CCNP Practice Test 27 — 15 Questions

Question 1

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS devices. The administrator prefers a tool that uses YAML for playbooks and does not require installing software on the managed devices. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ansible. Ansible is the correct choice because it is agentless, uses YAML for playbooks, and connects to Cisco IOS devices over SSH without requiring any software installation on the devices. It has a rich set of network modules, such as 'ios_config', that simplify configuration management. Other tools like Puppet and Chef use different languages and often require agents, making them less suitable for this scenario.

Answer

Puppet

Answer

Chef

Answer

SaltStack

Question 2

A network automation team uses a Python script with the ncclient library to configure a Cisco IOS XE router via NETCONF. The script sends an <edit-config> RPC with a candidate datastore, but the router returns an error indicating the candidate datastore is not supported. The team wants to make configuration changes without affecting the running configuration until they are verified. Which NETCONF capability should the team ensure is enabled on the router to allow this workflow?

Accepted Answer

:candidate. To use a candidate datastore for staging configuration changes, the NETCONF server must support the :candidate capability. This allows the client to edit the candidate configuration, validate it, and then commit it to the running configuration. Other capabilities like :confirmed-commit and :rollback-on-error enhance commit behavior but require :candidate as a prerequisite. Thus, enabling :candidate is necessary.

Answer

:writable-running

Answer

:rollback-on-error

Answer

:confirmed-commit

Question 3

A network architect is designing a Python script that will retrieve interface statistics from a Cisco IOS XE device using the RESTCONF API. The script must authenticate with a username and password, and all communication must be encrypted. The device is configured with the 'restconf' and 'ip http secure-server' commands. Which HTTP method and authentication mechanism should the script use to retrieve the data?

Accepted Answer

GET with Basic Authentication over HTTPS. RESTCONF uses HTTP methods that align with CRUD operations: GET for read, POST for create, PUT/PATCH for update, and DELETE for delete. To retrieve interface statistics, the script must use GET. Basic Authentication over HTTPS ensures that credentials are encrypted during transmission. The combination of GET and Basic Auth over HTTPS meets both the functional and security requirements of the scenario.

Answer

PATCH with Basic Authentication over HTTPS

Answer

PUT with Token Authentication over HTTPS

Answer

POST with OAuth 2.0 over HTTP

Question 4

A network automation team is using the ncclient Python library to configure a Cisco IOS XE router via NETCONF. The engineer wants to ensure the configuration changes are applied atomically and that the device automatically rolls back if any part of the change fails. Which NETCONF capability must the engineer verify is advertised by the device before relying on this behavior?

Accepted Answer

urn:ietf:params:netconf:capability:confirmed-commit:1.0. To achieve atomic configuration with automatic rollback, the NETCONF confirmed-commit capability is required. It allows a commit to be provisional until explicitly confirmed; if confirmation is not received within the timeout, the device reverts to the prior configuration. Verifying that the device advertises this capability ensures the automation can rely on rollback semantics rather than leaving the device in an inconsistent state after a failure.

Answer

urn:ietf:params:netconf:capability:candidate:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:validate:1.0

Question 5

A network engineer is building a Python script that must retrieve the operational state of all interfaces from a Cisco IOS XE device using RESTCONF. The engineer sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state and receives an HTTP 401 Unauthorized response. The device is reachable, RESTCONF is enabled, and the correct credentials are being used in the request. What is the most likely cause of the 401 response?

Accepted Answer

The HTTP Basic Authentication credentials are not being sent because the Authorization header is missing or malformed.. An HTTP 401 Unauthorized response is returned when authentication credentials are missing or invalid. With RESTCONF on Cisco IOS XE, authentication is performed using HTTP Basic Authentication, so the request must include a correctly formed Authorization header. Since the credentials are known to be correct, the failure must stem from the header not being transmitted or being malformed, which is a common scripting oversight.

Answer

The device's RESTCONF service is configured to use NETCONF over SSH instead of HTTPS, so the request must be sent to port 830.

Answer

The RESTCONF API requires the Accept header to be set to application/yang-data+json.

Answer

The URL path should be /restconf/data/ietf-interfaces:interfaces instead of interfaces-state.

Question 6

A network engineer needs to programmatically retrieve the operational status of all GigabitEthernet interfaces on a Cisco IOS XE device. The engineer wants to use a REST-based protocol that returns data in JSON and uses HTTP methods. The device is configured with 'restconf' and 'ip http secure-server'. Which protocol should the engineer use?

Accepted Answer

RESTCONF over HTTPS. RESTCONF is the correct choice because it is a REST-based protocol that uses HTTP methods and supports JSON encoding. It is enabled on Cisco IOS XE with the 'restconf' command and leverages the HTTPS server. The other options either use different transports (NETCONF over SSH), different data formats (SNMP), or are not REST-based (SSH CLI).

Answer

SSH with CLI commands

Answer

SNMPv3 with JSON output

Answer

NETCONF over SSH

Question 7

Drag and drop each EAP method on the left to its matching authentication type on the right.

Accepted Answer

EAP-TLS: Mutual certificate-based authentication. EAP-TLS uses certificates, PEAP uses server certificate with inner MSCHAPv2, EAP-FAST uses a PAC, and EAP-MD5 uses simple password hash.

Question 8

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write the automation tasks in YAML and does not want to install any software on the switches. Which tool should be used?

Accepted Answer

Ansible. Ansible is an agentless automation tool that uses YAML playbooks, making it ideal for simple configuration pushes to network devices without installing agents. Puppet and Chef typically require agents and use different DSLs, while SaltStack, although YAML-based, often involves a more complex architecture. Ansible's simplicity and native support for Cisco IOS XE modules align with the scenario.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 9

A network engineer is building a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate, retrieve interface configuration, and handle the response. Which two actions are required to successfully complete this task? (Choose two.)

Accepted Answer

Enable the RESTCONF agent on the device by entering the 'restconf' global configuration command and ensuring the HTTPS server is active.. Successful RESTCONF interaction requires enabling the RESTCONF agent and HTTPS server on the device, then issuing proper HTTP requests to the correct RESTCONF data URIs with appropriate media type headers. NETCONF libraries, SNMP settings, and client-side YANG tools do not enable or perform RESTCONF operations, so only enabling RESTCONF and using correct HTTP GET requests are required.

Answer

Configure the device with an SNMP community string so RESTCONF can authenticate the API session.

Answer

Use the 'ncclient' library to establish a NETCONF session on port 830 and then issue RESTCONF calls through that session.

Answer

Install the 'yangsuite' package on the IOS XE device to validate the RESTCONF payloads before sending them.

Question 10

A network engineer is using the Cisco DNA Center Intent API to create a new site hierarchy. The engineer sends a POST request to /dna/intent/api/v1/site with a JSON payload defining the site. The API returns a 202 Accepted response with a task ID. What should the engineer do next to confirm the site was created successfully?

Accepted Answer

Use the task ID to poll the GET /dna/intent/api/v1/task/{taskId} endpoint until the task status is 'SUCCESS'.. When the DNA Center Intent API returns 202 Accepted, it means the request is being processed asynchronously. The response includes a task ID. The engineer must poll the task endpoint with that ID until the status indicates success. This ensures the site creation is complete before proceeding with dependent tasks.

Answer

Check the DNA Center audit logs to see if the site creation was logged.

Answer

Resend the POST request with the same payload to ensure the site is created.

Answer

Immediately send a GET request to /dna/intent/api/v1/site to verify the site exists.

Question 11

A network administrator wants to use a declarative, agentless automation tool to push VLAN configurations to a group of Cisco IOS XE switches. The tool should connect over SSH, use YAML playbooks, and require no software installation on the switches. Which tool best fits these requirements?

Accepted Answer

Ansible with the cisco.ios collection and an inventory of the switches. Ansible is the only option that is agentless, connects via SSH, and uses YAML playbooks. The cisco.ios collection supplies modules purpose-built for IOS XE VLAN and configuration management. Puppet, Chef, and SaltStack all generally require an agent on managed nodes, which cannot be installed on Cisco IOS XE switches, so they do not satisfy the agentless requirement.

Answer

SaltStack with minions deployed on each switch and states written in YAML

Answer

Chef Infra Client installed on each switch with recipes written in Ruby

Answer

Puppet with the Cisco IOS module installed on each switch

Question 12

A network engineer is developing a Python script to configure OSPF on a Cisco IOS XE device using the NETCONF protocol. The script establishes an SSH session and sends a RPC with the target datastore set to 'running'. The configuration is applied successfully, but after a device reload, the OSPF configuration is missing. The engineer verifies that the operation included the 'default-operation' parameter set to 'merge'. What is the most likely reason for the configuration loss?

Accepted Answer

The NETCONF operation modifies the running configuration but does not automatically save it to the startup configuration; a separate or to startup is required.. NETCONF operations on Cisco IOS XE modify the running configuration. To persist changes across a reload, the running configuration must be explicitly saved to the startup configuration using a RPC or equivalent. The scenario describes a classic case where the configuration is applied but not saved, leading to loss after reload. The other options incorrectly attribute the loss to datastore targeting, merge behavior, or session handling.

Answer

The <edit-config> operation was applied to the 'candidate' datastore instead of the 'running' datastore, and the candidate was not committed.

Answer

The 'default-operation' parameter should have been set to 'replace' instead of 'merge' to ensure the configuration is saved to NVRAM.

Answer

The NETCONF session was not closed properly, causing the device to roll back the configuration upon session termination.

Question 13

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS devices. The administrator prefers a tool that uses YAML for playbooks and does not require installing software on the managed devices. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ios_facts. Ansible provides platform-specific modules for network devices. For Cisco IOS XE, the ios_facts module is designed to collect a wide range of operational facts, such as version, interfaces, and hardware. It returns structured data that can be used in playbooks. This module is the standard way to gather facts from IOS XE devices without manual parsing.

Answer

ios_config

Answer

ios_command

Answer

setup

Question 14

Drag and drop each EtherChannel port state on the left to its matching description on the right.

Accepted Answer

bundled: Port is actively forwarding traffic in the EtherChannel. In EtherChannel, ports can be in one of three states: bundled, stand-alone, or suspended. A bundled port actively forwards traffic in the channel. A stand-alone port is active but not part of any EtherChannel. A suspended port is administratively down or error-disabled. The remaining options are distractors that do not match any of these states.

Answer

bundled: Port is a member of the channel and forwarding

Answer

stand-alone: Port operates as a regular switch port

Question 15

A network automation team uses a Python script with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script establishes a session and sends an RPC with a candidate datastore. After sending the RPC, the script immediately sends a RPC, but the device returns an error indicating that the candidate datastore is not supported. Which statement explains the cause of this error?

Accepted Answer

The device does not support the candidate datastore, so the script must use the running datastore directly.. The error indicates that the candidate datastore is not supported by the device. Cisco IOS XE devices often support only the running datastore for NETCONF edits. The candidate datastore allows a two-phase commit, but if it is not available, the script must target the running datastore. The <commit> operation is only for the candidate datastore. Therefore, the script should be changed to edit the running datastore directly, which applies changes immediately.

Answer

The device requires the use of NETCONF over SSH instead of TLS for candidate datastore operations.

Answer

The script must first send a <lock> RPC on the candidate datastore before editing.

Answer

The script must send a RPC before the to ensure the candidate configuration is valid.