assigned to each Pod.

The Pod1 TEP pool must be split and a portion of the TEP pool allocated to each Pod.

The same TEP pool is used in all Pods.

Questions # 15:

An engineer is implementing an out-of-band (OOB) management access for the Cisco ACI fabric. The secure access must meet these requirements:

• Only GUI and secure shell must be allowed to access the management interfaces of the ACIs.

• The only IP ranges that must be permitted to connect the fabric will be 10.10.10.0724 and 192.168.15.0/24.

Which configuration set meets these requirements?

Options:

Implement HTTPS and SSH protocol filters in the OOB contract. Add the required subnets to the external network instance profile.

Create an out-of-band EPG in the external management entity. Associate the management profile with the OOB contract.

Set up static IPs on the management interfaces from the required IP range. Add the required subnets to the external network instance profile.

Create an out-of-band EPG in the common tenant. Associate the external network instance profile with the OOB contract.

Answer

Explanation

The engineer is implementing out-of-band (OOB) management access for the Cisco ACI fabric with the following requirements:

Only GUI (HTTPS) and Secure Shell (SSH) must be allowed to access the management interfaces.

Only IP ranges 10.10.10.0/24 and 192.168.15.0/24 must be permitted to connect.

This requires configuring access control and restricting IP ranges for OOB management.

Requirement Analysis

OOB management in ACI is typically handled via the Management Tenant (mgmt) and an OOB contract to define allowed protocols and sources.

The external network instance profile defines the permitted IP ranges for external access.

Option Evaluation

A. Implement HTTPS and SSH protocol filters in the OOB contract. Add the required subnets to the external network instance profile:

An OOB contract can specify allowed protocols (HTTPS on port 443 and SSH on port 22) to restrict access to GUI and SSH only. Adding the subnets 10.10.10.0/24 and 192.168.15.0/24 to the external network instance profile limits the source IP ranges, meeting both requirements.

[: Cisco APIC Management Guide, "Out-of-Band Management Configuration" and "Contract Configuration.", B. Create an out-of-band EPG in the external management entity. Associate the management profile with the OOB contract: , This approach creates an EPG for OOB management, but it does not specify protocol filters (HTTPS/SSH) or IP range restrictions. The management profile alone does not enforce these requirements., Reference: Cisco ACI External Management Configuration Guide., C. Set up static IPs on the management interfaces from the required IP range. Add the required subnets to the external network instance profile: , Assigning static IPs to management interfaces is a configuration step, but it does not enforce protocol restrictions (HTTPS/SSH) or limit source IP ranges via a contract. This is incomplete., Reference: Cisco APIC Interface Configuration Guide., D. Create an out-of-band EPG in the common tenant. Associate the external network instance profile with the OOB contract: , The common tenant can host an OOB EPG, but this option lacks explicit protocol filtering (HTTPS/SSH) and relies on the external network instance profile, which may not fully address the GUI/SSH restriction., Reference: Cisco ACI Tenant Configuration Guide., Final Answer Justification, A is correct because it directly addresses both requirements: using an OOB contract to filter HTTPS and SSH protocols and adding the specified subnets to the external network instance profile to restrict IP ranges., Primary Cisco References: , Cisco APIC Management Tenant Configuration Guide, "OOB Management Access.", Cisco ACI Security Guide, "Contract-Based Access Control.", , ]

Questions # 16:

A network administrator configures AAA inside the Cisco ACI fabric. The authentication goes through the local users if the TACACS+ server is not reachable. If the Cisco APIC is out of the cluster, the access must be granted through the fallback domain. Which configuration set meets these requirements?

Options:

Ping Check: True

Default Authentication Realm: Local

Fallback Check: True

Ping Check: True

Default Authentication Realm: TACACS+

Fallback Check: False

Ping Check: False

Default Authentication Realm: Local

Fallback Check: False

Ping Check: False

Default Authentication Realm: TACACS+

Fallback Check: True

Questions # 17:

When Layer 3 routed traffic is destined to a Cisco ACI fabric, which mechanism does ACI use to detect silent hosts?

Options:

gratuitous ARP

inverse ARP

ARP gleaning

proxy ARP

Answer

Explanation

The question asks about the mechanism Cisco ACI uses to detect silent hosts when Layer 3 routed traffic is destined to the ACI fabric. A "silent host" refers to an endpoint that does not initiate traffic or send ARP requests, making detection challenging without specific mechanisms. Let’s evaluate the options based on Cisco ACI documentation and best practices.

Requirement Analysis

Layer 3 routed traffic implies that the ACI fabric is handling IP routing, and the detection mechanism must work within the context of the bridge domain and endpoint learning.

Silent hosts require passive detection methods since they do not generate active traffic (e.g., ARP requests).

The solution must align with ACI’s endpoint learning and proxy mechanisms.

Option Evaluation

A. Gratuitous ARP:

Gratuitous ARP (GARP) is a mechanism where a host announces its IP-to-MAC mapping to update network devices. However, this requires the host to send the GARP, which a silent host does not do. ACI can use GARP when hosts are active, but it is not the primary method for silent hosts.

[: Cisco ACI Endpoint Learning Guide, "Gratuitous ARP Handling.", B. Inverse ARP: , Inverse ARP is used in Frame Relay or ATM networks to map DLCI/VPI-VCI to IP addresses. It is not applicable to ACI’s IP-based Layer 3 routing or silent host detection., Reference: Not relevant to ACI documentation., C. ARP Gleaning: , ARP gleaning is a passive mechanism in ACI where the fabric learns the IP-to-MAC binding of a silent host by inspecting ARP traffic destined to or from other devices (e.g., routers or proxies) within the same bridge domain. When Layer 3 routed traffic passes through the ACI fabric, the leaf switches can glean the silent host’s information from ARP responses or related traffic, even if the host itself is silent., Reference: Cisco APIC Bridge Domain Configuration Guide, "ARP Gleaning for Silent Hosts" and Cisco ACI Endpoint Learning White Paper., D. Proxy ARP: , Proxy ARP is used by ACI to respond to ARP requests on behalf of silent hosts when the hardware proxy feature is enabled. While this helps with connectivity, it is a response mechanism, not a detection method. Detection still relies on gleaning or other passive learning., Reference: Cisco ACI Routing Configuration Guide, "Proxy ARP.", Final Answer Justification, C is correct because ARP gleaning is the specific mechanism ACI uses to detect silent hosts when Layer 3 routed traffic is involved. The fabric passively learns the host’s IP and MAC addresses from ARP traffic generated by other devices (e.g., routers or active hosts) within the bridge domain, which is particularly effective in routed environments., Primary Cisco References: , Cisco APIC Layer 3 Networking Configuration Guide, "Endpoint Learning with ARP Gleaning.", Cisco ACI Best Practices, "Silent Host Detection in Routed Networks.", , ]

Questions # 18:

Refer to the exhibit.

Question # 18

An engineer is implementing Cisco ACI – VMware vCenter integration for a blade server that lacks support of bonding. Which port channel mode results in “route based on originating virtual port” on the VMware VDS?

Options:

Static Channel – Mode On

MAC Pinning-Physical-NIC-load

LACP Passive

MAC Pinning+

LACP Active

Questions # 19:

An engineer must add a group of 70 bare-metal ESXi servers to the Cisco ACI fabric, which is integrated with vCenter. These configuration steps are complete:

The configured pool of ESXi hosts is configured with an Attachable Access Entity Profile (AAEP) called AEP_VMM.

The new group uses the AAEP called AEP_BAREMETAL.

Which action extends functional VMM integration to the new nodes?