300-620 Implementing Cisco Application Centric Infrastructure Exam Topics and Questions

This is where the exam begins, and it's the heaviest topic by count. It spans the physical build, the object model, and the logical constructs that sit on top. Most candidates underestimate how much the exam cares about the relationships between objects rather than what each one does in isolation. The cost comes when you assume a topology diagram or a tenant design is self-explanatory.

– Architecture, topology and hardware

You need to recognise the spine-leaf topology and know which components live where. The physical APIC cluster, the fabric nodes, and the virtual APIC all appear in items, and the exam expects you to distinguish when each is appropriate. Virtual APIC matters when you're deploying ACI without dedicated hardware for the controller, typically in cloud or branch scenarios. The topology questions probe whether you understand why certain connections are forbidden and why others are required. Hardware questions focus on port roles, not product SKUs. Know what makes a leaf node different from a spine node in terms of forwarding behaviour, and where endpoints attach.

– The object model, faults, events and health

The ACI object model is hierarchical, and the exam tests whether you can trace a configuration down from the root to the managed object. You'll see items that present a fault or a health score drop and ask what caused it or where to look. Faults, events and the audit log serve different purposes, and the exam distinguishes them. A fault is a condition that persists until resolved. An event is a state change. The audit log records who changed what. Mixing them up loses marks. Health scores aggregate upward, so a problem in a leaf interface affects the pod score. Items often describe a symptom and ask which log or score to check first.

– Fabric discovery and policy implementation

Fabric discovery is the process that brings a new node into the ACI fabric. The exam wants you to know the sequence: DHCP, image download, registration with the APIC, and policy push. Items describe a node that won't join and ask what's missing. Access policies control how endpoints connect to the fabric, covering interface selectors, port channels, VLANs and domains. Fabric policies govern the infrastructure itself: NTP, DNS, BGP route reflectors. The exam tests whether you can tell which policy type applies to a given requirement. A common trap is configuring an access policy when the problem is actually a fabric policy, or the reverse.

– Logical constructs: tenant, VRF, bridge domain, EPG, contracts and endpoint security groups

Tenants partition the fabric. VRFs provide Layer 3 separation. Bridge domains map to broadcast domains and contain subnets. EPGs group endpoints with a common policy. Contracts define the traffic allowed between EPGs, using filters to match protocols and ports. The exam tests the relationships: which object sits inside which, and what happens when you change one. A bridge domain must reference a VRF. An EPG must reference a bridge domain or a VRF directly in certain designs. Contracts require both a provider and a consumer. vzAny is a shortcut that makes every EPG in a VRF provide and consume a contract. Preferred group is another shortcut that permits all EPGs in the group to communicate without explicit contracts. Endpoint Security Groups offer a finer-grained alternative to EPGs, and the exam asks when each is the better choice.

How ACI Fabric Infrastructure is tested

Twenty percent of the exam means roughly one in five items, so you'll see this topic in multiple forms: exhibits showing object hierarchies, fault messages, configuration snippets, and scenario stems that describe a tenant design. Items reward knowing which object contains which, and what breaks when a reference is missing. A common pattern presents a contract that isn't working and asks whether the provider EPG, the consumer EPG, the filter, or the VRF is misconfigured. Another pattern shows a health score drop and asks which log to check or which object is faulted. Candidates lose marks by confusing access policies with fabric policies, by assuming vzAny and preferred group are interchangeable, and by not recognising that a bridge domain without a VRF reference will fault. The exhibit-based items often include a partial object tree, and you need to spot the missing or incorrect parent-child link. Speed matters: if you're reading every line of a long fault message instead of scanning for the object class and the condition, you'll run out of time.

After the logical constructs, the exam moves to how packets actually move through the fabric. This topic is narrower than the first but deeper: it cares about the forwarding decisions that happen inside a bridge domain and how the fabric learns where endpoints are. Candidates who treat ACI like a traditional switch fabric struggle here, because the learning and flooding behaviour is different. The cost comes when an item describes a connectivity problem and you assume it's a contract issue when it's actually a bridge domain setting.

How ACI Packet Forwarding is tested

Fifteen percent means roughly one in seven items, often presented as a troubleshooting scenario. The stem describes a bridge domain and lists its configuration knobs: unicast routing enabled or disabled, Layer 2 unknown unicast set to flood or hardware proxy, ARP flooding on or off. Then it describes a symptom, such as endpoints in the same EPG that cannot reach each other, or a gateway that doesn't respond. Items reward knowing what each setting does to the forwarding plane, not just what the setting is called. Unicast routing controls whether the fabric routes between subnets in the bridge domain. Layer 2 unknown unicast determines what happens to a frame destined for a MAC the fabric hasn't learned: flood it or drop it. ARP flooding controls whether ARP requests are flooded or sent only to the spine for optimised handling. Candidates lose marks by enabling unicast routing when the requirement is pure Layer 2, by leaving Layer 2 unknown unicast on flood when silent hosts are causing problems, and by not recognising that endpoint learning happens in the leaf, not the spine. The scenario-based items often combine two or three settings, and you need to identify which one is causing the specific symptom described.

Now the exam tests how the fabric connects to the world outside: legacy Layer 2 domains and Layer 3 networks. This is the second twenty-per-cent topic, and it's where design and protocol knowledge intersect. You'll configure external EPGs, bind them to ports, and route traffic in and out of the fabric. Transit routing and VRF route leaking are explicitly excluded, so the scope is narrower than a full routing exam, but the exam still expects you to know how ACI handles STP, MCP, and external routing protocols.

– Layer 2 connectivity: STP, MCP and EPG port bindings

When you connect ACI to a traditional Layer 2 network, you need to manage spanning tree and loop prevention. ACI runs STP on external-facing ports, and the exam tests whether you know which mode to use and how ACI interacts with the external bridge. MCP, or mis-cabling protocol, detects loops that STP might miss. Items describe a loop or a port that's blocked unexpectedly and ask what's misconfigured. EPG port bindings determine which endpoints on a physical or virtual port belong to which EPG. Static bindings map a VLAN or a port to an EPG without requiring endpoint learning. The exam asks when static bindings are necessary and when dynamic learning is sufficient. A common mistake is configuring a static binding without also configuring the access policy for that port, which causes the binding to fault.

– Layer 3 out: routing protocols and external EPGs

Layer 3 out connects a VRF to an external router using BGP, OSPF or EIGRP. The exam excludes transit routing, so you're not redistributing between protocols or leaking routes between VRFs. What you do need is how to configure the L3Out object, the logical node profile, the interface profile, and the external EPG. The external EPG represents the remote networks, and you define them using subnet prefixes. Contracts apply between internal EPGs and external EPGs just as they do between internal EPGs. Items describe a scenario where internal endpoints cannot reach an external network and ask whether the route, the contract, the external EPG subnet, or the interface configuration is wrong. Candidates lose marks by forgetting to apply a contract between the internal EPG and the external EPG, by misconfiguring the subnet prefix so it doesn't match the remote network, and by not enabling the correct routing protocol on the logical interface.

How External Network Connectivity is tested

Twenty percent again, so expect multiple items, often with exhibits showing a topology that includes an external router or switch. One common pattern presents a Layer 3 out configuration and asks why the fabric isn't learning routes from the external router. Another shows a contract between an internal EPG and an external EPG and asks why traffic is still blocked. Items reward knowing the sequence: physical connectivity, routing protocol adjacency, route learning, external EPG subnet definition, and contract application. All five have to be right. The exam also tests STP and MCP in scenarios where a loop or a blocked port is causing connectivity loss. Candidates lose marks by assuming the routing protocol is at fault when the contract is missing, by defining an external EPG subnet that's too broad or too narrow, and by not recognising that MCP will block a port if it detects its own packets returning. The scenario-based items often give you partial output from a show command or a fault message, and you need to map that back to the configuration object that's wrong.

This topic covers how ACI integrates with virtualisation platforms and how you insert services into the traffic path using service graphs. The exam focuses on VMware vCenter with distributed virtual switches and Nutanix VMM integration, plus the resolution and deployment immediacy settings that control when and how the fabric pushes policy to the hypervisor. Service graphs let you chain firewalls, load balancers and other appliances between EPGs. The exam tests the configuration and the sequencing, not the appliance itself. Candidates often underestimate how much the resolution and immediacy settings affect troubleshooting, because a mismatch between immediate and on-demand can delay or block policy push. The cost comes when an item describes a VM that isn't getting connectivity and you focus on the EPG when the real problem is the VMM domain or the resolution setting.

How Integrations is tested

Fifteen percent, so roughly one in seven items. VMM integration items describe a vCenter or Nutanix environment and ask how to configure the domain, the VLAN pool, and the EPG association. Resolution determines when the fabric learns the VM's identity: immediate means the fabric pushes the EPG policy as soon as you configure it, on-demand means the fabric waits until the VM powers on. Deployment immediacy determines when the fabric programs the leaf switch: immediate or on-demand. A common scenario presents a VM that can't communicate and asks whether the problem is the resolution setting, the deployment immediacy, the VLAN pool, or the uplink. Items reward knowing which combination of resolution and immediacy is appropriate for a given requirement. Service graph items describe a requirement to insert a firewall or load balancer between two EPGs and ask you to configure the graph, the function node, and the connector EPGs. The exam expects you to know the sequence: create the device, create the graph template, apply the graph to a contract. Candidates lose marks by choosing immediate resolution when the hypervisor isn't ready, by forgetting to associate the VMM domain with the EPG, and by misconfiguring the connector EPG in the service graph so traffic bypasses the appliance.

The exam returns to a twenty-per-cent topic, this time covering how you manage the fabric day to day: connectivity to the APIC, monitoring, backups, access control, and upgrades. This is where operational discipline shows. Candidates who focus only on forwarding and contracts often skip the management topics and lose marks on straightforward items about backup schedules or RBAC. The cost comes when an item asks how to restore a configuration or which role permits a given action, and you guess instead of knowing the mechanics.

– Management connectivity and monitoring

Out-of-band management uses a dedicated network separate from the fabric, typically for initial setup and emergency access. In-band management runs over the fabric itself, using a bridge domain and EPG. The exam tests when each is appropriate and how to configure them. A common mistake is configuring in-band management without also configuring the route to reach it, which leaves the APIC unreachable. Monitoring covers syslog and SNMP for traditional event collection, and Nexus Dashboard Insights for AI-assisted analytics. Items describe a requirement such as sending fault notifications to a remote server and ask which service to configure and where. Nexus Dashboard Insights appears in scenarios where you need to predict a capacity issue or correlate faults across the fabric. The exam expects you to know what Insights can do, not how to install it.

– Backup, restore, AAA and RBAC

Configuration backup in ACI uses snapshots and import-export. A snapshot is a point-in-time copy stored on the APIC. Import-export saves the configuration as XML and lets you move it between fabrics. The exam asks which method to use for a given recovery scenario and how to schedule automated backups. Items describe a failed change and ask how to roll back. AAA controls who can log in, using local users, RADIUS, TACACS+ or LDAP. RBAC controls what each user can do, using roles and security domains. The exam tests the relationship: a user's effective permissions are the intersection of their role and their domain. A common trap is granting a user a powerful role but restricting them to a domain that doesn't include the object they need to change, which results in access denied. Items present a user who can't perform an action and ask whether the role, the domain, or the AAA configuration is wrong.

– Upgrades

Upgrading an ACI fabric involves the APIC cluster first, then the switches. The exam tests the sequence and the checks you perform before starting. Items describe an upgrade that failed or a fabric that's running mixed versions and ask what went wrong. You need to know that the APIC cluster must reach consensus before the upgrade proceeds, that switches download the image from the APIC, and that you can schedule the switch upgrade or trigger it manually. A common mistake is starting the upgrade without verifying that all APICs are healthy, which can leave the cluster unable to commit the new version.

How ACI Management is tested

Twenty percent, so expect this topic throughout the exam. Management items are often shorter than design items, but they're not easier. A typical item describes a monitoring requirement and asks whether to use syslog, SNMP, or Nexus Dashboard Insights. Another presents a user who can't modify a tenant and asks whether the problem is the role, the security domain, or the AAA provider. Backup and restore items describe a scenario where a change broke something and ask how to roll back: snapshot rollback, import a previous export, or reconfigure manually. Upgrade items present a failure and ask what you should have checked first: APIC cluster health, image repository connectivity, or switch compatibility. Items reward knowing the sequence and the dependencies. Candidates lose marks by choosing in-band management when out-of-band is required for the scenario, by granting a user the admin role without checking the security domain, by scheduling a snapshot but not testing the restore procedure, and by starting an upgrade without verifying cluster health. The RBAC items often include an exhibit showing the user's role and domain, and you need to determine whether the combination permits the action described.

The exam closes with ACI Anywhere, which extends the fabric across multiple pods, multiple sites, and remote locations. This is the lightest topic at ten percent, and the exam stays at the describe level: you need to know what each architecture does and when you'd choose it, but not the detailed configuration. Multi-Pod connects multiple ACI pods in different locations using an inter-pod network. Multi-Site connects separate ACI fabrics, each with its own APIC cluster, using the Multi-Site Orchestrator. Remote Leaf extends the fabric to a branch location over a WAN link. Candidates often confuse the three, and the exam tests the distinction.

How ACI Anywhere is tested

Ten percent means roughly one in ten items, and they're almost always scenario-based. The stem describes a requirement such as connecting two data centres, extending a tenant across sites, or providing ACI policy to a branch office, and asks which architecture to use. Items reward knowing the constraints: Multi-Pod requires low latency and high bandwidth between pods because the spine nodes in different pods form a single control plane. Multi-Site tolerates higher latency because each site has its own control plane, and the orchestrator synchronises policy between them. Remote Leaf uses a single APIC cluster and extends the fabric over a WAN, so it's suitable for a branch but not for a second full data centre. The exam also tests what gets stretched and what stays local: in Multi-Pod, endpoints can move between pods and keep their IP address. In Multi-Site, you explicitly configure which tenants and EPGs are stretched. In Remote Leaf, the branch is just another leaf from the fabric's perspective. Candidates lose marks by choosing Multi-Site when the requirement is for a single control plane, by choosing Multi-Pod when the latency is too high, and by assuming Remote Leaf can support a full data centre when it's designed for small branch locations.