Verified 300-620 dumps Q&As 100% Pass in First Attempt Guaranteed Updated Dump from ActualCollection
Pass CCNP Data Center 300-620 Exam With 371 Questions
NEW QUESTION # 11
Refer to the exhibit.
Refer to the exhibit. An engineer must divert the traffic between VM-1 and VM-2 by using a Multi-Node service graph. The solution should prevent an insufficient number of available Layer 4 to Layer 7 devices in the first cluster. Which configuration set accomplishes this goal?
- A. PBR node tracking
tracking threshold with action deny
symmetric PBR
unidirectional PBR - B. PBR node tracking
tracking threshold with action permit
symmetric PBR
resilient hashing - C. PBR node tracking
tracking threshold with action bypass
symmetric PBR
resilient hashing - D. PBR node tracking
tracking threshold with action permit
unidirectional PBR
resilient hashing
Answer: C
Explanation:
To divert traffic between VM-1 and VM-2 using a Multi-Node service graph while preventing an insufficient number of available Layer 4 to Layer 7 devices in the first cluster, the following configuration set should be used:
PBR node tracking: This feature monitors the health of the nodes (Layer 4 to Layer 7 devices) in the service graph. If a node becomes unavailable, the system can take action based on the tracking threshold1.
Tracking threshold with action bypass: When the number of healthy nodes falls below the tracking threshold, the action 'bypass' ensures that traffic is not sent to the unhealthy nodes, thus preventing service disruption1.
Symmetric PBR: This ensures that return traffic follows the same path as the original traffic, maintaining session consistency and avoiding asymmetric routing issues1.
Resilient hashing: This hashing mechanism provides a consistent and optimal distribution of traffic across the available Layer 4 to Layer 7 devices, even when the number of nodes changes due to a failure or maintenance1.
Reference:
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 5.2(x)
NEW QUESTION # 12
Which components must be configured for the BGP Route Reflector policy to take effect?
- A. access policies and profiles
- B. spine fabric interface overrides and profiles
- C. pod policy groups and profiles
- D. leaf fabric interface overrides and profiles
Answer: C
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/L3-configuration/Cisco- APIC-Layer-3-Networking-Configuration-Guide-401/Cisco-APIC-Layer-3-Networking-Configuration-Guide- 401_chapter_01.html
NEW QUESTION # 13
Refer to the exhibit.
Refer to the exhibit. Server A is connected to the Cisco ACI fabric using two teamed interfaces. One interface in a team is configured as active and the other remains in standby mode. When a failover occurs and the standby interface becomes active, it uses its built-in MAC address to send traffic. Which bridge domain configuration must be applied to resolve the issue?
- A. Activate Limit IP Learning to Subnet.
- B. Enable ARP flooding.
- C. Set L2 Unknown Unicast to Flood.
- D. Configure Hardware proxy.
Answer: B
Explanation:
In the scenario where Server A is connected to the Cisco ACI fabric using teamed interfaces with one active and one standby, enabling ARP flooding in the bridge domain configuration is necessary to resolve the issue that occurs when the standby interface becomes active and uses its built-in MAC address to send traffic. Enabling ARP flooding allows the fabric to learn the new MAC address without waiting for the ARP timeout, which helps to ensure that traffic continues to flow to the correct destination after a failover event1.
Reference:
Discuss Cisco 300-620 Exam Topic 9 Question 71 | Pass4Success1
NEW QUESTION # 14
A RADIUS user resolves its role via the Cisco AV Pair. What object does the Cisco AV Pair resolve to?
- A. security domain
- B. tenant
- C. managed object class
- D. primary Cisco APIC
Answer: C
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/Security_config/ b_Cisco_APIC_Security_Configuration_Guide/b_Cisco_APIC_Security_Guide_chapter_01011.html
NEW QUESTION # 15
A Cisco ACI environment consists of multiple silent hosts that are often relocated between leaf switches. When the host is relocated, the bridge domain takes more than a few seconds to relearn the host's new location. The requirement is to minimize the relocation impact and make the ACI fabric relearn the new location of the host faster. Which action must be taken to meet these requirements?
- A. Set L2 Unknown Unicast to Hardware Proxy.
- B. Configure ARP Flooding to Enabled.
- C. Configure IP Data-Plane Learning to No.
- D. Set Unicast Routing to Enabled.
Answer: C
Explanation:
In a Cisco ACI environment with multiple silent hosts that are often relocated between leaf switches, configuring IP Data-Plane Learning to 'No' will minimize the relocation impact and make the ACI fabric relearn the new location of the host faster. Disabling IP Data-Plane Learning prevents the fabric from learning IP addresses from the data plane, which can speed up the process of relearning host locations when they move3.
NEW QUESTION # 16
An engineer configures port-12 on Leaf-101 and Leaf-102 to connect to a new server, SVR-12. The new server will belong to EPG-12 and use encap VLAN-1212. The engineer configured SVR-12 as a VPC member port and statically bound the VPC member port to EPG-12. Which additional step must the engineer take to configure connectivity?
- A. Create a VPC Explicit Protection Group for EPG-12 and VLAN-1212.
- B. Select VLAN-1212 on the EPG-12 Interface Policy Group.
- C. Associate a domain with EPG-12 that is associated with VLAN-1212.
- D. Configure an LACP Interface Policy and apply it to EPG-12.
Answer: C
Explanation:
The engineer configures port 1/2 on Leaf-101 and Leaf-102 to connect to a new server (SVR-12), which belongs to EPG-12 using VLAN-1212 encapsulation. The server is configured as a vPC member port and statically bound to EPG-12. The task is to ensure connectivity, indicating a missing configuration step.
Requirement Analysis
Static binding of a vPC member port to an EPG requires proper VLAN association and domain mapping.
vPC ensures redundancy, and the VLAN (1212) must be allocated and associated with the EPG via a domain (e.g., VMM or physical domain).
Option Evaluation
A . Create a VPC Explicit Protection Group for EPG-12 and VLAN-1212:
vPC Explicit Protection Groups are used for specific vPC configurations, but this is not a standard requirement for EPG binding and VLAN association.
Reference:
B . Associate a domain with EPG-12 that is associated with VLAN-1212:
Associating a domain (e.g., VMM or physical domain) with EPG-12 and mapping VLAN-1212 ensures the VLAN is allocated and recognized by the fabric for the vPC ports. This is a critical step for static binding to work.
C . Select VLAN-1212 on the EPG-12 Interface Policy Group:
The Interface Policy Group defines port settings, but VLAN selection is managed via the domain association, not the policy group alone. This is insufficient.
D . Configure an LACP Interface Policy and apply it to EPG-12:
LACP is optional for vPC and not required for static EPG binding. The issue is VLAN/domain association, not link aggregation.
Final Answer Justification
B is correct because associating a domain with EPG-12 and VLAN-1212 ensures the fabric recognizes the VLAN encapsulation and applies the EPG configuration to the vPC ports.
Primary Cisco Reference:
Cisco APIC vPC Deployment Guide.
Cisco ACI EPG and Domain Configuration Guide.
NEW QUESTION # 17
Refer to the exhibit.
An engineer must configure an L3Out peering with the backbone network. The L3Out must forward unicast and multicast traffic over the link. Which two methods should be used to configure L3Out to meet these requirements? (Choose two.)
- A. port channel with SVI
- B. Layer 3 floating SVI
- C. Layer 3 routed subinterface
- D. VPC with SVI
- E. Layer 3 routed port
Answer: C,E
Explanation:
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centricinfrastructure/ guide-c07-743150.html#_L3Out_sStatic_rRoutes
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/L3-configuration/Cisco-APIC-Layer-3-Networking-Configuration-Guide-401/Cisco-APIC-Layer-3-Networking-Configuration-Guide-401_chapter_010010.html
NEW QUESTION # 18
Refer to the exhibit. Server A is connected to the Cisco ACI fabric using two teamed interfaces.
One interface in a team is configured as active and the other remains in standby mode. When a failover occurs and the standby interface becomes active, it uses its built-in MAC address to send traffic. Which bridge domain configuration must be applied to resolve the issue?
- A. Activate Limit IP Learning to Subnet.
- B. Set L2 Unknown Unicast to Flood.
- C. Enable ARP flooding.
- D. Configure Hardware proxy.
Answer: D
NEW QUESTION # 19
A network administrator configures AAA inside the Cisco ACI fabric. The authentication goes through the local users if the TACACS+ server is not reachable. If the Cisco APIC is out of the cluster, the access must be granted through the fallback domain. Which configuration set meets these requirements?
- A. Ping Check: True
Default Authentication Realm: TACACS+
Fallback Check: False - B. Ping Check: False
Default Authentication Realm: Local
Fallback Check: False - C. Ping Check: True
Default Authentication Realm: Local
Fallback Check: True - D. Ping Check: False
Default Authentication Realm: TACACS+
Fallback Check: True
Answer: D
Explanation:
For AAA configuration within the Cisco ACI fabric, where authentication should fall back to local users if the TACACS+ server is unreachable, and access must be granted through the fallback domain if the Cisco APIC is out of the cluster, the configuration set that meets these requirements is to have the Default Authentication Realm set to TACACS+ with Fallback Check enabled. This ensures that when the TACACS+ server cannot be reached, the system will fall back to using local authentication
NEW QUESTION # 20
Refer to the exhibit.
An engineer is implementing Cisco ACI - VMware vCenter integration for a blade server that lacks support of bonding. Which port channel mode results in "route based on originating virtual port" on the VMware VDS?
- A. LACP Passive
- B. MAC Pinning-Physical-NIC-load
- C. MAC Pinning+
- D. LACP Active
- E. Static Channel - Mode On
Answer: B
Explanation:
For a blade server that lacks support of bonding, the port channel mode that results in "route based on originating virtual port" on the VMware VDS is MAC Pinning-Physical-NIC-load (Option B). This mode ensures that the virtual machine traffic is distributed across the available uplinks based on the MAC address of the originating virtual port1.
https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/virtualization/cisco-aci-virtualization-guide-60x/ACI-Virtualization-Guide-60x-aci-with-vmware-vds.pdf
NEW QUESTION # 21
An ACI administrator notices a change in the behavior of the fabric. Which action must be taken to determine if a human intervention introduced the change?
- A. Inspect audit logs in the APIC UI to see all user events.
- B. Inspect /var/log/audit_messages on the APIC to see a record of all user actions.
- C. Inspect the output of show command history in the APIC CLI.
- D. Inspect event records in the APIC UI to see all actions performed by users.
Answer: D
Explanation:
Section: ACI Fabric Infrastructure
NEW QUESTION # 22
Refer to the exhibit. An engineer must configure a bridge domain inside the Cisco ACI fabric called BD. The configuration must permit EP2 and EP3 to reach EP1. Which configuration must be applied on the bridge domain to accomplish this goal?
- A. Define the Pervasive gateway on BD.
- B. Configure unicast routing within BD.
- C. Enable L2 Unknown unicast flooding.
- D. Optimize L2 Unknown unicast traffic.
Answer: C
Explanation:
While enabling L2 Unknown Unicast flooding ensures that traffic is flooded to all ports when the destination MAC address is unknown, this does not directly achieve unicast routing between EPs.
Unicast routing is more efficient for known unicast traffic.
NEW QUESTION # 23
Drag and drop the Cisco ACI filter entry options from the left onto the correct categories on the right indicating what are required or optional parameters.
Answer:
Explanation:
NEW QUESTION # 24
An engineer wants to monitor all configuration changes, threshold crossing, and link-state transitions in a Cisco ACI fabric. Which action must be taken to receive the required messages?
- A. Add Session Logs and Audit Logs to the monitor policy.
- B. Include Events and Session Logs in the Syslog source policy.
- C. Include Audit Logs and Events in the Syslog source policy.
- D. Add Faults and Events to the monitor policy.
Answer: C
NEW QUESTION # 25
An engineer is implementing a connection that represents an external bridged network. Which two configurations are used? (Choose two.)
- A. Layers 2 internal
- B. Static path binding
- C. Layer 2 outside
- D. Layer 2 remote fabric
- E. VXLAN outside
Answer: B,C
Explanation:
When implementing a connection that represents an external bridged network, the configurations used are Layer 2 outside (Option B) and Static path binding (Option D)12. Layer 2 outside is typically used to connect a bridged external network trunk switch to a leaf switch in the ACI fabric, while static path binding is used to assign specific ports on a leaf switch to an external bridged network12.
NEW QUESTION # 26
An ACI administrator notices a change in the behavior of the fabric. Which action must be taken to determine if a human intervention introduced the change?
- A. Inspect event records in the APIC UI to see all actions performed by users.
- B. Inspect /var/log/audit_messages on the APIC to see a record of all user actions.
- C. Inspect audit logs in the APIC UI to see all user events.
- D. Inspect the output of show command history in the APIC CLI.
Answer: C
NEW QUESTION # 27
An engineer must limit management access to me Cisco ACI fabric that originates from a single subnet where the NOC operates. Access should be limited to SSH and HTTPS only. Where should the policy be configured on the Cisco APIC to meet the requirements?
- A. ACL on the management interface of the APIC
- B. policy on the management VLAN
- C. ACL on the console interface
- D. policy In the management tenant
Answer: D
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/b_Cisco_Oper
NEW QUESTION # 28
A bridge domain for a new endpoint group in the Cisco ACI fabric must meet these requirements:
The bridge domain must function as the default gateway for the subnet so that routing remains within the Cisco ACI fabric.
ARP requests must be managed via Layer 3 unicast packets or be dropped to reduce excessive broadcast traffic.
The impact of misconfigured virtual machines must be kept to a minimum by preventing IP addresses outside of the configured subnet from being routed.
Which set of actions must be taken?
- A. Enable Limit IP Learning to Subnet.
Enable Unicast Routing on the bridge domain and configure a subnet.
Set Multi-Destination Flooding to Flood in BD. - B. Set Endpoint Retention Policy to default.
Enable ARP Flooding.
Enable Unicast Routing on the bridge domain and configure a subnet. - C. Disable ARP Flooding.
Enable Limit IP Learning to Subnet.
Enable Unicast Routing on the bridge domain and configure a subnet. - D. Enable Unicast Routing on the bridge domain and configure a subnet.
Set L2 Unknown Unicast to Flood.
Disable Endpoint Retention Policy.
Answer: C
Explanation:
ARP requests must be managed via Layer 3 unicast packets or be dropped to reduce excessive broadcast traffic.
Since there is no option for hardware proxy, disabling ARP is the only option to choose.
NEW QUESTION # 29
An engineer plans to integrate a Cisco ACI fabric with VMware vCenter DVS. Which set of actions must the engineer take to ensure a successful integration?
- A. Set a vCenter controller named ACI-VMware-Integration and select Read Only Access mode.
- B. Set a vCenter controller named ACI-VMware-Integration and select Read Write Access mode.
- C. Set a virtual switch named ACI-VMware-Integration and select Read Write Access mode.
- D. Set a virtual switch named ACI-VMware-Integration and select Read Only Access mode.
Answer: B
NEW QUESTION # 30
......
Ultimate Guide to Prepare Free 300-620 Exam Questions and Answer: https://drive.google.com/open?id=1aZ7_rs7Y-kqZXAtqDAfL2ZmOyfwCCx1u
Pass 300-620 Tests Engine pdf - All Free Dumps: https://www.actualcollection.com/300-620-exam-questions.html