Free 300-630 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

To redirect HTTP traffic between an EPG client and EPG server through a Cisco ASA firewall in a Cisco

ACI environment, a contract filter must be configured to allow both ARP and HTTP. ARP is essential

for IP to MAC address resolution, which is necessary for layer 2 communications within the same

subnet or across subnets when routing is involved. The HTTP filter ensures that only HTTP traffic is

redirected to the firewall for inspection or policy enforcement. Reference: Implementing Cisco

Application Centric Infrastructure Official Cert Guide

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/300-630/page_28_img_1.jpg

Before associating a schema with a newly configured site in Cisco ACI Multi-Site Orchestrator, it’s

essential to configure a provider. This establishes a communication link between the orchestrator

and the sites, enabling proper deployment and management of objects across multiple sites.

In a Cisco ACI Multi-Pod environment that is expanding, spine headend replication should be

configured to ensure efficient forwarding of BUM (Broadcast, Unknown unicast, Multicast) traffic

across the IPN (Inter-Pod Network). This configuration optimizes the control plane scaling and

ensures that BUM traffic is handled effectively, maintaining network performance and stability.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

The minimum MTU value that must be supported by the ISN to allow control plane endpoint

information exchange between sites in a Cisco ACI Multi-Site setup with default settings is 1554

bytes (B). This accounts for the standard MTU of 1500 bytes plus additional overhead for VXLAN

encapsulation. An MTU of 9000 (A) or 9100 © is not the minimum required, and 1600 (D) is not

related to the default fabric settings5. Reference := (Multi-site / Multi-Pod MTU Jumbo Frames5)

To address loops detected from endpoints in a Cisco ACI fabric, the engineer should enable the

rogue endpoint feature and set the Error Disabled Recovery Policy. This will allow the system to

detect rogue endpoints causing loops and automatically recover the port if it was disabled due to the

loop detection2.

Reference := ( Implementing Cisco Application Centric Infrastructure Official Cert Guide )

The best practices for configuring NIC teaming load balancing for Cisco UCS B-Series blades

connected to Cisco ACI leaf switches involve enabling LACP (Link Aggregation Control Protocol) in

active mode and enabling MAC pinning.

LACP active mode (option B) allows for the automatic bundling of several physical links into a single

logical link, providing redundancy and increased bandwidth. This mode actively tests the link to

ensure its functionality, which is essential for maintaining a stable connection.

MAC pinning (option E) is a method that assigns a virtual machine’s MAC address to a specific uplink.

This ensures consistent forwarding paths for traffic within the same session, which is crucial for

avoiding potential traffic distribution issues that could arise from dynamic changes in the network

topology.

Creating vPC+ (option A) and vPC (option D) are not recommended as they are related to virtual port

channels, which are not applicable in this scenario. PAgP (Port Aggregation Protocol) (option C) is

Cisco’s proprietary protocol similar to LACP, but it is not the recommended practice in this context.

Reference :=

Implementing Cisco Application Centric Infrastructure Official Cert Guide

Cisco’s documentation on UCS B-Series Teaming Bonding Options

To enable SSH communication between Web_EPG (Web Endpoint Group) and App_EPG (Application

Endpoint Group), it’s necessary to apply a configuration that allows bidirectional communication

while not restricting ports based on their directionality. By enabling “Apply Both Directions” and

disabling “Reverse Filter Ports,” this ensures that the filter allows SSH packets to flow from Web_EPG

to App_EPG and vice versa without any restrictions based on the port’s direction, which is essential

for establishing an SSH session. Reference := ( Implementing Cisco Application Centric Infrastructure

Official Cert Guide )

The integration of service nodes in transparent mode with a Cisco ACI Multi-Pod setup is achieved by

using an active-standby firewall mode stretched across pods. This configuration ensures that the

standby node takes over if the active node fails, providing high availability and seamless

operation. Reference := Cisco ACI Multi-Pod and Service Node Integration White Paper

To allow only the return traffic to be redirected to the service node when the load balancer does not

perform source NAT, we need to configure a Policy-Based Redirect (PBR). Here’s how it can be

achieved:

Create a Contract:

Create a contract linked to the common/default filter. This contract will define the communication

rules between the client endpoint and the server endpoint.

Configure L4-L7 Device:

Create an L4-L7 device with the function type set to “GoThrough.” This device will be used to redirect

traffic to the service node.

Create a Policy-Based Redirect Policy:

Set up a Policy-Based Redirect (PBR) policy.

Specify the L3 Destination as the load balancer’s inside IP/MAC address.

Ensure that the L4-L7 Policy-Based Redirect Policy has the “GoThrough” function type.

Create a Service Graph Template:

Define a service graph template that

the previously created contract and L4-L7 device.

Apply the service graph template to the relevant connectors.

Connector Configuration:

On the consumer connector, reference the L4-L7 Policy-Based Redirect Policy.

On the provider connector, also reference the L4-L7 Policy-Based Redirect Policy.

By following this configuration, only the return traffic (from the server to the client) will be redirected

to the service node, ensuring proper load balancing and traffic management.

Reference:

Implementing Cisco Application Centric Infrastructure Official Cert Guide

To facilitate communication between EPG1 in VRF1 and External EPG in VRF2, the following actions

are necessary:

Enable Shared Route Control Subnet: This allows subnets to be shared across different VRFs, which is

essential for inter-VRF communication.

Enable External Subnets for External EPG: Activating this makes the subnets within the External EPG

routable to external networks.

Enable Import Route Control Subnet: This enables the importation of routes from L3Out into the VRF,

permitting connectivity between different VRFs.

These steps ensure that routing and security policies are correctly implemented to permit traffic flow

between EPG1 and External EPG across distinct VRFs.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

When a packet is routed between two endpoints on different Cisco ACI leaf switches, the VXLAN

VNID applied to the packet is the VRF (Virtual Routing and Forwarding) VNID. This VNID enables

forwarding of the packet through tenant virtual routing and forwarding domains within the fabric34.

Reference := Cisco APIC Layer 3 Networking Configuration Guide, Release 3.x and later

In an Active-Active Across Pods deployment mode, traffic is intelligently redirected to the firewall

that currently owns the connection state, allowing for efficient use of network

resources. Additionally, the connection state being unsynchronized means that each pod can

independently manage its connections without relying on a centralized state, enhancing the

resilience and scalability of the network1.

Reference := (Implementing Cisco Application Centric Infrastructure Official Cert Guide)

The Forwarding Tag (FTAG) in Cisco ACI is used to load balance multi-destination traffic. FTAG trees

facilitate efficient forwarding of multicast traffic within the fabric, ensuring optimal distribution and

load balancing across multiple paths. All multi-destination traffic is encapsulated within VXLAN, and

FTAG trees play a crucial role in achieving efficient traffic flow345.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

The output shows details of tunnel 6 within a Cisco ACI fabric. The transport protocol is listed as

“isvlan,” which is typically associated with the GRE protocol in Cisco ACI terminology. GRE, a

tunneling protocol developed by Cisco, encapsulates various network layer protocols inside virtual

point-to-point links over an IP internetwork. Reference: Implementing Cisco Application Centric

Infrastructure Official Cert Guide

To advertise routes from border leaf switches to compute leaf switches in a shared services scenario,

the shared L3Out should be defined in the common tenant. This allows all tenants to access the

shared services provided by the L3Out. By configuring the L3Out in the common tenant, routes can

be advertised to the compute leaf switches, ensuring that the services are available across the ACI

fabric.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

The L2 Stretch feature allows for the extension of a Layer 2 network across multiple sites without

changing the IP addressing scheme, which satisfies the requirement for starting an application at a

DR site without re-IPing servers. Disabling inter-site BUM (Broadcast, Unknown unicast, and

Multicast) traffic prevents broadcast storms between sites while still allowing IP mobility, meeting

both specified criteria. Reference := (Implementing Cisco Application Centric Infrastructure Official

Cert Guide)

When allowing routes learned from one L3Out to be advertised out another L3Out, the Export Route

Control Subnet should be enabled, and Aggregate Export should also be enabled. This configuration

allows the necessary routes within the specified CIDR block to be aggregated and advertised out,

facilitating efficient route advertisement without the need for an explicit list of all routes.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

To create an exit point from all the tenants using the common tenant after removing RT-2 and RT-3

devices, the following two configuration tasks must be completed:

Update L3Out ExtEPG Subnet: The L3Out ExtEPG subnet in the common tenant should be updated

with the flag “Shared Route Control Subnet” and “Aggregate Shared Routes” (Option C). This

configuration allows for the sharing of routes between different tenants through a common exit

point.

Mark Subnets and Attach Contract: All subnets should be marked with the flag “Shared between

VRFs,” and contract Ctr-3 should be attached as a provider to all the EPGs (Option D). This ensures

that all EPGs can provide services under contract Ctr-3 across different VRFs, facilitating inter-tenant

communication via shared routes. Reference := (Implementing Cisco Application Centric

Infrastructure Official Cert Guide)

In a Cisco ACI Multi-Site deployment, proper configuration of the inter-site link is crucial for traffic to

pass between different sites. The MTU size is particularly important; if it’s not set correctly, packets

may be dropped or fragmented, leading to connectivity issues. By configuring the MTU on the link to

be at least 100 bytes larger than that of the ACI fabrics, you allow for encapsulation overhead

without packet drops due to exceeding MTU limits. Additionally, configuring the link as a routed

subinterface using VLAN-4 is necessary for routing across different broadcast domains, which is

essential for inter-site communication in an ACI fabric. Reference: Implementing Cisco Application

Centric Infrastructure Official Cert Guide