2026 Updated Verified Pass 300-620 Study Guides & Best Courses
Ultimate Guide to the 300-620 - Latest Edition Available Now
Cisco 300-620 exam is designed to test the knowledge and skills of IT professionals in implementing Cisco Application Centric Infrastructure (ACI). 300-620 exam is a part of the Cisco Certified Specialist - ACI Implementation certification track, and it assesses the candidates' abilities to deploy, manage, and troubleshoot ACI environments.
NEW QUESTION # 32
Refer to the exhibit.
Refer to the exhibit. A Cisco ACI environment hosts two e-commerce applications. The default contract from a common tenant between different application tiers is used, and the applications work as expected. The customer wants to move to more specific contracts to prevent unwanted traffic between EPGs. A network administrator creates the app-to-db contract to meet this objective for the application and database tiers. The application EPGs must communicate only with their respective database EPGs. How should this contract be configured to meet this requirement?
- A. Set the app-to-db scope to Application Profile.
- B. Set the app-to-db scope to Global.
- C. Implement the app-to-db scope as VRF.
- D. Implement the app-to-db as a Taboo contract.
Answer: A
Explanation:
To ensure that application EPGs communicate only with their respective database EPGs, the app-to-db contract should be configured with a scope set to the Application Profile. This scope ensures that the contract is applied only within the specific application profile, allowing for granular control over the communication between the application and database tiers. By setting the scope to Application Profile, the contract will not apply to other application profiles, thus preventing unwanted traffic between EPGs of different applications1.
Reference:
Cisco ACI Contract Guide White Paper1
NEW QUESTION # 33
When does the Cisco ACI leaf learn a source IP or MAC as a remote endpoint?
- A. When VXLAN traffic arrives on a leaf fabric port from the spine and inner source IP is in the Layer 3 Out EPG subnet range.
- B. When VXLAN traffic arrives on a leaf fabric port from the spine and inner source IP is in the bridge domain subnets range.
- C. When VXLAN traffic arrives on a leaf fabric port from the spine and outer source IP is in the bridge domain subnets range.
- D. When VXLAN traffic arrives on a leaf fabric port from the spine and outer source IP is in the Layer 3 Out EPG subnet range.
Answer: B
Explanation:
In Cisco ACI, a leaf switch learns a source IP or MAC as a remote endpoint when VXLAN traffic arrives on a leaf fabric port from the spine, and the inner source IP is within the range of the bridge domain subnets associated with the leaf. This process is part of the ACI's COOP (Council Of Oracles Protocol), which ensures that endpoint information is accurately disseminated across the fabric for efficient traffic forwarding.
NEW QUESTION # 34
Refer to the exhibit. An engineer is deploying a Cisco ACI fabric with an L2Out to external switches. The Cisco ACI fabric has just been deployed and follows the default forwarding behavior. Which two actions accomplish a loop free topology? (Choose two.)
- A. Implement LLDP on ports Eth1/1 and Eth1/2 on Leaf2.
- B. Configure BPDU guard on Catalyst switch ports.
- C. Enable MCP on the ports between the leafs and spine switches.
- D. Add ports Eth1/1 and Eth1/2 to the LACP port channel.
- E. Disconnect the link between Leaf3 and Leaf4.
Answer: D,E
NEW QUESTION # 35
What is the function of an HTTP GET request during Cisco ACI fabric discovery?
- A. It assigns VTEP IPs to leaf switches.
- B. It downloads firmware image on leaf switches.
- C. It allows neighbor discovery of leaf switches.
- D. It pushes policy elements from Cisco APIC to leaf switches.
Answer: C
Explanation:
During the Cisco ACI fabric discovery process, an HTTP GET request is used by the APIC to communicate with connected leaf switches. This request facilitates the discovery of neighbors by retrieving information about connected devices. The discovery process identifies the topology and relationships between fabric components (spines, leaves, and APICs), which is essential for building the ACI fabric infrastructure.
NEW QUESTION # 36
Drag and drop the Cisco ACI filter entry options from the left onto the correct categories on the right indicating what are required or optional parameters.
Answer:
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/ b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_01000.html
NEW QUESTION # 37 
Refer to the exhibit. Which two objects are created as a result of the configuration? (Choose two.)
- A. application profile
- B. bridge domain
- C. endpoint group
- D. VRF
- E. attachable AEP
Answer: B,D
Explanation:
Section: ACI Packet Forwarding
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/rest_cfg/2_1_x/ b_Cisco_APIC_REST_API_Configuration_Guide/ b_Cisco_APIC_REST_API_Configuration_Guide_chapter_01110.html
NEW QUESTION # 38
A network engineer is configuring syslogs in the Cisco ACI environment with these requirements:
- All message severities must be logged except for debugging messages.
- Messages must be compliant with RFC 5424 format.
- Logs must be saved only in a file on the APIC.
Which settings must be used in the Syslog Monitoring Destination Group to meet these requirements?
- A. Format: NX-OS
Local File Destination Admin State: Disabled
Severity: Alerts
Console Destination Admin State: Enabled - B. Format: ACI
Local File Destination Admin State: Enabled
Severity: Notifications
Console Destination Admin State: Disabled - C. Format: ACI
Local File Destination Admin State: Enabled
Severity: Information
Console Destination Admin State: Disabled - D. Format: NX-OS
Local File Destination Admin State: Disabled
Severity: Emergencies
Console Destination Admin State: Enabled
Answer: C
Explanation:
Format: ACI: The ACI format supports RFC 5424 compliance, making it suitable for this requirement.
Local File Destination Admin State: Enabled: To ensure that logs are saved only to a file on the APIC, the local file destination must be enabled.
Severity: Information: The "Information" level includes all message severities except for debugging messages, aligning with the requirement to log all except debugging.
Console Destination Admin State: Disabled: Since the requirement is to save logs only to a file on the APIC, the console logging must be disabled.
NEW QUESTION # 39
A network engineer must backup the PRODUCTION tenant. The configuration backup should be stored on the APIC using a markup language and contain all secure information. Which export policy must be used to meet these requirement?
A)
B)
C)
D)
- A. Option A
- B. Option B
- C. Option D
- D. Option D
Answer: D
NEW QUESTION # 40
An engineer is extending EPG connectivity to an external network. The external network houses the Layer 3 gateway and other end hosts. Which ACI bridge domain configuration should be used?
- A. Forwarding: Custom
L2 Unknown Unicast: Hardware Proxy L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enabled - B. Forwarding: Custom
L2 Unknown Unicast: Hardware Proxy L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Disabled - C. Forwarding: Custom
L2 Unknown Unicast: Flood
L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Disabled - D. Forwarding: Custom
L2 Unknown Unicast: Flood
L3 Unknown Multicast Flooding: Flood Multi Destination Flooding: Flood in BD ARP Flooding: Enabled
Answer: C
NEW QUESTION # 41
An engineer must configure SNMP inside a Cisco ACI fabric. The engineer has created an SNMP Policy, called SNMP-policy and an SNMP Monitoring Group called SNMP-group1 that contains five trap receivers. Which configuration set completes the configuration?
- A. Create an OOB management contract.
Include the SNMP server in the OOB management EPG. - B. Allow all OOB management traffic.
Configure three trap receivers on SNMP-group1. - C. Edit oobbrc to permit traffic using UDP port 16.
Associate the client group policy to SNMP-group1. - D. Permit OOB management traffic using UDP port 161.
Associate client group policy with the OOB management EPG.
Answer: D
NEW QUESTION # 42
An engineer must configure an export policy that regularly backs up Cisco APIC configuration to a remote location. The backup must be sent by using a secure and encrypted protocol. Which configuration set must be used?
- A. Configure the export policy with the required export destination.
Set the export destination as SSH.
Set the scheduler settings to recurring. - B. Configure the export policy with the required export destination.
Set the export destination as SCP.
Set the scheduler settings to recurring. - C. Configure the export policy with the required export destination.
Set the export destination as AES.
Configure the scheduler with a maximum number of nodes. - D. Configure the export policy with the required export destination.
Set the export destination as TLS.
Configure the scheduler with a maximum number of nodes.
Answer: B
Explanation:
To back up Cisco APIC configuration securely and regularly:
1. Export Destination as SCP (Secure Copy Protocol): SCP is a secure and encrypted protocol that ensures configuration backups are securely transmitted to the remote location.
2. Set Scheduler Settings to Recurring: This ensures the backups occur at regular intervals without manual intervention.
3. Export Policy Configuration: The export policy defines the backup parameters, including the destination server and credentials.
NEW QUESTION # 43
What is the maximum number of sites connected using spine back-to-back with a direct link in a Cisco ACI Multi-Site fabric?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION # 44
Refer to the exhibit. An engineer is implementing a BPDU filter on external switch interfaces that face the Cisco ACI fabric to prevent excessive TCNs from impacting the fabric. Which configuration must be applied on Cisco ACI to avoid a Layer 2 loop?
- A. Apply an MSTP instance on Cisco ACI.
- B. Configure MCP globally.
- C. Implement BPDU Guard.
- D. Enable STP on downlinks.
Answer: B
Explanation:
https://www.linkedin.com/pulse/cisco-aci-network-behaviour-stptcn-how-identify-loop-ankit- kulshresta
NEW QUESTION # 45
As part of a migration, legacy non-ACI switches must be connected to the Cisco ACI fabric. All non-ACI switches run per-VLAN RSTP. After the non-ACI switches are connected to Cisco ACI, the STP convergence caused a microloop and significant CPU spike on all switches. Which configuration on the interfaces of the external switches that face the Cisco ACI fabric resolves the problem?
- A. aggressive STP timers
- B. BPDU filtering
- C. BPDU guard
- D. STP type link shared
Answer: D
NEW QUESTION # 46
A network engineer must integrate VMware vCenter cluster with Cisco ACI. The requirement is for the management traffic of the hypervisors and VM controllers to use the virtual switch associated with the Cisco Application Policy. The EPG called "Vmware-MGMT" with VLAN 300 has been created for this purpose. Which set of steps must be taken to complete the configuration?
- A. Enable Infrastructure VLAN on AAEP used toward VMware hypervisors.
Associate the target EPG with the VMM domain with default settings. - B. Associate the target EPG with the VMM domain with default settings.
Enable Infrastructure VLAN on AAEP used toward VMware hypervisors. - C. Add VLAN 300 with static allocation to the VLAN POOL that is used for VMM integration.
Attach the VMM domain to the target EPG with resolution preprovision, mode static, untagged access VLAN, and Port-Encap 300. - D. Enable Infrastructure VLAN on AAEP used toward VMware hypervisors.
Create a static binding in the target EPG toward VMware hypervisors with VLAN 300, untagged access VLAN, and Untagged 802.1P mode.
Answer: C
NEW QUESTION # 47
Which statement regarding ACI Multi-Pod and TEP pool is true?
- A. The Pod1 TEP pool must be split and a portion of the TEP pool allocated to each Pod.
- B. The IP addresses used in the IPN network can overlap TEP pool of the APIC.
- C. The same TEP pool is used in all Pods.
- D. A different TEP pool must be assigned to each Pod.
Answer: D
Explanation:
Reference:
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric- infrastructure/white-paper-c11-739714.html
NEW QUESTION # 48
A Cisco ACI bridge domain and VRF are configured with a default data-plane learning configuration. Which two endpoint attributes are programmed in the leaf switch when receiving traffic? (Choose two.)
- A. Local IP, not MAC
- B. Remote IP
- C. Local Subnet
- D. Local MAC, IP
- E. Remote Subnet
- F. Remote MAC. IP
Answer: D,F
NEW QUESTION # 49
What is the advantage of implementing an active-active firewall cluster that is stretched across separate pods when anycast services are configured?
- A. The local pod anycast node is preferred by the local spines.
- B. A different MAC/IP configuration combination is configurable for the firewall in each pod.
- C. A cluster is capable to be deployed in transparent mode across pods.
- D. Local traffic in a pod is load-balanced between the clustered firewalls.
Answer: D
Explanation:
The advantage of implementing an active-active firewall cluster that is stretched across separate pods when anycast services are configured is that local traffic within a pod is load-balanced between the clustered firewalls. This means that traffic destined for the anycast IP address of the service node (firewall) will preferentially be directed to the local node within the same pod, thus optimizing traffic flows and reducing latency by avoiding unnecessary traffic tromboning to a remote pod1.
NEW QUESTION # 50
A Cisco ACI is integrated with a VMware vSphere environment. The port groups must be created automatically in vSphere and propagated to hypervisors when created in the ACI environment. Which action accomplishes this goal?
- A. Assign the uplinks of the ESXi hosts to the vDS that the APIC created.
- B. Associate the VMM domain with the EPGs that must be available in vCenter.
- C. Configure contracts for the EPGs that are required on the ESXi hosts.
- D. Create the port groups on the vCenter that reflect the EPG names in the APIC.
Answer: B
Explanation:
Associating the VMM domain with the EPGs (Endpoint Groups) that must be available in vCenter is the action that accomplishes the goal of creating port groups automatically in vSphere and propagating them to hypervisors when created in the ACI environment. This integration allows the APIC to automatically create port groups in the VMware vCenter under the VDS (vSphere Distributed Switch), which provisions the network policy in the VMware vCenter
NEW QUESTION # 51
An engineer must limit management access to me Cisco ACI fabric that originates from a single subnet where the NOC operates. Access should be limited to SSH and HTTPS only. Where should the policy be configured on the Cisco APIC to meet the requirements?
- A. policy In the management tenant
- B. ACL on the management interface of the APIC
- C. policy on the management VLAN
- D. ACL on the console interface
Answer: A
Explanation:
To limit management access to the Cisco ACI fabric that originates from a single subnet where the NOC operates, the policy should be configured in the management tenant on the Cisco APIC5.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_0111.html
NEW QUESTION # 52
Drag and drop the Cisco ACI filter entry options from the left onto the correct categories on the right indicating what are required or optional parameters.
Answer:
Explanation:
NEW QUESTION # 53
......
Target Audience and Required Skills
300-620 DCACI is a professional-level exam majorly designed for field engineers, network designers and engineers, data center engineers, storage administrators, technical solutions architects, and other personnel who wants to validate their competence in this field. No strict prerequisites are set by Cisco, so the candidates only need to master the topics mentioned in the official outline.
Thus, applicants should have an in-depth understanding of different network protocols, routing and switching, as well as have to be familiar with switching products offered by Cisco Ethernet. Awareness of the basics of virtualization and data center architecture is also recommended. There is a training course by Cisco, which is Understanding Cisco Data Center Foundations (DCFNDU), that may help to grasp all the important information.
Dumps MoneyBack Guarantee - 300-620 Dumps Approved Dumps: https://www.surepassexams.com/300-620-exam-bootcamp.html
2026 Updated Verified Pass 300-620 Exam - Real Questions and Answers: https://drive.google.com/open?id=1JBw6WMNtjv6epRWRs0gYlB8yNhrhdk4J