Free 600-660 sample questions

Correct answer: Enable Optimized WAN (OWAN) mode.

In a Multi-Site environment, the Bridge Domain can be configured with 'Optimized WAN' (OWAN) mode, also referred to as 'Inter-Site BUM Traffic Allow' set to disabled. This configuration ensures that BUM traffic is contained within the local site and not forwarded across the Inter-Site Network (ISN). This is the standard best practice to conserve expensive WAN bandwidth and prevent fault propagation between sites.

Correct answer: Configure a taboo contract between EPG-Web and EPG-DB.

A taboo contract is a special type of contract that explicitly denies communication between EPGs. It has a higher priority than standard allow contracts. By creating a taboo contract between EPG-Web and EPG-DB, all traffic will be dropped, regardless of any other contracts that might permit communication. A standard contract with a deny filter has lower precedence. vzAny doesn't provide the specific EPG-to-EPG denial required. Setting contract priorities can work but is more complex to manage; taboo is the most direct and highest-precedence method for this specific requirement.

Correct answers: Enable BPDU Filter on the ACI leaf port policy group.; Enable BPDU Guard on the ACI leaf port policy group.

BPDU Filter prevents the ACI leaf from sending BPDUs out of the port, which is crucial to not interfere with the external STP domain where the legacy switch is root.

BPDU Guard should be enabled on ACI ports facing traditional switches. This is a safety mechanism; if the ACI leaf unexpectedly receives a superior BPDU, it will err-disable the port, preventing a potential loop from forming. The combination of BPDU Filter (outbound) and BPDU Guard (inbound) is the Cisco best practice for this scenario.

Correct answers: The PBR policy must be configured for symmetric redirection.; The consumer and provider connectors of the service graph must be connected to the same EPG.

Symmetric PBR ensures that return traffic from the server to the client is also redirected through the same firewall instance, which is essential for stateful inspection.

Since the client and server are in the same EPG (and therefore the same BD), this is an intra-EPG contract scenario. For PBR to work in this case, both the consumer and provider connectors of the service graph must be attached to the same EPG (EPG-A), effectively redirecting traffic that originates and terminates within that EPG.

Correct answer: False

This statement is false. COOP is responsible for distributing endpoint information (MAC and IP addresses) to the spine proxy database within its *local* pod only. For inter-pod communication, MP-BGP EVPN is used over the IPN to advertise endpoint reachability information between the pods.

Correct answer: Enable 'Limit IP Learning to Subnet'

The 'Limit IP Learning to Subnet' option (also known as Enforce Subnet Check in some versions/contexts) on a Bridge Domain enforces that the fabric only learns endpoint IP addresses that fall within the subnets configured under that BD. This is a security and hygiene feature to prevent learning of unexpected or misplaced endpoints.

Correct answer: An inter-site L3Out with route leaking configured in the MSO schema template.

In MSO, communication between EPGs in different VRFs and different sites is achieved by configuring route leaking between the VRFs at the schema level. This is typically done in conjunction with an inter-site L3Out configuration within the template. MSO automates the underlying BGP EVPN route-target configurations on both fabrics to allow the selective exchange of routes between VRF1 in SiteA and VRF2 in SiteB, enabling the required communication.

Correct answer: The scope of the subnet under the provider EPG.

When configuring inter-VRF route leaking, the subnet object under the EPG that is *providing* the contract must have its scope configured correctly. To leak the subnet to another VRF, the scope must be set to 'Shared between VRFs'. This tells the fabric that this specific prefix is eligible to be advertised to other VRFs that consume the contract.

Correct answers: The 'Export Route Control Subnet' option on both L3Out external EPGs.; The 'Import Route Control Subnet' option on both L3Out external EPGs.

The 'Export Route Control Subnet' option under the external EPG (InstP) is used to control which learned routes are re-advertised out of that L3Out. It is a fundamental component of transit routing.

The 'Import Route Control Subnet' option controls which external routes are imported into the ACI fabric's routing table for the VRF. For transit routing, routes learned from one L3Out (import) must be allowed to be advertised to the other (export).

Correct answer: To assign a source leaf for load-balancing multi-destination traffic across multiple spine switches.

In ACI, multi-destination traffic (like multicast or broadcast) needs to be forwarded efficiently. The fabric builds multicast trees, and the Forwarding Tag (FTAG) is used by the ingress leaf to select a specific tree (and therefore a specific spine switch) to forward the traffic. This acts as a load-balancing mechanism, ensuring that not all multi-destination traffic from a leaf goes to the same spine.