Cisco Application Centric Infrastructure (ACI) is a cornerstone technology in modern enterprise data centers. As a result, Cisco ACI interview questions appear frequently in interviews for Network Engineers, Data Center Specialists, ACI Architects, and CCIE Data Center candidates.
This comprehensive guide brings together basic, intermediate, and advanced ACI interview questions, including Endpoint Security Groups (ESG), Multi‑Pod, Multi‑Site, and Nexus Dashboard / NDO, with concise, practical answers. It also includes comparison tables frequently used by interviewers to test real‑world understanding.
Section 1: Cisco ACI Fundamentals – Core Interview Questions
1. What is Cisco ACI?
Cisco ACI is a policy‑based data center networking solution that centralizes management and enforces application‑centric policies across a fabric.
2. What problem does Cisco ACI solve?
It reduces operational complexity, configuration drift, and scalability issues found in traditional networking.
3. Which switches are used in ACI?
Cisco Nexus 9000 series switches running in ACI mode.
4. What is APIC?
APIC (Application Policy Infrastructure Controller) is the centralized control and management platform for the ACI fabric.
5. Is APIC part of the data path?
No. APIC is out of the data path; traffic continues even if APIC is unavailable.
Section 2: ACI Architecture Interview Questions
6. What topology does ACI use?
Leaf–spine architecture.
7. What connects to leaf switches?
Endpoints such as servers, firewalls, load balancers, and L3Outs.
8. What is the role of spine switches?
High‑speed packet forwarding between leaf switches.
9. Can endpoints connect to spine switches?
No.
10. What happens if a spine fails?
Traffic reroutes through remaining spines without impact.
Section 3: ACI Logical Model Questions
11. What is a Tenant?
An administrative boundary representing an organization or business unit.
12. What is a VRF in ACI?
A Layer‑3 routing domain providing IP isolation.
13. What is a Bridge Domain (BD)?
A Layer‑2 forwarding domain that defines flooding and gateway behavior.
14. What is an Endpoint Group (EPG)?
A logical group of endpoints that share the same policy.
15. Is an EPG the same as a VLAN?
No. EPGs are policy objects, not VLANs.
Section 4: Traffic Flow and Contracts Interview Questions
16. What is the default traffic behavior in ACI?
Traffic between EPGs is denied by default.
17. How is traffic allowed?
Using contracts.
18. What is a contract?
A policy object that defines who talks, what traffic is allowed, and direction.
19. What are subjects?
Logical groupings of filters within a contract.
20. What is a filter?
Defines protocol, port, and direction.
Section 5: Advanced Policy – vzAny and Taboo
21. What is vzAny?
A special object that represents all EPGs within a VRF.
22. Why use vzAny?
To simplify policy and reduce TCAM usage.
23. What is a Taboo Contract?
A deny contract used to explicitly block traffic.
24. Does Taboo override permit contracts?
Yes. Deny always takes precedence.
25. When should Taboo be used?
Only for specific, unavoidable deny cases.
Section 6: Endpoint Security Group (ESG) Interview Questions
26. What is an ESG?
Endpoint Security Group is a policy‑based security construct independent of topology.
27. How is ESG different from EPG?
EPG is topology‑based; ESG is security‑policy‑based.
28. Can ESG span multiple EPGs?
Yes.
29. Does ESG use contracts?
Yes, contracts are applied directly between ESGs.
30. Is ESG mandatory?
No, it is optional and mainly used for zero‑trust designs.
🔍 Comparison Table: EPG vs ESG
| Feature | EPG | ESG |
|---|---|---|
| Based on | Topology | Security policy |
| Dependency | BD / VLAN | Independent |
| Scope | Limited | Cross‑EPG |
| Zero‑Trust | Basic | Strong |
| Use Case | General policy | Advanced security |
Section 7: ACI Multi‑Pod Interview Questions
31. What is ACI Multi‑Pod?
A single ACI fabric stretched across multiple locations (pods).
32. Is Multi‑Pod one fabric?
Yes.
33. How many APICs manage Multi‑Pod?
One APIC cluster.
34. Are L2 and L3 stretched?
Yes.
35. What is IPN?
Inter‑Pod Network connecting pods.
36. What is the main risk of Multi‑Pod?
Increased fault domain.
Section 8: ACI Multi‑Site Interview Questions
37. What is ACI Multi‑Site?
Multiple independent ACI fabrics managed under common policy.
38. Are fabrics independent?
Yes.
39. Is Layer‑2 stretched in Multi‑Site?
No, Multi‑Site is primarily Layer‑3.
40. What is Multi‑Site mainly used for?
Disaster recovery and geo‑redundancy.
🔍 Comparison Table: Multi‑Pod vs Multi‑Site
| Feature | Multi‑Pod | Multi‑Site |
|---|---|---|
| Fabric | Single | Multiple |
| APIC | Shared | Separate |
| L2 Stretch | Yes | No |
| Latency Requirement | Strict | Relaxed |
| Fault Isolation | Low | High |
| Best Use Case | Metro DC | Geo‑redundancy |
Section 9: Nexus Dashboard & NDO Interview Questions
41. What is Nexus Dashboard (ND)?
A unified platform hosting ACI‑related services like NDO, NDI, and Insights.
42. What is Nexus Dashboard Orchestrator (NDO)?
A tool used to orchestrate policies across multiple ACI sites.
43. What was NDO previously called?
MSO (Multi‑Site Orchestrator).
44. Does NDO replace APIC?
No.
45. What is a schema in NDO?
A logical template defining tenants and policies.
Section 10: Nexus Dashboard Insights (NDI)
46. What is NDI?
Nexus Dashboard Insights provides health analytics, anomaly detection, and assurance.
47. Does NDI configure the fabric?
No. It is analytics only.
48. Is NDI mandatory?
No, but highly recommended for large environments.
🔍 Comparison Table: ND vs NDO vs NDI
| Component | Purpose |
|---|---|
| Nexus Dashboard | Platform |
| NDO | Policy orchestration |
| NDI | Analytics & assurance |
| APIC | Fabric control |
Section 11: Troubleshooting Interview Questions
49. What is a health score?
A numeric representation of object health.
50. What is a fault?
An abnormal condition detected in the fabric.
51. What is moquery?
A read‑only CLI tool to query ACI managed objects.
52. Is moquery safe in production?
Yes.
53. Why prefer moquery over GUI?
Speed and accuracy.
Section 12: Automation and Operations
54. Does ACI support automation?
Yes, via native REST APIs.
55. Can Ansible be used with ACI?
Yes.
56. What is Day‑0?
Fabric deployment.
57. What is Day‑1?
Policy configuration.
58. What is Day‑2?
Operations and troubleshooting.
Section 13: ACI Disadvantages (Interview Favorite)
59. What is the biggest challenge in ACI?
Learning curve.
60. Is ACI expensive?
Yes, compared to traditional designs.
61. Is ACI vendor locked?
Yes.
62. Can ACI be over‑engineered?
Yes, with poor design.
Conclusion
Cisco ACI interviews test more than definitions—they assess design thinking, security understanding, architecture choice, and operational awareness. A clear grasp of EPG vs ESG, Multi‑Pod vs Multi‑Site, and NDO vs NDI is critical for senior‑level roles.
If you understand why ACI behaves the way it does, not just how to configure it, you will stand out in interviews.
