CCNP Automation Practice Test 2 — 15 Questions

Question 1

A network engineer is using the Python ncclient library to retrieve interface statistics from a Cisco IOS XE device. The script connects successfully but the returned data is a large XML document that is difficult to parse. The engineer wants to work with data in a structured, vendor-neutral format that can be validated against a model. Which action should be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the YANG models supported by the device to filter and structure the data, then parse the XML using the model's schema.. The engineer needs a structured, vendor-neutral way to handle NETCONF data. YANG models provide the schema that defines the data, allowing the engineer to parse and validate the XML response. By using the YANG models, the data becomes structured and can be manipulated programmatically. This is the standard approach for NETCONF automation, as it leverages the model-driven nature of the protocol. Other options either suggest non-existent features or switch protocols without addressing the modeling need.

Answer

Switch from NETCONF to RESTCONF and request the data in JSON format using the Accept: application/json header.

Answer

Convert the NETCONF RPC reply from XML to JSON using the ncclient library's built-in to_json() method.

Answer

Enable the 'format json' option in the NETCONF hello message to receive JSON-encoded responses.

Question 2

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of devices. The API requires authentication via a session token. The engineer successfully obtains a token using the /j_security_check endpoint but then receives a 403 Forbidden error when calling /dataservice/device. What is the most likely cause?

Accepted Answer

The token is not included in the request headers as a cookie named JSESSIONID.. The vManage REST API uses session cookies for authentication. After a successful login to /j_security_check, the server returns a JSESSIONID cookie that must be included in subsequent requests. A 403 Forbidden error typically means the session cookie is missing or invalid. Including the cookie in the request headers authenticates the API call and allows retrieval of device information.

Answer

The engineer must use HTTP Basic Authentication instead of session-based authentication.

Answer

The engineer must use the /dataservice/client/token endpoint to obtain a CSRF token and include it as a header.

Answer

The API call must use the POST method instead of GET to retrieve device information.

Question 3

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices managed by the controller. The engineer sends a GET request to https://vmanage.example.com:8443/dataservice/device with the header 'Accept: application/json' and receives an HTTP 200 OK response containing a JSON payload. The engineer now needs to extract only the device IDs of the devices that are in a 'reachable' state. Which Python code snippet correctly parses the response and filters the devices?

Accepted Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['deviceId'] for dev in data['data'] if dev['reachability'] == 'reachable']. The vManage REST API returns device data under the 'data' key, with each device represented as a dictionary containing 'deviceId' and 'reachability'. To extract device IDs of reachable devices, you must iterate over data['data'] and filter by the 'reachability' field. The correct snippet does exactly that, while others use incorrect keys or iterate over the wrong structure.

Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['id'] for dev in data['devices'] if dev['status'] == 'up']

Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['deviceId'] for dev in data['data'] if dev['status'] == 'reachable']

Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['deviceId'] for dev in data if dev['reachability'] == 'reachable']

Question 4

A network engineer is designing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer wants to ensure the script can perform both read and write operations on the device's configuration. Which two actions must be taken to enable RESTCONF and allow the script to authenticate? (Choose two.)

Accepted Answer

Configure an HTTP client with a valid username and password for authentication.. To use RESTCONF on Cisco IOS XE, the service must be enabled with the restconf command. Additionally, the script must authenticate using valid credentials, typically via HTTP Basic Authentication. These two steps are mandatory for any RESTCONF interaction. Enabling NETCONF is unrelated, and additional YANG models or certificates are not required for basic read/write operations.

Answer

Install a CA-signed certificate on the device to enable HTTPS.

Answer

Configure a YANG model repository on the device to store custom models.

Answer

Enable the NETCONF service on the device using the netconf-yang command.

Question 5

A network engineer is using Ansible to configure a Cisco IOS XE device. The playbook uses the 'ios_config' module to apply an ACL. The playbook runs successfully, but the ACL is not present on the device. The engineer verifies that the device is reachable and credentials are correct. Which action should the engineer take to troubleshoot the issue?

Accepted Answer

Run the playbook with the '-vvv' flag to enable verbose output and inspect the exact commands sent to the device.. When an Ansible playbook runs without errors but the configuration is not applied, the issue is often that the commands were not sent or were rejected silently. Running with '-vvv' shows the exact commands and device responses, helping pinpoint the problem. Other actions like saving configuration or checking syslog are less direct. The correct approach is to increase verbosity to see what Ansible is actually doing.

Answer

Add the 'save_when: modified' parameter to the ios_config task to ensure the configuration is saved to startup.

Answer

Use the 'debug' module to enable debugging on the device and capture the configuration commands sent by Ansible.

Answer

Check the device's syslog for errors related to ACL configuration and verify that the ACL name matches the one in the playbook.

Question 6

A network engineer is comparing YANG models available on a Cisco IOS XE device. The engineer needs a model that is vendor-neutral and can be used across multiple vendors' devices. Which type of YANG model should the engineer choose?

Accepted Answer

Standard YANG model. Standard YANG models, such as those defined by the IETF, are vendor-neutral and designed for interoperability across different vendors' equipment. They provide a common language for configuration and state data, which is essential in multi-vendor networks. Native and custom models are vendor-specific, while OpenConfig is a specific set of models but not a general type. The engineer should choose standard models to meet the requirement.

Answer

Custom YANG model

Answer

OpenConfig YANG model

Answer

Native YANG model

Question 7

A network automation engineer is using the Cisco DNA Center Intent API to provision a new network device. The engineer needs to ensure that the device is successfully added to the inventory and assigned to a site before configuring it. Which API endpoint should the engineer use to add the device to the DNA Center inventory?

Accepted Answer

POST /dna/intent/api/v1/network-device. To add a device to the Cisco DNA Center inventory, the engineer must send a POST request to /dna/intent/api/v1/network-device with the device details. This endpoint is part of the Intent API and is specifically designed for device onboarding. Other methods like PUT or incorrect paths will not work.

Answer

PUT /dna/intent/api/v1/network-device

Answer

POST /dna/intent/api/v1/network-device/import

Answer

POST /dna/intent/api/v1/device

Question 8

An engineer writes a Python script that sends a RESTCONF GET request to a Cisco IOS XE device at https://10.1.1.5/restconf/data/ietf-interfaces:interfaces. The device returns HTTP 401 Unauthorized even though the same credentials work for SSH. The device is configured with 'restconf' and a local user with privilege 15. What is the most likely cause?

Accepted Answer

RESTCONF requires the 'ip http secure-server' command to be enabled and the local user must be authorized for the 'privilege 15' level via the HTTP authentication configuration.. A 401 Unauthorized from RESTCONF points to authentication or HTTP server configuration rather than URI or media type problems. IOS XE RESTCONF depends on the HTTPS server being enabled and the user being authorized through the HTTP authentication method. Ensuring 'ip http secure-server' is active and the local user is properly authorized for HTTP access restores RESTCONF connectivity.

Answer

The RESTCONF URI is incorrect; it should be /restconf/data/ietf-interfaces:interfaces-state to retrieve interface data.

Answer

The local user must be configured with the 'username privilege 15 password ' syntax and also added to the 'netconf' group for RESTCONF access.

Answer

RESTCONF only supports XML, so the client must set the Accept header to application/yang-data+xml; otherwise the device rejects the request with 401.

Question 9

A network engineer is using the ncclient Python library to configure a Cisco IOS XE device via NETCONF. The engineer wants to change the description of a loopback interface. The script establishes a NETCONF session, but the configuration change fails with an error indicating that the data is not writable. The engineer verifies that the NETCONF session is active and that the user has privilege level 15. What is the most likely cause of the failure?

Accepted Answer

The NETCONF edit-config operation is targeting the 'running' datastore, but the device requires the use of the 'candidate' datastore for configuration changes.. NETCONF allows configuration changes through the edit-config operation. Cisco IOS XE devices often require that edits be made to the candidate datastore, which is a temporary configuration that can be validated and then committed to running. If a script attempts to edit the running datastore directly, the device may reject the change with a 'data not writable' error because the running datastore is not directly writable in that context. Using the candidate datastore and then committing ensures the configuration is applied correctly.

Answer

The NETCONF session is not using the correct namespace for the interface configuration.

Answer

The YANG model for the interface configuration is read-only and cannot be modified via NETCONF.

Answer

The NETCONF session is using the 'candidate' datastore, but the device does not support the Candidate Configuration capability.

Question 10

A network engineer has a Python script that retrieves the operational state of all interfaces from a Cisco IOS XE router using RESTCONF. The script currently sends a GET request to the base URI https://router/restconf/data/ietf-interfaces:interfaces. The engineer needs to modify the script to retrieve only the statistics for GigabitEthernet1, specifically the in-octets counter. Which RESTCONF request should the engineer use?

Accepted Answer

GET https://router/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/statistics. RESTCONF uses a hierarchical data path that mirrors the YANG model structure. To retrieve a specific leaf for a specific list entry, the URI must include the list name, the key predicate in the form key=value, and the full path to the leaf. The request that includes the interface predicate and the statistics container correctly navigates the YANG tree to return only the in-octets counter for GigabitEthernet1.

Answer

GET https://router/restconf/data/ietf-interfaces:interfaces/interface/GigabitEthernet1/statistics

Answer

GET https://router/restconf/data/ietf-interfaces:interfaces?interface=GigabitEthernet1&statistics

Answer

GET https://router/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/in-octets

Question 11

A network engineer is writing a Python script to retrieve the current interface configuration from a Cisco IOS XE device using RESTCONF. The script sends a GET request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces but receives an HTTP 406 Not Acceptable response. The engineer confirms that the device supports RESTCONF and that the credentials are correct. What is the most likely cause of the error?

Accepted Answer

The Accept header is set to application/json instead of application/yang-data+json.. RESTCONF uses specific media types for data encoding. The Accept header must be set to application/yang-data+json or application/yang-data+xml. Using application/json is invalid and triggers a 406 Not Acceptable error. The engineer must correct the header to use the proper YANG data media type to retrieve the interface configuration successfully.

Answer

The Accept header is set to application/xml instead of application/yang-data+json.

Answer

The Accept header is set to application/yang-data+json, but the device only supports application/yang-data+xml.

Answer

The request is missing the Accept header, so the server cannot determine the desired response format.

Question 12

A network team is implementing a Python script to interact with a Cisco IOS XE device using the RESTCONF API. The script must authenticate using HTTP Basic Authentication and send a GET request to retrieve interface details. Which two actions must the script perform to correctly authenticate and retrieve data? (Choose two.)

Accepted Answer

Use the requests.get() method with the 'auth' parameter set to a tuple of username and password.. To authenticate with RESTCONF using HTTP Basic Authentication, the script can either manually include the Authorization header with base64-encoded credentials or use the requests library's 'auth' parameter, which automatically handles it. Both methods achieve the same result. The other options either relate to request body format, use an unsupported authentication method, or specify an incorrect response format.

Answer

Set the Accept header to 'application/xml' to ensure the response is parsed correctly.

Answer

Include a custom header 'X-Auth-Token' with the session token obtained from a prior login request.

Answer

Set the Content-Type header to 'application/yang-data+json'.

Question 13

A network engineer is writing a Python script using the requests library to retrieve the operational state of all GigabitEthernet interfaces from a Cisco IOS XE device via RESTCONF. The script uses the URL https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state and includes the header 'Accept: application/yang-data+json'. The script fails with HTTP 406 Not Acceptable. Which action resolves the issue?

Accepted Answer

Ensure the Accept header is included and correctly spelled; the 406 error indicates the server cannot provide the requested media type, often because the Accept header is missing or malformed.. A 406 Not Acceptable error occurs when the server cannot generate a response that matches the client's Accept header. For RESTCONF, the client must include an Accept header specifying 'application/yang-data+json' to receive JSON. If the header is missing or incorrect, the server may return 406. Ensuring the header is correctly set resolves the issue.

Answer

Change the HTTP method from GET to POST and include the interface filter in the request body.

Answer

Modify the Accept header to 'application/yang-data+json' without any additional parameters, because the current header includes an unsupported media type parameter.

Answer

Add the header 'Content-Type: application/yang-data+json' to the request.

Question 14

A network automation engineer is using NETCONF to retrieve configuration data from a Cisco IOS XE device. The engineer wants to ensure that the RPC request is secure and authenticated. Which protocol should be used as the transport for NETCONF in this scenario?

Accepted Answer

SSH. NETCONF is designed to run over SSH, which provides secure authentication and encryption. This is the standard transport for NETCONF on Cisco IOS XE devices. Other protocols like TLS are not typically used, and HTTP or SNMP do not provide the required security or functionality. The engineer should use SSH to ensure secure and authenticated NETCONF sessions.

Answer

HTTP

Answer

TLS

Answer

SNMP

Question 15

A network automation engineer is comparing configuration management approaches for a fleet of Cisco IOS XE devices. The team wants the automation tool to compute the difference between the device's running configuration and the desired intent, apply only the missing lines, and leave unrelated configuration untouched. Which tool and mode should be selected?

Accepted Answer

Cisco NSO with a service model applied using the commit dry-run and commit check workflow. Cisco NSO is a model-driven configuration management platform that maintains a configuration database representing intended state. Its commit dry-run and commit check workflow computes a line-level diff against the device's running configuration and applies only the necessary changes, which preserves unrelated configuration and provides the idempotent, intent-based behavior the team requires across many Cisco IOS XE devices.

Answer

Ansible with the ios_config module run with the default settings

Answer

Python scripts that call the Cisco IOS XE CLI over SSH and push the full desired configuration with configure replace

Answer

Puppet with the cisco_ios module using idempotent resource declarations