CCNP Ansible Automation — Timed 20 Questions

Question 1

A network engineer is automating the deployment of VLAN configurations on a set of Cisco IOS-XE switches using Ansible. The playbook uses the ios_vlans module and runs successfully on the first switch, but fails on the second switch with an error indicating that the module is not found. Both switches are running the same IOS-XE version and have the same management access configured. What is the most likely cause of this issue?

Accepted Answer

The cisco.ios collection is not installed on the Ansible control node.. The ios_vlans module is part of the cisco.ios collection, which must be installed on the Ansible control node, not on the managed devices. The error 'module not found' typically indicates the collection is missing or not properly referenced in the playbook. The switches themselves do not need to have the module installed.

Answer

The second switch does not have the ios_vlans module installed locally.

Answer

The second switch has a different SSH key that is not accepted by the Ansible control node.

Answer

The playbook uses a fully qualified collection name (FQCN) incorrectly.

Question 2

An engineer is writing an Ansible playbook to configure OSPF on a fleet of Cisco Nexus 9000 switches. The playbook uses the nxos_ospf module. When executed, the playbook reports 'changed' for every switch, even on subsequent runs when no configuration changes are made. The engineer wants to achieve idempotent behavior. What is the most likely cause of the non-idempotent results?

Accepted Answer

The playbook does not specify all OSPF parameters, such as 'router-id', causing the module to detect a difference with the running configuration.. The nxos_ospf module may report changes if the OSPF process configuration includes parameters that are not fully idempotent, such as the 'router-id' being set dynamically. However, a common cause is that the module compares the current state with the desired state, and if the switch returns extra default parameters (like 'log-adjacency-changes' or 'auto-cost') that are not specified in the playbook, the module may see a difference and report 'changed'. The most direct cause here is that the playbook does not specify all parameters that the module manages, leading to a mismatch.

Answer

The Ansible control node is using an outdated version of the nxos_ospf module that does not support idempotency.

Answer

The switches have different NX-OS versions, causing the module to behave inconsistently.

Answer

The engineer forgot to use the '--check' flag to verify idempotency.

Question 3

A network team uses Ansible Tower to manage configuration backups of 500 Cisco IOS routers. They have a playbook that uses the ios_config module with the 'backup: yes' option. Recently, backups started failing for a subset of routers, with errors like 'backup destination path does not exist'. The playbook uses a variable 'backup_dir' set in the Tower job template. What is the most likely cause of these failures?

Accepted Answer

The 'backup_dir' variable is not defined for those specific routers in their host_vars or group_vars, causing the playbook to use an undefined path.. The backup option in ios_config saves the backup file to a local directory on the Ansible control node. If the directory specified by 'backup_dir' does not exist on the control node, the module will fail. Since the error is specific to a subset of routers, it is likely that the variable is not being resolved correctly for those routers, possibly due to host_vars or group_vars overriding the job template variable.

Answer

The routers have insufficient storage space to save the backup locally.

Answer

The ios_config module requires the 'backup_options' sub-option to specify the directory, and the playbook is using the deprecated 'backup' parameter.

Answer

The routers are not reachable via SSH during the backup window.

Question 4

An engineer is automating the configuration of SNMPv3 on a large number of Cisco IOS-XE devices using Ansible. The playbook uses the ios_snmp_server module. The engineer wants to ensure that the SNMP configuration is applied only if the device is running a specific IOS version that supports SNMPv3. Which Ansible feature should the engineer use to conditionally execute the task?

Accepted Answer

Use the 'when' clause with a condition on the 'ansible_net_version' fact.. Ansible provides the 'when' clause to conditionally execute tasks based on variables or facts. The engineer can gather facts from the device (e.g., ansible_net_version) and use a 'when' condition to check the IOS version before applying the SNMP configuration.

Answer

Use the 'tags' feature to selectively run the SNMP task only on certain devices.

Answer

Use the 'register' directive to capture the output and then use 'failed_when' to skip the task.

Answer

Use the 'block' and 'rescue' structure to handle version mismatches.

Question 5

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Accepted Answer

The playbook uses 'direction: outbound' but the module expects 'direction: out'.. The ios_acl_interfaces module requires the direction to be specified in lowercase (e.g., 'out'). If the playbook uses 'outbound' instead of 'out', the module may not recognize the value and could default to 'in' or ignore the parameter. The module documentation clearly states the valid values are 'in' or 'out'.

Answer

The routers have a different IOS version that interprets 'outbound' as 'in'.

Answer

The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.

Answer

The ACL itself is defined with the wrong direction in the playbook.

Question 6

An organization uses Ansible to manage network device configurations. They have a playbook that uses the ios_command module to execute 'show ip route' on multiple routers and then uses the 'debug' module to print the output. Recently, the playbook started failing with 'Timeout (12s) waiting for privilege escalation prompt'. The routers are reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The 'ansible_connection' is set to 'network_cli' but the 'ansible_become_method' is not set to 'enable'.. The error 'Timeout waiting for privilege escalation prompt' indicates that Ansible is trying to enter enable mode (or similar) but is not receiving the expected prompt (usually '#'). This often happens when the 'ansible_become' method is not set correctly for network devices. For Cisco IOS, the become method should be 'enable', and the become password must be provided. If the become method is missing or set to 'sudo', the privilege escalation will fail.

Answer

The routers are configured with a different enable secret that does not match the one in the Ansible vault.

Answer

The SSH key exchange is taking longer than the default 12-second timeout.

Answer

The ios_command module requires a different privilege level to execute 'show ip route'.

Question 7

A network engineer is using Ansible to automate the deployment of a new VLAN on a Cisco Nexus switch. The playbook uses the nxos_vlan module. The engineer wants to ensure that if the VLAN already exists, the playbook does not make any changes (idempotent). However, the playbook always reports 'changed' even when the VLAN exists with the same configuration. What is a likely reason?

Accepted Answer

The playbook does not include the 'vlan_state' parameter, and the existing VLAN is in 'suspend' state, while the module defaults to 'active'.. The nxos_vlan module compares the desired state with the current state. If the playbook specifies parameters that the module does not fully manage or if the switch returns additional default parameters (e.g., 'state: active' vs 'state: suspend'), the module may detect a difference. A common cause is that the playbook does not specify the 'vlan_state' parameter, and the module defaults to 'active', but if the switch has the VLAN in a different state (e.g., 'suspend'), the module will report 'changed'.

Answer

The playbook uses the 'vlan_id' parameter but not the 'name' parameter, causing the module to ignore the name mismatch.

Answer

The nxos_vlan module is not idempotent by design and always reports changes.

Answer

The engineer is using the '--diff' flag, which forces the module to report changes.

Question 8

A company uses Ansible to manage the configuration of 1000 Cisco IOS routers. They have a playbook that uses the ios_config module with the 'src' parameter pointing to a Jinja2 template. The playbook runs successfully for months, but after a recent IOS upgrade on a subset of routers, the playbook fails with 'ERROR! Syntax error while loading YAML script'. The template has not been changed. What is the most likely cause?

Accepted Answer

The IOS upgrade changed the output of a 'show' command that is used to set a fact, and that fact now contains characters that break YAML syntax.. The error 'Syntax error while loading YAML script' suggests that the playbook itself has a YAML syntax issue, not the template. However, if the template is included in the playbook via a variable that contains special characters, it could cause a YAML parsing error. But since the template hasn't changed, the most likely cause is that the IOS upgrade changed the output of a command that is used to generate a fact, and that fact is now being passed to the template in a way that breaks YAML. Alternatively, the playbook might be using a 'vars_prompt' or 'set_fact' that now produces invalid YAML.

Answer

The Jinja2 template now contains syntax errors because the IOS upgrade changed the configuration requirements.

Answer

The ios_config module is incompatible with the new IOS version.

Answer

The playbook file was corrupted during the IOS upgrade process.

Question 9

An engineer is using Ansible to automate the configuration of NTP on a group of Cisco IOS-XE switches. The playbook uses the ios_ntp module. The engineer wants to ensure that the NTP configuration is applied only to switches that are in the 'core' group, not the 'access' group. The inventory file defines these groups. Which Ansible feature should the engineer use to restrict the playbook to the 'core' group?

Accepted Answer

Set the 'hosts' field in the play to 'core' instead of 'all'.. Ansible playbooks can target specific groups by specifying the group name in the 'hosts' field of the play. This is the simplest and most direct way to restrict execution to a particular inventory group.

Answer

Use the 'when' clause to check if the switch is in the 'core' group using the 'group_names' variable.

Answer

Use the 'limit' option when running the ansible-playbook command to specify the 'core' group.

Answer

Define a variable in the 'core' group and use 'vars_prompt' to ask the engineer which group to run on.

Question 10

A network engineer writes the following Ansible playbook to configure an interface on a Cisco IOS-XE device:

---
- hosts: routers
  gather_facts: no
  tasks:
    - name: Configure interface
      cisco.ios.ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
        parents: interface GigabitEthernet0/1

What is the issue with this playbook?

Accepted Answer

The playbook will fail because the 'cisco.ios.ios_config' module requires the 'connection: network_cli' parameter in the play or inventory.. The playbook uses the cisco.ios.ios_config module but does not specify the provider or connection details. In Ansible 2.9+, the connection type must be set to 'network_cli' or the module will fail. The correct answer identifies this missing connection parameter.

Answer

The playbook will work correctly because the module automatically detects the device type.

Answer

The playbook will fail because 'cisco.ios.ios_config' is not a valid module name.

Answer

The playbook will work but only if the device is running IOS-XE 16.9 or later.

Question 11

A Python script using Netmiko is written to send a command to a Cisco router:

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
    'secret': 'enable'
}

connection = ConnectHandler(**device)
connection.enable()
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()

What is the potential issue with this script?

Accepted Answer

The script lacks exception handling for authentication or connection failures, which can cause the script to crash.. The script does not handle authentication failures or connection timeouts. If the device is unreachable or credentials are wrong, the script will throw an unhandled exception and crash. The correct answer identifies the lack of exception handling.

Answer

The script will fail because 'device_type' should be 'cisco_ios_telnet' for telnet connections.

Answer

The script will work correctly without any issues.

Answer

The script will fail because 'secret' is misspelled; it should be 'enable_secret'.

Question 12

A REST API call is made to Cisco DNA Center to get the list of network devices:

GET /dna/intent/api/v1/network-device
Headers:
  X-Auth-Token: <token>

The response is:

{
  "response": [
    {
      "id": "123456",
      "managementIpAddress": "10.10.10.1",
      "platformId": "C9300-24P",
      "role": "ACCESS"
    }
  ],
  "version": "1.0"
}

What does this response indicate?

Accepted Answer

The response contains a single device with management IP 10.10.10.1 and role ACCESS.. The response shows a list of devices; each device has an id, management IP, platform ID, and role. The correct answer correctly interprets the JSON structure.

Answer

The response indicates an error because the 'version' field is missing a value.

Answer

The response contains multiple devices, but only one is shown due to pagination.

Answer

The response requires authentication because the token is missing.

Question 13

An Ansible playbook uses the cisco.nxos.nxos_config module to configure a Nexus switch:

---
- hosts: nxos_switches
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure VLAN
      cisco.nxos.nxos_config:
        lines:
          - vlan 100
          - name Test_VLAN
        parents: vlan 100

What will be the result of this playbook?

Accepted Answer

The playbook will fail because the 'parents' parameter cannot be the same as the lines.. The playbook attempts to configure VLAN 100 with a name. However, the 'parents' parameter is incorrectly set to 'vlan 100', which is the same as the lines being configured. This can cause idempotency issues or errors because the module may try to enter the same configuration mode again. The correct answer identifies this logical error.

Answer

The playbook will successfully create VLAN 100 and set its name to Test_VLAN.

Answer

The playbook will fail because 'cisco.nxos.nxos_config' does not support VLAN configuration.

Answer

The playbook will work but only if the Nexus switch runs NX-OS 7.0 or later.

Question 14

A Python script uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device:

from napalm import get_network_driver

driver = get_network_driver('ios')
device = driver('192.168.1.1', 'admin', 'cisco')
device.open()
arp_table = device.get_arp_table()
print(arp_table)
device.close()

What is the issue with this script?

Accepted Answer

The script will fail because the driver name 'ios' is incorrect; it should be 'iosxe' for IOS-XE devices.. The NAPALM driver for IOS-XE is 'ios' but the correct driver for IOS-XE is 'iosxe'. Using 'ios' may work for some devices but is deprecated. The correct answer identifies the driver name mismatch.

Answer

The script will work correctly because 'ios' is the correct driver for all Cisco IOS devices.

Answer

The script will fail because the 'get_arp_table()' method requires an argument.

Answer

The script will work but only if the device is running IOS-XE 16.12 or later.

Question 15

A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics:

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1
Accept: application/yang-data+json

Response:

{
  "ietf-interfaces:interface": [
    {
      "name": "GigabitEthernet1",
      "type": "iana-if-type:ethernetCsmacd",
      "enabled": true,
      "ietf-ip:ipv4": {
        "address": [
          {
            "ip": "192.168.1.1",
            "netmask": "255.255.255.0"
          }
        ]
      }
    }
  ]
}

What does the response indicate about the interface?

Accepted Answer

The interface GigabitEthernet1 is enabled and has an IPv4 address of 192.168.1.1/24.. The response shows the interface configuration, including its name, type, enabled status, and IPv4 address. The correct answer correctly interprets the JSON structure.

Answer

The interface is disabled because the 'enabled' field is missing.

Answer

The response indicates an error because the interface type is incorrect.

Answer

The response shows that the interface has no IP address configured.

Question 16

An Ansible playbook uses the uri module to make a REST API call to Cisco DNA Center:

---
- hosts: localhost
  gather_facts: no
  tasks:
    - name: Get devices
      uri:
        url: "https://dna-center/api/v1/network-device"
        method: GET
        headers:
          X-Auth-Token: "{{ token }}"
        return_content: yes
      register: result

- debug:
        var: result.json

What is missing from this playbook?

Accepted Answer

The playbook is missing a task to authenticate and obtain the X-Auth-Token before making the API call.. The playbook does not include a task to obtain the authentication token. The token variable is used but never defined. The correct answer identifies the missing authentication step.

Answer

The playbook will work if the token is defined in the inventory file.

Answer

The playbook should use the 'cisco.dnac' collection instead of the uri module.

Answer

The playbook is missing the 'validate_certs: no' parameter to ignore SSL errors.

Question 17

A telemetry subscription is configured on a Cisco IOS-XE device using gRPC dial-out:

telemetry ietf subscription 101
 encoding encode-kvgpb
 filter xpath /interfaces/interface/statistics
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.10.10.10 50001 protocol grpc-tcp

What does this configuration do?

Accepted Answer

It sends interface statistics every 500 seconds to the receiver at 10.10.10.10 port 50001 using gRPC.. The subscription pushes interface statistics every 500 seconds to a receiver at 10.10.10.10:50001 using gRPC over TCP. The correct answer correctly describes the behavior.

Answer

It sends interface statistics every 500 milliseconds to the receiver using gRPC.

Answer

It sends configuration changes for interfaces to the receiver using gRPC.

Answer

It sends interface statistics only when there is a change, using a push model.

Question 18

A Python script uses the requests library to interact with Cisco DNA Center's REST API:

import requests

url = "https://dna-center/api/v1/network-device"
headers = {
    "X-Auth-Token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

response = requests.get(url, headers=headers, verify=False)
print(response.json())

What is a security concern with this script?

Accepted Answer

The script disables SSL certificate verification, making it vulnerable to man-in-the-middle attacks.. The script disables SSL certificate verification with verify=False, which makes it vulnerable to man-in-the-middle attacks. The correct answer identifies this security issue.

Answer

The script uses a hardcoded token, which is a security risk.

Answer

The script does not handle HTTP errors, which could expose sensitive information.

Answer

The script uses an incorrect URL; the path should be /dna/intent/api/v1/network-device.

Question 19

Given the following Ansible playbook snippet:
---
- name: Configure interface
  hosts: routers
  gather_facts: no
  tasks:
    - name: Set IP address
      ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
          - no shutdown
        parents: interface GigabitEthernet0/1
What is the effect of this playbook?

Accepted Answer

It configures IP address 192.168.1.1/24 on interface GigabitEthernet0/1 and enables it.. The playbook uses the ios_config module to push configuration lines to a Cisco IOS device. The 'parents' parameter specifies the parent configuration mode (interface GigabitEthernet0/1), so the lines are applied under that interface. The lines configure an IP address and enable the interface.

Answer

It configures the IP address globally, not under the interface.

Answer

It only configures the IP address; no shutdown is ignored because it is not a valid command.

Answer

It fails because 'parents' cannot be used with 'lines' in ios_config.

Question 20

Given the following Ansible playbook snippet:
---
- name: Configure VLAN
  hosts: switches
  gather_facts: no
  tasks:
    - name: Create VLAN 100
      ios_vlan:
        vlan_id: 100
        name: Engineering
        state: present
Which statement is true about this playbook?

Accepted Answer

It creates VLAN 100 with name Engineering if it does not exist.. The ios_vlan module is used to manage VLANs on Cisco IOS switches. The 'state: present' ensures the VLAN exists. The module will create VLAN 100 with the name 'Engineering' if it does not already exist.

Answer

It only checks if VLAN 100 exists and reports its status.

Answer

It deletes VLAN 100 if it exists.

Answer

It fails because 'name' is not a valid parameter for ios_vlan.