300-630 Sample Questions & Answers

False. A contract with 'Global' scope, when configured in a schema on the NDO, allows it to be exported to other tenants. This enables inter-tenant communication across the Multi-Site fabric, a key feature for shared service designs in a multi-site environment.

When using PBR with a redundant, non-clustered service device, ACI needs a mechanism to track the health of the destination and redirect traffic if a path fails. The 'PBR Tracking' for a service device feature allows the fabric to monitor the health of multiple PBR destinations (the firewall interfaces on each leaf). If one path fails its health check, ACI automatically redirects traffic to the other healthy destination, ensuring service availability. This is the correct mechanism for this specific high-availability scenario.

This is the most direct and correct way to implement the policy. A contract from App to Web allows the required communication. A second contract from DB to App allows that required communication. Because the VRF is in 'Enforced' mode, any communication not explicitly permitted by a contract is denied by default. Therefore, no communication is possible between Web and DB, and no additional 'deny' or 'taboo' contract is necessary.

Bidirectional Forwarding Detection (BFD) is the recommended mechanism for achieving fast failure detection and convergence in an IPN. BFD provides low-overhead, sub-second failure detection for the OSPF adjacencies between the ACI spine switches and the IPN devices. When a failure is detected by BFD, it immediately informs OSPF, which can then reconverge much faster than it would by waiting for its own hello/dead timers to expire.

BPDU Guard, when enabled on an ACI leaf port, will err-disable the port if it receives a BPDU. This is a strong protective measure to ensure that no external STP instance can influence the ACI fabric.

BPDU Filter, when enabled, prevents the ACI leaf port from both sending and receiving BPDUs. This effectively isolates the ACI fabric from the external STP domain without shutting down the port, making it a less disruptive option than BPDU Guard.

Rogue Endpoint Control is the ACI feature specifically designed to handle situations where an endpoint's IP address is learned from an unauthorized or unexpected location, such as a different bridge domain or EPG. When an endpoint's IP flaps rapidly between ports, Rogue EP Control can detect this behavior, flag the endpoint as rogue, and quarantine it to prevent it from causing further instability in the fabric.

This scenario requires a sophisticated form of route leaking often called 'transit routing with shared services.' It involves leaking routes from Tenant-A's VRF into the 'common' tenant's VRF, and from Tenant-B's VRF into the 'common' tenant's VRF. The firewall, connected via an L3Out (or service graph) in the 'common' tenant, then routes traffic between these leaked prefixes. This is effectively using the 'common' tenant as a transit VRF, which falls under the advanced topic of L3Out VRF route leaking.

A VRF (Virtual Routing and Forwarding) instance creates a unique Layer 3 forwarding domain. By placing each tenant's EPGs and bridge domains into a separate VRF, the IP subnets are isolated from each other. The 'Private to VRF' scope on the bridge domain subnet ensures that the subnet is only significant within its own VRF, allowing the same IP address range to be reused in other VRFs without conflict.

When a BD is stretched across sites using NDO, ACI automatically configures the subnet's gateway as an anycast gateway. This means the identical IP address and MAC address for the gateway are active on the border leaf switches in both sites simultaneously. This allows endpoints to use their local gateway for routing, optimizing north-south traffic and enabling seamless VM mobility without changing gateway configuration.

When service devices are centralized in one pod but serve traffic from multiple pods, maintaining traffic symmetry is crucial for stateful devices like firewalls. ACI's PBR feature can be used to redirect traffic to the service node. By enabling the 'Symmetric PBR' option within the service graph's PBR policy, ACI ensures that the return traffic is redirected back to the same service node that processed the initial flow, thus preserving symmetry even across pods.