QUESTION 81
How does Cisco ACI manage the old endpoint information on the original leaf switch after an endpoint moves between two Cisco ACI leaf switches?

A. The spine switch pushes all endpoint database entries to all leaf switches.
B. A remote endpoint is created to represent the endpoint on another leaf.
C. Cisco APIC deletes an endpoint after receiving GARP packets from the new leaf.
D. A bounce entry is created by COOP communication instead of data plane learning.

Correct Answer: D

QUESTION 82
A VM called App_1 belongs to VLAN 10. VM App_2 belongs to VLAN 20. Pool_1 contains VLAN 10 and Pool_2 contains VLAN 20. Currently, AP_1 is located on Server 1. The Cisco ACI fabric has these configurations:
1. The two physical domains are called Phys_1 and Phys_2.
2. The two VLAN pools are called Pool_1 and Pool 2.
3. The two AAEPs are called AAEP_1 and AAEP 2.

An engineer must replace App_1 with App_2. Which action under the VPC interface policy group accomplishes this goal?

A. Map VM App_2.
B. Attach AAEP_2.
C. Configure Phys 2.
D. Assign Pool_2.

Correct Answer: B

QUESTION 83
An engineer is implementing an out-of-band (OOB) management access for the Cisco ACI fabric. The secure access must meet these requirements:
1. Only GUI and secure shell must be allowed to access the management interfaces of the ACIs.
2. The only IP ranges that must be permitted to connect the fabric will be 10.10.10.0/24 and 192.168.15.0/24.

Which configuration set meets these requirements?

A. Create an out-of-band EPG in the common tenant.
Associate the external network instance profile with the OOB contract.
B. Set up static IPs on the management interfaces from the required IP range.
Add the required subnets to the external network instance profile.
C. Implement HTTPS and SSH protocol filters in the OOB contract.
Add the required subnets to the external network instance profile.
D. Create an out-of-band EPG in the external management entity.
Associate the management profile with the OOB contract.

Correct Answer: C

QUESTION 84
What is a characteristic of endpoint loop prevention?

A. It disables endpoint learning per bridge domain.
B. It detects malicious traffic.
C. It err-disables offending ports by EPG.
D. It detects moves based on the IP or MAC address.

Correct Answer: A

QUESTION 85
An engineer associates EPG-A with a VMM domain and sets the Deployment and Resolution preferences to Immediate. The host that will generate endpoints for EPG-A is attached to Leaf-101 and Leaf-102 using etht1/1. However, no configuration for EPG-A appears to have been pushed to the leaf switches. Which action must be taken for the configuration to be pushed to Leaf-101 and Leaf-102?

A. Disable and enable eth1/1 on both leaf switches.
B. Enable CDP or LLDP on the host.
C. Configure both ports for trunking.
D. Enable LACP on the leaf switch ports.

Correct Answer: B

QUESTION 86
Which Cisco ACI feature allows the encryption of communication over TEP addresses connecting sites via the intersite network in a Cisco Multi-Site deployment?

A. IPsec
B. TrustSec
C. MACsec
D. CloudSec

Correct Answer: D

QUESTION 87
An engineer is configuring a PBR service insertion for a firewall. The firewall must be inserted one-armed with these IP/MAC addresses:
1. Inside interface: 10.1.0.0.254/24 0000.0000.000a
2. Outside interface: 10.2.0.0.100/24 0000.0000.000b

The engineer has configured a device, a service graph template, and a contract. The service graph template has been applied to the contract, and the contract has been applied between EPG-1 and EPG-100. Which two actions complete the configuration? (Choose two.)

A. Associate the firewall bridge domain to a PBR policy.
B. Associate the provider and consumer connectors with a PBR policy.
C. Configure inside addresses in a PBR policy.
D. Configure the service graph template using a PBR policy.
E. Configure the device object to call a PBR policy.

Correct Answer: BD

QUESTION 88
An engineer must configure LACP Fast Rate for rapid error detection. The configuration must be applied to a port channel between an ACI leaf switch and an LACP-enabled network server. A new interface policy with a fast transmit rate has already been configured. Which configuration set is needed to finish the configuration?

A. Create a new port channel policy.
Apply the port channel policy as an override in the interface policy group.
B. Configure a leaf port channel interface policy group
Create a leaf interfaces overrides policy group.
C. Configure a leaf port channel interface policy.
Map the port channel member policy to the appropriate switch profile.
D. Associate the port channel policy to the appropriate policy group.
Configure a leaf port channel interface policy.

Correct Answer: A

QUESTION 89
An engineer must configure Cisco ACI for VMM integration to VMware vCenter. Which two attributes must be configured on the Cisco APIC to achieve this goal? (Choose two.)

A. cluster name
B. logon credentials
C. data center name
D. virtual switch name
E. port group

Correct Answer: BC

QUESTION 90
A Cisco APIC is configured with RADIUS authentication as the default. The network administrator must ensure that users can access the APIC GUI with a local account if the RADIUS server is unreachable. Which action must be taken to accomplish this goal?

A. Set RADIUS Realm to connect with Console Authentication
B. Create an additional login domain to associate with local accounts.
C. Configure the fallback login domain to reference Local Realm.
D. Enable Fallback Check for Default Authentication.

Correct Answer: C

QUESTION 91
A Cisco ACI fabric is integrated with a Cisco ASA firewall using a service graph under the tenant called Operations. The fabric must permit the firewall used on tenant Operations to be referenced by the tenant called Management. Which export action must be used to accomplish this goal?

A. service graph template
B. Layer4-Layer7 device
C. device selection policies
D. router configurations

Correct Answer: B

QUESTION 92
A Cisco ACI fabric is integrated with a VMware environment. The engineer must back up the current configuration of the fabric and restore the vCenter password when the configuration is imported. Which action accomplishes this goal?

A. Enable the Global AES Encryption setting.
B. Create a Configuration Import Policy.
C. Select SCP protocol for the remote location.
D. Set the Authentication type to Use Password.

Correct Answer: A

QUESTION 93
A Cisco ACI fabric with an ARP packet must ensure detection of silent hosts with an ARP packet. The current bridge domain is configured with hardware proxy and unicast routing. Which step must be taken on the bridge domain to complete the configuration?

A. Enable Flood in the bridge domain for Multi Destination Flooding.
B. Set Optimized Flood for L3 Unknown Multicast.
C. Set L2 Unknown Unicast to Flood.
D. Enable ARP Flooding in the bridge domain.

Correct Answer: D

QUESTION 94
An engineer configures port-12 on Leaf-101 and Leaf-102 to connect to a new server called SVR-12.This server will belong to a new EPG-12 and needs to use Encapsulation VLAN-12.An already existing server, which is named SVR-10, is also connected to the same leaf switches. SVR-10 belongs to EPG-10 and also uses Encapsulation VLAN-12. Which step must the engineer take to configure connectivity for SVR-12 and EPG-12?

A. Disable native VLAN on both EPGs.
B. Assign the IP address of SVR-12 to a different subnet.
C. Associate EPG-12 to the same BD as EPG-10.
D. Enable port local VLAN scope.

Correct Answer: D

QUESTION 95
A Cisco ACI environment is configured to integrate with a vCenter environment using the VMM domain name west_coast_VMM. Within the ACI environment, only tenant west_coast has EPGs associated with west_coast_VMM. This deployment is new, so these EPGs currently do not have any members. A systems engineer is setting up vCenter, creates a VDS named west-coast-VMM, and deletes the VDS named west_coast_VMM. The systems engineer creates the necessary port groups that correspond with the EPGs, but when VMs are connected to the port groups, they cannot ping their gateway. Which action establishes connectivity?

A. Rename the VDS to west_coast_VMM.
B. Use the EPG encap-VLAN on the port goups.
C. Disconnect Cisco APIC connectivity from vCenter.
D. Associate the EPGs to west-coast-VMM.

Correct Answer: A

QUESTION 96
An engineer must configure a Cisco ACI bridge domain to prevent flooding from unknown unicast frames. Which action must be configured in Cisco ACI to accomplish this goal?

A. Set Disable Remote EP Learn in the Fabric Wide Setting Policy.
B. Configure Clear Remote MAC Entries in the bridge domain mode.
C. Configure the bridge domain to operate in optimized mode.
D. Set the bridge domain option to Flood in Encapsulation.

Correct Answer: C

QUESTION 97
An endpoint called EP1 is connected to Cisco ACI compute leaf1. The engineer must replace EP1 with EP2 on the same leaf switch. Which set of actions forces all remote leaves to delete EP1 before timer expiration?

A. Set L2 Unknown Unicast to Hardware Proxy.
Select Clear remote I entries.
B. Set L2 Unknown Unicast to Flood.
Select Clear remote IP entries.
C. Set L2 Unknown Unicast to Flood.
Select Clear remote MAC entries.
D. Set L2 Unknown Unicast to Hardware proxy.
Select Clear remote MAC entries.

Correct Answer: C

QUESTION 98
Which protocol is used in the Cisco ACI fabric for automatic discovery?

A. IS-IS
B. COOP
C. LLDP
D. CFS

Correct Answer: C

QUESTION 99
An engineer configures an L3Out between BLeaf1 and Core1.ACisco Nexus 9000 Series Switch runs in NX-OS mode, and the two devices must peer using OSPF. The devices in the network are configured as follows:
1. BLeaf1 has been configured with the IP address 10.1.0.2/31 and the router ID 0.0.0.2.
2. Core1 has been configured with the IP address 10.1.0.3/31 and the router ID 0.0.0.1.
3. On Cisco ACI, the engineer has enabled OSPF using the default OSPF settings.
4. The engineer has configured OSPF on the NX-OS switch using the ip router ospf ACI_peering area 1 command.

Which action brings up the OSPF adjacency?

A. Set and Auth Key on Core1.
B. Configure Area 1 on BLeaf1.
C. Change the MTU on Core1.
D. Disable Hello Timer on BLeaf1.

Correct Answer: B

QUESTION 100
An engineer is configuring ACI VMM domain integration with Cisco UCS-B Series. Which type of port channel policy must be configured in the vSwitch policy?

A. MAC Pinning
B. LACP Active
C. LACP Passive
D. MAC Pinning-Physical-NIC-load

Correct Answer: A