Friday, 14 August 2026

Top 10 Cisco ACI Multiple Choice Questions (MCQs) with Answers and Explanations

 Cisco ACI's policy-driven model trips up even experienced engineers coming from traditional VLAN/routing backgrounds. The following ten questions cover the concepts that come up most often in interviews, CCIE Data Center prep, and real production troubleshooting — contracts, EPGs, zoning-rules, Multi-Site, and APIC cluster behavior.

Question 1

A contract subject is configured with scope "VRF" instead of "Tenant." What does this actually control?

Options

A. Whether the contract can be reused by other tenants

B. Which EPGs within the fabric the contract's filter rules are allowed to apply between

C. The QoS priority assigned to matched traffic

D. Whether the contract requires stateful firewall inspection

Correct Answer

✅ B. Which EPGs within the fabric the contract's filter rules are allowed to apply between

Explanation

Contract scope controls the boundary within which a contract's consumer/provider relationship is valid — VRF scope restricts it to EPGs within the same VRF, Tenant scope extends it to any VRF within the same tenant, and Global scope allows it across tenants. Getting this wrong is a common cause of contracts silently failing to apply between EPGs that appear correctly configured otherwise.

Question 2

Which ACI construct is responsible for propagating endpoint reachability information (which leaf owns which endpoint) across the fabric?

Options

A. Zoning-rules

B. COOP (Council of Oracle Protocol)

C. LLDP

D. OSPF between leaf and spine

Correct Answer

✅ B. COOP (Council of Oracle Protocol)

Explanation

COOP runs between leaf switches and spine switches to synchronize the fabric-wide endpoint database, so any leaf can look up where an endpoint currently lives. This is distinct from zoning-rules, which enforce policy (what's allowed to talk to what) rather than reachability (where something physically is).

Question 3

What is the KEY architectural difference between ACI Multi-Pod and ACI Multi-Site?

Options

A. Multi-Pod supports more leaf switches per Pod than Multi-Site

B. Multi-Pod uses a single APIC cluster and fabric-wide policy domain; Multi-Site uses independent APIC clusters per site orchestrated centrally

C. Multi-Site does not support Layer 3 connectivity between sites

D. Multi-Pod requires Nexus Dashboard Orchestrator; Multi-Site does not

Correct Answer

✅ B. Multi-Pod uses a single APIC cluster and fabric-wide policy domain; Multi-Site uses independent APIC clusters per site orchestrated centrally

Explanation

Multi-Pod extends one fabric (single APIC cluster, single policy domain) across pods connected by an IPN. Multi-Site keeps each site as its own independent fabric with its own APIC cluster, and coordinates policy between them via Nexus Dashboard Orchestrator — giving genuine fault-domain isolation that Multi-Pod doesn't provide.

Question 4

An engineer configures EPG-WEB as the consumer and EPG-DB as the provider of a contract, but traffic from DB to WEB is unexpectedly blocked while WEB to DB works fine. What is the MOST likely cause?

Options

A. The Bridge Domain is set to flood mode

B. The contract's filter is unidirectional and "Apply Both Directions" was not enabled (or a reverse filter wasn't added)

C. The VRF is in unenforced mode

D. The two EPGs are in different tenants

Correct Answer

✅ B. The contract's filter is unidirectional and "Apply Both Directions" was not enabled (or a reverse filter wasn't added)

Explanation

By default, ACI contracts can be configured to apply filters in both directions automatically, but if that option is disabled, the consumer-to-provider direction is permitted while the reverse (provider-to-consumer) traffic needs its own explicit filter entry. This is one of the most common real-world contract misconfigurations.

Question 5

What is the purpose of vzAny in an ACI tenant?

Options

A. It disables all contract enforcement within a VRF

B. It represents all EPGs in a VRF as a single group, allowing one contract to apply to every EPG in that VRF at once

C. It is the default deny rule applied to unmatched traffic

D. It defines the L3Out external EPG

Correct Answer

✅ B. It represents all EPGs in a VRF as a single group, allowing one contract to apply to every EPG in that VRF at once

Explanation

vzAny is a shortcut object representing every EPG within a VRF. Associating a contract to vzAny (as provider or consumer) avoids configuring the same contract relationship individually for dozens of EPGs — commonly used for shared services like DNS or NTP that every EPG needs to reach.

Question 6

An APIC cluster is running with a target size of 3, but only 2 controllers are currently healthy. What is the operational impact?

Options

A. The fabric immediately goes into a full outage

B. The fabric continues to run on existing policy, but the cluster is out of quorum for making and validating new configuration changes reliably

C. Only Tenant-level changes are blocked; Fabric Access Policy changes still work normally

D. APIC automatically demotes itself to a single-controller cluster with no impact

Correct Answer

✅ B. The fabric continues to run on existing policy, but the cluster is out of quorum for making and validating new configuration changes reliably

Explanation

Data plane forwarding on the leaf/spine switches is independent of APIC availability — it keeps running on already-programmed policy. But losing quorum in the APIC cluster means new configuration changes may not be reliably validated or replicated, which is why restoring cluster health quickly matters even though traffic isn't immediately affected.

Question 7

Which ACI feature allows two endpoints within the SAME EPG to be prevented from communicating with each other?

Options

A. Intra-EPG Isolation

B. Preferred Group Member

C. Taboo Contract

D. Unenforced VRF mode

Correct Answer

✅ A. Intra-EPG Isolation

Explanation

By default, endpoints in the same EPG can freely communicate with each other since they share the same policy. Intra-EPG Isolation overrides this, blocking east-west traffic between endpoints in the same EPG — useful for scenarios like a shared VDI or DMZ EPG where individual endpoints shouldn't reach each other directly.

Question 8

What is the primary function of an L3Out in Cisco ACI?

Options

A. To create a Layer 2 extension between two Bridge Domains

B. To provide Layer 3 connectivity between the ACI fabric and external networks, and control which external routes are imported/exported

C. To define QoS policy for external traffic only

D. To replace the need for a Bridge Domain in a tenant

Correct Answer

✅ B. To provide Layer 3 connectivity between the ACI fabric and external networks, and control which external routes are imported/exported

Explanation

An L3Out defines the routing protocol (BGP, OSPF, EIGRP, or static) used to exchange routes with an external network, along with route-map-based import/export control over which external subnets are learned into the fabric and which internal subnets are advertised out.

Question 9

What does a VMM (Virtual Machine Manager) domain in ACI primarily enable?

Options

A. Automatic firmware upgrades for ESXi hosts

B. Direct integration between APIC and a hypervisor manager (like vCenter) so EPGs can be dynamically mapped to VM port groups

C. A dedicated management VRF for hypervisor traffic

D. Automatic contract creation between all VMs in a cluster

Correct Answer

✅ B. Direct integration between APIC and a hypervisor manager (like vCenter) so EPGs can be dynamically mapped to VM port groups

Explanation

A VMM domain lets APIC push EPGs directly into the hypervisor as port groups (e.g., in vCenter), so VM placement automatically inherits the correct network policy without a network admin manually configuring VLANs or trunk ports for every new VM.

Question 10

A leaf switch shows a health score of 45 with no active critical faults listed. What does this indicate?

Options

A. The health score is unrelated to faults and only reflects hardware temperature

B. The health score is a weighted aggregate that can be pulled down by multiple minor/major faults even without any single critical fault present

C. A health score below 50 always means the leaf is about to fail

D. The health score only reflects the previous 24 hours and resets automatically

Correct Answer

✅ B. The health score is a weighted aggregate that can be pulled down by multiple minor/major faults even without any single critical fault present

Explanation

ACI health scores are calculated as a weighted aggregate across all faults affecting an object, including minor and major severities — not just critical ones. A moderate score with no critical faults often means several smaller issues are compounding, which is why it's worth reviewing the full fault list rather than only filtering for critical severity.

Key Takeaways

Policy Model

  • Contracts define what's allowed to communicate — scope defines the boundary they operate within
  • vzAny simplifies shared-services contracts across an entire VRF
  • Intra-EPG Isolation blocks communication within a single EPG when needed

Fabric Architecture

  • COOP synchronizes endpoint location, independent of policy enforcement
  • Multi-Pod = one fabric, one APIC cluster; Multi-Site = independent fabrics, centrally orchestrated
  • APIC cluster health affects config changes, not existing data-plane forwarding

Connectivity and Integration

  • L3Out controls both routing protocol adjacency and route import/export to external networks
  • VMM domains connect APIC directly to hypervisor managers for automatic policy-to-VM mapping

Operations

  • Health scores are weighted aggregates — always check the full fault list, not just the score

Conclusion

These ten questions cover the concepts that separate engineers who can navigate the APIC GUI from engineers who genuinely understand why ACI behaves the way it does — contract scope, zoning-rule enforcement, fabric architecture, and health-score interpretation all come up constantly in real troubleshooting. Use these as a quick self-check before an interview, a CCIE Data Center study session, or your next production change window.

Related Reading on Networklearner:

Need help with Cisco ACI, Nexus, data center networking, or network automation?

I am a CCIE Data Center engineer with 18+ years of enterprise networking experience, working hands-on with production ACI fabrics.

Contact me for consulting, troubleshooting, design reviews, and project support: rockingoa@gmail.com

Posted by at
Labels: , , , , , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)