Free 600-660 sample questions

Correct answer: Configure MACsec encryption on the links between the ACI spine switches and the IPN devices.

When the IPN devices do not support CloudSec, the recommended and supported method for encrypting inter-pod traffic is to use MACsec (802.1AE) on the physical links between the ACI spine switches and the IPN. This provides hop-by-hop Layer 2 encryption. CloudSec is used for ACI Multi-Site encryption over the ISN. L3Out with IPsec is a valid encryption method but is more complex and typically used for connecting to external networks, not for the IPN itself. GDOI is not the standard mechanism for IPN encryption in ACI.

Correct answer: The server-side NIC teaming is configured for active/active load balancing without using LACP.

When a server connected via vPC uses an active/active NIC teaming mode (like source MAC hashing) without a link aggregation protocol like LACP, it can send traffic from the same MAC address out of both physical NICs. The ACI leaf switches may see the same endpoint MAC address rapidly appearing on different ports in the vPC, leading the rogue endpoint detection feature to incorrectly flag it. The correct configuration is to use LACP for active/active teaming to present a single logical link to the fabric.

Correct answer: Enable Optimized WAN (OWAN) mode.

In a Multi-Site environment, the Bridge Domain can be configured with 'Optimized WAN' (OWAN) mode, also referred to as 'Inter-Site BUM Traffic Allow' set to disabled. This configuration ensures that BUM traffic is contained within the local site and not forwarded across the Inter-Site Network (ISN). This is the standard best practice to conserve expensive WAN bandwidth and prevent fault propagation between sites.

Correct answer: Configure a taboo contract between EPG-Web and EPG-DB.

A taboo contract is a special type of contract that explicitly denies communication between EPGs. It has a higher priority than standard allow contracts. By creating a taboo contract between EPG-Web and EPG-DB, all traffic will be dropped, regardless of any other contracts that might permit communication. A standard contract with a deny filter has lower precedence. vzAny doesn't provide the specific EPG-to-EPG denial required. Setting contract priorities can work but is more complex to manage; taboo is the most direct and highest-precedence method for this specific requirement.

Correct answers: Enable BPDU Filter on the ACI leaf port policy group.; Enable BPDU Guard on the ACI leaf port policy group.

BPDU Filter prevents the ACI leaf from sending BPDUs out of the port, which is crucial to not interfere with the external STP domain where the legacy switch is root.

BPDU Guard should be enabled on ACI ports facing traditional switches. This is a safety mechanism; if the ACI leaf unexpectedly receives a superior BPDU, it will err-disable the port, preventing a potential loop from forming. The combination of BPDU Filter (outbound) and BPDU Guard (inbound) is the Cisco best practice for this scenario.

Correct answers: The PBR policy must be configured for symmetric redirection.; The consumer and provider connectors of the service graph must be connected to the same EPG.

Symmetric PBR ensures that return traffic from the server to the client is also redirected through the same firewall instance, which is essential for stateful inspection.

Since the client and server are in the same EPG (and therefore the same BD), this is an intra-EPG contract scenario. For PBR to work in this case, both the consumer and provider connectors of the service graph must be attached to the same EPG (EPG-A), effectively redirecting traffic that originates and terminates within that EPG.

Correct answer: False

This statement is false. COOP is responsible for distributing endpoint information (MAC and IP addresses) to the spine proxy database within its *local* pod only. For inter-pod communication, MP-BGP EVPN is used over the IPN to advertise endpoint reachability information between the pods.

Correct answer: Enable 'Limit IP Learning to Subnet'

The 'Limit IP Learning to Subnet' option (also known as Enforce Subnet Check in some versions/contexts) on a Bridge Domain enforces that the fabric only learns endpoint IP addresses that fall within the subnets configured under that BD. This is a security and hygiene feature to prevent learning of unexpected or misplaced endpoints.

Correct answer: An inter-site L3Out with route leaking configured in the MSO schema template.

In MSO, communication between EPGs in different VRFs and different sites is achieved by configuring route leaking between the VRFs at the schema level. This is typically done in conjunction with an inter-site L3Out configuration within the template. MSO automates the underlying BGP EVPN route-target configurations on both fabrics to allow the selective exchange of routes between VRF1 in SiteA and VRF2 in SiteB, enabling the required communication.

Correct answer: The scope of the subnet under the provider EPG.

When configuring inter-VRF route leaking, the subnet object under the EPG that is *providing* the contract must have its scope configured correctly. To leak the subnet to another VRF, the scope must be set to 'Shared between VRFs'. This tells the fabric that this specific prefix is eligible to be advertised to other VRFs that consume the contract.