Which two statements about contract policy enforcement are true? (Choose two)

Question

Options

• AThe class ID (or PCTag) of the source EPG is inserted by the ingress leaf into any packets going into the fabric.
• BContracts are always enforced in the ingress leaf
• CThe Class ID (or PCTag) of the destination EPG is inserted by the ingress leaf into any packets going into the fabric
• DContracts are sometimes enforced in the ingress leaf and sometimes in the egress leaf.
• EContracts are always enforced m the egress leaf

• A
  7% (4)
• B
  75% (44)
• D
  14% (8)
• E
  5% (3)

Explanation

In Cisco ACI, when a packet enters the fabric, the ingress leaf is responsible for policy lookup: it identifies the destination endpoint, determines its EPG, and inserts that destination EPG's Class ID (PCTag) into the iVXLAN header (making C correct). Because the ingress leaf already knows the source EPG (from the source endpoint) and has just looked up the destination EPG, it has everything it needs to evaluate the contract policy right then and there - so enforcement always happens at the ingress leaf (making B correct).

Why the distractors are wrong:

• A is wrong because it's the destination EPG's PCTag that gets inserted, not the source EPG's - the source EPG is already known locally at ingress and doesn't need to be tagged for transit.
• D is wrong because enforcement is not split between leaves; ACI's distributed policy model consistently enforces at ingress, not "sometimes" at egress.
• E is wrong for the same reason - egress-only enforcement was a misconception about older or simplified models; ACI enforces at ingress.

Memory tip: Think "DI" - Destination tag, Ingress enforcement. The Ingress leaf inserts the Destination EPG's tag and enforces the contract Immediately - before the packet travels further into the fabric.

No community discussion yet for this question.