CCNA AI and Network Operations Practice Test 14 — 15 Questions

Question 1

Which THREE of the following best describe how agentic AI is used in network automation, specifically regarding AI agents, tool-calling, and closed-loop remediation workflows?

Accepted Answer

AI agents can autonomously decide which network troubleshooting steps to perform and invoke appropriate tools via APIs.. Options A, C, and D are correct because agentic AI in network automation involves autonomous decision-making (A), tool-calling to execute network commands or gather data (C), and closed-loop remediation that continuously monitors, diagnoses, and applies fixes automatically (D). Options B and E are incorrect because they contradict the autonomous nature of agentic AI: B describes a passive monitoring system with human-only remediation, and E states that closed-loop remediation always requires human approval, which is not true for full closed-loop automation.

Answer

AI agents only monitor network traffic and alert humans for any remediation actions.

Answer

Closed-loop remediation always requires a human to approve each corrective action before it is executed.

Question 2

Which THREE statements accurately describe the role of AI agents in closed-loop remediation workflows for network automation?

Accepted Answer

AI agents can autonomously analyze network telemetry and decide on remediation actions.. B is correct because AI agents in closed-loop remediation workflows autonomously analyze network telemetry (e.g., gRPC, NETCONF) and decide on remediation actions without manual intervention, enabling rapid response. D is correct because tool-calling allows the AI agent to invoke external automation tools like Ansible or Python scripts to execute the chosen remediation steps. E is correct because a key part of the closed-loop is that the AI agent monitors the network after action to confirm the issue is resolved and adjusts if needed, ensuring the loop is closed. A is wrong because closed-loop automation implies autonomous execution based on predefined policies, not requiring manual approval for every action. C is wrong because AI agents use dynamic telemetry and learned patterns, not just static baseline configurations, to detect anomalies. F is wrong because AI agents augment, not eliminate, human oversight; human intervention remains for policy exceptions and oversight.

Answer

AI agents require manual approval before executing any remediation action in a closed-loop workflow.

Answer

AI agents rely solely on static baseline configurations to detect anomalies.

Answer

AI agents eliminate the need for human oversight in network operations.

Question 3

A network administrator notices that the NTP server on Router R1 is not synchronizing with the upstream NTP server at 192.0.2.1. The router is configured as an NTP client, but show ntp status indicates the clock is unsynchronized and the stratum is 16. There is no firewall between R1 and 192.0.2.1. What is the most likely cause of this issue?

Accepted Answer

Router R1 does not have a route to reach 192.0.2.1.. The most likely cause is that Router R1 lacks a route to the upstream NTP server at 192.0.2.1. Without a valid IP route, NTP packets cannot reach the server, so the client remains unsynchronized with stratum 16. The other options are incorrect: A is not required for client operation, C is irrelevant because NTP version negotiation works across versions, and D is ruled out by the absence of a firewall.

Answer

The NTP server at 192.0.2.1 is not configured as a peer on R1.

Answer

The NTP server at 192.0.2.1 is not using NTP version 4.

Answer

The NTP server at 192.0.2.1 has a firewall blocking NTP traffic.

Question 4

A network engineer notices that the system clock on a Cisco IOS-XE router is incorrect, causing syslog timestamps to be unreliable. The router is configured as an NTP client to synchronize with a remote NTP server at 192.168.1.10. However, the show ntp status command indicates the clock is unsynchronized. What is the most likely cause of this issue?

Accepted Answer

The router cannot reach the NTP server due to a missing route or firewall blocking UDP port 123.. NTP operates over UDP port 123. If the router cannot reach the NTP server at 192.168.1.10 due to a missing route or a firewall blocking UDP 123, the NTP client will remain unsynchronized, as indicated by the 'show ntp status' command showing the clock as unsynchronized. This is the most common cause of NTP synchronization failure in a network.

Answer

The NTP server is using TCP instead of UDP for NTP communication.

Answer

The NTP server has a higher stratum level than the router's local clock, so the router ignores it.

Answer

NTP authentication is misconfigured on the router.

Question 5

Which TWO statements correctly describe NTP stratum levels and syslog severity levels in a Cisco IOS-XE environment?

Accepted Answer

An NTP stratum value of 1 indicates a higher accuracy than a stratum value of 3.. A lower NTP stratum number indicates higher accuracy; stratum 1 is directly synchronized to a precise reference clock (e.g., GPS) and is thus more accurate than stratum 3, which is two hops away. Option C is correct because the 'ntp server' command configures a device to synchronize its clock to a specified NTP server, making it an NTP client. Option B is incorrect: syslog severity level 4 (warning) is more severe than level 5 (notice) because lower severity numbers indicate higher severity. Option D is incorrect: severity level 0 (emergency) is the most severe level, indicating a system-wide critical event, not a normal operational message. Option E is incorrect: NTP stratum 0 is assigned to an authoritative time source itself (e.g., atomic clock), not to devices directly connected to it; devices connected to stratum 0 sources are stratum 1.

Answer

A syslog severity level of 5 (notice) is more severe than a level of 4 (warning).

Answer

Syslog severity level 0 (emergency) indicates a normal operational message.

Answer

NTP stratum 0 is assigned to devices that are directly connected to an authoritative time source.

Question 6

Drag and drop the syslog severity levels and NTP concepts on the left to their correct descriptions on the right.

Accepted Answer

Syslog severity level 0 (Emergency) – System is unusable; NTP Stratum 0 – Reference clock (e.g., atomic clock). Syslog severity levels range from 0 (Emergency) to 7 (Debug), with 0 being the most critical. NTP stratum indicates clock accuracy: stratum 0 is the reference clock, stratum 1 is directly connected to a reference, and so on up to stratum 15, which is the maximum usable synchronized stratum. Stratum 16 means the device is unsynchronized. The ntp server command configures a device as a client, and show ntp status displays synchronization state and current stratum.

Answer

Syslog severity level 0 (Emergency) – System is unusable; NTP Stratum 0 – Client that synchronizes to a Stratum 1 server

Answer

Syslog severity level 7 (Debug) – System is unusable; NTP Stratum 0 – Reference clock (e.g., atomic clock)

Answer

Syslog severity level 7 (Debug) – System is unusable; NTP Stratum 0 – Client that synchronizes to a Stratum 1 server

Question 7

A network engineer is tasked with monitoring a large enterprise network that requires high-frequency, real-time data collection from thousands of routers and switches. The engineer needs a solution that minimizes CPU overhead on the network devices and supports push-based data delivery. Which technology should the engineer choose for this requirement?

Accepted Answer

Streaming telemetry. Streaming telemetry uses a push model (e.g., gRPC or UDP-based dial-out) to continuously send structured data (YANG-modeled, often encoded in GPB or JSON) from network devices to a collector, which eliminates the need for periodic polling. This minimizes CPU overhead because the device only encodes and transmits data when a subscription triggers an update, rather than processing repeated SNMP GET requests. It is designed for high-frequency, real-time data collection at scale, making it ideal for monitoring thousands of routers and switches with minimal performance impact.

Answer

SNMPv2c with frequent polling intervals

Answer

NetFlow

Answer

IPFIX

Question 8

A network engineer is evaluating monitoring technologies for a large enterprise network that requires high-frequency, low-latency traffic data collection with support for custom fields. The solution must also support encryption and authentication to prevent tampering. Which technology best meets these requirements?

Accepted Answer

Implement streaming telemetry using gRPC with TLS and YANG data models.. Streaming telemetry using gRPC with TLS and YANG data models is correct because it provides high-frequency, low-latency push-based data collection, supports custom fields via YANG models, and ensures encryption and authentication through TLS. This meets all the requirements, unlike polling-based or unencrypted alternatives.

Answer

Configure SNMPv2c with community strings and polling every 30 seconds.

Answer

Deploy NetFlow v9 with custom flow records and SNMPv3 for encryption.

Answer

Use IPFIX with UDP export and add authentication via MD5 hashing.

Question 9

Which TWO statements correctly describe characteristics of SNMPv2c and SNMPv3 for network monitoring?

Accepted Answer

SNMPv3 supports authentication and encryption for secure network monitoring.. SNMPv3 is correct because it introduces authentication (MD5/SHA) and encryption (DES/AES) for secure monitoring. SNMPv2c is correct because it uses community strings transmitted in cleartext, lacking security. Option C is wrong: SNMPv3 is more secure than v2c, not the same. Option D is wrong: SNMPv2c supports traps in addition to GET and SET. Option E is wrong: SNMPv3 uses usernames and security models, not community strings.

Answer

SNMPv3 provides the same security level as SNMPv2c but with additional trap support.

Answer

SNMPv2c supports only GET and SET operations, but not traps.

Answer

SNMPv3 uses community strings to authenticate agents and managers.

Question 10

A network engineer needs to automate the configuration of multiple Cisco IOS XE routers in a data center. The team requires a standard, vendor-neutral data modeling language to define the configuration parameters, and they need a protocol that uses XML-based remote procedure calls over SSH for secure, reliable configuration transactions. Which combination of technologies best meets these requirements?

Accepted Answer

Use YANG data models combined with NETCONF over SSH.. YANG is a standard, vendor-neutral data modeling language (RFC 6020) for defining configuration parameters, and NETCONF (RFC 6241) uses XML-based remote procedure calls (RPCs) over SSH for secure, reliable configuration transactions. This combination directly satisfies the requirement for a standard data model and XML-based RPCs over SSH, unlike RESTCONF which uses HTTPS and JSON/XML but not SSH.

Answer

Use YANG data models combined with RESTCONF over HTTPS.

Answer

Use CLI commands combined with NETCONF over SSH.

Answer

Use CLI commands combined with RESTCONF over HTTPS.

Question 11

A network engineer is automating the configuration of a new branch office router. The engineer needs a protocol that uses a YANG data model, supports both configuration and operational state retrieval, and operates over SSH for secure transport. Which protocol should the engineer use?

Accepted Answer

NETCONF. NETCONF (Network Configuration Protocol) is the correct choice because it uses YANG data models for configuration and operational state retrieval, and it operates over SSH (RFC 6242) for secure transport. Unlike SNMP, NETCONF provides transactional configuration changes and separates configuration from operational state data, making it ideal for automated router configuration.

Answer

SNMP

Answer

RESTCONF

Answer

CLI scripting

Question 12

Which THREE statements accurately describe the characteristics of NETCONF and RESTCONF for programmatic network configuration?

Accepted Answer

NETCONF uses XML-encoded RPCs over a secure transport such as SSH or TLS.. NETCONF uses XML-encoded Remote Procedure Calls (RPCs) over a secure transport such as SSH or TLS, making option B correct. RESTCONF supports both XML and JSON encoding and uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE), so option C is correct. Both NETCONF and RESTCONF rely on YANG data models to define the structure of configuration and operational data, confirming option D. Option A is incorrect because NETCONF does not use HTTP methods; that is a characteristic of RESTCONF. Option E is wrong because RESTCONF does not use a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's candidate config and commit model.

Answer

NETCONF uses HTTP methods such as GET, POST, PUT, and DELETE to manipulate configuration data.

Answer

NETCONF uses a separate commit operation to apply changes, while RESTCONF uses a similar commit mechanism.

Question 13

Drag and drop the protocols/technologies on the left to the descriptions on the right.

Accepted Answer

SSH: Provides secure remote access to network devices using encryption, typically on TCP port 22.. SSH (Secure Shell) provides encrypted remote access to network devices, typically using TCP port 22. It is the secure alternative to Telnet. Telnet (port 23) is unencrypted and insecure. HTTP (port 80) is used for web traffic, not remote access. FTP (port 21) is for file transfers and is not designed for remote shell access. Therefore, only SSH matches the description of secure remote access.

Answer

Telnet: Provides secure remote access to network devices using encryption, typically on TCP port 23.

Answer

HTTP: Provides secure remote access to network devices using encryption, typically on TCP port 80.

Answer

FTP: Provides secure remote access to network devices using encryption, typically on TCP port 21.

Question 14

Drag and drop the following steps into the correct order to implement a basic network monitoring workflow using telemetry and streaming analytics on Cisco IOS-XE.

Accepted Answer

Collect data via telemetry from network devices. The workflow begins by collecting data via telemetry from network devices (A), then streaming that data to an analytics platform (B). After streaming, the data is monitored using dashboards (C), and finally alerts are generated for threshold violations (D).

Question 15

Drag and drop the following steps into the correct order to troubleshoot an end-to-end connectivity issue using a bottom-up approach.

Accepted Answer

Check physical layer connectivity and interface status. The correct troubleshooting order follows the OSI model bottom-up: start with physical connectivity (A), then verify Layer 3 addressing (B), use diagnostic tools (C) to isolate the failure, and finally implement the solution and verify restoration (D). Skipping layers can lead to misdiagnosis.