CCNP Automation Practice Test 12 — 15 Questions

Question 1

A network engineer is new to automation and wants to use a Python library that provides a simple, high-level interface for interacting with network devices, including Cisco IOS XE, without dealing with low-level SSH or NETCONF details. The engineer needs to quickly script configuration changes and command execution. Which Python library is best suited for this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Netmiko. Netmiko is designed to simplify SSH-based interactions with network devices. It provides a high-level, consistent interface across multiple vendors, handling device-specific behaviors like prompt detection and output paging. For a network engineer new to automation who needs to quickly script configuration changes and command execution on Cisco IOS XE, Netmiko is the most appropriate choice. It reduces the complexity of low-level SSH libraries.

Answer

Requests

Answer

Ncclient

Answer

Paramiko

Question 2

A network engineer is writing a Python script using the requests library to interact with a Cisco IOS XE device's RESTCONF API. The script needs to authenticate using basic authentication and retrieve interface details. The engineer writes the following code snippet:

import requests
url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)

However, the script returns a 401 Unauthorized error. What is the most likely cause?

Accepted Answer

The credentials are incorrect or the user does not have sufficient privileges.. A 401 Unauthorized response from RESTCONF means the authentication credentials are missing or invalid. The script uses basic authentication with a username and password; if those are incorrect or the user lacks permissions, the server rejects the request. The engineer should confirm the credentials and user privilege level.

Answer

The verify=False parameter disables SSL verification, which causes the server to reject the request.

Answer

The Accept header is set incorrectly; it should be application/yang-data+xml.

Answer

The URL is missing the .json extension, which is required for RESTCONF.

Question 3

A network engineer is using Cisco DNA Center's Intent API to create a new site hierarchy for a branch office. The engineer sends a POST request to the /dna/intent/api/v1/site endpoint with a JSON payload containing the site name and parent site. The API returns HTTP 202 Accepted. The engineer immediately sends a GET request to retrieve the newly created site but receives a 404 Not Found. What is the most likely explanation?

Accepted Answer

The site creation is an asynchronous operation, and the GET request was sent before the task completed.. Cisco DNA Center's Intent API uses asynchronous operations for many tasks, including site creation. A 202 Accepted response means the request is being processed. The response usually contains a task ID. The engineer should poll the task endpoint until the task completes successfully, then retrieve the site. A GET immediately after the POST can return 404 because the site is not yet available.

Answer

The POST request must use the PUT method to create a new site.

Answer

The GET request must include the same JSON payload as the POST to retrieve the site.

Answer

The site name must be unique across all sites, and a duplicate name caused the creation to fail silently.

Question 4

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write playbooks in YAML and use SSH for connectivity. Which tool should the engineer choose?

Accepted Answer

Ansible. Ansible is an agentless automation tool that uses SSH for connectivity and YAML for playbooks. It provides dedicated modules for Cisco IOS XE, such as ios_config and ios_command, enabling straightforward configuration pushes. The engineer's requirements for agentless operation, YAML playbooks, and SSH align perfectly with Ansible's design, making it the correct choice among the options.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 5

A network automation team is evaluating YANG models to manage Cisco IOS XE devices. They need to ensure that the models they choose can be used with both NETCONF and RESTCONF. Which two statements about YANG models are true in this context? (Choose two.)

Accepted Answer

YANG models can be augmented to add vendor-specific data.. YANG is a data modeling language that defines both configuration and state data, and it is used by both NETCONF and RESTCONF. It supports augmentations for vendor-specific extensions. These characteristics make YANG suitable for multi-protocol automation. The other statements are incorrect because they misrepresent YANG's protocol independence, encoding, or scope.

Answer

YANG models can only define configuration data, not operational state data.

Answer

YANG models are written in XML and must be converted to JSON for RESTCONF.

Answer

YANG models are specific to NETCONF and cannot be used with RESTCONF.

Question 6

A network engineer is using the RESTCONF API on a Cisco IOS XE device to configure an interface. The engineer sends a PATCH request to the URL https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 with the following JSON payload: {"ietf-interfaces:interface": {"description": "Uplink to Core"}}. The request returns a 400 Bad Request error. What is the most likely reason for this error?

Accepted Answer

The Content-Type header is missing or incorrect; it should be application/yang-data+json.. RESTCONF requires the Content-Type header to be 'application/yang-data+json' for JSON payloads. Without this header, the server cannot interpret the payload and returns a 400 Bad Request. The PATCH method is supported, the URL path is correct, and the interface name does not need encoding. Ensuring the correct media type resolves the error.

Answer

The URL should use the data store 'running' instead of 'data'.

Answer

The PATCH method is not supported by RESTCONF; PUT should be used instead.

Answer

The interface name must be URL-encoded, so GigabitEthernet1 should be GigabitEthernet%31.

Question 7

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices. The engineer sends a GET request to /dataservice/device but receives a 403 Forbidden error. The engineer has already authenticated successfully and obtained a valid session cookie. What is the most likely reason for this error?

Accepted Answer

The user account does not have the necessary permissions to access the device inventory.. A 403 Forbidden error indicates that the authenticated user does not have the required permissions to access the requested resource. In vManage, user roles and group permissions control access to API endpoints. The engineer must ensure the account has read access to device inventory.

Answer

The session cookie has expired and needs to be renewed.

Answer

The request must include an X-XSRF-TOKEN header to prevent CSRF attacks.

Answer

The API endpoint /dataservice/device requires a POST request instead of GET.

Question 8

A network engineer is implementing a CI/CD pipeline for network configuration changes. The pipeline uses Git for version control and Jenkins for orchestration. The engineer wants to ensure that configuration changes are validated before deployment to production devices. Which approach best integrates validation into the pipeline?

Accepted Answer

Run a syntax check using a YANG model validator against the proposed configuration before merging.. Integrating YANG model validation into the CI pipeline allows automated checks against device data models, ensuring configurations are syntactically and semantically correct before deployment. This proactive approach reduces errors and aligns with CI/CD best practices for network automation.

Answer

Use SNMP traps to detect configuration errors after deployment.

Answer

Manually review the configuration changes in a change advisory board meeting.

Answer

Apply the configuration directly to production devices and monitor for errors.

Question 9

A network automation team is using the Cisco DNA Center Intent API to create a new site hierarchy and assign devices. The API call to create the site returns HTTP 202 Accepted, but a subsequent call to assign a device to that site fails with an error that the site does not exist. The team is polling the task endpoint but has not yet received a success status. What is the most likely explanation?

Accepted Answer

The 202 response means the request is processed asynchronously, and the site is not available until the associated task completes successfully. Cisco DNA Center Intent API operations such as site creation are asynchronous and return HTTP 202 Accepted with a task ID. The site is not available for subsequent operations until the task completes successfully. The team must poll the task endpoint until it reports success before attempting to assign devices to the new site, which resolves the site-not-found error.

Answer

The site creation API requires a PUT instead of a POST, so the site was never created

Answer

The device assignment must be performed before site creation, so the order of operations is reversed

Answer

The API token expired between the two calls, causing the second call to fail with a site-not-found error

Question 10

A network team is using Ansible to manage a fleet of Cisco IOS XE switches. The team wants to ensure that the Ansible playbook can connect to the switches without prompting for passwords and without storing passwords in plaintext. The team has generated an SSH key pair and copied the public key to the switches. Which Ansible connection method and authentication mechanism should the team use?

Accepted Answer

Use the network_cli connection with SSH key-based authentication.. For Cisco IOS XE switches, Ansible uses the network_cli connection plugin to establish SSH sessions and send CLI commands. SSH key-based authentication allows passwordless login by using the private key on the control node, with the public key installed on the switches. This avoids plaintext passwords and interactive prompts. Other connection plugins like ssh or local are not suitable for network device CLI management.

Answer

Use the local connection with SSH key-based authentication.

Answer

Use the ssh connection with password authentication stored in an Ansible vault.

Answer

Use the netconf connection with SSH key-based authentication.

Question 11

A network automation engineer is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The engineer writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script receives an HTTP 403 Forbidden response. The engineer has verified that the username and password are correct and that the user has the SUPER-ADMIN-ROLE. What is the most likely cause of the issue?

Accepted Answer

The API endpoint requires a valid X-Auth-Token header, which the script did not include.. Cisco DNA Center's Intent API requires token-based authentication. The script must first obtain a token from the authentication endpoint and then include it in the X-Auth-Token header for all subsequent API calls. Without this header, the server returns 403 Forbidden, indicating the request lacks proper authorization. Correct credentials alone are insufficient; the token is mandatory.

Answer

The script must use HTTPS instead of HTTP to access the API.

Answer

The user account is locked due to multiple failed login attempts.

Answer

The API endpoint URL is incorrect and should be /dna/intent/api/v1/network-device/count.

Question 12

A network engineer wants to automate configuration backups for a fleet of Cisco IOS XE devices using Ansible. The engineer uses the ios_config module with the backup: yes option and sets the backup directory via the ANSIBLE_BACKUP_DIR environment variable. After running the playbook, the engineer finds that no backup files are created on the control node. What is the most likely cause?

Accepted Answer

The ANSIBLE_BACKUP_DIR environment variable is not recognized by Ansible; the backup directory must be specified using the backup_options parameter in the task.. The ios_config module's backup feature saves the device configuration to the Ansible control node. The directory for these backups is not controlled by an environment variable like ANSIBLE_BACKUP_DIR; instead, it is set using the backup_options parameter, specifically the dir_path sub-option. Without specifying this, backups may go to a default location or fail to be created, leading to the observed issue.

Answer

The ios_config module does not support the backup option; the ios_command module must be used instead.

Answer

The ios_config module requires the backup option to be set to a file path, not a boolean value.

Answer

The Ansible control node must have the paramiko library installed for backups to work; otherwise, backups are silently skipped.

Question 13

A network administrator is using Cisco SD-WAN to manage a large enterprise network. They want to automate the deployment of a new branch site using a template. Which component of Cisco SD-WAN is responsible for pushing the configuration to the WAN edge devices?

Accepted Answer

vManage. In Cisco SD-WAN, vManage is the management plane component that centralizes configuration and policy. It stores templates and orchestrates their deployment to WAN edge devices. The other components have different roles: vBond handles orchestration and NAT traversal, vSmart manages control plane policies, and vAnalytics provides reporting. Only vManage is responsible for pushing configurations.

Answer

vSmart

Answer

vAnalytics

Answer

vBond

Question 14

A network engineer is writing a Python script to retrieve the configured hostname from a Cisco IOS XE device using RESTCONF. The device has RESTCONF enabled, and the engineer sends a GET request to https://10.1.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname with the header 'Accept: application/yang-data+json'. However, the request fails with HTTP 401 Unauthorized. The engineer verifies that the device is reachable and RESTCONF is enabled. What is the most likely reason for the failure?

Accepted Answer

The engineer did not include valid authentication credentials in the request, such as a username and password or a token.. The 401 Unauthorized status code is a clear indication that authentication failed. RESTCONF on Cisco IOS XE requires the client to provide credentials, usually via HTTP Basic Authentication. Without a valid Authorization header, the device denies access. The other options describe issues that would produce different error codes or are irrelevant to authentication.

Answer

The RESTCONF URI is incorrect; it should be /restconf/data/ietf-interfaces:interfaces to retrieve hostname information.

Answer

The RESTCONF API requires the use of HTTPS with a valid certificate, and the device's certificate is self-signed.

Answer

The request is missing the 'Content-Type' header, which is required for all RESTCONF requests.

Question 15

A network automation engineer is using the ncclient Python library to retrieve configuration from a Cisco IOS XE device via NETCONF. The engineer sends a <get-config> RPC with a filter for the interface configuration. The device returns a large XML response, but the engineer only needs the interface description and IP address. Which NETCONF capability should the engineer use to filter the response to only the required data?

Accepted Answer

urn:ietf:params:netconf:capability:subtree:1.0. NETCONF supports filtering of configuration data through capabilities. The subtree filtering capability allows a client to specify a filter that matches only the desired portions of the configuration tree. By using a subtree filter, the engineer can retrieve only the interface description and IP address, minimizing the response size and improving efficiency. Other capabilities like writable-running or rollback-on-error do not provide filtering.

Answer

urn:ietf:params:netconf:capability:xpath:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0