Free 300-630 sample questions

Correct answers: A taboo contract applied between 'EPG-Legacy-App' and 'EPG-Legacy-DB'.; Set the VRF Policy Control Enforcement Preference to 'Enforced'.

A taboo contract is used to explicitly deny traffic between EPGs, and it takes precedence over any standard contracts that might permit the traffic. This directly fulfills the requirement to block communication between the two legacy EPGs regardless of other policies.

Setting the VRF to 'Enforced' mode establishes a default-deny policy where no traffic is allowed unless explicitly permitted by a contract. This meets the primary requirement of denying all traffic by default.

Correct answer: A GIPo (Group IP Outer) address has not been configured for the VRF under the tenant.

In ACI Multi-Pod, inter-pod multicast traffic is encapsulated using a VRF-specific multicast address known as the GIPo. Each VRF that needs to pass multicast traffic between pods must have a unique GIPo from the reserved multicast address pool configured under the tenant. If this is not configured, the fabric does not have a destination multicast address to use for the outer VXLAN header when forwarding multicast packets across the IPN.

Correct answer: Disable 'Remote EP Learn'

The 'Remote EP Learn' setting, available on a Bridge Domain, controls whether remote endpoints (those learned in other pods and advertised via COOP) are programmed into the local leaf switch tables. By disabling this feature, the leaf switches in that pod will not learn remote endpoint information. Instead, traffic destined for a remote endpoint will be forwarded to the spine proxy, which performs the lookup and forwards accordingly. This conserves leaf switch table space and reduces control plane churn at the cost of a slightly less optimal data path.

Correct answer: False

False. A contract with 'Global' scope, when configured in a schema on the NDO, allows it to be exported to other tenants. This enables inter-tenant communication across the Multi-Site fabric, a key feature for shared service designs in a multi-site environment.

Correct answer: Placing the firewall's bridge domain into a 'PBR Tracking' group.

When using PBR with a redundant, non-clustered service device, ACI needs a mechanism to track the health of the destination and redirect traffic if a path fails. The 'PBR Tracking' for a service device feature allows the fabric to monitor the health of multiple PBR destinations (the firewall interfaces on each leaf). If one path fails its health check, ACI automatically redirects traffic to the other healthy destination, ensuring service availability. This is the correct mechanism for this specific high-availability scenario.

Correct answer: One contract provided by App and consumed by Web, and one contract provided by DB and consumed by App.

This is the most direct and correct way to implement the policy. A contract from App to Web allows the required communication. A second contract from DB to App allows that required communication. Because the VRF is in 'Enforced' mode, any communication not explicitly permitted by a contract is denied by default. Therefore, no communication is possible between Web and DB, and no additional 'deny' or 'taboo' contract is necessary.

Correct answer: Bidirectional Forwarding Detection (BFD)

Bidirectional Forwarding Detection (BFD) is the recommended mechanism for achieving fast failure detection and convergence in an IPN. BFD provides low-overhead, sub-second failure detection for the OSPF adjacencies between the ACI spine switches and the IPN devices. When a failure is detected by BFD, it immediately informs OSPF, which can then reconverge much faster than it would by waiting for its own hello/dead timers to expire.

Correct answers: BPDU Guard; BPDU Filter

BPDU Guard, when enabled on an ACI leaf port, will err-disable the port if it receives a BPDU. This is a strong protective measure to ensure that no external STP instance can influence the ACI fabric.

BPDU Filter, when enabled, prevents the ACI leaf port from both sending and receiving BPDUs. This effectively isolates the ACI fabric from the external STP domain without shutting down the port, making it a less disruptive option than BPDU Guard.

Correct answer: Rogue Endpoint Control

Rogue Endpoint Control is the ACI feature specifically designed to handle situations where an endpoint's IP address is learned from an unauthorized or unexpected location, such as a different bridge domain or EPG. When an endpoint's IP flaps rapidly between ports, Rogue EP Control can detect this behavior, flag the endpoint as rogue, and quarantine it to prevent it from causing further instability in the fabric.

Correct answer: L3Out VRF route leaking where the firewall acts as the external router.

This scenario requires a sophisticated form of route leaking often called 'transit routing with shared services.' It involves leaking routes from Tenant-A's VRF into the 'common' tenant's VRF, and from Tenant-B's VRF into the 'common' tenant's VRF. The firewall, connected via an L3Out (or service graph) in the 'common' tenant, then routes traffic between these leaked prefixes. This is effectively using the 'common' tenant as a transit VRF, which falls under the advanced topic of L3Out VRF route leaking.