I85PREP
⌘ K
Cisco DCACI 300-620 study materials
Cisco DCACI 300-620 study resources

Cisco DCACI 300-620 practice questions

One question at a time. Build your Cisco DCACI 300-620 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ACI Fabric Infrastructure

Which component of an ACI fabric is responsible for hosting the fabric-wide policies and providing the central point of configuration for the APIC cluster?

  1. The fabric extender
  2. The spine switches
  3. The Application Policy Infrastructure Controller Correct answer.
  4. The leaf switches

Explanation

The APIC cluster is the management and policy brain of the fabric. It stores the policy repository and pushes the resulting policy to the leaves and spines, while the switches themselves forward traffic. The APIC is not in the data path for endpoint-to-endpoint packets.

Question 2ACI Fabric Infrastructure

In an ACI spine-leaf topology, which statement correctly describes the typical physical connectivity?

  1. Every leaf connects to every other leaf in a full mesh.
  2. Every spine connects to every leaf, and leaves do not connect to each other. Correct answer.
  3. Leaves connect only to their local spines, and spines connect to each other in a ring.
  4. Spines connect only to the APIC cluster, and leaves connect only to border gateways.

Explanation

ACI uses a two-tier Clos fabric in which each leaf has at least one link to every spine, and leaf-to-leaf links are not part of the fabric underlay. Spines provide the any-to-any path between leaves. Leaf-to-leaf cabling is used only for special cases such as a leaf pair acting as a vPC access domain, not as fabric transport.

Question 3ACI Fabric Infrastructure

Which ACI construct is a logical container of endpoints and policies that behaves similarly to a VLAN broadcast domain but is decoupled from the physical VLAN ID?

  1. Bridge domain Correct answer.
  2. EPG
  3. Tenant
  4. VRF

Explanation

A bridge domain defines a Layer 2 forwarding domain and owns the subnet gateway and flooding behavior. It maps to a VLAN on a leaf only through the encapsulation assigned to EPGs. Endpoints in the same bridge domain can communicate at Layer 2, subject to contract and policy.

Question 4ACI Fabric Infrastructure

What is the function of the VXLAN-based overlay in an ACI fabric?

  1. It encrypts all tenant traffic between leaves and spines.
  2. It replaces the need for a routing protocol between spines and leaves.
  3. It provides Layer 2 connectivity only between the APIC and the leaves.
  4. It carries tenant traffic in a VXLAN header using the fabric's own encapsulation over the spine-leaf underlay. Correct answer.

Explanation

ACI encapsulates tenant frames in VXLAN with a fabric-specific header so that endpoints can be reached across the Clos underlay. The outer header carries the source and destination leaf VTEP addresses. The underlay itself uses IS-IS for routing, independent of the overlay.

Question 5ACI Fabric Infrastructure

Which protocol does an ACI fabric use for the underlay routing between spines and leaves by default?

  1. EIGRP
  2. OSPFv2
  3. IS-IS Correct answer.
  4. BGP

Explanation

ACI uses IS-IS as the underlay routing protocol to distribute loopback addresses for the spine and leaf VTEPs. This gives a stable, scalable topology database for the Clos fabric. Tenant routing is handled separately by the overlay and by the fabric's distributed gateway.

Question 6ACI Fabric Infrastructure

Which ACI policy element is used to group endpoints that share the same network policy and are associated with a single bridge domain?

  1. Filter
  2. Tenant
  3. Endpoint group Correct answer.
  4. Contract

Explanation

An endpoint group (EPG) is the policy grouping of endpoints, such as virtual machines or physical servers, that share the same requirements. Each EPG is associated with a bridge domain and a set of contracts. The EPG is the unit to which contracts are applied.

Question 7ACI Fabric Infrastructure

What is the purpose of the APIC cluster of three or more controllers in a production ACI fabric?

  1. To act as the default gateway for all bridge domains
  2. To replace the spine switches in the data path
  3. To provide redundancy and distributed policy management for the fabric Correct answer.
  4. To load-balance tenant data traffic across controllers

Explanation

The APIC cluster provides high availability and a distributed policy repository, with one controller elected as the leader. It is a management-plane cluster and does not forward tenant data. If a controller fails, the remaining controllers continue to manage the fabric.

Question 8ACI Fabric Infrastructure

Which statement best describes the role of a leaf switch in an ACI fabric?

  1. It connects endpoints and enforces fabric policy at the edge. Correct answer.
  2. It performs only Layer 2 switching and never routes.
  3. It hosts the policy repository and management GUI.
  4. It provides the any-to-any path between other leaves.

Explanation

Leaves are the edge devices that connect servers, hypervisors, and external networks to the fabric. They enforce policy through endpoint groups, contracts, and the distributed gateway. Spines provide the interspine forwarding path between leaves.

Question 9ACI Fabric Infrastructure

What does the APIC use to communicate management and policy information to the leaf and spine switches?

  1. SNMP traps only
  2. A separate OOB network using the REST API and an in-band policy channel Correct answer.
  3. A direct serial console session
  4. BGP route reflection

Explanation

The APIC uses an out-of-band management network for REST API access and an in-band policy channel to the switches. The switches register with the APIC cluster and receive policy updates through this channel. The APIC is not in the data path, so its connectivity is management-focused.

Question 10ACI Fabric Infrastructure

A network engineer wants to verify that a newly cabled leaf has joined the fabric. Which APIC GUI location would show the leaf's registration and health status?

  1. Fabric > Inventory > Topology Correct answer.
  2. System > Controllers
  3. Virtual Networking > Inventory
  4. Tenants > Policies > Contracts

Explanation

The Fabric > Inventory > Topology view shows the discovered nodes, their roles, and their health. A newly cabled leaf appears there once it registers with the APIC cluster. Checking this view confirms that the switch is discovered and part of the fabric.

Question 11ACI Fabric Infrastructure

Which ACI component is responsible for the distributed anycast gateway that allows endpoints in the same bridge domain to use the same default gateway IP regardless of their leaf?

  1. The border leaf
  2. The APIC
  3. The leaf switches Correct answer.
  4. The spine switches

Explanation

The distributed anycast gateway is configured on the bridge domain and implemented on every leaf that hosts the subnet. Each leaf answers for the same gateway MAC and IP, so endpoints can move without changing their default gateway. This is a fabric-wide function on the leaves.

Question 12ACI Fabric Infrastructure

What is the purpose of a VRF in an ACI tenant?

  1. To provide Layer 3 routing and isolation between bridge domains Correct answer.
  2. To assign VLAN encapsulation to endpoints
  3. To provide Layer 2 flooding domain isolation
  4. To manage APIC cluster membership

Explanation

A VRF is a Layer 3 context that provides routing and isolation between bridge domains. Bridge domains within the same VRF can route to each other, while different VRFs are isolated by default. This is analogous to a VRF-lite instance in traditional networking.

Question 13ACI Fabric Infrastructure

An engineer needs to allow HTTP traffic from a web EPG to an app EPG. Which ACI construct should be used to define the permitted traffic?

  1. A VRF context
  2. A contract with a filter that matches TCP port 80 Correct answer.
  3. An EPG static path binding
  4. A bridge domain subnet

Explanation

Contracts define the communication policy between EPGs, and a filter inside the contract subject specifies the match criteria such as TCP port 80. The contract is provided by one EPG and consumed by the other. This is the ACI way to permit specific traffic flows.

Question 14ACI Fabric Infrastructure

Which statement accurately describes the relationship between a bridge domain and a VRF in ACI?

  1. A bridge domain can belong to multiple VRFs at the same time.
  2. A bridge domain and a VRF are the same object with different names.
  3. A bridge domain belongs to one VRF, and a VRF can contain multiple bridge domains. Correct answer.
  4. A VRF belongs to one bridge domain, and a bridge domain can contain multiple VRFs.

Explanation

Each bridge domain is associated with exactly one VRF, which supplies the Layer 3 context for its subnet. A VRF can hold many bridge domains, allowing routing between them. This hierarchy provides both Layer 2 segmentation and Layer 3 isolation.

Question 15ACI Fabric Infrastructure

What does the fabric use the endpoint learning (endpoint database) for?

  1. To record APIC cluster leader elections
  2. To store the configuration of contracts and filters
  3. To map endpoint MAC and IP addresses to the leaf and port where they are learned Correct answer.
  4. To distribute IS-IS routes between spines

Explanation

The endpoint database tracks where each endpoint MAC and IP address was learned, including the leaf and interface. This lets the fabric forward frames directly to the correct leaf without flooding. Endpoint learning is a core part of the ACI data-plane behavior.

Question 16ACI Fabric Infrastructure

Which ACI feature allows a single leaf port to carry traffic for multiple EPGs by using different VLAN encapsulations?

  1. A VRF leak
  2. A static path binding with a VLAN pool and EPG encapsulation Correct answer.
  3. An anycast gateway
  4. A contract subject

Explanation

A static path binding attaches an EPG to a leaf interface and port, and the EPG's encapsulation (VLAN) identifies the traffic on that port. Multiple EPGs can share a port with different VLANs through separate bindings. This is common for bare-metal servers that trunk multiple VLANs.

Question 17ACI Fabric Infrastructure

What is the function of the ACI fabric's IS-IS configuration on the spine and leaf loopback interfaces?

  1. It advertises tenant subnets to external routers.
  2. It elects the APIC cluster leader.
  3. It provides reachability for the VTEP loopback addresses used by the VXLAN overlay. Correct answer.
  4. It assigns VLAN pools to leaf ports.

Explanation

The underlay IS-IS advertises the loopback addresses that serve as VTEP source and destination addresses for VXLAN. This gives every leaf a routable path to every other leaf's VTEP. Tenant subnets are advertised through the overlay and external routing, not the underlay IS-IS.

Question 18ACI Fabric Infrastructure

Which APIC object must be configured to define the VLAN pool that a leaf port uses for an EPG's encapsulation?

  1. A VRF context
  2. A tenant name
  3. A domain profile with a VLAN pool association Correct answer.
  4. A contract filter

Explanation

A domain profile associates a VLAN pool with a physical, virtual, or external domain, and the EPG uses an encapsulation from that pool. The VLAN pool defines the range of VLAN IDs available for allocation. Without the domain association, the EPG cannot bind to the leaf port with a valid VLAN.

Question 19ACI Fabric Infrastructure

A leaf switch is configured with an EPG static path binding to interface Ethernet 1/1 for VLAN 100. A server connected to that port sends untagged frames. What is the most likely result?

  1. The frames are flooded to all leaves in the fabric.
  2. The frames are accepted and mapped to the EPG regardless of tagging.
  3. The frames are dropped because the EPG expects VLAN 100 tagged traffic. Correct answer.
  4. The frames are routed to the default gateway automatically.

Explanation

A static path binding with an EPG encapsulation of VLAN 100 expects traffic tagged with VLAN 100 on that port. Untagged frames do not match the EPG encapsulation and are not admitted to that EPG. The port would need to be configured as an access port or the server would need to tag its frames.

Question 20ACI Fabric Infrastructure

Which statement correctly describes how the ACI fabric handles unknown unicast traffic in a bridge domain configured with hardware proxy mode?

  1. The frame is dropped until the destination endpoint is learned.
  2. The ingress leaf forwards the frame to the spine, which replicates it to all leaves.
  3. The ingress leaf floods the frame to every leaf in the fabric.
  4. The ingress leaf sends the frame only to leaves that have endpoints in the bridge domain, based on the endpoint database. Correct answer.

Explanation

In hardware proxy mode, the ingress leaf consults the endpoint database and forwards unknown unicast only to leaves that host endpoints in the bridge domain. This reduces unnecessary flooding compared with traditional flood-and-learn behavior. The spine does not replicate frames for this purpose.

Question 21ACI Fabric Infrastructure

An engineer observes that a leaf is not forming an IS-IS adjacency with a spine after cabling. Which two items are the most relevant to verify? (Choose the best single answer.)

  1. The VLAN pool and the domain profile
  2. The contract filters and the EPG encapsulation
  3. The APIC cluster leader election and the tenant VRF configuration
  4. The interface IP addressing and the IS-IS network point-to-point setting on both sides Correct answer.

Explanation

IS-IS adjacency formation depends on correct interface addressing and matching IS-IS settings such as the network point-to-point configuration on the fabric interfaces. If these do not match, the adjacency will not come up. Tenant policy objects such as contracts and EPGs are irrelevant to underlay adjacency.

Question 22ACI Fabric Infrastructure

What is the purpose of the ACI fabric's spine switch in the VXLAN overlay data path?

  1. It terminates VXLAN and decapsulates traffic for the APIC.
  2. It forwards VXLAN-encapsulated packets between leaf VTEPs based on the outer IP header. Correct answer.
  3. It assigns endpoint IP addresses through DHCP.
  4. It acts as the VTEP for all endpoints.

Explanation

Spines forward the VXLAN-encapsulated packets between leaf VTEPs using the outer IP header and the underlay routing. They do not terminate the overlay or act as VTEPs for tenant endpoints. This keeps the spine role simple and scalable.

Question 23ACI Fabric Infrastructure

Which ACI construct provides a way to share a route from one VRF to another within the same tenant?

  1. An EPG static path binding
  2. A contract
  3. A VRF leak Correct answer.
  4. A bridge domain subnet

Explanation

A VRF leak is configured to export and import routes between VRFs, allowing controlled Layer 3 reachability across isolated routing contexts. Contracts govern endpoint-to-endpoint policy and do not leak routing tables. This is useful for shared services reachable from multiple VRFs.

Question 24ACI Fabric Infrastructure

Which statement about the APIC's role in the ACI data plane is correct?

  1. The APIC provides the default gateway for all bridge domains.
  2. The APIC forwards tenant traffic between leaves when the spine path fails.
  3. The APIC encapsulates tenant traffic in VXLAN for the leaves.
  4. The APIC is not in the tenant data path; it manages policy and the fabric configuration. Correct answer.

Explanation

The APIC is a management and policy controller and does not forward tenant data. If the APIC cluster is unavailable, existing fabric forwarding continues based on the last policy. The leaves and spines handle all data-plane forwarding.

Question 25ACI Fabric Infrastructure

What is the effect of configuring a bridge domain with unicast routing enabled and an associated subnet?

  1. The bridge domain becomes a Layer 3 gateway for endpoints in that subnet. Correct answer.
  2. The bridge domain is converted into a VRF.
  3. The bridge domain floods all traffic to the spine for routing.
  4. The bridge domain stops learning endpoint MAC addresses.

Explanation

Enabling unicast routing on a bridge domain with a subnet makes the fabric act as the default gateway for that subnet. The anycast gateway address is derived from the subnet configuration. Endpoint MAC learning continues alongside routing.

Question 26ACI Fabric Infrastructure

Which APIC construct is the container for all tenant-level policy objects and is used to isolate configuration between different customers or environments?

  1. Bridge domain
  2. Tenant Correct answer.
  3. Access policy
  4. Context

Explanation

A tenant is the top-level policy container in ACI, and all VRFs, bridge domains, EPGs, and contracts for a given customer or environment live inside it. Because policy names are scoped to the tenant, two tenants can reuse the same names without conflicting.

Question 27ACI Fabric Infrastructure

Which object must be associated with a VLAN pool before that pool can be used in a domain for EPG encapsulation?

  1. A domain profile
  2. A physical domain Correct answer.
  3. An AAEP
  4. An interface policy group

Explanation

VLAN pools become usable only when they are associated with a domain profile such as a physical domain, which ties the pool to the ports managed by that domain. The EPG's static or dynamic path resolves its VLAN from the pool through the domain.

Question 28ACI Fabric Infrastructure

An engineer needs a leaf interface to come up as a fabric port toward a spine without any manual per-port configuration. Which access policy feature accomplishes this?

  1. A VLAN pool with static allocation
  2. An EPG with a dynamic path
  3. Fabric port auto-configuration via LLDP Correct answer.
  4. A static path binding

Explanation

Fabric ports use LLDP-based auto-configuration so that when a leaf port is cabled to a spine, the port is automatically placed into fabric mode without per-port policy. This is why spine-facing ports do not need interface policy groups or VLAN assignments.

Question 29ACI Fabric Infrastructure

Which statement describes the role of the APIC cluster's database in relation to fabric configuration?

  1. Switches pull raw GUI objects and compile them locally on each boot.
  2. Policy is stored only on the spines because they forward the overlay.
  3. Policy is written to the APIC cluster and distributed to switches as a fully resolved, normalized policy. Correct answer.
  4. Each leaf keeps an independent copy of tenant policy that is never synchronized.

Explanation

The APIC cluster holds the authoritative policy repository, and the controller resolves and normalizes configuration before pushing it to the switches. Switches receive the resulting concrete policy rather than raw user objects.

Question 30ACI Fabric Infrastructure

Which component of the ACI fabric is responsible for resolving endpoint locations and distributing that information across the fabric?

  1. The IS-IS link-state database on the spines only
  2. The COOP database maintained by spine and leaf switches Correct answer.
  3. The contract TCAM entries on each leaf
  4. The APIC's management VRF routing table

Explanation

Endpoint address and location information is shared among switches through the Council of Oracles Protocol (COOP) database, which lets any leaf forward to a remote endpoint without flooding. The APIC manages policy, but endpoint reachability is a fabric data-plane function.

Question 31ACI Fabric Infrastructure

What is the effect of assigning a VLAN pool to a physical domain with dynamic allocation enabled for EPG static paths?

  1. The administrator must manually type the VLAN on every static path.
  2. The pool is ignored and the EPG uses VLAN 1 by default.
  3. The APIC allocates a free VLAN from the pool per EPG on the port and prevents duplicate assignments. Correct answer.
  4. Each EPG chooses any VLAN from the pool, and conflicts are resolved by the spine.

Explanation

With dynamic allocation, the APIC picks an unused VLAN from the associated pool for each EPG's path and tracks assignments so that two EPGs on the same port do not collide. Static allocation instead requires the administrator to specify the VLAN explicitly.

Question 32ACI Fabric Infrastructure

Which ACI object group is used to apply interface-level policies such as speed, CDP, and LACP to a set of leaf ports?

  1. Interface policy group Correct answer.
  2. Access port selector
  3. Attachable access entity profile
  4. Leaf profile

Explanation

An interface policy group bundles link-level policies (for example CDP, LLDP, LACP, and speed) and is referenced by port selectors or profiles. The selector chooses which ports the policies apply to, while the policy group defines what those policies are.

Question 33ACI Fabric Infrastructure

A leaf switch is rebooted and comes back with its previously assigned policy intact. Which mechanism explains this behavior?

  1. The leaf downloads its full configuration from a TFTP server at boot.
  2. The leaf retains a local copy of its resolved policy and re-registers with the APIC cluster. Correct answer.
  3. The spine pushes a configuration snapshot to the leaf over the fabric port.
  4. The leaf boots in a default state until an administrator reapplies policy.

Explanation

Each switch stores a local copy of its resolved policy so that it can resume forwarding after a reload even if the APIC is briefly unreachable, and it re-registers with the cluster when connectivity returns. This design keeps the data plane resilient to controller outages.

Question 34ACI Fabric Infrastructure

Which statement describes how the ACI fabric forwards traffic between two endpoints in the same bridge domain on different leaves?

  1. The source leaf sends the frame to the spine, which looks up the destination leaf and forwards it.
  2. The APIC proxies the frame between leaves through its management interface.
  3. The source leaf encapsulates the frame in VXLAN and sends it directly to the destination leaf's VTEP. Correct answer.
  4. The frame is flooded to every leaf because bridge domains cannot be stretched.

Explanation

ACI uses a VXLAN overlay in which each leaf is a VTEP, so a source leaf that knows the remote endpoint's location encapsulates the frame and sends it directly to the destination leaf. Spines provide the underlying IP fabric for reachability but do not perform per-flow endpoint lookups.

Question 35ACI Fabric Infrastructure

Which ACI feature allows a leaf port to learn endpoints for multiple EPGs when the port is connected to a hypervisor using a VMM domain?

  1. A dynamic path binding resolved through the VMM domain Correct answer.
  2. An untagged native VLAN binding
  3. A routed sub-interface on the leaf
  4. A static path binding with a single encapsulation

Explanation

VMM domains create dynamic path bindings so that when a hypervisor adds a port group, the APIC automatically programs the corresponding encapsulation on the leaf port. This lets one port serve many EPGs without manual static configuration.

Question 36ACI Fabric Infrastructure

Which statement about the APIC's in-band and out-of-band management connectivity is correct?

  1. Out-of-band management traffic traverses the VXLAN overlay between leaves.
  2. Out-of-band management requires a routed path through the tenant data VRFs.
  3. In-band management uses the fabric's infrastructure VRF and is reachable through the leaf and spine network. Correct answer.
  4. In-band management is only available when the fabric is in monitor mode.

Explanation

In-band management gives the APIC and switches reachability through the fabric infrastructure network using the infrastructure VRF, typically via a leaf or spine management connection. Out-of-band management uses a dedicated physical management port separate from the data plane.

Question 37ACI Fabric Infrastructure

Which ACI construct maps a set of leaf interfaces to a switch profile so that interface policies are applied consistently to those ports?

  1. Node policy group
  2. Fabric membership policy
  3. Switch profile
  4. Interface profile Correct answer.

Explanation

An interface profile references interface selectors that pick the leaf ports, and it is associated with a switch profile that identifies the leaf switches. Together they apply interface policy groups to the chosen ports consistently.

Question 38ACI Fabric Infrastructure

What is the purpose of the infra tenant in an ACI fabric?

  1. It is a read-only tenant used only for reporting.
  2. It holds user-created bridge domains for application traffic.
  3. It contains fabric infrastructure policies such as access policies and fabric-wide settings. Correct answer.
  4. It stores the VMM domain integrations for hypervisors.

Explanation

The infra tenant is a built-in tenant that holds fabric infrastructure configuration, including access policies, fabric-wide settings, and management connectivity. User application policy normally lives in user-created tenants rather than in infra.

Question 39ACI Fabric Infrastructure

An engineer needs to confirm whether a leaf has successfully registered with the APIC cluster. Which fabric membership indicator should be checked?

  1. The bridge domain's unicast routing setting
  2. The leaf's interface policy group assignment
  3. The VLAN pool allocation range
  4. The node's fabric membership status and registered APIC controllers Correct answer.

Explanation

Fabric membership is tracked per node, including whether the switch has registered with the APIC cluster and its current membership state. This is the authoritative check for whether a newly cabled leaf has joined the fabric.

Question 40ACI Fabric Infrastructure

Which statement best describes how ACI handles a broadcast frame received from an endpoint in a bridge domain?

  1. The leaf drops it because ACI does not support broadcast traffic.
  2. The leaf forwards it only to ports and remote leaves that participate in the same bridge domain. Correct answer.
  3. The leaf floods it to all leaves in the fabric regardless of bridge domain membership.
  4. The leaf sends it to the APIC, which replicates it to the correct leaves.

Explanation

Broadcast, unknown unicast, and multicast traffic is scoped to the bridge domain, so the source leaf replicates it only to local ports and remote leaves that have members in that bridge domain. ACI does not flood such frames fabric-wide.

Question 41ACI Packet Flow

In an ACI fabric, which forwarding decision does the leaf perform when it receives a frame from a server-facing port on an EPG mapped to a bridge domain?

  1. Source MAC lookup in the local endpoint table and destination lookup in the global endpoint table Correct answer.
  2. Policy enforcement by the spine before the frame reaches the leaf
  3. Flooding to all fabric ports until an endpoint is learned
  4. Routing lookup in the spine's forwarding table for the destination IP

Explanation

The ingress leaf learns the source MAC in its local endpoint table and performs a destination lookup in the global endpoint table distributed by COOP. If the destination is local it switches locally; if remote it encapsulates the frame with VXLAN toward the destination leaf. Spines never make the routing or bridging decision for the packet.

Question 42ACI Packet Flow

What does the ingress leaf add to a frame before sending it across the ACI fabric to a remote leaf?

  1. A GRE tunnel header with the spine as the tunnel endpoint
  2. A MAC-in-MAC header with the spine's bridge identifier
  3. A VXLAN header carrying the source and destination VTEP addresses Correct answer.
  4. An 802.1Q tag with the destination leaf's VLAN ID

Explanation

ACI uses VXLAN encapsulation between leaf VTEPs. The ingress leaf builds a VXLAN header whose outer IP addresses are the source and destination leaf VTEP addresses, and the fabric header carries a class ID used for forwarding. The spine forwards based on this fabric header without changing the VXLAN payload.

Question 43ACI Packet Flow

Which component is responsible for distributing endpoint reachability information between leaf switches in an ACI fabric?

  1. The DHCP relay agent on each leaf
  2. The COOP protocol running on spine switches Correct answer.
  3. The APIC policy compiler
  4. The STP domain spanning the fabric

Explanation

Endpoint information is distributed by the Council of Oracles Protocol (COOP), which runs on the spines and shares the endpoint tables held by leaves. The APIC configures policy but does not forward or distribute endpoint reachability in the data plane.

Question 44ACI Packet Flow

A leaf receives a frame for a destination MAC that is not present in its global endpoint table. What does the leaf do with the frame within the bridge domain?

  1. Drops it and sends an ICMP unreachable message
  2. Sends it to the APIC for resolution
  3. Forwards it to the spine's supervisor for a routing decision
  4. Floods it to all leaf switches that have the bridge domain's EPG deployed Correct answer.

Explanation

When the destination is unknown, the ingress leaf floods the frame to all leaves where the bridge domain and the source EPG are deployed, using the fabric multicast tree for that group. This is the standard unknown-unicast behavior in an ACI bridge domain.

Question 45ACI Packet Flow

Which statement describes the role of the spine in the ACI packet flow for traffic between two leaf switches?

  1. It enforces contract filters between source and destination EPGs
  2. It forwards VXLAN-encapsulated frames using the fabric header without rewriting the tenant payload Correct answer.
  3. It performs the inter-VRFs routing lookup on behalf of the leaves
  4. It terminates VXLAN and re-encapsulates the frame toward the destination leaf

Explanation

Spines act as the VXLAN transit fabric. They forward based on the fabric header that carries the destination VTEP information and do not rewrite the tenant payload or inspect tenant IP addresses. Routing and contract enforcement occur at the leaf.

Question 46ACI Packet Flow

How is the destination VTEP address selected for a frame forwarded to a remote endpoint in the same bridge domain?

  1. It is the physical interface address of the destination leaf's uplink
  2. It is the anycast address of the spine proxy
  3. It is the loopback address of the leaf where the destination endpoint was learned Correct answer.
  4. It is the router MAC of the destination bridge domain

Explanation

Each leaf has a VTEP address derived from its loopback, and the global endpoint table maps each endpoint MAC to the VTEP of the leaf that owns it. The ingress leaf uses that mapping to build the VXLAN outer header. The destination leaf's physical uplink address is not used as the VTEP.

Question 47ACI Packet Flow

For traffic between two EPGs in different bridge domains within the same tenant, where is the contract enforced?

  1. On the destination leaf only, after the frame is decapsulated
  2. On the APIC, which proxies the first packet of each flow
  3. On the ingress leaf, using the source EPG's contract and the destination EPG's policy Correct answer.
  4. On the spine that carries the VXLAN frame

Explanation

ACI enforces contracts at the ingress leaf by combining the source EPG's contract with the destination EPG's provider or consumer relationship. The leaf applies the filter before forwarding, so the decision is made as close to the source as possible. The APIC is not in the data path.

Question 48ACI Packet Flow

What is the purpose of the fabric header that the ingress leaf prepends to the VXLAN packet?

  1. It carries the class ID used by the spine to forward the packet to the destination leaf Correct answer.
  2. It carries the APIC's management IP for logging
  3. It carries the tenant's VLAN ID for the destination leaf
  4. It carries the contract filter result for the destination leaf

Explanation

The fabric header contains a class ID that identifies the destination leaf or multicast group, allowing the spine to forward the frame without inspecting the tenant payload. It is stripped by the egress leaf before the frame leaves the fabric.

Question 49ACI Packet Flow

A packet is routed between two bridge domains on the same leaf. Which address does the leaf use as the source MAC in the routed frame?

  1. The destination leaf's VTEP address
  2. The bridge domain's router MAC address Correct answer.
  3. The spine's fabric MAC address
  4. The source endpoint's original MAC address

Explanation

When the leaf routes between bridge domains, it rewrites the source MAC to the bridge domain's router MAC and the destination MAC to the next-hop endpoint or router MAC. The original source MAC is not preserved in the routed frame. This is standard distributed anycast gateway behavior in ACI.

Question 50ACI Packet Flow

An endpoint is learned on a leaf, but the same MAC later appears on a different leaf. What does ACI do to resolve the conflict?

  1. The original leaf keeps the entry until the aging timer expires, ignoring the new location
  2. The newer endpoint learning updates the global table and traffic is redirected to the new location Correct answer.
  3. The APIC raises a fault and blocks all traffic to that MAC
  4. Both entries remain and traffic is load-balanced between the two leaves

Explanation

ACI uses a move detection mechanism: when an endpoint is learned at a new location, COOP updates the global endpoint table so the new location becomes authoritative. The old entry is replaced rather than kept until aging, and traffic follows the endpoint to its new leaf.