Exam 300-630 topic 1 question 20 discussion

Actual exam question from Cisco's 300-630

Question #: 20
Topic #: 1

Refer to the exhibits. Which subject must be configured for the All_noSSH contract to allow all IP traffic except SSH between the two EPGs?
A.

B.

C.

D.

Show Suggested Answer

Suggested Answer: D
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/ACI_Best_Practices/b_ACI_Best_Practices/ b_ACI_Best_Practices_chapter_010.html

by apot at Sept. 16, 2021, 1:17 p.m.

Comments

Submit Cancel

Netdude

10 months ago

D is the correct answer! Though the SSH filter entry has a lower priority, it will still be executed first.. Deny actions and protocol ( SSH ) wins over filter priority. Also 'apply both directions' and reverse filter port should be checked.. https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html

upvoted 4 times

...

H_nna

1 year, 6 months ago

I go for D https://community.cisco.com/t5/application-centric-infrastructure/aci-contract/td-p/3855931

upvoted 3 times

...

NSF2

1 year, 8 months ago

All_noSSH contract to allow all IP traffic except SSH except SSH = deny allow all IP traffic = allow I too go with C

upvoted 1 times

...

DSAM9

2 years, 9 months ago

I think C is correct too, Priority become greyed if selected, so option A and B could not be, destination ports should not be swapped at source ports on provider EPG, (no need for provider EPG to answer) hence... Reverse Filter Ports should be disabled. denying SSH is a priority.

upvoted 3 times

...

apot

3 years, 3 months ago

I think C

upvoted 2 times

...