300-620 Sample Questions & Answers

For an L3Out to be fully functional and for routes to be exchanged, an External EPG (also known as an External Network Instance Profile) must be configured. This object is used to classify external networks and apply contracts. Without it, the L3Out is not complete, and routing protocol adjacencies may not form correctly or routes will not be exchanged.

Microsegmentation (uSeg) EPGs allow for the dynamic classification of endpoints based on their attributes. When integrated with a VMM domain like VMware vCenter, you can create rules based on various VM attributes, including 'VM Name', 'IP Address', 'OS', or custom attributes. This allows for automated policy assignment without manual intervention.

In the ACI object model, the Layer 2 forwarding construct (Bridge Domain) must be linked to the Layer 3 routing context (VRF). If the BD is not associated with a VRF, the fabric does not have a complete L2/L3 forwarding context, and endpoints will not be able to communicate, even within the same subnet, because essential functions like ARP are tied to this relationship.

The ACI firmware upgrade process involves two main components: a Firmware Group, which specifies the target firmware image, and a Maintenance Group, which contains the nodes to be upgraded and the schedule (or trigger) for the upgrade.

COOP is a zero-conf protocol used to communicate endpoint mapping information (IP/MAC/VRF to VTEP) to the spine switches. It ensures that all spines maintain a consistent copy of the mapping database, which is used for forwarding decisions. This allows any leaf to send traffic to a spine, which can then correctly forward it to the destination leaf.

In NDO (formerly MSO), the correct method to create stretched objects is to use a single schema that is associated with all relevant sites. Within this schema, you create a template that holds the configuration for the stretched tenant. By defining the VRF, BDs, and EPGs within this single template and marking the tenant as stretched, NDO ensures that the same configuration and policies are deployed consistently across both APIC sites, fulfilling the requirement for seamless mobility and consistent security.

The command show system internal epm endpoint ip on a leaf switch displays the endpoint manager (EPM) table entry for a specific IP address. This command will show if the endpoint is known, whether it is local or remote, the VTEP of the remote leaf it's attached to, and the encapsulation details. It is the most direct way to verify remote endpoint learning on a leaf.

The 'preferred group' is a mechanism to relax the contract requirement for certain EPGs. When an EPG (including an External EPG) is a member of the preferred group, it can communicate freely with any other EPG in the same VRF that is also a member of the preferred group, without an explicit contract. This is essentially a shortcut to an 'any-to-any' policy within the group.

In ACI's Role-Based Access Control (RBAC) model, a 'Role' defines the permissions (what a user can do, e.g., read or write), and a 'Security Domain' defines the scope (which objects a user can see, e.g., a specific tenant). To meet the requirement, you must create a new security domain that is explicitly tied to the target tenant and a role with read-only permissions. Assigning the user this role within this security domain grants them the exact access required.

VLAN Pools are configured under Fabric -> Access Policies. They define the ranges of VLAN IDs that can be used for port attachments.

The BGP Route Reflector policy, which defines the spine nodes that act as MP-BGP route reflectors for the fabric, is a fabric-wide setting configured under Fabric -> Fabric Policies.

AAEPs are a critical part of the access policy chain, linking domains (physical, VMM) to interface policies. They are configured under Fabric -> Access Policies.