Implementing Cisco Application Centric Infrastructure - Advanced (DCACIA) Free Sample Questions

In a Multi-Pod fabric, the COOP protocol uses multicast to announce the spine proxy TEP addresses between pods. This requires multicast routing to be correctly configured and enabled on the IPN. Specifically, PIM Bi-directional (bidir) mode is a requirement for the IPN to properly forward the COOP multicast traffic. While OSPF establishes unicast reachability, the absence of PIM prevents the control plane announcements necessary for endpoint learning across pods.

For VRF route leaking to function for shared services, the subnet of the provider (the DNS service) must be leaked into the consumer VRFs, and the subnets of the consumers must be leaked into the provider VRF. While setting the consumer subnet scope to 'Shared between VRFs' is a necessary step, the provider's BD must also be explicitly associated with the consumer tenant VRFs. This action, combined with the contract, allows the fabric to program the necessary routes and policy for inter-VRF communication.

A taboo contract is used to explicitly deny traffic between EPGs, and it takes precedence over any standard contracts that might permit the traffic. This directly fulfills the requirement to block communication between the two legacy EPGs regardless of other policies.

Setting the VRF to 'Enforced' mode establishes a default-deny policy where no traffic is allowed unless explicitly permitted by a contract. This meets the primary requirement of denying all traffic by default.

In ACI Multi-Pod, inter-pod multicast traffic is encapsulated using a VRF-specific multicast address known as the GIPo. Each VRF that needs to pass multicast traffic between pods must have a unique GIPo from the reserved multicast address pool configured under the tenant. If this is not configured, the fabric does not have a destination multicast address to use for the outer VXLAN header when forwarding multicast packets across the IPN.

The 'Remote EP Learn' setting, available on a Bridge Domain, controls whether remote endpoints (those learned in other pods and advertised via COOP) are programmed into the local leaf switch tables. By disabling this feature, the leaf switches in that pod will not learn remote endpoint information. Instead, traffic destined for a remote endpoint will be forwarded to the spine proxy, which performs the lookup and forwards accordingly. This conserves leaf switch table space and reduces control plane churn at the cost of a slightly less optimal data path.

False. A contract with 'Global' scope, when configured in a schema on the NDO, allows it to be exported to other tenants. This enables inter-tenant communication across the Multi-Site fabric, a key feature for shared service designs in a multi-site environment.

When using PBR with a redundant, non-clustered service device, ACI needs a mechanism to track the health of the destination and redirect traffic if a path fails. The 'PBR Tracking' for a service device feature allows the fabric to monitor the health of multiple PBR destinations (the firewall interfaces on each leaf). If one path fails its health check, ACI automatically redirects traffic to the other healthy destination, ensuring service availability. This is the correct mechanism for this specific high-availability scenario.

This is the most direct and correct way to implement the policy. A contract from App to Web allows the required communication. A second contract from DB to App allows that required communication. Because the VRF is in 'Enforced' mode, any communication not explicitly permitted by a contract is denied by default. Therefore, no communication is possible between Web and DB, and no additional 'deny' or 'taboo' contract is necessary.

Bidirectional Forwarding Detection (BFD) is the recommended mechanism for achieving fast failure detection and convergence in an IPN. BFD provides low-overhead, sub-second failure detection for the OSPF adjacencies between the ACI spine switches and the IPN devices. When a failure is detected by BFD, it immediately informs OSPF, which can then reconverge much faster than it would by waiting for its own hello/dead timers to expire.

BPDU Guard, when enabled on an ACI leaf port, will err-disable the port if it receives a BPDU. This is a strong protective measure to ensure that no external STP instance can influence the ACI fabric.

BPDU Filter, when enabled, prevents the ACI leaf port from both sending and receiving BPDUs. This effectively isolates the ACI fabric from the external STP domain without shutting down the port, making it a less disruptive option than BPDU Guard.