Updated Aug 29, 2025 300-620 Exam Dumps - PDF Questions and Testing Engine
New (2025) Cisco 300-620 Exam Dumps
NEW QUESTION # 222
Which two components are essential parts of a Cisco ACI Virtual Machine Manager (VMM) domain policy configuration? (Choose two.)
- A. EPG static port binding
- B. VMM domain profile
- C. IP address pool association
- D. Layer 3 outside interface association
- E. EPG association
Answer: B,E
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/aci-fundamentals/b_ACI-Fundamenta
NEW QUESTION # 223
An engineer is configuring ACI VMM domain integration with Cisco UCS-B Series. Which type of port channel policy must be configured in the vSwitch policy?
- A. LACP Passive
- B. MAC Pinning-Physical-NIC-load
- C. LACP Active
- D. MAC Pinning
Answer: C
NEW QUESTION # 224
Which attribute should be configured for each user to enable RADIUS for external authentication in Cisco ACI?
- A. cisco-aci-role
- B. cisco-av-pair
- C. cisco-auth-features
- D. cisco-security domain
Answer: B
Explanation:
Section: ACI Management
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/Security_config/ b_Cisco_APIC_Security_Configuration_Guide/b_Cisco_APIC_Security_Guide_chapter_01011.html
NEW QUESTION # 225
An engineer configures a one-armed policy-based redirect service Insertion for an unmanaged firewall. The engineer configures these Cisco ACI objects:
a contract named All_Traffic_Allowed
a Layer 4 to Layer 7 device named FW-Device
a policy-based redirect policy named FW-1Arm-Policy-Based RedirectPolicy Which configuration set redirects the traffic to the firewall?
- A. Configure a firewall bridge domain.
Associate the bridge domain with FW-Device. - B. Configure a policy-based redirect subject.
Associate the policy-based redirect subject with All_Traffic_Allowed. - C. Configure a device interface policy.
Associate the device interface policy with FW-Device. - D. Configure a service graph.
Associate the service graph with All_Traffic_Allowed.
Answer: D
NEW QUESTION # 226
An application team tells the Cisco ACI network administrator that it wants to monitor the statistics of the unicast and BUM traffic that are seen in a certain EPG. Which statement describes the collection statistics?
- A. EPG statistics can be collected only for VMM domains. If a physical domain exists, statistics are not collected.
- B. All EPGs in the Cisco ACI tenant object must be enabled for statistics to be collected.
- C. Cisco ACI does not capture statistics at the EPG level. Only statistics that pass through ACI contracts can be monitored.
- D. The collection of statistics is enabled on the EPG level by enabling the statistics for unicast and BUM traffic.
Answer: D
Explanation:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_01011.html
NEW QUESTION # 227
How many ARP requests are sent from leaf switches to perform host tracking for local endpoints?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION # 228
Assuming that a service device you are integrating into the Cisco ACI is dedicated to one tenant, where should you configure the logical device and associated concrete devices?
- A. in the device's base hypervisor UI
- B. within the tenant context
- C. within the management tenant
- D. on the service device itself
Answer: B
NEW QUESTION # 229
When creating a subnet within a bridge domain, which configuration option is used to specify the network visibility of the subnet?
- A. scope
- B. limit IP learning to subnet
- C. subnet control
- D. gateway IP
Answer: B
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/ b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_0111.html
NEW QUESTION # 230
What do Pods use to allow Pod-to-Pod communication in a Cisco ACI Multi-Pod environment?
- A. over Layer 3 directly connected back-to-back spines
- B. over Layer 3 Out connectivity via border leafs
- C. over Layer 3 IPN connectivity via spines
- D. over Layer 3 IPN connectivity via border leafs
Answer: C
Explanation:
Section: ACI Anywhere
Explanation/Reference:
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/ white-paper-c11-737855.html
NEW QUESTION # 231
Cisco ACI fabric contains a tenant called Prod. User_1 must have write access to tenant Prod and full access to the fabric access policy. Which set of actions must be taken to meet these requirements?
- A. Associate User_1 to the security domain.
Associate the security domain to tenant Prod.
Create RBAC for the distinguished name of fabric access policy. - B. Associate User_1 to the distinguished name of the fabric access policy.
Associate the security domain to RBAC.
Create RBAC for the distinguished name of User__1. - C. Associate User_1 to tenant Prod.
Associate the security domain to the distinguished name of the fabric access policy.
Create RBAC for the distinguished name of security domain. - D. Associate User_1 to the fabric access policy.
Associate the security domain to the fabric access policy.
Create RBAC for the distinguished name of tenant Prod.
Answer: A
NEW QUESTION # 232
An engineer plans to integrate a Cisco ACI fabric with VMware vCenter DVS. Which set of actions must the engineer take to ensure a successful integration?
- A. Set a vCenter controller named ACI-VMware-Integration and select Read Only Access mode.
- B. Set a virtual switch named ACI-VMware-Integration and select Read Only Access mode.
- C. Set a virtual switch named ACI-VMware-Integration and select Read Write Access mode.
- D. Set a vCenter controller named ACI-VMware-Integration and select Read Write Access mode.
Answer: D
NEW QUESTION # 233
An engineer has set the VMM resolution immediacy to pre-provision in a Cisco ACI environment.
No Cisco Discovery Protocol neighborship has been formed between the hypervisors and the ACI fabric leaf nodes. How does this affect the download policies to the leaf switches?
- A. No policies are downloaded because there is no discovery protocol neighborship.
- B. No policies are downloaded because LLDP is the only supported discovery protocol.
- C. Policies are downloaded when the hypervisor host is connected to the VMM VDS.
- D. Policies are downloaded to the ACI leaf switch regardless of Cisco Discovery Protocol neighborship.
Answer: D
Explanation:
Pre-provision - Specifies that a policy (for example, VLAN, VXLAN binding, contracts, or filters) is downloaded to a leaf switch even before a VM controller is attached to the virtual switch (for example, VMware VDS). This pre-provisions the configuration on the switch.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/aci- fundamentals/b_ACI-Fundamentals/b_ACI-Fundamentals_chapter_01011.html
NEW QUESTION # 234
An engineer has set the VMM resolution immediacy to pre-provision in a Cisco ACI environment. No Cisco Discovery Protocol neighborship has been formed between the hypervisors and the ACI fabric leaf nodes. How does this affect the download policies to the leaf switches?
- A. No policies are downloaded because there is no discovery protocol neighborship.
- B. No policies are downloaded because LLDP is the only supported discovery protocol.
- C. Policies are downloaded when the hypervisor host is connected to the VMM VDS.
- D. Policies are downloaded to the ACI leaf switch regardless of Cisco Discovery Protocol neighborship.
Answer: D
Explanation:
When the VMM resolution immediacy is set to pre-provision in a Cisco ACI environment, policies are downloaded to the ACI leaf switch regardless of Cisco Discovery Protocol neighborship1. This setting ensures that the policies are in place on the leaf switches even before a VM controller is attached to the virtual switch1.
NEW QUESTION # 235
A Cisco ACI endpoint group must have its gateway address migrated out of the ACI fabric. An engineer configures EPG-TEST with a static port binding and configures the encap VLAN with the required VLAN. Which configuration set must be used on the bridge domain to meet these requirements?
- A. L2 Unknown Unicast: Hardware Proxy
Unicast Routing: Disabled
ARP Flooding: Disabled - B. L2 Unknown Unicast: Flood
Unicast Routing: Enabled
ARP Flooding: Enabled - C. L2 Unknown Unicast: Flood
Unicast Routing: Disabled
ARP Flooding: Enabled - D. L2 Unknown Unicast: Hardware Proxy
Unicast Routing: Disabled
ARP Flooding: Enabled
Answer: C
NEW QUESTION # 236
A network engineer configures the Cisco ACI fabric to connect to vCenter with these requirements:
Port groups must be automatically created on the distributed virtual switch.
Port groups must use the VLAN allocation in the range between 20-30.
The deployment must optimize the CAM space on the leaf switches.
Which set of actions meets these criteria?
- A. Create a dynamic VLAN pool with the VLAN range of 20-30.
Create a physical domain and associate it with the VLAN pool.
Create the EPG and associate the domain.
Set the deployment immediacy to On Demand. - B. Create a static VLAN pool with the VLAN range of 20-30.
Create a physical domain and associate it with the VLAN pool.
Create the EPG and associate the domain.
Set the deployment immediacy to Immediate. - C. Create a static VLAN pool with the VLAN range of 20-30.
Create a VMM domain and associate it with the VLAN pool.
Create the EPG and associate the domain.
Set the deployment immediacy to Immediate. - D. Create a dynamic VLAN pool with the VLAN range of 20-30.
Create a VMM domain and associate it with the VLAN pool.
Create the EPG and associate the domain.
Set the deployment immediacy to On Demand.
Answer: D
Explanation:
To meet the criteria for configuring the Cisco ACI fabric to connect to vCenter, the following actions should be taken:
Create a dynamic VLAN pool with the VLAN range of 20-30: This step involves creating a VLAN pool that dynamically assigns VLANs within the specified range to the port groups as they are created1.
Create a VMM domain and associate it with the VLAN pool: The VMM domain is a representation of the VMware vSphere Distributed Switch (VDS) in ACI, and associating it with the VLAN pool allows for the automatic creation of port groups on the VDS1.
Create the EPG and associate the domain: An Endpoint Group (EPG) is a logical entity to which workloads are attached. Associating the EPG with the VMM domain ensures that the port groups are automatically created in vCenter when the EPG is associated with a VMM domain1.
Set the deployment immediacy to On Demand: Setting the deployment immediacy to 'On Demand' optimizes the CAM space on the leaf switches by deploying policies to leaf nodes only when endpoints assigned to this EPG are connected, rather than immediately upon configuration12.
By following these steps, the network engineer can ensure that the Cisco ACI fabric is correctly configured to connect to vCenter, with port groups being automatically created on the distributed virtual switch, using the VLAN allocation in the range between 20-30, and optimizing the CAM space on the leaf switches.
NEW QUESTION # 237
Which class of ACI object is presented in this output?
- A. Endpoint
- B. Tenant
- C. Contract
- D. Bridge Domain
Answer: B
Explanation:
In Cisco ACI, the object classes are used to categorize different types of managed objects within the ACI model. The output presented is indicative of a Tenant class object. Tenants in ACI are a top-level container for application policies, essentially providing a unit of isolation from other tenants. Each tenant can contain its own application policies, services, and network policies, and they are separate from other tenants to ensure multi-tenancy1.
Reference:
Cisco ACI Policy Model Guide1
Object Renaming in Cisco ACI - Cisco2
Application Centric Infrastructure (ACI) REST API Guide - Cisco DevNet
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/openstack/ACI-Installation-Guide-for-Red-Hat-Using-OSP13-Director/m-configuring-ironic-for-openstack.html
NEW QUESTION # 238
Which endpoint learning operation is completed on the egress leaf switch when traffic is received from an L3Out?
- A. No source MAC or IP address of the traffic is learned as a remote endpoint.
- B. The source IP address of the traffic is learned as a remote endpoint.
- C. The source MAC address of the traffic is learned as a remote endpoint.
- D. The source MAC and IP address of the traffic is learned as a local endpoint.
Answer: C
Explanation:
Section: ACI Packet Forwarding
Explanation/Reference: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric- infrastructure/white-paper-c11-739989.html
NEW QUESTION # 239
Which statement about ACI syslog is true or Which statement describes the ACI syslog?
- A. All syslog messages are sent to the destination through APIC.
- B. Switches send syslog messages directly to the destinations.
- C. Syslog messages are sent to the destination through the spine.
- D. Notifications for different scopes of syslog objects can be sent only to one destination.
Answer: A
Explanation:
The correct statement about ACI syslog is that all syslog messages are sent to the destination through APIC1. This centralized approach allows for consistent logging and monitoring across the ACI fabric1.
NEW QUESTION # 240
In Cisco ACI, which three statements are true about endpoints and endpoint groups? (Choose three.)
- A. An EPG can only be configured statically by an administrator in the Cisco APIC.
- B. Policies are applied to individual endpoints rather than EPGs for better efficiency.
- C. EPGs contain endpoints that have common policy requirements such as security, virtual machine mobility, QoS, or Layer 4 to Layer 7 services.
- D. Endpoints have attributes and can only be virtual.
- E. An EPG can be statically configured by an administrator in the Cisco APIC, or dynamically configured by an automated system such as vCenter or OpenStack.
- F. Endpoints have an address (identity), a location, attributes (such as version or patch level), and can be physical or virtual.
Answer: C,E,F
NEW QUESTION # 241
Refer to the exhibit. The 0.0.0.0/0 is configured as a default static route on L3Out-1. Which action should be taken for the 0.0.0.0/0 prefix to advertise out on L3Out-2 OSPF?
- A. Enable Shared Security Import Subnet.
- B. Enable Shared Route Control Subnet.
- C. Enable Export Route Control Subnet.
- D. Enable Aggregate Export Subnet.
Answer: C
Explanation:
Aggregate Export
This option can be used only for 0.0.0.0/0 with "Export Route Control Subnet". When both "Export Route Control Subnet" and "Aggregate Export" are enabled for 0.0.0.0/0, ACI creates an IP prefix-list with "0.0.0.0/0 le 32", which matches any subnets. Thus, this option can be used when an L3Out needs to advertise (export) any routes to the outside.
NEW QUESTION # 242
Which Cisco ACI import mode reverts the entire shard to its original state when a single fault appears?
- A. Best-effort
- B. Merge
- C. Replace
- D. Atomic
Answer: D
Explanation:
The Atomic import mode enforces an all-or-nothing operation: if any object within the shard fails to import, the entire shard is rolled back to its previous state.
NEW QUESTION # 243
An engineer is implementing Cisco ACI at a large platform-as-a-service provider using APIC controllers,
9396PX leaf switches, and 9336PQ spine switches. The leaf switch ports are configured as IEEE 802.1p ports.
Where does the traffic exit from the EPG in IEEE 802.1p mode in this configuration?
- A. from leaf ports untagged
- B. from leaf ports tagged as VLAN 0
- C. from leaf ports tagged as VLAN 1
- D. from leaf ports tagged as VLAN 4094
Answer: B
Explanation:
Section: ACI Fabric Infrastructure
NEW QUESTION # 244
......
Updated Verified Pass 300-620 Exam - Real Questions and Answers: https://www.test4sure.com/300-620-pass4sure-vce.html
Best Way To Study For Cisco 300-620 Exam Brilliant 300-620 Exam Questions PDF: https://drive.google.com/open?id=1vBL5_DevAGzCHhuVfhxTO7cQxsByEtP0