Configuring In-Band Management in Cisco ACI

The question asks for the 'new construct' required when configuring in-band management (iBFD) in Cisco ACI. To answer this, we must distinguish between pre-existing default objects and those that must be explicitly created by the administrator.

First, let's analyze the default state of the ACI fabric. When an APIC cluster is initialized, it automatically creates the Management Tenant (mgmt). Within this tenant, several logical constructs are already present: a VRF named mgmt, a Bridge Domain named inb (In-Band), and an Application Profile with an EPG. Therefore, options C (management tenant) and D (bridge domain) are incorrect because they are not 'new' constructs; they exist by default.

Next, consider the role of a VLAN pool. While a VLAN pool is necessary to assign VLANs to the leaf spine interfaces for traffic forwarding, it is typically associated with the physical domain or specific EPG bindings rather than being the primary 'management construct' defined within the policy model for iBFD connectivity itself. More importantly, the question uses the term 'construct'. In ACI terminology, contracts are the fundamental policy constructs that define communication rules.

The critical missing piece for iBFD functionality is allowing external management systems (like SSH, HTTPS, or SNMP clients) to communicate with the APICs and switches over the Layer 3 network. This requires a Contract. Specifically, you must create a contract (often called 'mgmt-default' or a custom one) and subscribe the inb EPG to it. Without this contract, even if the IP addressing and VLANs are correct, the traffic will be dropped due to ACI's default-deny policy. The comments highlight a debate between VLAN Pool and Contract. However, standard ACI documentation and exam logic emphasize that the policy construct enabling the management access is the contract. The VLAN pool is a resource allocation object, but the contract is the logical construct that permits the flow. Furthermore, many sources indicate that while VLAN pools are needed for general traffic, the specific 'management contract' (or just contract) is the distinct policy element configured specifically for iBFD access control. Wait, looking closer at the options and common exam traps: Option B says 'management contract'. Is there a specific object called 'management contract'? No, you create a generic contract and apply it. However, compared to a VLAN pool, the contract is the more direct 'construct' for defining the management access policy. Let's re-evaluate based on official Cisco documentation. The task 'Configure In-Band Management' involves: 1. Assigning IPs to the inb BD (which exists). 2. Creating a Contract that allows ICMP, HTTP/HTTPS, SSH, etc., and associating it with the inb EPG. The VLAN pool is part of the Physical Domain configuration, which is often considered infrastructure setup rather than the specific iBFD policy construct. But actually, the most precise answer relies on the definition of 'construct'. In ACI, Tenants, VRFs, BDs, EPGs, Contracts, and Profiles are all constructs. Since Tenant and BD are pre-built, and VLAN Pools are resources linked to domains, the Contract is the key policy construct that must be created to permit management traffic. The comment citing Red Nectar and other users supports B, noting that the bridge domain is pre-defined. Therefore, B is the best answer among the choices, as it represents the new policy construct required to enable the service.