CCNP Automation Practice Test 3 — 15 Questions

Question 1

A network automation team is using NETCONF to configure a Cisco IOS XE device. They want to ensure that the configuration changes are applied atomically and that the device reverts to its previous state if any part of the change fails. The team is using the <edit-config> operation with the default error-option. Which NETCONF capability must be supported and used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The :candidate capability combined with the operation. To achieve atomic configuration changes with automatic rollback on failure, the NETCONF client must use the :candidate capability. This allows editing a separate candidate datastore, and only upon a successful are changes applied to the running configuration. If any edit fails, the candidate is discarded, and the running configuration remains untouched, ensuring transactional integrity.

Answer

The :confirmed-commit capability with a timeout

Answer

The :rollback-on-error capability

Answer

The :validate capability with the <validate> operation

Question 2

A network automation team is using the Cisco IOS XE RESTCONF API to retrieve interface statistics from a Catalyst 9300 switch. The engineer sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state with the header 'Accept: application/yang-data+json'. The switch returns HTTP 401 Unauthorized. The engineer confirms that the RESTCONF feature is enabled with 'restconf' and that the correct credentials are used. What is the most likely cause of the 401 response?

Accepted Answer

The user account used for authentication lacks the necessary privilege level (e.g., privilege 15) to access the RESTCONF API.. The 401 Unauthorized response indicates that the credentials provided are not authorized to access the RESTCONF API. On Cisco IOS XE, RESTCONF requires the user to have privilege level 15. Even if the username and password are correct, a lower privilege level results in a 401. The other options either misidentify the authentication mechanism or confuse different HTTP status codes.

Answer

The RESTCONF server is configured to use HTTPS, but the client is attempting to connect over HTTP, causing an authentication redirect that results in 401.

Answer

The RESTCONF API on Cisco IOS XE requires the 'Accept' header to be 'application/yang-data+json' and the 'Content-Type' header to be 'application/yang-data+json', but for GET requests only 'Accept' is needed.

Answer

The RESTCONF server requires the client to use HTTP Basic Authentication, but the engineer's tool is sending credentials in the URL query string.

Question 3

A network engineer is writing a Python script that uses the requests library to send a RESTCONF PATCH request to a Cisco IOS XE device to update the description of a loopback interface. The script sends the request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces/interface=Loopback100 with a Content-Type of application/yang-data+json. The device returns HTTP 415 Unsupported Media Type. Which is the most likely cause?

Accepted Answer

The Content-Type header should be application/yang-data+json, but the script is sending a different value, such as application/json.. HTTP 415 Unsupported Media Type indicates that the server does not support the media type specified in the Content-Type header of the request. RESTCONF requires application/yang-data+json for YANG data in JSON. If the script sends application/json or omits the correct header, the device rejects the request. Ensuring the Content-Type is set correctly resolves the issue.

Answer

The PATCH method is not supported by RESTCONF; PUT should be used instead.

Answer

The URL is incorrect and should include the interface name in the body instead of the URL.

Answer

The device requires the Accept header to be set to application/yang-data+json, and its absence causes the 415 error.

Question 4

A network engineer is writing a Python script that uses the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script connects successfully but receives an RPC error stating 'operation not supported'. The engineer verifies that NETCONF is enabled with 'netconf-yang' and that the correct port 830 is used. What is the most likely cause?

Accepted Answer

The NETCONF RPC requires a element that references a YANG model not supported by the device.. A successful NETCONF session can still return RPC errors when the requested operation references unsupported YANG models or nodes. The 'operation not supported' error is a server-side response indicating the filter or datastore content is invalid for that device. Checking advertised capabilities and supported YANG modules is the correct troubleshooting step, rather than changing transport or base version.

Answer

The script is using the wrong NETCONF datastore; it should target the 'operational' datastore instead of 'running'.

Answer

The script must use SSH subsystem 'netconf' instead of 'xmlagent' when connecting to port 830.

Answer

The NETCONF session uses the 'urn:ietf:params:netconf:base:1.0' capability, but the device requires base:1.1 for get-config operations.

Question 5

A network engineer is writing a Python script that uses the ncclient library to retrieve the running configuration from a Cisco IOS XE device. The script establishes a NETCONF session on the default port and then calls get_config with source='running'. However, the device returns an RPC error indicating that the requested data is not available in the specified datastore. The engineer confirms that the device supports NETCONF and that the SSH session is established successfully. Which action should the engineer take to resolve this error?

Accepted Answer

Enable the NETCONF-YANG feature on the device with the 'netconf-yang' command and ensure the correct datastore is used.. The error arises because NETCONF on IOS XE requires the netconf-yang feature to be enabled. Once enabled, the device advertises the running datastore and supports get_config operations. The other options either target incorrect datastores or apply filters that do not fix the underlying availability problem. Enabling the feature is the prerequisite for successful NETCONF retrieval.

Answer

Specify a filter in the get_config request to limit the output to the interfaces subtree.

Answer

Change the source parameter to 'candidate' because IOS XE stores the running configuration in the candidate datastore.

Answer

Use the 'startup' datastore as the source because NETCONF on IOS XE only exposes the startup configuration.

Question 6

A network engineer is evaluating Cisco IOS XE Guest Shell for automating device operations. The engineer needs to run Python scripts that interact with the underlying IOS XE CLI and also expose a webhook endpoint that an external orchestrator can call. Which two capabilities of Guest Shell support these requirements? (Choose two.)

Accepted Answer

Guest Shell can host a lightweight HTTP server, such as Flask or http.server, bound to an interface IP so an external orchestrator can send webhook requests. Guest Shell is a Linux container on Cisco IOS XE that includes Python and Cisco libraries for executing IOS XE CLI commands from within the device. It also provides a general-purpose Linux environment where a lightweight HTTP server can be run and bound to a management IP, enabling external orchestrators to send webhook requests. Together these two capabilities satisfy the automation and integration requirements.

Answer

Guest Shell runs on a separate physical CPU complex and therefore cannot access the IOS XE CLI for security reasons

Answer

Guest Shell requires the device to be in bundle mode and disables all southbound interfaces except NETCONF

Answer

Guest Shell automatically converts every Python function into a RESTCONF RPC that is published in the device's YANG model

Question 7

A network automation engineer is writing a Python script that must retrieve the running configuration from a Cisco IOS XE device. The engineer decides to use the NETCONF protocol over an SSH session. After establishing the SSH connection, the script sends a RPC with a element containing . The device returns an with the message 'access-denied'. The engineer verifies that the SSH credentials are correct and that the user has privilege level 15. What is the most likely cause of the error?

Accepted Answer

The NETCONF session must be established on TCP port 830, not the standard SSH port 22.. NETCONF over SSH conventionally listens on TCP port 830. If a script connects to port 22, it may authenticate but fail to enter the NETCONF subsystem, resulting in access-denied when RPCs are sent. Ensuring the client uses port 830 and that the NETCONF-YANG feature is enabled on the device resolves the issue. The other options misidentify the cause as group membership, transport encryption, or an unsupported RPC.

Answer

The user account must be a member of the 'netconf' local group on the IOS XE device.

Answer

The operation is not supported for the running datastore; the script should use instead.

Answer

The NETCONF protocol requires TLS encryption, so the script must use NETCONF over TLS instead of SSH.

Question 8

A network team is implementing a Python script to configure a Cisco IOS XE device using the RESTCONF API. The script must send a PATCH request to update the description of a loopback interface. The team needs to ensure the request is properly formatted and secured. Which two actions must the script perform to successfully update the configuration? (Choose two.)

Accepted Answer

Set the Content-Type header to application/yang-data+json.. To update a configuration via RESTCONF, the script must send a PATCH request with a properly formatted payload. The Content-Type header must be set to application/yang-data+json to indicate the payload format. Additionally, the communication must be secured with HTTPS to protect the data and credentials. These two actions are essential for a successful and secure configuration update.

Answer

Send the request to the /restconf/data/ietf-interfaces:interfaces/interface=Loopback1 endpoint with the HTTP method POST.

Answer

Set the Accept header to application/yang-data+json.

Answer

Include the username and password in the URL as query parameters.

Question 9

A network engineer is using a Python script with the requests library to send a PATCH request to a Cisco IOS XE device via RESTCONF. The goal is to update the description of GigabitEthernet1. The script uses the URI /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 and a JSON body. The device returns HTTP 400 Bad Request. What is the most likely cause?

Accepted Answer

The JSON body must be wrapped in a top-level object that matches the YANG module and container, such as {"ietf-interfaces:interface": {"name": "GigabitEthernet1", "description": "..."}}.. A RESTCONF PATCH body must be a valid instance of the YANG data tree, including the module-qualified top-level container and the list key. Sending only a leaf such as description without the enclosing interface object and module prefix causes the server to reject the payload with 400 Bad Request. Structuring the JSON to match the ietf-interfaces model resolves the error.

Answer

The PATCH method is not supported by RESTCONF; the engineer must use PUT instead.

Answer

The Content-Type header must be set to application/json instead of application/yang-data+json.

Answer

The interface name in the URI must use the full YANG path, such as /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/description.

Question 10

A network engineer is developing a Python script using the ncclient library to configure a Cisco IOS XE device via NETCONF. The script needs to change the description of an interface. The engineer writes a RPC with the appropriate XML payload and sends it to the device. The device returns an response, but the interface description does not change. What is the most likely reason for this behavior?

Accepted Answer

The script is targeting the candidate datastore but did not issue a operation.. When using NETCONF with the candidate datastore, configuration changes are not applied to the running configuration until a operation is performed. The operation returns to indicate the candidate was modified, but the running config remains unchanged. The engineer must either target the running datastore directly or issue a after editing the candidate. This is the most likely cause of the described behavior.

Answer

The script is using the incorrect namespace in the XML payload, so the device ignores the configuration.

Answer

The script is missing the <validate> operation before applying the configuration.

Answer

The script must use the operation with the running datastore instead of .

Question 11

A network automation team is using Ansible to manage a fleet of Cisco IOS XE devices. They have written a playbook that uses the ios_config module to push a banner to all devices. The playbook runs successfully but the banner is not applied. The team suspects that the device is rejecting the configuration due to an interactive prompt. Which Ansible module parameter should be used to handle this?

Accepted Answer

lines: ['banner motd ^C', 'Authorized access only', '^C']. The ios_config module sends configuration commands as a list of lines. For banners, Cisco IOS XE requires the starting delimiter, then the message, then the ending delimiter on its own line. If the playbook sends the banner as a single string without proper line breaks, the device may prompt for the end delimiter, which Ansible cannot handle, resulting in the configuration not being applied. Providing the lines explicitly with the delimiter on a separate line resolves this.

Answer

backup: yes

Answer

save_when: modified

Answer

match: none

Question 12

A network engineer is writing a Python script that uses the requests library to retrieve interface statistics from a Cisco IOS XE device via RESTCONF. The script sends a GET to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces and receives a 401 Unauthorized response even though the credentials are correct. The device is configured with restconf and ip http secure-server. Which change is most likely to resolve the issue?

Accepted Answer

Set the Accept header to application/yang-data+json and add the Authorization header with Basic authentication. RESTCONF on Cisco IOS XE uses HTTP Basic authentication by default, so the client must include an Authorization header with base64-encoded username and password. The 401 response indicates the server did not receive valid credentials. Adding the Authorization header and setting the Accept header to application/yang-data+json allows the GET to succeed and returns the interface data in JSON format.

Answer

Disable the ip http authentication local command and enable ip http client authentication none

Answer

Configure a self-signed certificate and switch the URL scheme from https to http

Answer

Change the request method from GET to POST and include an empty JSON body

Question 13

A network automation team is evaluating YANG models to programmatically configure and retrieve operational data from Cisco IOS XE devices. They need to select models that are natively supported by IOS XE and can be used with RESTCONF and NETCONF. Which two YANG model types are directly supported by Cisco IOS XE for these purposes? (Choose two.)

Accepted Answer

OpenConfig models. Cisco IOS XE supports both OpenConfig and IETF YANG models natively. These models are accessible via NETCONF and RESTCONF and are commonly used for automation. OpenConfig provides vendor-neutral models, while IETF models cover standard networking constructs. Vendor-specific models exist but are not one of the two types asked for in this context. Python-specific and JSON Schema are not YANG model types supported by the device.

Answer

Vendor-specific proprietary models (e.g., Cisco-IOS-XE-native)

Answer

JSON Schema models

Answer

Python-specific models generated by pyang

Question 14

A network engineer is using a Python script with the requests library to interact with a Cisco IOS XE device's RESTCONF API. The script needs to update the description of a loopback interface. The engineer writes the following code:

import requests
import json

url = "https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/interface=Loopback0"
headers = {
    "Content-Type": "application/yang-data+json",
    "Accept": "application/yang-data+json"
}
payload = {
    "ietf-interfaces:interface": {
        "name": "Loopback0",
        "description": "Updated by script"
    }
}
response = requests.patch(url, headers=headers, data=json.dumps(payload), auth=('admin', 'password'), verify=False)
print(response.status_code)

The script returns a 400 Bad Request error. What is the most likely cause of the error?

Accepted Answer

The payload must be wrapped in the "ietf-interfaces:interfaces" container with an "interface" list.. RESTCONF payloads must conform to the YANG data model. When updating a specific interface, the JSON body must reflect the hierarchy: the module-qualified container (ietf-interfaces:interfaces), the list (interface), and the key leaf (name). The engineer's payload omitted the interfaces container and the interface list, so the server could not map it to the correct node, resulting in a 400 Bad Request.

Answer

The HTTP method should be PUT instead of PATCH.

Answer

The payload must include the "type" leaf for the interface.

Answer

The URL must include the key predicate as interface=Loopback0, but it is missing the "data" segment.

Question 15

A network engineer is using the Cisco SD-WAN Manager (vManage) API to retrieve a list of all devices in the overlay. The engineer writes a Python script that sends a GET request to the API endpoint. The script includes an authentication token in the header. The response returns HTTP 200 OK but the JSON body contains an empty data array. The engineer confirms that there are active devices in the overlay. What is the most likely reason for the empty response?

Accepted Answer

The API request is missing a required query parameter, such as 'size' or 'page', which defaults to zero results.. The vManage API often requires pagination parameters such as 'size' and 'page' for list endpoints. Without them, the API may return an empty data array even with a successful HTTP 200 response. The engineer should include these parameters to retrieve the full list. Other options like expired token or wrong HTTP method would produce different error codes, not a successful but empty response.

Answer

The API request must use the POST method instead of GET to retrieve device lists.

Answer

The authentication token has expired and must be refreshed.

Answer

The script must include the 'Content-Type: application/json' header for GET requests.