Free 300-620 Practice Test Questions and Answers (2026)

In Cisco ACI, inter-VRF communication requires a contract between a provider EPG and a consumer EPG, alongside specific subnet configurations. For routing to be fully bidirectional, the subnets associated with both the provider and consumer must have the "Shared between VRFs" scope enabled. The exhibit's routing tables show that the provider subnet (172.16.18.0/24) is successfully present in the consumer VRF (Production:vrf-prod), meaning the contract and provider subnet are correctly configured. However, the consumer subnet (192.168.1.0/24) is missing from the provider VRF (Non-Production:vrf-nonprod). Enabling the "Shared between VRFs" flag on the consumer's BD subnet in the production VRF will trigger the APIC to leak the consumer route into the provider VRF, establishing return reachability.

A: The successful presence of the provider route inside the consumer's routing table proves that the contract scope is already sufficiently configured for cross-VRF or cross-tenant communication.

C: The non-production VRF contains the provider EPG (CDev). Its route is already visible in the production VRF, proving its subnet is already correctly flagged as shared.

D: The contract is already taking effect in one direction, meaning it is successfully consumed. The missing component is the data-plane route leaking configuration on the consumer subnet.

Cisco Systems, Inc. "Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x)." VRF Route Leaking, Section: About Inter-VRF and Inter-Tenant Communications. (Confirms that for bidirectional communication across VRFs, the subnet must be set to "Shared between VRFs" in both the provider and consumer Bridge Domains/EPGs).

Cisco Systems, Inc. "Cisco Application Centric Infrastructure Fundamentals." Contracts and Route Leaking, Document ID: 418193. (Explains that a consumer subnet must be explicitly defined and marked as shared to be advertised back to the provider VRF for return traffic).

In Cisco ACI, to permit data plane traffic between an internal EPG and external subnets via an L3Out, the external subnets must be classified into an External EPG (L3Out EPG). This is achieved by configuring the subnet under the External EPG with the scope "External Subnets for the External EPG" (also known as the Security Import Subnet). This setting maps the incoming traffic from those WAN subnets to the External EPG, allowing the APIC to apply security contracts between the internal production EPGs and the WAN.

A. Export Route Control Subnet is used to control which internal routes are advertised out to the external WAN router via routing protocols, not for host access contracts.
C. Import Route Control Subnet is used to filter which routes are imported into the ACI fabric's routing table (BGP/OSPF), not for classifying traffic into an EPG.
D. Shared Route Control Subnet is used for route leaking between different VRFs, which is not required here since the hosts and L3Out are in the same production VRF.

1. Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x), Chapter: "L3Out Subnet Scopes", Section: "External Subnets for the External EPG".

2. Cisco Application Centric Infrastructure Fundamentals, Chapter: "External Layer 3 Connectivity".

When extending a Layer 2 broadcast domain between a Cisco ACI fabric and a legacy network for migration purposes, the Bridge Domain (BD) must be configured to emulate traditional Ethernet flooding behavior. Setting "L2 Unknown Unicast" to "Flood" ensures that frames destined for MAC addresses not yet learned by the ACI fabric are flooded down to the legacy switches. Enabling "ARP Flooding" ensures that broadcast ARP requests traverse the entire extended Layer 2 domain. Together, these settings guarantee that the legacy switches receive the necessary traffic to populate their local MAC address tables and discover endpoints seamlessly.

A: Disabling ARP flooding and setting L2 Unknown Unicast to Hardware Proxy will drop unknown traffic, preventing legacy switches from learning MAC addresses or resolving ARP.

B: Setting L2 Unknown Unicast to Hardware Proxy forces the fabric to drop unicast traffic destined for unlearned MAC addresses instead of flooding it to the legacy network.

C: Disabling ARP Flooding prevents ARP broadcast messages from crossing the Layer 2 extension, disrupting IP-to-MAC resolution and preventing standard MAC learning on the legacy switches.

Cisco Systems, Inc. "Cisco APIC Layer 2 Networking Configuration Guide, Release 5.2(x) - Bridge Domain Configuration." Cisco.com, Section: Layer 2 Unknown Unicast and ARP Flooding. (Specifically notes that for L2 extensions to external networks, ARP Flooding must be enabled and L2 Unknown Unicast set to flood).

Cisco Systems, Inc. "Migrating to Cisco ACI: Best Practices." Cisco White Papers, Document ID: 1530283733075. (Details bridge domain configurations required during legacy infrastructure integration to ensure endpoint learning).

Cisco ACI fabric discovery relies primarily on the Link Layer Discovery Protocol (LLDP) and the Dynamic Host Configuration Protocol (DHCP). LLDP is used by the APIC and fabric nodes (leaf and spine switches) to discover their physical neighbors and build the topology map. Once a neighbor is discovered via LLDP, the APIC uses DHCP to assign a Tunnel Endpoint (TEP) IP address to the node. This IP assignment allows the node to join the fabric and participate in the IS-IS routing domain.

B: OSPF is a routing protocol used for external connectivity (L3Out), not for internal fabric discovery. C: CDP is supported for neighbor discovery with external devices but is not the protocol used for internal ACI fabric discovery. E: IS-IS is used for infrastructure routing after discovery and IP assignment, not for the initial discovery process itself.

- Cisco Application Centric Infrastructure Fundamentals, Chapter: "Fabric Discovery", Section: "Discovery Process".

- Cisco APIC Getting Started Guide, Section: "Discovering the Fabric".

The requirements specify a link-state routing protocol that supports a hierarchical network design, which perfectly describes OSPF (using areas like Area 0). EIGRP is an advanced distance-vector protocol, and BGP is a path-vector protocol. Furthermore, connecting the core switch with a single 1G link using 802.1Q tagging and dedicated IP addresses per VLAN requires the use of Layer 3 Routed Sub-interfaces in ACI. Therefore, configuring an OSPF Protocol policy and building an Interface profile with Routed Sub-interfaces fulfills all design requirements.

A: EIGRP is an advanced distance-vector routing protocol, not a link-state protocol, and a Port-channel is not required for a single link. B: BGP is a path-vector routing protocol, not a link-state protocol, and an External Bridged Domain does not provide dedicated Layer 3 IPs per VLAN. D: EIGRP is an advanced distance-vector routing protocol, not a link-state protocol.

1. Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x), Chapter: "Layer 3 Outside Network Configuration", Section: "OSPF and Routed Sub-interfaces".

2. Cisco ACI Design Guide, Chapter: "External Layer 3 Connectivity (L3Out)".

To meet the requirements, EIGRP is selected because it provides rapid convergence (via the DUAL algorithm) and maintains low CPU usage compared to link-state protocols. Connecting a pair of leaf switches using 802.1Q tagging is accomplished by configuring a Switch Virtual Interface (SVI) over a Virtual Port Channel (vPC). Finally, to provide internet access to the ACI fabric, the External EPG (External Network object) must be configured with the default route subnet 0.0.0.0/0 (noted as a typo 0.0.0.070 in the prompt) to classify outbound internet traffic.

A: OSPF requires higher CPU usage for SPF calculations compared to EIGRP, and this option lacks the explicit SVI configuration required for 802.1Q tagging over vPC. B: BGP is an exterior gateway protocol that generally has slower convergence times than IGPs like EIGRP or OSPF. C: IS-IS is used internally by the ACI fabric for infrastructure VTEP reachability and is not supported as a routing protocol for tenant L3Out connections.

Cisco ACI Routing Guide, "EIGRP L3Out" section.

Cisco ACI Fundamentals Guide, "Layer 3 Outside Connections".

In Cisco ACI, enabling inter-VRF communication (route leaking) within the same tenant requires two specific configurations. First, the subnets associated with the provider EPG or its Bridge Domain (BD) must have their scope set to "Shared between VRFs". This configuration allows the ACI fabric to leak the subnet routes from the provider's VRF routing table into the consumer's VRF routing table. Second, the contract facilitating the connection between the EPGs must have a scope broad enough to encompass both VRFs. Because VRF1 and VRF2 both reside within "Tenant Prod", configuring the contract scope to "Tenant" ensures the contract is applied across both routing domains.

B. Enable Advertise Externally under the subnet scope: This is used for advertising subnets outside the ACI fabric via an L3Out, not for internal route leaking between VRFs.

C. Export the contract and import as a contract interface: This configuration is utilized for inter-tenant communication. Because both VRFs reside in the same tenant, this complexity is completely unnecessary.

E. Change the subject scope to VRF: In ACI, scope boundaries for inter-VRF communication are defined at the contract level, not the subject level. Additionally, VRF scope restricts communication to one VRF.

Cisco Systems, Inc. Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x). Chapter: "VRF Route Leaking", Section: "Guidelines and Limitations for VRF Route Leaking".

Cisco Systems, Inc. Cisco Application Centric Infrastructure Fundamentals, Release 4.2(x). Chapter: "Contracts", Section: "Contract Scopes and Inter-VRF Communication".

The MisCabling Protocol (MCP) in Cisco ACI is designed to detect Layer 2 loops by transmitting ACI-generated MCP packets from leaf switch interfaces. If a leaf interface receives an MCP packet, it indicates a loop. To mitigate this, MCP can error-disable the affected interface. However, MCP is disabled by default globally in the ACI fabric. Therefore, the primary action required to utilize this feature is to change the default administrative state of the global MCP Instance Policy from disabled to enabled.

A. The Error Disabled Recovery Policy is used to automatically bring an interface back up after it has been error-disabled, not to detect loops or cause the error-disable action.
B. Rogue EP Control is used to detect and mitigate endpoints that rapidly move across different leaf switch ports, not to detect physical cabling loops via ACI-generated packets.
C. Unchecking the Loop Protection Action check box would prevent the interface from being error-disabled when a loop is detected, which contradicts the requirement.

- Cisco APIC Layer 2 Networking Configuration Guide, Release 5.2(x), Chapter: MisCabling Protocol, Section: Configuring MCP.

- Cisco ACI Design Guide, Chapter: Fabric Loop Protection.

To enable inter-VRF communication and route leaking from the shared L3Out in VRF "VF2" to the internal EPG in VRF "VF1", three subnet flags are required:

• Shared Route Control Subnet: Enables MP-BGP route leaking so the external subnet (192.168.16.0/24) learned in VRF VF2 is installed into consumer VRF VF1's routing table.
• Shared Security Import Subnet: Programs the prefix and external classification pcTag into the hardware lookup tables of consumer VRF VF1, permitting contract enforcement between EPG1 and the external network.
• External Subnets for External EPG: Classifies the external network into Ext-EPG2 for security contract enforcement in the local VRF.

Together, these flags provide both routing reachability and data-plane contract enforcement across VRFs.

Option A is incorrect: Export Route Control Subnet only controls outbound route advertisements to external peers, while Aggregate Shared Routes merely summarizes prefixes. Neither option leaks routes to VF1 nor enables contract classification.

Option C is incorrect: Import Route Control Subnet only filters inbound protocol updates. Omitting Shared Security Import Subnet prevents contract enforcement rules from being installed in VF1, causing packets to be dropped.

Option D is incorrect: Export Route Control Subnet and Aggregate Shared Routes do not leak prefixes to VF1. Omitting Shared Route Control Subnet leaves VRF VF1 without a route to the external network.

Cisco Systems, Inc. Cisco APIC Layer 3 Networking Configuration Guide, Release 6.0(x). Document ID: cisco-apic-layer-3-networking-configuration-guide-60x. Chapter: "Route and Subnet Scope," Section: "Subnet Scope Definitions" (Defining External Subnets for External EPG, Shared Route Control Subnet, and Shared Security Import Subnet).

Cisco Systems, Inc. Cisco Application Centric Infrastructure (ACI) Design Guide. Document ID: cisco-application-centric-infrastructure-design-guide. Section: "L3Out Simplified Object Model," Subsection: "Considerations When Using Shared L3Out."

Cisco Systems, Inc. Cisco ACI Contract Guide White Paper. Document Number: C11-740135-03. Section: "Shared Layer 3 Outside (L3Out)," Subsection: "External Subnet Scope Combinations and Inter-VRF Contract Enforcement."

Cisco Systems, Inc. Cisco Catalyst SD-WAN Cloud OnRamp Connecting ACI to AWS Design Guide. Section: "ACI Configuration Overview," Subsection: "Shared-services Design for Multiple Tenants with Shared External Connectivity" (Step 3: Subnet Scopes for Shared L3Out).

In Cisco ACI Multi-Site architectures, enabling Intersite L3Out requires border leaf switches in the site hosting the external connection (SITE1) to be reachable across the Inter-Site Network (ISN). By default, leaf switch TEPs are internal and not advertised across the ISN. To support cross-site data plane forwarding directly to an external network, an external/routable TEP (RTEP/ETEP) pool must be defined under the Multi-Site Orchestrator (MSO) Infrastructure configuration for SITE1. This allocates routable IP addresses to the border leaf switches in SITE1, enabling leaf switches in remote sites (SITE2) to encapsulate and forward tenant VXLAN traffic across the ISN directly to the egress border leaves.

Option B: CloudSec provides optional line-rate encryption across the inter-site network; it is not an architectural prerequisite for establishing cross-site L3Out control-plane or data-plane reachability.

Option C: The prompt confirms all template/schema objects are already defined. Furthermore, an L3Out is local to SITE1, meaning its external EPG does not need to be stretched.

Option D: Policy-Based Redirect (PBR) with service graphs is utilized solely to divert traffic through Layer 4–Layer 7 service nodes, which is not required for standard intersite L3Out routing.

Cisco Systems, Inc. Cisco ACI Multi-Site Architecture White Paper (Document ID: C11-739609), Section: "Introducing the Intersite L3Out Functionality," Subsection: "External Routable TEP Pools."

Cisco Systems, Inc. Cisco Nexus Dashboard Orchestrator Configuration Guide for ACI Fabrics, Release 4.1(x), Chapter: "Intersite L3Out," Section: "Configuring External TEP Pool."

Cisco Systems, Inc. Cisco ACI Multi-Site Configuration Guide, Release 3.1(x), Chapter: "Configuring Infra for Cisco APIC Sites," Section: "Adding Routable TEP Pools" (pp. 42–45).

Cisco Systems, Inc. Cisco Application Centric Infrastructure (ACI) Design Guide (White Paper, Document ID: EDCS-11585640), Section: "Connectivity to the External Layer 3 Domain," Subsection: "Intersite L3Out Requirements."