Building the Cisco Cloud with Application Centric Infrastructure Free Practice Test — 30 Questions

Question 1

Consider a scenario where a critical cloud application, deployed within a Cisco Application Centric Infrastructure (ACI) fabric, experiences a sudden surge in user traffic that necessitates an immediate reallocation of network resources and a shift in traffic prioritization. Concurrently, an unexpected hardware anomaly is detected on one of the fabric\'s spine switches, potentially impacting connectivity for a subset of leaf switches. Which core ACI architectural principle is most instrumental in ensuring the application\'s continued availability and performance during this period of dynamic operational adjustment and potential infrastructure instability?

Accepted Answer

The distributed nature of policy enforcement and forwarding state across the ACI fabric.

Question 2

A distributed cloud environment utilizing Cisco Application Centric Infrastructure (ACI) is experiencing a critical failure where a core application service, essential for tenant onboarding, is intermittently unavailable. Initial investigations confirm that the relevant Application Network Profiles (ANPs) and their associated Endpoint Groups (EPGs) are correctly provisioned and healthy within the ACI fabric. However, the specific Contract governing communication between the service-providing EPG and its dependent EPGs is not being consistently enforced, leading to unpredictable access. Which of the following conditions most directly explains this observed behavior of inconsistent policy enforcement within the ACI fabric?

Accepted Answer

A misconfiguration within the Contract's filters, leading to selective denial of legitimate traffic.

Question 3

During a planned maintenance window for a critical leaf switch in a Cisco ACI fabric, the switch unexpectedly fails to rejoin the fabric after a reboot, leading to a temporary loss of connectivity for several endpoints. Which fundamental operational principle of the APIC is most directly responsible for re-establishing consistent policy enforcement across the remaining active leaf switches for the affected endpoints?

Accepted Answer

The APIC's distributed state synchronization mechanism and its ability to re-propagate policy context to available fabric nodes.

Question 4

Consider a multi-tenant Cisco ACI environment where a financial services tenant requires advanced intrusion detection services for traffic flowing between its web application servers and its backend database servers. The security policy dictates that all such traffic must be inspected by a third-party firewall appliance, and logs from this inspection must be retained for compliance. The web servers are represented by an EPG named `web-tier`, and the database servers by an EPG named `db-tier`. Which of the following ACI policy configurations most accurately facilitates this requirement, ensuring both traffic redirection to the external appliance and the capture of relevant logs for auditing?

Accepted Answer

A contract between `web-tier` and `db-tier` with the "Any" subject and "permit" action, with logging enabled on the contract.

Question 5

Consider a scenario within a Cisco ACI fabric where Tenant Alpha hosts a critical database service EPG, and Tenant Beta hosts a front-end application EPG. A contract, \"DB-Access-Policy,\" has been meticulously configured and deployed exclusively within Tenant Alpha, intended to permit communication from a specific external EPG to the database EPG. However, the front-end application EPG in Tenant Beta is now unable to establish a connection to the database EPG in Tenant Alpha, despite both EPGs being configured with appropriate VRFs and subnets. What is the most likely reason for this communication failure?

Accepted Answer

The "DB-Access-Policy" contract, being scoped solely to Tenant Alpha, is not recognized or enforced for EPGs residing in Tenant Beta, preventing inter-tenant communication.

Question 6

A cloud architect is tasked with enabling secure, controlled communication between a customer-facing web application residing in \"Tenant_Web\" and a backend data analytics service in \"Tenant_Analytics\" within a Cisco ACI fabric. Both tenants are configured with distinct VRFs and have their respective application components organized into Endpoint Groups (EPGs). The current policy configuration prohibits all inter-tenant traffic by default. Which of the following actions is the most appropriate and secure method to facilitate the necessary communication, ensuring that only the specific data exchange required for analytics is permitted?

Accepted Answer

Create a new contract that defines the permitted protocols and ports, and then associate the relevant EPGs from Tenant_Web and Tenant_Analytics with this contract.

Question 7

A cloud deployment team, tasked with integrating a new application suite onto a Cisco ACI fabric, finds itself consistently falling behind schedule and facing escalating operational costs. Their established workflows, heavily reliant on manual network device configurations and ad-hoc troubleshooting, are proving inadequate for the dynamic policy-driven nature of ACI. Team members express frustration with the unfamiliar automation tools and the perceived complexity of the new policy models, leading to a reluctance to deviate from their traditional methods. The project lead observes a pattern of resistance to adopting new deployment paradigms and a struggle to manage the evolving requirements of the ACI environment. Which of the following behavioral competencies, when developed, would most directly address the team\'s core challenges in this ACI deployment scenario?

Accepted Answer

Adaptability and Flexibility

Question 8

Consider a scenario where a Cisco Nexus 9000 series leaf switch, operating within a Cisco Application Centric Infrastructure (ACI) fabric, temporarily loses its network management connectivity to the APIC cluster. While the leaf switch maintains operational forwarding for existing active flows based on its last synchronized configuration, which of the following capabilities is *most* immediately and critically impaired due to this loss of APIC synchronization?

Accepted Answer

The leaf switch's ability to dynamically instantiate new endpoint groups (EPGs) or update policies for existing EPGs according to the defined application network profiles.

Question 9

Following a successful product launch, a critical financial services application deployed within a Cisco ACI fabric experiences a significant and sustained increase in concurrent user sessions. This surge in traffic has led to intermittent application unresponsiveness and has placed the system in jeopardy of violating its Service Level Agreement (SLA) for transaction processing time. Initial diagnostics indicate no hardware over-subscription or physical network congestion on the leaf or spine switches. The application owner reports that the application is designed for elastic scaling but appears constrained by network policy configurations. What fundamental ACI design principle, when appropriately applied, would best address this scenario to ensure the application can leverage its inherent elasticity?

Accepted Answer

Re-architecting the application's Endpoint Group (EPG) definitions and associated contracts to allow for more granular and dynamic communication flows, enabling better resource utilization during peak demand.

Question 10

Consider a scenario within a Cisco Application Centric Infrastructure (ACI) fabric where a single spine switch experiences a catastrophic hardware failure, leading to its complete offline status. Assuming the fabric has multiple APIC controllers for high availability and other spine and leaf switches remain operational and connected, what is the most accurate consequence regarding the enforcement of tenant policies across the functional segments of the fabric?

Accepted Answer

Tenant policies continue to be enforced by the operational leaf switches based on their cached policy information, although fabric capacity and potential traffic paths may be reduced.

Question 11

A new tenant, \"AstroDynamics,\" is onboarding to a Cisco ACI fabric. Their primary application, \"MissionControl,\" needs to securely communicate with an existing application, \"LaunchServices,\" which resides within the \"SpaceOps\" tenant. Both applications are designed to leverage microservices architecture and require specific port access for inter-service communication. Given the inherent isolation between tenants in ACI, what is the most effective and secure method to enable this controlled communication between the \"MissionControl\" application in \"AstroDynamics\" and the \"LaunchServices\" application in \"SpaceOps\"?

Accepted Answer

Create an EPG for "MissionControl" within the "AstroDynamics" tenant and associate a Contract that explicitly permits the required traffic to the EPG associated with "LaunchServices" in the "SpaceOps" tenant.

Question 12

Consider a multi-tiered enterprise application deployed within a Cisco Application Centric Infrastructure (ACI) fabric. The application\'s network profile is mapped to an EPG that utilizes a specific VXLAN VNI and is governed by a set of inter-EPG contracts defining communication policies. If a new instance of a web server virtual machine, requiring the same network segmentation and communication privileges as existing web servers, is provisioned and associated with this EPG, what is the fundamental mechanism by which the ACI fabric ensures its immediate and compliant network integration without requiring manual VLAN reassignments or VRF modifications?

Accepted Answer

The ACI fabric automatically assigns the new virtual machine to the appropriate VXLAN VNI associated with its EPG, and the declarative policy model dynamically enforces the pre-defined security and network contracts upon instantiation.

Question 13

Consider a scenario where a critical network fabric switch, integral to a multi-tier application\'s phased migration to a Cisco ACI environment, experiences an unexpected hardware malfunction. This event occurs mid-deployment, impacting the planned sequence of operations. Which of the following actions best exemplifies the required adaptability and problem-solving skills to maintain operational effectiveness and minimize service degradation?

Accepted Answer

Immediately activate contingency plans to isolate the affected fabric node, re-evaluate the remaining migration phases considering the new constraint, and communicate revised timelines and potential service adjustments to all relevant stakeholders.

Question 14

A critical enterprise resource planning (ERP) system, recently migrated to a Cisco ACI fabric, is exhibiting intermittent and subtle increases in transaction response times, affecting user productivity. Initial network diagnostics confirm full Layer 2 and Layer 3 reachability between application tiers, and the ACI fabric health scores are nominal. The migration involved defining new Application Network Profiles (ANPs) with associated EPGs and Contracts to segment the ERP application. Which ACI policy element, if improperly configured or overly permissive in its definition, is most likely contributing to this observed latency, assuming no fundamental hardware or interface failures?

Accepted Answer

Contract definitions allowing a broad range of protocols and ports without specific filtering.

Question 15

A cloud architect is tasked with deploying a new multi-tier application suite for a financial services firm, \"ApexFin,\" within an existing Cisco ACI fabric. The firm operates under stringent regulatory compliance mandates requiring strict network segmentation and auditable policy enforcement for all financial data processing. The architect needs to establish the foundational elements to represent ApexFin\'s application infrastructure and define how different application tiers will communicate securely. What is the most appropriate sequence of ACI object creation to logically represent ApexFin\'s application environment and enable inter-tier communication according to best practices?

Accepted Answer

Tenant -> Application Network Profile -> Endpoint Group -> Contract

Question 16

Consider a complex multi-tier financial application deployed within a Cisco ACI-managed cloud environment. The application relies on an external, latency-sensitive market data feed service. During a routine infrastructure maintenance window, the operations team relocates this market data feed service to a new, more robust data center segment, which is represented by a different bridge domain and associated endpoint group (EPG) within the ACI fabric. The application\'s existing ACI policy, defining communication contracts between the application\'s tiers and the market data feed service, has not been altered. What is the most appropriate and efficient method to ensure continued, compliant communication for the financial application with the relocated market data feed service, leveraging ACI\'s architectural strengths?

Accepted Answer

Update the application's EPG to include the new endpoint group where the market data feed service has been relocated, ensuring the existing contracts are automatically enforced across the updated endpoint associations.

Question 17

Consider a scenario where a network administrator is expanding an existing Cisco ACI fabric by adding a new leaf switch. The fabric currently operates with multiple EPGs, bridge domains, and VRFs already defined and actively used for application traffic. The administrator has completed the physical cabling and initial fabric discovery for the new leaf switch. Which of the following accurately describes the immediate and expected behavior of the ACI fabric regarding policy enforcement for existing EPGs and their associated traffic after the new leaf switch has successfully joined the fabric?

Accepted Answer

The new leaf switch will automatically receive and apply the existing ACI policies for all relevant EPGs and VRFs, enabling seamless integration without disruption to ongoing traffic flows on other fabric nodes.

Question 18

Consider a scenario where a network administrator, accustomed to traditional Cisco IOS environments, attempts to manually configure a VLAN on a Cisco Nexus 9000 series leaf switch participating in an ACI fabric. This manual configuration is performed directly on the switch\'s command-line interface, bypassing the APIC. What is the most probable outcome for this manually created VLAN configuration?

Accepted Answer

The manually configured VLAN will be automatically removed or overwritten by the APIC during its next configuration reconciliation cycle.

Question 19

Consider a scenario within a Cisco ACI fabric where an organization has established two distinct Bridge Domains (BDs), \"Finance-BD\" and \"HR-BD,\" both intended to utilize the same IP subnet range for their respective virtual machines. The IT security policy mandates strict segmentation between these two departments at Layer 2, but requires controlled Layer 3 access to a common corporate application gateway. Which ACI configuration best facilitates this requirement, ensuring policy adherence and efficient routing?

Accepted Answer

Associating both Bridge Domains with the same Virtual Routing and Forwarding (VRF) instance.

Question 20

A large financial institution is undertaking a significant modernization initiative, migrating its core trading platforms from legacy on-premises infrastructure to a new cloud-native environment built upon Cisco Application Centric Infrastructure (ACI). The migration strategy involves a phased approach, where certain components of a trading application will reside on-premises while others are deployed within the ACI fabric. This hybrid state necessitates a robust mechanism for maintaining consistent network segmentation, security policies, and service guarantees across both environments throughout the transition. Which architectural construct within the ACI framework is most instrumental in abstracting and managing these policy requirements for services that are in a state of flux between the traditional data center and the new ACI-based cloud?

Accepted Answer

Endpoint Group (EPG) abstraction

Question 21

A critical, unpatched vulnerability has been identified within the Cisco APIC controller software that poses a significant security risk to the entire data center fabric. The organization relies heavily on the stability and availability of applications managed by this ACI deployment. Considering the need for both immediate risk mitigation and the preservation of ongoing application delivery, what is the most prudent and effective strategy to address this situation?

Accepted Answer

Immediately deploy the security patch to all APIC controllers during the next scheduled maintenance window, prioritizing complete remediation over pre-deployment testing to minimize exposure time.

Question 22

A multi-tier financial analytics application is being deployed within a shared Cisco ACI tenant. The application\'s database tier requires strict network isolation, preventing any form of direct communication with the HR department\'s legacy reporting servers, which reside in a separate Endpoint Group (EPG) within the same tenant. Both the database tier EPG and the HR reporting EPG are correctly configured with their respective network access policies and associated with specific contracts governing their internal communication. To enforce the required isolation, what is the most effective ACI configuration strategy to prevent any data exfiltration or unauthorized access from the database tier to the HR reporting infrastructure?

Accepted Answer

Ensure no contract is shared between the database tier EPG and the HR reporting EPG that explicitly permits the required database protocols and ports.

Question 23

Consider a large enterprise cloud environment utilizing Cisco ACI where a critical business application\'s operational paradigm has recently evolved. Previously, the application maintained a stable set of servers with consistent roles. However, the new strategy involves dynamic scaling, frequent redeployments of microservices across different server instances, and a requirement for ephemeral EPG memberships that change based on workload characteristics rather than static IP addresses. Which fundamental ACI policy enforcement mechanism best supports this transition, ensuring that security and connectivity policies remain consistently applied to these fluid workloads without requiring manual intervention for each shift?

Accepted Answer

Dynamic EPG membership based on endpoint attributes and contract inheritance

Question 24

Consider a multi-tier web application deployed within a Cisco ACI fabric. The presentation tier consists of stateless web servers distributed across multiple leaf switches, while the application tier comprises stateful application servers that require centralized load balancing and session persistence. The load balancer must be positioned to intercept and manage traffic between the presentation and application tiers, ensuring that specific security policies are applied only to the load balancer\'s traffic. Which ACI configuration best facilitates this requirement while maintaining granular policy control and optimal network segmentation for the stateful component?

Accepted Answer

Create a dedicated Endpoint Group (EPG) for the stateful load balancer, establish a contract between this EPG and the EPG for the stateless presentation tier, and then establish another contract between the load balancer EPG and the EPG for the application tier.

Question 25

Consider a scenario in a Cisco ACI fabric where a critical leaf switch responsible for connecting a set of tenant workloads experiences an unexpected hardware failure. Following a successful hardware replacement and reboot, the leaf switch rejoins the fabric. What is the most accurate description of the ACI fabric\'s behavior regarding policy enforcement for the endpoints previously connected to the failed leaf switch?

Accepted Answer

The APIC re-applies the existing policies to the recovered leaf switch, re-establishing endpoint connectivity and policy enforcement.

Question 26

A network administrator is migrating a suite of critical business applications from a traditional Cisco IOS-based network to a Cisco Application Centric Infrastructure (ACI) fabric. During testing, it is observed that several of these applications, which rely on multicast protocols for service discovery and state synchronization, are exhibiting intermittent failures and timeouts. The applications function correctly when tested in isolation but fail when integrated into the ACI environment. What is the most fundamental ACI configuration element that needs to be reviewed and potentially adjusted to ensure proper multicast operation for these applications?

Accepted Answer

The multicast configuration settings within the Bridge Domain associated with the application's Endpoint Groups.

Question 27

A critical multi-tier application deployed within a Cisco ACI fabric is exhibiting intermittent packet loss affecting user experience. The application\'s primary database tier, currently managed by a specific Endpoint Group (EPG), is configured with a static binding to a physical interface on Leaf 102. However, monitoring reveals that the database instances are frequently relocated by the orchestration platform to different virtual machines hosted on various servers connected to Leaf 102 and, occasionally, Leaf 103. This dynamic movement of application endpoints is not being reflected in the ACI policy due to the static binding. What is the most appropriate action to rectify this persistent packet loss and ensure consistent service delivery?

Accepted Answer

Reconfigure the EPG's binding from static to dynamic, leveraging ACI's fabric intelligence to track endpoint mobility.

Question 28

A financial services firm is undertaking a significant initiative to modernize its on-premises data center by migrating a suite of legacy, stateful transactional applications to a new infrastructure built on Cisco Application Centric Infrastructure (ACI). The primary objective is to enhance agility, scalability, and security while ensuring minimal disruption to ongoing business operations. A critical requirement for these applications is the preservation of user session continuity, meaning that subsequent requests from a specific client must be reliably directed to the same application server instance to maintain transactional integrity and avoid data inconsistencies. During the design phase, the architecture team is evaluating the most effective ACI constructs and policies to guarantee this stateful behavior.

What specific ACI configuration element is paramount for ensuring that subsequent client requests are consistently routed to the same application instance within a migrated stateful application deployment?

Accepted Answer

Implementing a load balancing policy with session affinity configured at the application EPG level.

Question 29

Consider a scenario within a Cisco ACI environment where administrators observe that two distinct Endpoint Groups (EPGs), designed to communicate via a specific contract allowing only certain protocols and ports, are intermittently failing to establish sessions. Network telemetry indicates that the fabric is not correctly enforcing the granular access controls defined in the contract, leading to unexpected communication breakdowns. What is the most probable root cause of this policy enforcement anomaly?

Accepted Answer

An error in the contract's filter entry, incorrectly specifying the allowed protocols or ports, or a missing relationship between the contract and the involved EPGs.

Question 30

Consider a scenario within a Cisco Application Centric Infrastructure (ACI) fabric where a critical leaf switch experiences an unexpected reboot. Following the reboot, the leaf switch successfully rejoins the ACI fabric. What is the immediate and most accurate operational consequence for this leaf switch as it reintegrates into the active fabric?

Accepted Answer

The leaf switch re-establishes its operational state and policy configurations from the APIC cluster.

Building the Cisco Cloud with Application Centric Infrastructure Free Practice Test — 30 Questions

A lot more is already mapped out

About the Building the Cisco Cloud with Application Centric Infrastructure Certification