CCNP Automation Practice Test 11 — 15 Questions

Question 1

A network engineer is using Ansible to manage a group of Cisco IOS XE devices. The engineer wants to ensure that the playbook can securely connect to the devices without prompting for passwords and without storing passwords in plaintext in the playbook. Which method should be used to provide the credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the passwords in an encrypted file using Ansible Vault and reference them in the playbook.. Ansible Vault provides a secure way to encrypt sensitive data like passwords. By storing credentials in an encrypted file and referencing them in the playbook, the engineer can run playbooks without interactive prompts and without exposing passwords in plaintext. This is the standard best practice for securing credentials in Ansible automation, including for Cisco IOS XE devices.

Answer

Use the ansible_ssh_pass variable in the inventory file and encrypt the inventory with Ansible Vault.

Answer

Use the --ask-pass command-line option when running the playbook.

Answer

Set the ANSIBLE_PASSWORD environment variable on the control node before running the playbook.

Question 2

A network engineer is using a Python script to retrieve the operational status of all interfaces on a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state but receives an HTTP 401 Unauthorized response. The engineer can successfully ping the device and has verified that the RESTCONF feature is enabled with 'restconf' in global configuration. Which action will resolve the issue?

Accepted Answer

Configure a local username with privilege level 15 and ensure the script includes valid Basic Authentication credentials.. The 401 Unauthorized response indicates that the HTTP request lacks valid authentication credentials. RESTCONF on Cisco IOS XE uses HTTP Basic Authentication by default when no AAA is configured. The engineer must create a local user with appropriate privileges and include the credentials in the request. Enabling HTTPS or adjusting ACLs does not address authentication.

Answer

Configure an ACL to permit TCP port 830 on the device to allow RESTCONF traffic.

Answer

Enable the 'ip http secure-server' command to allow HTTPS access to the RESTCONF API.

Answer

Add the 'restconf' command under the interface configuration mode for the management interface.

Question 3

A network engineer is using the Python requests library to interact with a Cisco IOS XE device's RESTCONF API. The engineer wants to retrieve the configured hostname. Which HTTP method and URI should be used?

Accepted Answer

GET https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native/hostname. To retrieve the hostname via RESTCONF, the engineer must use the GET method with the correct URI that points to the hostname leaf in the Cisco IOS XE native YANG model. The URI structure includes the module name (Cisco-IOS-XE-native), the container (native), and the leaf (hostname). This is a straightforward read operation.

Answer

PUT https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native/hostname

Answer

POST https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native/hostname

Answer

GET https://<device-ip>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Question 4

A network automation team is using the Cisco SD-WAN vManage REST API to monitor the status of WAN Edge devices. The team writes a Python script that authenticates using basic authentication and then sends a GET request to /dataservice/device. The script receives a 401 Unauthorized error even though the credentials are correct. The team verifies that the user account has the 'admin' role. What is the most likely cause of the authentication failure?

Accepted Answer

The vManage API requires the use of a session token obtained via /j_security_check instead of basic authentication.. The Cisco SD-WAN vManage REST API uses session-based authentication. Clients must first POST to /j_security_check with credentials to obtain a JSESSIONID cookie, which is then included in subsequent requests. Basic authentication is not supported, leading to a 401 error even with valid credentials.

Answer

The vManage API requires TLS client certificate authentication for all API calls.

Answer

The script must include the header 'Content-Type: application/json' in the GET request to authenticate.

Answer

The user account must be assigned the 'api' role in addition to the 'admin' role to access the REST API.

Question 5

A network engineer is writing a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script uses the <get-config> RPC with the source datastore set to 'running'. After running the script, the engineer receives a large XML response but needs to extract only the interface configuration. Which NETCONF capability allows the engineer to filter the response to include only specific configuration data?

Accepted Answer

The element within the RPC, specifying a subtree filter or XPath filter.. NETCONF provides a element within and RPCs to restrict the response to specific data. The filter can be a subtree filter or an XPath filter. This allows the engineer to retrieve only the interface configuration, reducing the payload and processing time. The other capabilities mentioned do not serve this purpose.

Answer

The 'rollback-on-error' capability, which reverts changes if an error occurs and returns only the changed data.

Answer

The 'candidate' datastore, which contains only the differences from the running configuration.

Answer

The 'with-defaults' capability, which allows the server to return only non-default configuration.

Question 6

A network engineer is writing a Python script to query interface statistics from a Cisco IOS XE device using NETCONF. The script must establish a secure session that supports configuration and state data retrieval. Which transport protocol and port should the engineer use for the NETCONF session?

Accepted Answer

SSH over TCP port 22. NETCONF is transported over SSH, which by default listens on TCP port 22. This provides a secure, encrypted connection suitable for configuration and state data retrieval. Other protocols like TLS or HTTP are either not supported on Cisco IOS XE for NETCONF or are used for different APIs such as RESTCONF. The engineer must use SSH on port 22 to establish a NETCONF session.

Answer

HTTPS over TCP port 443

Answer

TLS over TCP port 6513

Answer

HTTP over TCP port 80

Question 7

A network automation team is using Ansible to push configuration changes to a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module with the 'backup: yes' option. During a recent run, the playbook failed on one device due to a syntax error in the configuration lines. The team wants to ensure that if a failure occurs, the device automatically reverts to its previous configuration without manual intervention. Which Ansible feature should be used to achieve this?

Accepted Answer

Implement a 'block' and 'rescue' section in the playbook to run a rollback task if the configuration fails.. To automatically revert to the previous configuration upon failure, the playbook must include error handling. Ansible's block/rescue construct allows tasks to be grouped, and if any task in the block fails, the rescue section runs. Within rescue, a task can invoke 'configure replace' using a saved configuration file, restoring the device to its prior state. This approach ensures atomic rollback without manual intervention.

Answer

Use the 'ios_config' module with the 'rollback' parameter set to 'yes'.

Answer

Set the 'ansible_command_timeout' to a higher value to prevent premature failure.

Answer

Enable 'config' mode with the 'save_when' parameter set to 'modified'.

Question 8

A network automation engineer is using NETCONF to configure a Cisco IOS XE device. The engineer wants to ensure that the configuration changes are applied atomically and that the device can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities should the engineer verify are supported by the device? (Choose two.)

Accepted Answer

:rollback-on-error. To achieve atomic configuration changes and rollback on error with NETCONF, the device must support the :candidate and :rollback-on-error capabilities. The :candidate capability provides a staging area for changes, allowing them to be applied as a single transaction. The :rollback-on-error capability ensures that if any part of the transaction fails, the entire change set is discarded, reverting to the previous configuration. Together, they enable reliable and safe configuration management.

Answer

:writable-running

Answer

:validate

Answer

:startup

Question 9

A network automation team is using YANG models with NETCONF to configure a Cisco IOS XE device. They want to change the description of a loopback interface. The engineer writes an RPC with the 'operation' attribute set to 'merge' on the leaf. The RPC is accepted, but the description is not changed. The engineer verifies that the YANG path is correct and that the interface exists. What is the most likely reason the description was not updated?

Accepted Answer

The RPC was sent to the 'candidate' datastore, but a operation was not performed.. When using NETCONF with a candidate datastore, modifies the candidate configuration but does not affect the running configuration until a RPC is executed. The RPC being accepted without error indicates the edit was valid but not applied. The engineer must send a to activate the change. Other options like namespace or operation type would typically produce errors, not silent acceptance.

Answer

The description leaf is read-only in the YANG model and cannot be modified via NETCONF.

Answer

The 'merge' operation requires the parent container to be specified with a namespace, which was omitted.

Answer

The 'operation' attribute must be set to 'replace' instead of 'merge' to change a leaf value.

Question 10

A network automation engineer is using the ncclient Python library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The engineer writes a script that establishes a NETCONF session and sends a <get-config> RPC. However, the script fails with an error indicating the source datastore is not specified. What should the engineer do to correct the script?

Accepted Answer

Add a element with inside the RPC.. The RPC in NETCONF requires a element to identify the datastore (e.g., running, candidate, startup). Without it, the server cannot process the request. The correct fix is to include in the RPC. This is a common oversight when building NETCONF scripts.

Answer

Add a <filter> element to specify the configuration subtree.

Answer

Change the RPC to instead of .

Answer

Include a element with in the RPC.

Question 11

A network engineer is using Cisco DNA Center's Intent API to automate the configuration of a new branch site. The engineer needs to create a new site hierarchy, assign devices to the site, and apply a template that configures VLANs and QoS. The engineer writes a Python script that calls the DNA Center APIs in sequence. After running the script, the site is created, and devices are assigned, but the template application fails with an error indicating that the device is not provisioned. What is the most likely missing step in the automation workflow?

Accepted Answer

The engineer must provision the devices to the site using the DNA Center provisioning API before applying templates.. Cisco DNA Center requires devices to be provisioned to a site before templates can be applied. Provisioning configures the device with the necessary management settings and associates it with the site. The Intent API provides a provisioning endpoint that must be called after assigning devices to the site. Without this step, template application fails. The other options are either for different workflows (fabric, discovery) or not prerequisites.

Answer

The engineer must create a network profile that includes the template before assigning devices to the site.

Answer

The engineer must synchronize the devices with DNA Center by triggering a discovery job after site assignment.

Answer

The engineer must first add the devices to a fabric domain before applying templates.

Question 12

A network engineer is using a Python script with the ncclient library to retrieve interface statistics from a Cisco IOS XE router. The script connects successfully, but when it sends a <get> RPC, the router returns an error stating that the requested data model is not supported. The engineer verifies that the YANG model is present on the device. What is the most likely cause of this error?

Accepted Answer

The YANG model is present but not enabled in the NETCONF capability set on the device.. The error indicates that the NETCONF server does not support the requested YANG model, even though the model file exists. In NETCONF, capabilities are advertised in the initial <hello> exchange. If a model is not listed there, it is not enabled for NETCONF access. The engineer must verify the device's NETCONF capabilities and ensure the model is supported and enabled.

Answer

The script is using the wrong NETCONF port; it should use port 830 instead of 22.

Answer

The NETCONF session is using the default namespace urn:ietf:params:xml:ns:netconf:base:1.0 instead of the correct YANG namespace.

Answer

The ncclient library version is incompatible with the router's NETCONF implementation.

Question 13

A network engineer is writing a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces but receives an HTTP 406 Not Acceptable response. The engineer verifies that the device has RESTCONF enabled and the credentials are correct. Which action should the engineer take to resolve this issue?

Accepted Answer

Add an Accept header of application/yang-data+json to the request.. The 406 Not Acceptable status code indicates that the server cannot produce a response matching the client's Accept header. In RESTCONF, the client must specify the desired media type, such as application/yang-data+json. Without it, the server may reject the request. Adding the Accept header tells the server to return JSON-encoded YANG data, which is the expected format.

Answer

Enable NETCONF on the device and use it instead of RESTCONF.

Answer

Change the HTTP method from GET to POST.

Answer

Add a Content-Type header of application/yang-data+json to the request.

Question 14

A network engineer is learning about data models used in network automation. The engineer needs to choose a data modeling language that is human-readable, supports hierarchical data structures, and is used by NETCONF and RESTCONF to define the structure of configuration and state data. Which data modeling language should the engineer choose?

Accepted Answer

YANG. YANG is the data modeling language standardized by IETF for NETCONF and RESTCONF. It provides a hierarchical, human-readable way to model configuration and state data. JSON and XML are serialization formats used to encode data, but they do not define the data model. SNMP MIBs are for SNMP and not used by NETCONF/RESTCONF. Therefore, YANG is the correct choice for modeling data in modern network automation.

Answer

JSON

Answer

XML

Answer

SNMP MIB

Question 15

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer sends a GET request to the URL https://dnac.example.com/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token. What is the most likely cause of the error?

Accepted Answer

The token was not included in the request header as an X-Auth-Token.. The Cisco DNA Center Intent API uses token-based authentication. After obtaining a token via the authentication API, the token must be included in every subsequent request as an HTTP header named 'X-Auth-Token'. Omitting this header causes a 401 Unauthorized response. The engineer should add the header with the valid token to successfully retrieve the device list. Other methods like query parameters or different HTTP methods are not used for authentication.

Answer

The request must use HTTP instead of HTTPS.

Answer

The API endpoint /api/v1/network-device requires a POST request.

Answer

The token must be passed as a query parameter named 'token'.