AI and Network Operations

An API client sends a valid GET request and receives an HTTP 200 response. What does that indicate?

Why is version control valuable for network automation files?

Why is version control useful for network automation scripts?

What is a main operational benefit of a controller-based networking architecture?

What is a northbound API in a controller-based network architecture?

Which HTTP method is commonly used to retrieve information from a REST API without modifying the resource?

Which two tasks are strong candidates for network automation? (Choose two.)

Why are data models such as YANG important in network automation?

Given the JSON snippet below, what is the value of hostname? { "device": { "hostname": "R1", "mgmt_ip": "192.0.2.10" } }

Which data format is commonly used with REST APIs to represent objects, arrays, and key-value pairs?

Which HTTP method is typically used to retrieve data from a REST API without modifying the resource?

Which pairing is correct?

Which tool type is most appropriate for turning a variable set of interface values into a reusable configuration template?

What is version control primarily used for in network automation workflows?

Which two statements about RESTful APIs are correct? (Choose two.)

A REST API query returns this JSON snippet: { "interface": { "name": "GigabitEthernet1", "admin-status": "up", "oper-status": "down" } } What does this indicate?

What data format is commonly used in REST API responses because it is lightweight and easy for applications to parse?

In a controller-based network architecture, what is a southbound API typically used for?

Which two practices most improve safety when automating network changes? (Choose two.)

Why is idempotency valuable in network automation?

A network automation script sends this HTTP request to a controller API: POST /api/v1/devices What does the POST method typically indicate in a RESTful API?

A controller API returns this data: { "device": { "hostname": "Dist-1", "interfaces": [ {"name": "Gig0/0", "status": "up"}, {"name": "Gig0/1", "status": "down"} ] } } Which statement is correct?

Which two statements accurately describe REST-based APIs in a network automation context?

An automation script must retrieve the current configuration state of a device from a REST API without modifying anything. Which HTTP method should it use?

Which two statements accurately describe JSON?

An API response returns a list of interface objects in JSON. Which structure most likely represents that list?

Match each HTTP method to the most accurate action it commonly represents in REST-style APIs.

Which two statements accurately describe APIs in network automation?

In a controller-based design, which statement best describes a northbound API?

Which two statements accurately describe controller-based networking at the CCNA level?

Which two statements accurately describe JSON arrays?

Match each REST or API concept to its most accurate description.

Why is a northbound API especially useful in a controller-based network architecture?

Match each common automation term to its most accurate meaning.

Match each automation transport or interaction term to its most accurate description.

Why might an automation script prefer a token-based API session over repeatedly prompting a human operator for credentials?

Which two statements accurately describe APIs in controller-based networking?

Why is HTTPS usually preferred over HTTP when accessing controller APIs?

Match each controller or automation term to its most accurate description.

Match each common API or data term to its most accurate meaning.

Why is a northbound API valuable to orchestration tools in a controller-based network?

Why might a controller return interface information as a JSON array instead of a single JSON object?

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Match each API or programmability term to its most accurate meaning.

Which two statements accurately describe controller-based networking?

Why is HTTPS preferred over HTTP when accessing sensitive controller APIs?

Why is a northbound API generally more useful to orchestration software than a human-readable CLI screen?

Why are tokens commonly used in API workflows instead of sending raw credentials with every request?

Match each basic automation term to its most accurate meaning.

Why is a northbound API valuable to orchestration systems in a controller-based architecture?

Why is JSON often preferred over completely unstructured text in API responses?

Match each REST-style method to the action it most commonly represents.

Match each data-structure term to its most accurate meaning.

Which two statements accurately describe JSON in network automation contexts?

Which two statements accurately describe software-defined networking and network virtualization concepts at a basic CCNA level?

A JSON response from a controller contains a list of interfaces, each with its own name and status fields. Which JSON structure is most likely used to represent that list?

Drag each automation or API concept from the left to its corresponding description on the right. Not all descriptions are used. Concepts: - Northbound API - Southbound API - JSON - HTTPS

Match each programmability term to its most accurate description.

Which two statements accurately describe why APIs and human-oriented CLIs are both still useful in network operations?

A REST API call uses the GET method against a device inventory endpoint. What is the most likely intent of the call?

Match each REST-style method to the most common intent.

In a REST-style API, which method is most commonly associated with retrieving information?

Which two statements accurately describe why structured telemetry and APIs improve operational tooling?

Match each automation-related term to the description that best fits it.

Match each API workflow concept to the description that best fits it.

A network engineer sends an HTTP GET request to a controller API and receives status code 401. What does that response indicate?

Match each automation term to the best description.

Which data format is most commonly used in REST APIs because it is lightweight and easy for applications to parse?

Which data format uses key-value pairs and is commonly returned by REST APIs?

Match each HTTP method to the action it most commonly performs in a REST API.

An API call returns HTTP status code 401. What does that usually mean?

Which two statements accurately describe API authentication tokens? (Choose two.)

Exhibit: A script sends an HTTP GET request to a controller API endpoint. What is the usual purpose of the GET method?

A network engineer queries a REST API and receives data in JSON format. Which statement about JSON is correct?

Exhibit: A controller returns an authentication token after a successful API login. Why does the client include that token in later requests?

Which HTTP method is normally used by a REST API client to retrieve data from a resource without changing it?

Match each HTTP method to the most common API action.

An engineer receives API output that starts with curly braces and contains name-value pairs. Which data format is being used?

Exhibit: A script sends an API request and receives HTTP status code 401. What does that code indicate?

Which two statements correctly describe a RESTful API used by network controllers? Choose two.

A network engineer is reviewing REST API behavior. Which two statements are true?

Which two statements about YANG are correct?

Which term describes a string or credential passed to an API to prove the client is allowed to access a resource?

Which term refers to a lightweight data-interchange format that is easy for humans to read and write, and easy for machines to parse and generate?

Which two statements correctly describe JSON?

A controller exposes a YANG-modeled interface configuration through an API. Which two statements correctly describe the purpose of YANG in that workflow?

An engineer is comparing data serialization formats used by controllers and automation tools. Which two statements correctly describe JSON?

A developer is interacting with a REST API exposed by a network controller. Which two statements correctly describe common REST behavior?

A script authenticates to a controller API and receives a token that it presents in later requests. Which two statements about that token-based workflow are correct?

A network administrator at a large enterprise notices that the network monitoring system frequently generates false positive alerts for unusual traffic patterns during normal business hours. The administrator wants to reduce these false positives while still detecting genuine security threats. Which AI/ML concept would best address this requirement?

A network engineer at a large enterprise observes repeated spikes in latency on the core network every weekday at 10:00 AM, but no corresponding increase in overall bandwidth utilization. The engineer wants to use AI/ML to automatically identify the root cause and take corrective action without manual intervention. Which concept best describes this approach?

Which TWO statements accurately describe how AI and ML concepts are applied to network operations?

Drag and drop the AI/ML concepts on the left to the correct descriptions on the right.

A network operations team is implementing an AI-driven automation system that uses an agentic AI agent to handle routine network issues. The agent is configured to detect high CPU utilization on a core router, then automatically execute a series of diagnostic commands and, if a specific pattern is found, trigger a configuration change to reduce load. After the change, the agent re-checks CPU utilization and, if still high, escalates the issue to a human engineer. Which of the following best describes the workflow being used?

A network operations team is implementing an automated system to detect and remediate interface flapping on core switches. The system must be able to query the network device for interface status and execute commands to disable or reconfigure the interface if a pattern of flapping is detected. Which protocol or technology enables the system to programmatically interact with the network device for both monitoring and configuration changes?

Which THREE of the following best describe how agentic AI is used in network automation, specifically regarding AI agents, tool-calling, and closed-loop remediation workflows?

Which THREE statements accurately describe the role of AI agents in closed-loop remediation workflows for network automation?

A network administrator notices that the NTP server on Router R1 is not synchronizing with the upstream NTP server at 192.0.2.1. The router is configured as an NTP client, but show ntp status indicates the clock is unsynchronized and the stratum is 16. There is no firewall between R1 and 192.0.2.1. What is the most likely cause of this issue?

A network engineer notices that the system clock on a Cisco IOS-XE router is incorrect, causing syslog timestamps to be unreliable. The router is configured as an NTP client to synchronize with a remote NTP server at 192.168.1.10. However, the show ntp status command indicates the clock is unsynchronized. What is the most likely cause of this issue?

Which TWO statements correctly describe NTP stratum levels and syslog severity levels in a Cisco IOS-XE environment?

Drag and drop the syslog severity levels and NTP concepts on the left to their correct descriptions on the right.

Drag and drop the syslog and NTP items on the left to the correct descriptions on the right.

A network engineer is tasked with monitoring a large enterprise network that requires high-frequency, real-time data collection from thousands of routers and switches. The engineer needs a solution that minimizes CPU overhead on the network devices and supports push-based data delivery. Which technology should the engineer choose for this requirement?

A network engineer is evaluating monitoring technologies for a large enterprise network that requires high-frequency, low-latency traffic data collection with support for custom fields. The solution must also support encryption and authentication to prevent tampering. Which technology best meets these requirements?

Which TWO statements correctly describe characteristics of SNMPv2c and SNMPv3 for network monitoring?

A network engineer needs to automate the configuration of multiple Cisco IOS XE routers in a data center. The team requires a standard, vendor-neutral data modeling language to define the configuration parameters, and they need a protocol that uses XML-based remote procedure calls over SSH for secure, reliable configuration transactions. Which combination of technologies best meets these requirements?

A network engineer is automating the configuration of a new branch office router. The engineer needs a protocol that uses a YANG data model, supports both configuration and operational state retrieval, and operates over SSH for secure transport. Which protocol should the engineer use?

Which THREE statements accurately describe the characteristics of NETCONF and RESTCONF for programmatic network configuration?

Drag and drop the protocols/technologies on the left to the descriptions on the right.

Drag and drop the following steps into the correct order to implement a basic network monitoring workflow using telemetry and streaming analytics on Cisco IOS-XE.

Drag and drop the following steps into the correct order to troubleshoot an end-to-end connectivity issue using a bottom-up approach.

Which TWO statements accurately describe how AI/ML concepts are applied to network operations in modern enterprise networks?

Drag and drop the following steps into the correct order for an agentic AI system to remediate a network performance issue using Cisco IOS-XE CLI commands.

Drag and drop the following steps into the correct order to configure an IOS-XE device as an NTP client and ensure its syslog messages are sent to a remote server with correct timestamps.

Drag and drop the following steps into the correct order to configure an IOS-XE device as an NTP client and set up syslog reporting of NTP events to a remote log server.

Drag and drop the syslog severity levels on the left to their corresponding names and meanings on the right.

Drag and drop the following steps into the correct order to configure gRPC streaming telemetry subscription on a Cisco IOS-XE device, from initial setup to data collection.

Drag and drop the following phases into the correct order to configure gRPC streaming telemetry subscription setup and then the NetFlow data path sequence.

Select the correct sequence of steps to retrieve a specific interface's configuration via RESTCONF and apply a change to the interface description.

Drag and drop the following steps into the correct order to send a RESTCONF GET request to retrieve interface configuration from a Cisco IOS-XE device and apply a configuration change based on the response.

Drag and drop the protocol/model on the left to the correct description on the right.

You are connected to R1 via the console. The network operations center (NOC) has asked you to configure R1 as an NTP client of the NTP server at 192.0.2.10 (reachable via VLAN 100, SVI 192.168.1.1/24). They also need all system messages of level 'debug' (level 7) and higher forwarded to the syslog server at 203.0.113.50. The current configuration shows that NTP is not working (stratum 16) and syslog is only sending critical and higher messages. Fix both issues.

You are connected to R1. Configure NTP client so that R1 synchronizes with the NTP server at 198.51.100.10, using its Loopback0 (10.0.0.1/32) as the source interface. Also configure syslog to send messages of severity 5 (notifications) and above to 192.0.2.20. The current configuration shows a misconfigured NTP server address and an incorrect logging trap level. Verify with 'show ntp status' (stratum should not be 16) and 'show logging'.

You are connected to R1, a branch router connected to a central NTP server at 203.0.113.10 and a syslog server at 198.51.100.20. Configure R1 as an NTP client using its Loopback0 interface (192.168.1.1/32) as the source, and ensure syslog messages of severity 'informational' and above are sent to the syslog server. Currently, R1 shows 'Clock is unsynchronized, stratum 16'. Identify and fix the NTP issue, then apply the syslog configuration.

You are connected to R1, a branch router that must synchronize time with the NTP server at 198.51.100.1 (reachable via G0/0) and send critical syslog messages (severity 0-4) to the logging server at 203.0.113.10. The current configuration has NTP pointing to a wrong server and syslog set to debug level, flooding the server. Correct the NTP server, set the NTP source interface to Loopback0 (10.10.10.1/32), and adjust the syslog trap level so that only emergencies through warnings are logged.

You are connected to R1 via the console. SNMP v2c community strings (public RO, private RW) are already configured. The network has a management server at 10.1.1.100 and a NetFlow collector at 10.1.1.200. Configure SNMP traps to the management server for link status changes. Also configure NetFlow on interface GigabitEthernet0/0 to export version 9 to the collector, with a source interface of Loopback0 (10.255.255.1/32).

You are connected to R1. Configure SNMP v2c with a read-only community string 'monitorRO' and a read-write community string 'controlRW', and enable SNMP traps for link status to the management server at 203.0.113.100. Additionally, configure NetFlow to export version 9 flow records to the same server on UDP port 2055, and ensure that only traffic from the 10.10.10.0/24 network is monitored. Finally, verify your configurations with the appropriate show commands.

You are connected to R1, a router that must send SNMP traps to a management server at 203.0.113.10 and export NetFlow data to a collector at 203.0.113.20. Currently, SNMPv2c traps are not being sent, and SNMPv3 is not configured for read-only access with authentication and privacy. Additionally, NetFlow export is missing the destination and version configuration. Configure the necessary commands on R1 to enable SNMPv2c traps (community string 'public'), configure SNMPv3 user 'admin' with SHA authentication and AES 128 encryption (password 'cisco123' for both auth and priv), and set NetFlow export to version 9.

You are connected to R1, a Cisco router running IOS-XE. Configure SNMP v2c with a read-only community string 'publicRW' (note: the string is intentionally misnamed for the task), and SNMP v3 with user 'admin' using MD5 authentication (password 'cisco123') and DES encryption (password 'cisco456'). Ensure SNMP traps for linkUp/linkDown are sent to the management server at 192.0.2.100. Additionally, configure NetFlow export to send version 9 flow records to 192.0.2.200 on UDP port 2055, and ensure that only inbound traffic on GigabitEthernet0/0 is monitored. Finally, verify your configuration using 'show snmp' and 'show ip cache flow'.

You are connected to R1, a Cisco ISR 4321 running IOS-XE. Configure SNMPv2c with a read-only community string 'public' and SNMPv3 with user 'admin' using SHA authentication and AES encryption. Ensure SNMP traps are sent to the management server at 203.0.113.10. Additionally, configure NetFlow export to destination 203.0.113.20 on UDP port 2055 using version 9. Verify your configuration with appropriate show commands. The current running-config is incomplete; you must add the missing commands.

You are connected to R1, a Cisco ISR 4331 router running IOS-XE. Your task is to enable SNMP v2c with community string 'public' (read-only) and 'private' (read-write), and configure SNMP v3 with a user 'admin' using SHA authentication (password 'Cisco123') and AES 128 encryption (password 'Cisco456'). Additionally, configure SNMP traps to be sent to a management server at 203.0.113.10 for both v2c and v3. Finally, enable NetFlow export to a collector at 203.0.113.20, using version 9. Verify your configuration using 'show snmp' and 'show ip cache flow'.

You are connected to R1. Configure SNMPv3 with authentication (SHA) and encryption (AES-128) for user 'monitor' in group 'AdminGroup', and also configure SNMPv2c read-only community string 'cisco123' to send traps to the management server at 192.0.2.100. Additionally, configure NetFlow on interface GigabitEthernet0/0 to export flow data to 198.51.100.50 using version 9. Verify your configuration using the appropriate show commands.

You are connected to R1 (192.0.2.1/24, management IP). The network team needs to automate interface configuration using RESTCONF. Construct a valid RESTCONF GET request to retrieve the operational status of GigabitEthernet0/1 using the ietf-interfaces YANG module, and a PATCH request to set the description of that interface to 'Link to R2' using the Cisco-IOS-XE-native YANG module. Identify the error that occurs if the Accept header is set to application/json instead of application/yang-data+json.

You are connected to R1. Use RESTCONF to retrieve all operational interface statistics from the ietf-interfaces YANG module, then modify the description of GigabitEthernet0/1 to 'Link to R2 via RESTCONF' using a PATCH request. The device is reachable at 203.0.113.1 with port 443, username 'admin', password 'cisco123'. Identify the error that would occur if you used a PATCH with Content-Type: application/json instead of application/yang-data+json.

You are connected to R1 (192.0.2.1/24). Use RESTCONF to query the operational state of GigabitEthernet0/0 using the ietf-interfaces YANG module. Then, send a PATCH request to disable the interface (set 'enabled' to false) using the Cisco-IOS-XE-native YANG module. Identify the error when a PATCH request is sent with the wrong Content-Type header (application/json instead of application/yang-data+json) and when the PATCH URI uses an incorrect YANG path (ietf-interfaces instead of Cisco-IOS-XE-native).

Which option performs the RESTCONF operations correctly?

Which three options best describe how machine learning models are trained for network anomaly detection? (Choose three.)

Which three of the following are benefits of integrating AI into network operations? (Choose three.)

Which three statements accurately describe the role of Cisco's AI-powered security features (such as Cisco AI Network Analytics, Stealthwatch, or DNA Center's AI-Enhanced Analytics) in network security operations? (Choose three.)

Which three of the following are key benefits of integrating AI into network operations? (Choose three.)

Which three statements accurately describe the role of AI in software-defined networking (SDN) and intent-based networking (IBN)? (Choose three.)

Which TWO statements about network automation tools are true?

Which TWO of the following statements correctly describe REST API operations?

Drag and drop the following steps into the correct order to select and implement a network automation solution using the appropriate tool based on the use cases and differences between Puppet, Chef, Ansible, and Python.

Drag and drop the following steps into the correct order to retrieve the operational status of interface GigabitEthernet0/0 using NETCONF and the ietf-interfaces YANG model.

A network administrator needs to configure VLANs and access ports on 200 managed switches across multiple locations. The administrator requires a solution that uses a push‑based deployment model, does not require any agent software to be installed on the switches, and can be executed from a central control node. Which automation tool is most suitable for this task?

A network engineer is configuring a Cisco Catalyst 9300 switch to send syslog messages to a centralized server at 10.10.10.50. The engineer also wants to ensure that only messages with severity level 4 (warnings) and above are logged locally and sent to the server. Which command set correctly configures the logging destination and severity filter on the switch?

A network administrator is using a Python script to retrieve interface statistics from a Cisco IOS XE device via RESTCONF. The script sends an HTTP GET request to the RESTCONF endpoint. Which HTTP status code indicates that the request was successful and the response body contains the requested data?

An engineer uses the Cisco Catalyst Center (formerly DNA Center) Intent API to retrieve a list of network devices. The API response is paginated, returning only 50 devices by default even though the inventory holds several hundred. The engineer needs the complete inventory in a single automation run. Which action should the engineer take?

A network team deploys an AI-assisted operations platform that analyzes streaming telemetry from switches and routers. The team wants the platform to detect degradation before users report trouble. Which two data characteristics most directly improve the platform's ability to detect anomalies early? (Choose two.)

A network engineer at a small branch office needs to quickly verify the current operational state of a Cisco Catalyst 9200 switch using a REST-based API. The switch runs Cisco IOS XE 17.x. Which protocol should the engineer use to send HTTP requests directly to the switch's RESTCONF interface?

A network administrator is introducing a controller-based automation workflow that will push configuration changes to dozens of access switches. The administrator wants each change to be validated against the intended state before it reaches production devices. Which practice best supports this requirement?

A network administrator is evaluating a controller-based assurance platform that uses machine learning to baseline normal traffic patterns. The platform alerts on deviations that may indicate a security incident. Which characteristic best describes how this AI-driven approach improves network operations compared to traditional threshold-based monitoring?

An operations team uses an AI-based tool that correlates syslog messages, interface counters, and routing events to suggest probable root causes. After a recent change to the logging configuration, the tool's suggestions become noticeably less accurate. Which logging-related change most plausibly explains the degraded correlation?

A network automation team is designing a workflow that uses a controller's REST API to retrieve device inventory and then push configuration changes. The API requires an authentication token obtained from a login endpoint. Which two practices should the team follow to securely and efficiently manage the token? (Choose two.)

A network engineer is using a Python script with the requests library to interact with a Cisco DNA Center REST API. The script must retrieve a list of network devices and then filter for those with a specific software version. Which HTTP method and endpoint pattern should the engineer use for the initial retrieval?

A network operations team wants to use a controller's API to automatically back up device configurations daily. The API provides a GET endpoint that returns the running configuration as JSON. Which consideration is most important when designing the automation to ensure reliable backups?