CCNA AI and Network Operations Practice Test 14 — 15 Questions

Question 1

A network engineer at a large enterprise observes repeated spikes in latency on the core network every weekday at 10:00 AM, but no corresponding increase in overall bandwidth utilization. The engineer wants to use AI/ML to automatically identify the root cause and take corrective action without manual intervention. Which concept best describes this approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Intent-based networking. Intent-based networking (IBN) is correct because it describes a closed-loop system where the network continuously validates that its operational state matches the desired business intent. In this scenario, the engineer wants the network to automatically detect the latency anomaly, correlate it with other telemetry (e.g., routing changes, queue drops), and take corrective action (e.g., reroute traffic, adjust QoS) without human intervention — which is the core promise of IBN, often implemented via Cisco's DNA Center with Assurance and AI/ML capabilities.

Answer

Anomaly detection

Answer

Predictive analytics

Answer

Machine learning classification

Question 2

Which TWO statements accurately describe how AI and ML concepts are applied to network operations?

Accepted Answer

Intent-based networking translates business intent into network policies and continuously validates that the network meets those intentions.. Intent-based networking (IBN) captures business intent in a declarative model, translates it into network policies (e.g., via Cisco DNA Center), and continuously validates that the network state matches the intended outcome using assurance and closed-loop analytics. Option B is correct because anomaly detection leverages ML models to establish a baseline of normal traffic and then flags deviations, which can indicate security threats or performance issues. Option C is incorrect because predictive analytics forecasts future network conditions but does not automatically reconfigure devices; that requires closed-loop automation. Option D is false because ML models in network operations are not trained exclusively on labeled data; unsupervised learning can detect unknown patterns without labeled datasets. Option E is false because rule-based systems cannot adapt to new, unknown patterns without manual updates, whereas ML models are better suited for anomaly detection due to their ability to learn and generalize from data.

Answer

Predictive analytics uses historical data to forecast future network conditions and automatically reconfigures network devices to prevent issues.

Answer

ML models in network operations are trained exclusively on labeled datasets to detect known attack signatures.

Answer

Rule-based systems are preferred over ML for anomaly detection because they can adapt to new, unknown patterns without manual updates.

Question 3

Drag and drop the AI/ML concepts on the left to the correct descriptions on the right.

Accepted Answer

Anomaly detection: Identifies deviations from normal network behavior, such as unusual traffic spikes or security threats.. Supervised learning uses labeled data, unsupervised finds hidden patterns, reinforcement learning uses rewards, neural networks mimic brain structure, training data is for learning, and inference is applying the model to new data.

Question 4

A network operations team is implementing an AI-driven automation system that uses an agentic AI agent to handle routine network issues. The agent is configured to detect high CPU utilization on a core router, then automatically execute a series of diagnostic commands and, if a specific pattern is found, trigger a configuration change to reduce load. After the change, the agent re-checks CPU utilization and, if still high, escalates the issue to a human engineer. Which of the following best describes the workflow being used?

Accepted Answer

A closed-loop remediation workflow. The workflow described is a closed-loop remediation workflow because the agent detects a condition (high CPU), takes action (diagnostic commands and configuration change), then re-checks the condition (CPU utilization) and escalates if unresolved. This feedback loop—observe, act, verify, escalate—is the defining characteristic of closed-loop automation. It is not a static script because it adapts based on the outcome of its actions.

Answer

A static automation script that runs on a schedule without feedback

Answer

A tool-calling mechanism for executing network commands

Answer

An AI agent that uses reinforcement learning to optimize network performance

Question 5

A network operations team is implementing an automated system to detect and remediate interface flapping on core switches. The system must be able to query the network device for interface status and execute commands to disable or reconfigure the interface if a pattern of flapping is detected. Which protocol or technology enables the system to programmatically interact with the network device for both monitoring and configuration changes?

Accepted Answer

NETCONF. NETCONF is the correct choice because it is a standardized network configuration protocol that allows automated systems to retrieve operational data and push configuration changes securely. In this scenario, the system would use NETCONF to query interface status and then apply remediation configurations. SNMP can monitor but has limited configuration capabilities, CLI scripting is non-programmatic and error-prone, and Syslog is only for logging.

Answer

SNMP

Answer

CLI scripting

Answer

Syslog

Question 6

Which THREE of the following best describe how agentic AI is used in network automation, specifically regarding AI agents, tool-calling, and closed-loop remediation workflows?

Accepted Answer

AI agents can autonomously decide which network troubleshooting steps to perform and invoke appropriate tools via APIs.. Options A, C, and D are correct because agentic AI in network automation involves autonomous decision-making (A), tool-calling to execute network commands or gather data (C), and closed-loop remediation that continuously monitors, diagnoses, and applies fixes automatically (D). Options B and E are incorrect because they contradict the autonomous nature of agentic AI: B describes a passive monitoring system with human-only remediation, and E states that closed-loop remediation always requires human approval, which is not true for full closed-loop automation.

Answer

AI agents only monitor network traffic and alert humans for any remediation actions.

Answer

Closed-loop remediation always requires a human to approve each corrective action before it is executed.

Question 7

Which THREE statements accurately describe the role of AI agents in closed-loop remediation workflows for network automation?

Accepted Answer

AI agents can autonomously analyze network telemetry and decide on remediation actions.. B is correct because AI agents in closed-loop remediation workflows autonomously analyze network telemetry (e.g., gRPC, NETCONF) and decide on remediation actions without manual intervention, enabling rapid response. D is correct because tool-calling allows the AI agent to invoke external automation tools like Ansible or Python scripts to execute the chosen remediation steps. E is correct because a key part of the closed-loop is that the AI agent monitors the network after action to confirm the issue is resolved and adjusts if needed, ensuring the loop is closed. A is wrong because closed-loop automation implies autonomous execution based on predefined policies, not requiring manual approval for every action. C is wrong because AI agents use dynamic telemetry and learned patterns, not just static baseline configurations, to detect anomalies. F is wrong because AI agents augment, not eliminate, human oversight; human intervention remains for policy exceptions and oversight.

Answer

AI agents require manual approval before executing any remediation action in a closed-loop workflow.

Answer

AI agents rely solely on static baseline configurations to detect anomalies.

Answer

AI agents eliminate the need for human oversight in network operations.

Question 8

A network administrator notices that the NTP server on Router R1 is not synchronizing with the upstream NTP server at 192.0.2.1. The router is configured as an NTP client, but show ntp status indicates the clock is unsynchronized and the stratum is 16. There is no firewall between R1 and 192.0.2.1. What is the most likely cause of this issue?

Accepted Answer

Router R1 does not have a route to reach 192.0.2.1.. The most likely cause is that Router R1 lacks a route to the upstream NTP server at 192.0.2.1. Without a valid IP route, NTP packets cannot reach the server, so the client remains unsynchronized with stratum 16. The other options are incorrect: A is not required for client operation, C is irrelevant because NTP version negotiation works across versions, and D is ruled out by the absence of a firewall.

Answer

The NTP server at 192.0.2.1 is not configured as a peer on R1.

Answer

The NTP server at 192.0.2.1 is not using NTP version 4.

Answer

The NTP server at 192.0.2.1 has a firewall blocking NTP traffic.

Question 9

A network engineer notices that the system clock on a Cisco IOS-XE router is incorrect, causing syslog timestamps to be unreliable. The router is configured as an NTP client to synchronize with a remote NTP server at 192.168.1.10. However, the show ntp status command indicates the clock is unsynchronized. What is the most likely cause of this issue?

Accepted Answer

The router cannot reach the NTP server due to a missing route or firewall blocking UDP port 123.. NTP operates over UDP port 123. If the router cannot reach the NTP server at 192.168.1.10 due to a missing route or a firewall blocking UDP 123, the NTP client will remain unsynchronized, as indicated by the 'show ntp status' command showing the clock as unsynchronized. This is the most common cause of NTP synchronization failure in a network.

Answer

The NTP server is using TCP instead of UDP for NTP communication.

Answer

The NTP server has a higher stratum level than the router's local clock, so the router ignores it.

Answer

NTP authentication is misconfigured on the router.

Question 10

Which TWO statements correctly describe NTP stratum levels and syslog severity levels in a Cisco IOS-XE environment?

Accepted Answer

An NTP stratum value of 1 indicates a higher accuracy than a stratum value of 3.. A lower NTP stratum number indicates higher accuracy; stratum 1 is directly synchronized to a precise reference clock (e.g., GPS) and is thus more accurate than stratum 3, which is two hops away. Option C is correct because the 'ntp server' command configures a device to synchronize its clock to a specified NTP server, making it an NTP client. Option B is incorrect: syslog severity level 4 (warning) is more severe than level 5 (notice) because lower severity numbers indicate higher severity. Option D is incorrect: severity level 0 (emergency) is the most severe level, indicating a system-wide critical event, not a normal operational message. Option E is incorrect: NTP stratum 0 is assigned to an authoritative time source itself (e.g., atomic clock), not to devices directly connected to it; devices connected to stratum 0 sources are stratum 1.

Answer

A syslog severity level of 5 (notice) is more severe than a level of 4 (warning).

Answer

Syslog severity level 0 (emergency) indicates a normal operational message.

Answer

NTP stratum 0 is assigned to devices that are directly connected to an authoritative time source.

Question 11

Drag and drop the syslog severity levels and NTP concepts on the left to their correct descriptions on the right.

Accepted Answer

Syslog severity level 0 (Emergency) – System is unusable; NTP Stratum 0 – Reference clock (e.g., atomic clock). Syslog severity levels range from 0 (Emergency) to 7 (Debug), with 0 being the most critical. NTP stratum indicates clock accuracy: stratum 0 is the reference clock, stratum 1 is directly connected to a reference, and so on up to stratum 15, which is the maximum usable synchronized stratum. Stratum 16 means the device is unsynchronized. The ntp server command configures a device as a client, and show ntp status displays synchronization state and current stratum.

Answer

Syslog severity level 0 (Emergency) – System is unusable; NTP Stratum 0 – Client that synchronizes to a Stratum 1 server

Answer

Syslog severity level 7 (Debug) – System is unusable; NTP Stratum 0 – Reference clock (e.g., atomic clock)

Answer

Syslog severity level 7 (Debug) – System is unusable; NTP Stratum 0 – Client that synchronizes to a Stratum 1 server

Question 12

Drag and drop the syslog and NTP items on the left to the correct descriptions on the right.

Accepted Answer

Syslog facility: Identifies the type of system or process that generated the log message. Each item is correctly paired with its description: A identifies the syslog facility (the source of the log), B indicates syslog severity (urgency level), C correctly describes an NTP server (time source), and D correctly describes an NTP client (time requester). These are foundational definitions for syslog and NTP operations.

Question 13

A network engineer is tasked with monitoring a large enterprise network that requires high-frequency, real-time data collection from thousands of routers and switches. The engineer needs a solution that minimizes CPU overhead on the network devices and supports push-based data delivery. Which technology should the engineer choose for this requirement?

Accepted Answer

Streaming telemetry. Streaming telemetry uses a push model (e.g., gRPC or UDP-based dial-out) to continuously send structured data (YANG-modeled, often encoded in GPB or JSON) from network devices to a collector, which eliminates the need for periodic polling. This minimizes CPU overhead because the device only encodes and transmits data when a subscription triggers an update, rather than processing repeated SNMP GET requests. It is designed for high-frequency, real-time data collection at scale, making it ideal for monitoring thousands of routers and switches with minimal performance impact.

Answer

SNMPv2c with frequent polling intervals

Answer

NetFlow

Answer

IPFIX

Question 14

A network engineer is evaluating monitoring technologies for a large enterprise network that requires high-frequency, low-latency traffic data collection with support for custom fields. The solution must also support encryption and authentication to prevent tampering. Which technology best meets these requirements?

Accepted Answer

Implement streaming telemetry using gRPC with TLS and YANG data models.. Streaming telemetry using gRPC with TLS and YANG data models is correct because it provides high-frequency, low-latency push-based data collection, supports custom fields via YANG models, and ensures encryption and authentication through TLS. This meets all the requirements, unlike polling-based or unencrypted alternatives.

Answer

Configure SNMPv2c with community strings and polling every 30 seconds.

Answer

Deploy NetFlow v9 with custom flow records and SNMPv3 for encryption.

Answer

Use IPFIX with UDP export and add authentication via MD5 hashing.

Question 15

Which TWO statements correctly describe characteristics of SNMPv2c and SNMPv3 for network monitoring?

Accepted Answer

SNMPv3 supports authentication and encryption for secure network monitoring.. SNMPv3 is correct because it introduces authentication (MD5/SHA) and encryption (DES/AES) for secure monitoring. SNMPv2c is correct because it uses community strings transmitted in cleartext, lacking security. Option C is wrong: SNMPv3 is more secure than v2c, not the same. Option D is wrong: SNMPv2c supports traps in addition to GET and SET. Option E is wrong: SNMPv3 uses usernames and security models, not community strings.

Answer

SNMPv3 provides the same security level as SNMPv2c but with additional trap support.

Answer

SNMPv2c supports only GET and SET operations, but not traps.

Answer

SNMPv3 uses community strings to authenticate agents and managers.