CCNA AI and Network Operations Practice Test 17 — 15 Questions

Question 1

You are connected to R1 via the console. R1 is a Cisco ISR 4321 router running IOS-XE. The network team has recently changed the routing protocol from EIGRP to OSPF, but some routes are missing from the routing table. You need to analyze the OSPF neighbor states and LSDB to identify the issue.

Accepted Answer

Use 'show ip ospf neighbor' to check neighbor state; if not FULL, examine 'show ip ospf interface' for mismatched hello/dead intervals or network type.. OSPF requires consistent hello/dead intervals and network types to form adjacency. If the neighbor is not in FULL state, routes will not be exchanged. Checking 'show ip ospf neighbor' reveals the state; mismatched parameters can be corrected by adjusting interface configuration.

Answer

Use 'show ip route ospf' to verify OSPF routes; if missing, re-enter the OSPF process and redistribute connected routes.

Answer

Use 'debug ip ospf events' to monitor OSPF packets; if no packets are seen, reconfigure OSPF router ID and clear the OSPF process.

Answer

Use 'show ip protocols' to verify OSPF process configuration; if incorrect, delete and recreate the OSPF process with the correct network statements.

Question 2

You are connected to the console of R1, a Cisco IOS-XE router. The network operations team needs to automate the backup of the running configuration to a TFTP server using a Python netmiko script. However, the script is failing. Your task is to write the correct netmiko commands to connect to R1 and save the configuration to the TFTP server at 192.168.1.100.

Accepted Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config', expect_string=r'$$confirm$$')
connection.send_command('\n')
connection.disconnect(). The 'copy running-config tftp://...' command in Cisco IOS prompts with '[confirm]'. To handle this interactively in netmiko, the expect_string must use a regular expression that matches the literal characters '[' and ']', which requires escaping them as '$$' and '$$'. The corrected script uses r'$$confirm$$' and then sends a newline to confirm, ensuring the backup completes. Options B and D fail to expect the prompt, and C uses an incorrect prompt match (expect_string=r'#' would only wait for the privileged EXEC prompt, missing the confirmation).

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config')
connection.disconnect()

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config', expect_string=r'#')

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config
')
connection.disconnect()

Question 3

You are connected to R1 via the console. R1 is a Cisco IOS-XE router. The network manager wants to use an Ansible playbook to configure a loopback interface with IP address 10.0.0.1/24 on R1. You need to write the Ansible YAML playbook that connects to R1 and configures this interface. The playbook must not use the 'parents' argument in the ios_config module.

Accepted Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - no shutdown. It uses the network_cli connection type, applies the correct subnet mask (255.255.255.0), includes 'no shutdown' to enable the interface, and does not use the 'parents' argument, meeting the requirement. Option B is wrong because it uses an 'ssh' connection (not network_cli) and writes the IP address in CIDR notation (/24) instead of the required dotted-decimal mask. Option C is wrong because it uses 'shutdown' instead of 'no shutdown', which disables the interface. Option D is wrong because it uses the 'parents' argument, which the stem explicitly forbids, even though the configuration would otherwise be valid.

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: ssh
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1/24
          - no shutdown

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - shutdown

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - no shutdown
        parents: interface Loopback0

Question 4

You are connected to R1 via the console. R1 is a Cisco ISR 4321 router running IOS-XE 17.3. The network team has reported intermittent connectivity issues between VLAN 10 hosts and the server at 10.0.0.100. You suspect a routing problem and need to analyze the IP routing table, ARP cache, and interface status to identify the cause. Use the provided outputs to diagnose the issue.

Accepted Answer

The routing table shows a default route via 192.168.1.1, but the ARP cache has an incomplete entry for that next-hop IP, indicating a Layer 2 connectivity issue.. The issue is likely a missing or incorrect route, an incomplete ARP entry, or an interface problem. By checking the routing table, you can confirm if a route to 10.0.0.100 exists. The ARP cache shows whether the next-hop MAC is learned. Interface status indicates if the link is operational. The solution commands reveal these details, allowing you to pinpoint the cause (e.g., default route missing, ARP timeout, or interface down).

Answer

The routing table has a static route to 10.0.0.0/24 via 192.168.1.2, but the interface GigabitEthernet0/0/0 is administratively down.

Answer

The routing table shows a route to 10.0.0.0/16 via 192.168.1.1, but the ARP cache has a complete entry for 192.168.1.1, indicating the issue is at Layer 3.

Answer

The routing table has no route to 10.0.0.100, and the ARP cache is empty for all entries, indicating a complete routing failure.

Question 5

Which three options best describe how machine learning models are trained for network anomaly detection? (Choose three.)

Accepted Answer

Using historical baseline traffic data to learn normal behavior patterns. Machine learning models for network anomaly detection are effectively trained using historical baseline traffic data to learn normal behavior patterns, which allows the model to identify deviations that may indicate anomalies. Labeled datasets with known attack signatures enable supervised learning, where the model learns to classify traffic as normal or malicious based on examples. Unsupervised clustering techniques, such as k-means or DBSCAN, can identify deviations without predefined labels by grouping similar data points and flagging outliers as potential anomalies. The three incorrect options—manual threshold configuration, training exclusively on synthetic data, and reliance on SNMP polling—are not characteristic of ML training methods. Manual threshold configuration is a rule‑based approach that does not involve learning from data. Training exclusively on synthetic data is not representative of real‑world traffic patterns and would not generalize well. Relying solely on SNMP polling intervals is a traditional monitoring method, not a machine learning technique.

Answer

Relying solely on SNMP polling intervals to detect anomalies

Answer

Requiring manual threshold configuration for every monitored metric

Answer

Training exclusively on synthetic data generated by simulation tools

Question 6

Which three of the following are benefits of integrating AI into network operations? (Choose three.)

Accepted Answer

Reduced mean time to repair (MTTR) through faster incident diagnosis. AI reduces mean time to repair (MTTR) by rapidly diagnosing incidents through automated correlation of telemetry and logs. It improves capacity planning by analyzing traffic patterns and predicting future demands, enabling proactive scaling. Automated security policy enforcement uses real-time risk analysis to adjust rules dynamically. The three distractors are wrong because AI cannot guarantee complete elimination of network downtime (unexpected hardware failures still occur), zero configuration for new devices (initial setup and integration still require human input), or total removal of human engineers (AI augments but does not replace strategic oversight and complex problem-solving).

Answer

Complete elimination of network downtime

Answer

Zero configuration required for new network devices

Answer

Total removal of human network engineers from operations

Question 7

Which three statements accurately describe the role of Cisco's AI-powered security features (such as Cisco AI Network Analytics, Stealthwatch, or DNA Center's AI-Enhanced Analytics) in network security operations? (Choose three.)

Accepted Answer

AI models can detect zero-day exploits by analyzing behavioral anomalies. Cisco's AI-powered security features detect zero-day exploits by analyzing behavioral anomalies and deviations from learned baselines, without relying on signatures. These systems correlate logs from multiple Cisco products (e.g., firewalls, endpoints, cloud) to uncover multi-step attack chains. AI can also automate responses such as blocking malicious IPs via Cisco security controls, reducing mean time to respond (MTTR). However, AI complements but does not replace traditional security tools like firewall rules or ACLs, and it requires ongoing human oversight for validation and tuning.

Answer

AI is only effective against known, signature-based threats

Answer

AI security models require no human oversight once deployed

Answer

AI eliminates the need for firewall rules and access control lists

Question 8

Which four of the following correctly describe how AI/ML techniques can improve network operations in a modern enterprise? (Choose all that apply.)

Accepted Answer

Natural language processing (NLP) can be used to automate responses to helpdesk tickets based on intent. Options A, B, C, and D are correct. AI models can predict bandwidth congestion by analyzing historical traffic data, enabling proactive capacity planning. Natural language processing (NLP) automates helpdesk ticket responses by interpreting user intent, reducing manual effort. Reinforcement learning can dynamically adjust firewall rules in response to evolving attack patterns, improving threat response without human intervention. Unsupervised learning can cluster behavior patterns to identify unknown device types on the network. Option E ("AI eliminates the need for baseline performance metrics because it learns in real-time") is incorrect because even AI/ML models require baseline metrics to establish normal behavior and detect anomalies; real-time learning does not remove the need for baselines. Option F ("ML models always require labeled training data to be effective in network operations") is incorrect because many ML techniques, such as unsupervised learning (as shown in option D), operate effectively on unlabeled data by discovering patterns and clusters without predefined labels.

Answer

AI eliminates the need for baseline performance metrics because it learns in real-time

Answer

ML models always require labeled training data to be effective in network operations

Question 9

Which three of the following are key benefits of integrating AI into network operations? (Choose three.)

Accepted Answer

Automated detection and correlation of anomalies across the network. The three correct answers highlight practical AI benefits: anomaly detection correlates diverse telemetry (NetFlow, SNMP) to identify issues faster; real-time traffic classification uses ML models for dynamic policy enforcement without manual rule updates; predictive maintenance analyzes historical data to forecast failures, enabling proactive intervention. The wrong options are unrealistic: AI cannot eliminate all human administrators (complex troubleshooting still needs humans), cannot guarantee 100% uptime (failures still occur), and cannot automatically reconfigure physical cabling (that requires physical access).

Answer

Complete elimination of the need for human network administrators

Answer

Automatic reconfiguration of physical cabling without manual intervention

Answer

Guaranteed 100% network uptime through self-healing algorithms

Question 10

Which three statements accurately describe the role of AI in software-defined networking (SDN) and intent-based networking (IBN)? (Choose three.)

Accepted Answer

IBN systems may use AI to verify that the current network state matches the desired intent. AI enhances SDN and IBN by analyzing network state to suggest or enforce configuration changes that align with business intent, verifying that the current state matches the desired intent, and translating high-level policies into low-level device configurations. These capabilities enable automation, continuous validation, and policy-driven operations. The incorrect options are wrong because: (1) SDN controllers do not replace AI; AI can augment decision-making beyond basic controller logic. (2) AI in SDN is used for security, compliance, and many other areas, not just traffic engineering. (3) Intent-based networking relies on monitoring and feedback loops to maintain alignment with intent; it does not eliminate them.

Answer

SDN controllers replace AI for all decision-making, making AI unnecessary in IBN

Answer

AI in SDN is only used for traffic engineering, not for security or compliance

Answer

Intent-based networking eliminates the need for any monitoring or feedback loops

Question 11

Which three of the following are typical use cases for automation in network security operations? (Choose three.)

Accepted Answer

Automated identification and blocking of previously unseen malware variants using behavioral analysis. The three correct options represent realistic automation use cases in network security operations. Automated identification and blocking of malware variants using behavioral analysis leverages machine learning to detect zero-day threats without relying on signatures. Correlating authentication logs with network flows allows security teams to identify lateral movement by spotting anomalous access patterns, which is a key technique in threat hunting. Dynamic micro-segmentation adjusts policies in real-time based on endpoint risk scores, enabling instant isolation of compromised devices. The incorrect options are unrealistic: a single AI-generated rule cannot cover all traffic, AI cannot guarantee zero false positives, and disabling all ports on any anomaly would cause denial of service.

Answer

Replacing all firewall rules with a single AI-generated rule that covers all traffic

Answer

Guaranteeing zero false positives in intrusion detection by using deep learning

Answer

Automatically disabling all network ports when any anomaly is detected

Question 12

Which TWO statements about network automation tools are true?

Accepted Answer

Ansible uses an agentless architecture and communicates with network devices over SSH by default.. Ansible is agentless, meaning it does not require any software installed on managed network devices. It connects to devices over SSH by default (or API for some platforms) and pushes configuration modules directly, making it lightweight and easy to deploy in network environments.

Answer

Puppet and Chef both use a push-based model where the master server initiates configuration changes on managed nodes.

Answer

Chef playbooks are written in YAML, while Ansible uses a Ruby-based DSL for defining desired state.

Answer

Ansible requires an agent to be installed on managed network devices, while Puppet does not.

Question 13

Drag and drop the following steps into the correct order to select and implement a network automation solution using the appropriate tool based on the use cases and differences between Puppet, Chef, Ansible, and Python.

Accepted Answer

Define the network automation goal and the type of configuration changes required.. The correct order follows a systematic approach: First, define the specific network automation goal to understand the scope and constraints. Next, evaluate whether a persistent, agent-based configuration enforcement approach (Puppet/Chef) or an agentless, orchestration-driven approach (Ansible) is required. Then consider the flexibility of a scripting language like Python for custom or one-off tasks. After selecting the tool, write the automation logic (playbook, manifest, or script). Test it in a controlled environment to avoid production issues, and finally deploy and verify the automation to ensure it meets the intended outcome.

Question 14

Drag and drop the following steps into the correct order to retrieve the operational status of interface GigabitEthernet0/0 using NETCONF and the ietf-interfaces YANG model.

Accepted Answer

Establish an SSH connection to the network device on TCP port 830, the standard NETCONF port.. First, establish an SSH connection to the device's NETCONF subsystem (TCP port 830). The NETCONF protocol then performs a capability exchange via messages to ensure both sides support the required YANG models. Next, a RPC with an XPath filter is sent to request the specific interface status. The server replies with containing the XML data. The client parses the XML to extract the desired value. Finally, the NETCONF session is closed by a RPC, and the SSH connection is terminated. This order ensures a proper NETCONF transaction lifecycle.

Question 15

A network administrator needs to configure VLANs and access ports on 200 managed switches across multiple locations. The administrator requires a solution that uses a push‑based deployment model, does not require any agent software to be installed on the switches, and can be executed from a central control node. Which automation tool is most suitable for this task?

Accepted Answer

Ansible. Ansible is the most suitable tool because it uses a push-based model (SSH) to apply configurations directly to network devices without requiring any agent software. It operates from a central control node, making it ideal for managing 200 switches across multiple locations with a single playbook execution.

Answer

Puppet

Answer

Chef

Answer

Python scripts