Free 300-635 Practice Test Questions and Answers (2026)

The Cisco ACI (Application Centric Infrastructure) CNI (Container Network Interface) plug-in is specifically designed to integrate Kubernetes container networking into the ACI fabric. ACI provides a holistic, intent-based networking model managed from a central controller, the APIC. This "single pane of glass" management extends across bare-metal servers, virtual machines (VMs), and, with the CNI plug-in, containerized workloads. By using the ACI CNI plug-in, network policies, security, and visibility for containers are managed using the same constructs (like EPGs and Contracts) and interface as for traditional and virtualized workloads, achieving unified, intent-based policy enforcement across the entire data center.

B. Contiv is a container-networking project but does not inherently provide a unified management plane for VMs and bare-metal servers in the same way ACI does.
C. Ingress is a Kubernetes API object for managing external access to services, typically HTTP. It is not a CNI plug-in for pod-to-pod networking.
D. Calico is a popular CNI focused on scalable container networking and policy, but it operates independently and is not designed to integrate into a broader SDN fabric like ACI.

1. Cisco. (2022). Cisco ACI and Kubernetes Integration. "Solution Overview". This document states, "The Cisco ACI CNI Plug-in for Kubernetes... provides the means to apply ACI policy-based automation, security, and visibility to container-based applications... alongside existing virtualized and bare-metal workloads."

2. Cisco. (2023). Cisco Application Centric Infrastructure (ACI) CNI Plugin for Red Hat OpenShift Container Platform 4.12 Design Guide. "Introduction". This guide details how the ACI CNI plug-in allows OpenShift (a Kubernetes distribution) to be "a first-class citizen in the ACI fabric," managed under the same policy model as other endpoint types.

In the Cisco UCS PowerTool suite, the Connect-Ucs cmdlet is specifically designed to initiate and establish a session with a Cisco UCS Manager instance. It is the primary command used for authentication and connection. The command typically requires the hostname or IP address of the UCS Manager as a parameter, and it can accept credential objects for secure, non-interactive logins. All subsequent PowerTool cmdlets that interact with the UCS domain, such as Get-UcsBlade or Set-UcsServiceProfile, rely on the connection established by Connect-Ucs.

A. Get-UcsCentralManagedObject is used to retrieve objects from Cisco UCS Central, not to initiate a connection to UCS Manager.
C. Get-UcsCentralAppliance retrieves information about a UCS Central appliance, assuming a connection has already been made.
D. Get-UcsBlade is used to retrieve information about blade servers within a UCS domain after a connection has been established.

1. Cisco. (2021). Cisco UCS PowerTool Suite User Guide, Release 4.1. "Getting Started with Cisco UCS PowerTool" chapter, "Connecting to a Cisco UCS Domain" section. The guide explicitly states, "To connect to a Cisco UCS domain, use the Connect-Ucs cmdlet." and provides usage examples.

2. Cisco DevNet. (n.d.). UCS PowerTool. Cisco Developer documentation portal. The API reference and examples consistently show Connect-Ucs as the first step in any script that interacts with a UCS Manager domain.

The Cisco Intersight API adheres to the OData v4 standard for API calls. To analyze data across a collection, the $apply query option is used for aggregation.

1. Grouping: The groupby transformation is used to group the results. In the context of compute/RackUnits, the property Model is the correct field to categorize servers (e.g., separating UCS C220 M5 from C240 M6) to determine statistics per server model. ServerType is not a standard property ID for this resource.
2. Aggregation: The aggregate transformation calculates values within those groups. The correct OData syntax to compute a maximum value and rename the output is <Property> with <Method> as <Alias>. Therefore, max as MaxAvailableMemory is the correct syntax. The option using = is syntactically incorrect for OData.

Cisco Intersight API Reference

Context: Describes the compute.RackUnit Managed Object (MO) properties. The property defining the server's model identifier is explicitly named Model.

Resource: compute/RackUnits

OData Version 4.01. Part 2: URL Conventions (OASIS Standard)

Section: 5.1.3 System Query Option $apply

Subsection: 5.1.3.1.1 Transformation groupby

Quote: "The aggregate transformation takes a comma-separated list of aggregate expressions... An aggregate expression is... a property path... followed by the keyword with, the name of the aggregation method... and optionally the keyword as followed by an alias."

Relevance: confirming the AvailableMemory with max as MaxAvailableMemory syntax.

Cisco DevNet: Intersight API Overview

Topic: Query Parameters

Details: confirms Intersight's support for standard OData query parameters like $apply, $filter, and $select.

The Ansible playbook is attempting to connect to the Cisco NX-OS device's NX-API endpoint (/ins) on port 80. The error message "Connection refused" indicates that the switch is not listening for connections on that port because the required service is not running. The feature nxapi command enables the NX-API feature on the switch, which starts the necessary web server process to listen for and accept API requests.

B. http-server enabled is used to enable the web-based GUI (DCNM/Data Center Network Manager), not the programmatic NX-API service.
C. An access-group would result in a timeout or a specific "permission denied" error, not a "Connection refused" error, which implies no service is listening.
D. feature http is not a valid Cisco NX-OS command for enabling the required API service.

1. Cisco Nexus 9000 Series NX-OS Programmability Guide, Release 10.2(x), "Getting Started with NX-API REST", Section: "Enabling NX-API". The document states, "To enable NX-API, use the feature nxapi command."

2. Cisco DevNet, "NX-API - Nexus Programmability", "NX-API CLI". This resource shows that the NX-API feature must be enabled with feature nxapi before sending cli commands over HTTP/HTTPS.

The exhibit displays a configuration for model-driven telemetry on a Cisco IOS XR device. The destination array contains four distinct IP addresses, indicating the data is streamed to four collectors. The interval parameter is set to 10000. In Cisco IOS XR telemetry subscriptions, this value is specified in milliseconds. Therefore, an interval of 10000 milliseconds is equivalent to 10 seconds. The subscription streams data to four destinations every 10 seconds.

A. The interval unit is milliseconds, not microseconds. 10000 microseconds would be 10 milliseconds, which is incorrect.
B. 100 milliseconds would correspond to an interval value of 100, not 10000.
D. The interval unit is milliseconds. Interpreting it as 10000 seconds is incorrect.

1. Cisco, "Programmability Configuration Guide, Cisco IOS XR Release 7.3.x," Chapter: Configure Model-Driven Telemetry. In the section "Configure Telemetry Subscription," the documentation for the sample-interval (or interval in JSON/gRPC) parameter states, "Specifies the sample interval in milliseconds."

2. Cisco, "Telemetry Configuration Guide for Cisco ASR 9000 Series Routers, IOS XR Release 7.5.x," Chapter: Implementing Model-Driven Telemetry. The guide consistently defines the subscription interval in milliseconds.

Cisco Intersight REST API requests use a request signing scheme for authentication. The client creates a signature using its private RSA key. This signature, which is derived from hashing the message body (using SHA-256) and select HTTP headers, is then Base64-encoded and included in the Authorization header of the request. Upon receiving the request, the Intersight web service uses the public key associated with the client's API Key ID to verify the signature. This process ensures the request's integrity and authenticates the sender without transmitting any secret credentials.

B. The hash algorithm used for the message body is SHA-256, not SHA-384.
D. The private key is a secret that must never be transmitted. The server uses the public key to verify a signature created with the private key.
E. The signature is generated using the private key associated with the API Key ID, not the API Key ID itself, which is a public identifier.

1. Cisco Intersight API Docs, "Request Signing". Cisco Systems, Inc. Accessed 2023. "The message body is hashed using the SHA-256 algorithm... The signature is generated using the RSA-SHA256 algorithm and the private key... The signature is then Base64 encoded... Intersight authenticates the API request by validating the signature using the public key."

The script targets a URI ending in .xml, and the headers specify text/xml, necessitating an XML payload. The option payload = '<fvAp name="WebApp" />' correctly defines the Application Profile (fvAp) object with the name "WebApp" using valid XML syntax. The JSON option is incorrect due to the format mismatch, and the other XML option uses an incorrect naming convention ("MyCompany/WebApp" suggests a Distinguished Name rather than the relative name property).

For the request, the standard method to create or modify Managed Objects (MOs) in the Cisco ACI REST API is POST. The correct code snippet uses POST and references the existing headers variable (which contains the correct XML content type), whereas the distractor explicitly sets a JSON header, which contradicts the endpoint's requirement.

Cisco Application Centric Infrastructure (ACI) Design Guide

Reference: "REST API": This section details that the API supports both XML and JSON, determined by the extension (.xml or .json) in the URI. It confirms that POST operations are used to create managed objects.

Cisco APIC REST API Configuration Guide

Reference: Chapter: "Cisco APIC REST API Usage", Section: "Rest API Methods". This documentation specifies that POST is used to create a new object or update an existing one. It also validates the object naming structure where the payload includes the relative name of the child object being created under the target parent URI.

Cisco ACI Programmability Guidelines

Reference: "Managed Object Model": Defines fvAp as the class name for an Application Profile and confirms it is a child of the Tenant (fvTenant).

Model-driven telemetry (MDT) is a network monitoring framework that uses a push-based model. Instead of a network management system (NMS) polling devices for data (pull model), the network devices themselves continuously stream structured operational data to a collector. This streaming is based on subscriptions to specific data models (typically YANG). This approach provides near real-time visibility into the network's state with higher frequency and granularity than traditional methods like SNMP, making it more efficient and scalable for modern network automation and assurance.

A. MDT provides structured, predictable data based on YANG models; it does not randomize data.
C. MDT is concerned with exporting data from the network for monitoring, not randomizing data coming to it.
D. This describes a pull-based model, characteristic of SNMP. MDT is fundamentally a push-based, streaming model.

1. Cisco, "Model-Driven Telemetry," Cisco IOS XE Programmability Configuration Guide, Cisco IOS XE Bengaluru 17.6.x, Section: "Model-Driven Telemetry". It states, "With streaming telemetry, devices push and continuously stream data to a remote management station."

2. Cisco, "Cisco Nexus 9000 Series NX-OS Programmability Guide, Release 9.3(x)," Chapter: "Streaming Telemetry". The introduction states, "Streaming telemetry is a new paradigm for network monitoring in which data is streamed from network devices continuously."

3. Cisco, "Cisco IOS XR Telemetry Configuration Guide," Release 7.3.x. The "Telemetry Overview" section explains, "Model-driven telemetry provides a mechanism to stream data from a router to a data collector. Applications can subscribe to specific data items they need, by using standard-based YANG data models."

The REST API Browser is a tool for developers and advanced administrators within Cisco UCS Director. It is not enabled by default for standard users to maintain a simplified user interface. To access it, an administrator must explicitly enable "Developer Menu" or a similar "developer options" setting within the user's account profile or the group to which the user belongs. This action makes advanced features, including the API browser, visible and accessible to that specific user.

B: Raising a case with Cisco TAC is for technical support and troubleshooting, not for enabling a standard, built-in product feature. C: The Power User role has elevated privileges, but access to developer-specific tools like the API browser is a separate setting and not automatically enabled. D: There is no default, special user named "REST" for accessing the API browser. Access is controlled through individual user profile settings.

1. Cisco, "Cisco UCS Director Administration Guide, Release 6.7," Chapter: User Accounts, Section: User Rights. The guide details that advanced features are enabled by editing a user's account settings. Specifically, enabling the "Developer Menu" for a user grants access to the REST API Browser.

2. Cisco, "Cisco UCS Director REST API Getting Started Guide," Section: Accessing the REST API Browser. This guide states, "To access the REST API Browser, you must have developer privileges. Your administrator can grant you developer privileges by editing your user account."

To configure the Embedded Event Manager (EEM) on a Cisco Nexus device, the engineer must first enter global configuration mode using conf t. Next, the applet is created with the command event manager applet link monitor. Inside the applet configuration mode, the trigger is defined; in this scenario, the requirement is to detect when an interface comes up, so the event syslog pattern "IF_UP" command is used to match the specific syslog message. Subsequently, the action is defined to execute the automation script using action 1 cli command "source cdp_description.py" (the source command is used in NX-OS to run Python scripts). Finally, exit is used to leave the applet configuration mode.

Cisco Nexus 9000 Series NX-OS System Management Configuration Guide, Release 9.3(x), Chapter: "Configuring the Embedded Event Manager," Section: "Defining an Applet." (This section details the hierarchy of entering configuration mode, defining the applet name, setting the event trigger, and defining the action).

Cisco Nexus 9000 Series NX-OS Programmability Guide, Release 9.x, Chapter: "Python API," Section: "Executing Python Scripts." (Documents the usage of the source command to execute Python scripts from the CLI).

The Cisco Data Center Network Manager (DCNM) REST API utilizes a token-based authentication system. An initial login request using basic authentication is made to the /rest/logon endpoint, which returns a Dcnm-Token. This token must be included in the dcnm-token header for all subsequent API calls. The API itself is structured into logical categories that reflect the functional areas of DCNM, such as LAN Fabric for VXLAN EVPN deployments, Classic LAN for traditional networks, SAN Management for storage fabrics, and Media Controller for broadcast media infrastructures. This organization helps users navigate and utilize the extensive capabilities of the API.

B. Basic authentication requires the username and password to be Base64 encoded, not sent without encoding.
C. The DCNM REST API uses HTTPS for secure communication, not HTTP.
D. The API uses a proprietary Dcnm-Token for session authentication, not a standard Bearer token associated with OAuth 2.0.

1. Cisco DCNM REST API Guide, Release 11.5(1), "Authentication" section. "To authenticate with the DCNM server, you must first send a login request... The DCNM server returns a security token (Dcnm-Token) that you must use in the header for all subsequent requests."

2. Cisco DCNM REST API Guide, Release 11.3(1), "Chapter: DCNM REST API," "API Categories" section. This section details the API's organization into categories including "Classic LAN APIs," "External Fabric APIs," "IP Fabric for Media APIs," and "SAN APIs," which align with the option provided.

In the Cisco ACI Management Information Model (MIM), a class name is composed of a package prefix and the class name itself, typically in the format Package:ClassName or, more commonly in API/code representations, pkgClassName. The package provides a namespace to group related classes. For example, the class for a tenant is fvTenant, where fv (fabric virtualization) is the package and Tenant is the class. This structure ensures that class names are unique across the entire object model.

A: A method is an operation or action that can be performed on an object (e.g., create, delete), not the name of the object's class. B: This format incorrectly combines a class name with a method. A class defines the object's properties, while a method defines an action. D: MitName is not a standard component of an ACI class name. The structure is based on packages and classes.

1. Cisco, "Cisco APIC Management Information Model Reference," Introduction. The document states, "The model is a hierarchical management information tree (MIT), composed of a tree of managed objects (MOs). Each MO is an instance of a class, and each class is identified by a package and a class name."

2. Cisco, "Cisco ACI Fundamentals, 2nd Edition," Chapter 12: ACI Programmability and Automation. Section "ACI Object Model" explains, "Every object in the ACI fabric belongs to a class. Classes are grouped into packages... For example, the class for a tenant is fvTenant."

Configuration management tools like Ansible and Puppet are central to modern data center automation. Their primary benefits are enforcing consistency and automating repetitive work. By defining configurations as code (Infrastructure as Code), these tools ensure that all managed systems adhere to a standard, preventing configuration drift (consistency). They also execute routine tasks, such as provisioning VLANs, applying security policies, or deploying software across numerous devices without manual intervention, which saves time and reduces human error (automation of repetitive tasks).

C. Creating groups is a feature that enables the benefits of consistency and automation, not a core benefit itself.
D. Adding VLANs and routes is a specific example of a repetitive task, not the overarching benefit of automation.
E. These tools manage configurations; they do not inherently remove or replace fundamental network protocols like Spanning Tree.

1. Cisco, "Data Center Automation with Cisco and Ansible," White Paper, 2019. Page 3, Section "Why Automate with Ansible and Cisco?," states, "Ansible helps you to reduce repetitive tasks... ensure consistency and reduce errors."

2. Cisco, "Ansible for Cisco ACI," DevNet. The overview section states, "Automation provides speed, reliability, and consistency." This directly supports the chosen answers.

3. Puppet, "What is configuration management?," Official Documentation. The document explains that a key benefit is to "Enforce system consistency and prevent configuration drift."

To integrate Kubernetes with Cisco ACI, Kubernetes objects like Pods must be mapped to ACI network constructs, such as Endpoint Groups (EPGs). This mapping is achieved by adding specific annotations to the Kubernetes manifest files (e.g., for a Deployment or Pod). The annotation, such as opflex.cisco.com/epg, explicitly references the target ACI EPG. This allows ACI to apply network policies to the pods, enabling micro-segmentation and service insertion within the Kubernetes environment. Without these modifications, pods are typically placed in a default EPG with limited ACI integration.

A. The APIC's management IP is part of the overall ACI CNI plugin configuration, not a per-object annotation in a Kubernetes manifest.
B. This is contradictory; if the object is not discovered without a change, then a change is required for proper integration and policy enforcement.
D. A change is necessary. Without annotations, specific ACI policies cannot be applied to Kubernetes pods, defeating the purpose of the integration.

1. Cisco, "Cisco ACI and Kubernetes Integration," Cisco ACI Solution Overviews, 2021. In the "ACI CNI Plug-in" section, it states: "The ACI CNI plug-in allows you to assign pods to an EPG and a security group using annotations in the pod’s YAML file."

2. Cisco, "Cisco ACI CNI Plugin for Red Hat OpenShift Container Platform Architecture and Design Guide," White Paper, March 2022. Section "Mapping Pods to EPGs," page 11, shows an example manifest with the annotation "opflex.cisco.com/epg": '{"tenant":"common","app-profile":"k8s","epg":"default"}'.

3. Cisco, "ACI CNI Plugin," github.com/noironetworks/aci-containers. The documentation and examples consistently show the use of annotations in Kubernetes manifests to define ACI network properties. For instance, the README.md file under the "Usage" section details how to use annotations for EPG mapping.

The NX-API allows for the execution of CLI commands using a JSON-RPC interface over HTTP/HTTPS. The correct format requires a JSON object with method set to cli and a params object containing the cmd key. The value for cmd must be the exact CLI command string. The correct command to display the MAC address table on a Cisco NX-OS device is show mac address-table. Box 4 contains the correctly formatted JSON payload with the exact command string.

A. The method value clishow is incorrect. The correct method for sending a CLI command is cli.
B. The command show mac-address-table is syntactically incorrect. The correct command uses a space, not a hyphen, between "mac" and "address-table".
C. The command show mac address table is syntactically incorrect. The correct command is show mac address-table.

1. Cisco Nexus 9000 Series NX-OS Programmability Guide, Release 10.2(x), Chapter: "Using NX-API REST", Section: "JSON-RPC Request". This section provides the structure for JSON-RPC requests, showing the method as cli and cmd containing the command string.

2. Cisco Nexus 9000 Series Command Reference (Master Index), Release 10.2(x). This reference lists the valid command as show mac address-table.