CCNP Automation Practice Test 8 — 15 Questions

Question 1

A network automation team needs to securely retrieve the running configuration from 200 Cisco IOS XE routers daily using a Python script. The script must authenticate with individual user credentials, use a structured data format, and avoid screen-scraping. Which approach best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the ncclient Python library to send NETCONF RPCs over SSH, requesting the datastore with a YANG-modeled filter.. NETCONF over SSH with ncclient delivers secure, credential-based access and returns configuration data as structured XML governed by YANG models. This eliminates the fragility of parsing CLI text and avoids screen-scraping. The other approaches either return unstructured output, cannot retrieve full configurations reliably, or rely on UI scraping, so they do not meet the stated automation requirements.

Answer

Use SNMPv3 GET requests with the OID for the running configuration MIB object to retrieve the full configuration.

Answer

Use the requests library to send HTTP GET requests to the device's web UI login page, then scrape the configuration page HTML.

Answer

Use the paramiko library to open an SSH session and execute the 'show running-config' command, then parse the raw text output.

Question 2

A network automation team is using Cisco NSO (Network Services Orchestrator) to manage a multi-vendor network. They have created a service model in YANG and deployed it. A network engineer notices that when a device configuration is changed manually outside of NSO, NSO does not automatically correct it. Which NSO feature should be configured to ensure that NSO re-applies the intended configuration when a device drifts from the service model?

Accepted Answer

Enable the 'reconcile' action on the device or service in NSO.. To correct configuration drift in Cisco NSO, the reconcile action is used. It compares the device's actual configuration with the intended configuration defined by the service model and re-applies any discrepancies. This ensures that the device remains compliant with the service intent. Other options either do not address drift correction or would worsen the situation by syncing the wrong state. Reconcile is the standard mechanism for enforcing compliance in NSO.

Answer

Set up a periodic 'sync-from' operation to pull the device configuration into NSO.

Answer

Configure NSO to use the 'commit dry-run' option when deploying services.

Answer

Configure the device to use NETCONF Call Home to notify NSO of changes.

Question 3

A network automation engineer is developing a Python script using the ncclient library to configure a Cisco IOS XE device via NETCONF. The engineer wants to lock the running datastore, apply a candidate configuration, validate it, and then commit it. Which sequence of ncclient operations correctly performs this workflow?

Accepted Answer

manager.lock('candidate')
manager.edit_config(target='candidate', config=config_payload)
manager.validate('candidate')
manager.commit()
manager.unlock('candidate'). The correct NETCONF workflow with a candidate datastore involves locking the candidate, editing it, validating it, committing to running, and unlocking. This ensures configuration changes are atomic and can be validated before application. The ncclient library maps these to lock, edit_config, validate, commit, and unlock methods. Using the candidate datastore is essential for this sequence.

Answer

manager.lock('running')
manager.edit_config(target='candidate', config=config_payload)
manager.validate('candidate')
manager.commit()
manager.unlock('running')

Answer

manager.lock('candidate')
manager.edit_config(target='running', config=config_payload)
manager.validate('candidate')
manager.commit()
manager.unlock('candidate')

Answer

manager.lock('running')
manager.edit_config(target='running', config=config_payload)
manager.validate('running')
manager.commit()
manager.unlock('running')

Question 4

A network engineer is writing a Python script to retrieve the operational state of all GigabitEthernet interfaces from a Cisco IOS XE device using RESTCONF. The device is configured with HTTPS and the engineer has valid credentials. The script uses the 'requests' library to send a GET request to the RESTCONF API. Which HTTP header must be included in the request to specify that the client expects JSON-formatted data in the response?

Accepted Answer

Accept: application/yang-data+json. To retrieve JSON-formatted data from a RESTCONF API on Cisco IOS XE, the client must include the Accept header with the value 'application/yang-data+json'. This media type is defined by RFC 8040 for RESTCONF and ensures the server returns the response in JSON according to the YANG model. The Content-Type header is only for request bodies, and 'application/json' is not the correct media type for RESTCONF.

Answer

Accept: application/json

Answer

Content-Type: application/json

Answer

Content-Type: application/yang-data+json

Question 5

A network engineer is building a Python script that must retrieve the operational state of all interfaces from a Cisco IOS XE device using RESTCONF. The engineer sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state and receives an HTTP 401 Unauthorized response. The device is reachable, RESTCONF is enabled, and the correct credentials are being used in the request. What is the most likely cause of the 401 response?

Accepted Answer

The HTTP Basic Authentication credentials are not being sent because the Authorization header is missing or malformed.. An HTTP 401 Unauthorized response is returned when authentication credentials are missing or invalid. With RESTCONF on Cisco IOS XE, authentication is performed using HTTP Basic Authentication, so the request must include a correctly formed Authorization header. Since the credentials are known to be correct, the failure must stem from the header not being transmitted or being malformed, which is a common scripting oversight.

Answer

The device's RESTCONF service is configured to use NETCONF over SSH instead of HTTPS, so the request must be sent to port 830.

Answer

The RESTCONF API requires the Accept header to be set to application/yang-data+json.

Answer

The URL path should be /restconf/data/ietf-interfaces:interfaces instead of interfaces-state.

Question 6

A network engineer is writing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer wants to retrieve the current configuration of a specific interface. Which HTTP method and URI should be used?

Accepted Answer

GET https://<device>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1. To retrieve configuration data via RESTCONF, the GET method must be used with a URI that correctly identifies the resource. The URI must follow the RESTCONF syntax for list keys, which uses key=value. The correct option uses GET and the proper URI format to access the specific interface. The other options use incorrect HTTP methods or malformed URIs, which would not retrieve the desired data.

Answer

PUT https://<device>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Answer

POST https://<device>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Answer

GET https://<device>/restconf/data/ietf-interfaces:interfaces/interface/GigabitEthernet1

Question 7

A network engineer is comparing YANG models used in Cisco IOS XE automation. The engineer needs to distinguish between standard IETF YANG models and Cisco-specific YANG models. Which two statements accurately describe these YANG model types? (Choose two.)

Accepted Answer

Cisco-specific YANG models often use a namespace that includes 'cisco' and are tailored to expose Cisco IOS XE features.. IETF YANG models are vendor-neutral standards from the IETF, enabling multi-vendor consistency. Cisco-specific models have namespaces indicating Cisco and expose IOS XE features. Both can be used over NETCONF or RESTCONF. The other statements are false: Cisco models are not always required, not limited to RESTCONF, and not IETF standards.

Answer

IETF YANG models can only be used with NETCONF, while Cisco-specific models can only be used with RESTCONF.

Answer

Cisco-specific YANG models are always required to configure any feature on Cisco IOS XE devices.

Answer

Cisco-specific YANG models are defined in RFCs and are open standards maintained by the IETF.

Question 8

A network engineer needs to programmatically retrieve the operational status of all GigabitEthernet interfaces on a Cisco IOS XE device. The engineer wants to use a REST-based protocol that returns data in JSON and uses HTTP methods. The device is configured with 'restconf' and 'ip http secure-server'. Which protocol should the engineer use?

Accepted Answer

RESTCONF over HTTPS. RESTCONF is the correct choice because it is a REST-based protocol that uses HTTP methods and supports JSON encoding. It is enabled on Cisco IOS XE with the 'restconf' command and leverages the HTTPS server. The other options either use different transports (NETCONF over SSH), different data formats (SNMP), or are not REST-based (SSH CLI).

Answer

SSH with CLI commands

Answer

SNMPv3 with JSON output

Answer

NETCONF over SSH

Question 9

A network automation team is using the ncclient Python library to configure a Cisco IOS XE router via NETCONF. The engineer wants to ensure the configuration changes are applied atomically and that the device automatically rolls back if any part of the change fails. Which NETCONF capability must the engineer verify is advertised by the device before relying on this behavior?

Accepted Answer

urn:ietf:params:netconf:capability:confirmed-commit:1.0. To achieve atomic configuration with automatic rollback, the NETCONF confirmed-commit capability is required. It allows a commit to be provisional until explicitly confirmed; if confirmation is not received within the timeout, the device reverts to the prior configuration. Verifying that the device advertises this capability ensures the automation can rely on rollback semantics rather than leaving the device in an inconsistent state after a failure.

Answer

urn:ietf:params:netconf:capability:candidate:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:validate:1.0

Question 10

A network engineer is comparing the characteristics of agent-based and agentless automation tools for managing Cisco IOS XE devices. Which two statements accurately describe agentless automation? (Choose two.)

Accepted Answer

Agentless tools often rely on APIs or CLI scraping to push configuration changes.. Agentless automation tools, such as Ansible, do not require software on the managed devices. They communicate over standard protocols like SSH or HTTPS and use APIs or CLI to push changes. This makes them easy to deploy and suitable for multi-vendor environments. The other statements incorrectly attribute agent-based characteristics or overstate capabilities. The correct answers are the ones that accurately reflect how agentless tools operate.

Answer

Agentless tools provide real-time telemetry streaming from devices without additional configuration.

Answer

Agentless tools are unable to manage devices from multiple vendors.

Answer

Agentless tools require a persistent agent to be installed on each managed device.

Question 11

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write the automation tasks in YAML and does not want to install any software on the switches. Which tool should be used?

Accepted Answer

Ansible. Ansible is an agentless automation tool that uses YAML playbooks, making it ideal for simple configuration pushes to network devices without installing agents. Puppet and Chef typically require agents and use different DSLs, while SaltStack, although YAML-based, often involves a more complex architecture. Ansible's simplicity and native support for Cisco IOS XE modules align with the scenario.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 12

A network engineer is new to network automation and wants to use a declarative, agentless tool that uses YAML playbooks to push configuration to Cisco IOS devices over SSH. Which tool should the engineer choose?

Accepted Answer

Ansible. Ansible is known for being agentless, using YAML playbooks, and connecting over SSH. These features align perfectly with the engineer's requirements. Puppet and Chef typically require agents and use different configuration languages, while SaltStack, though YAML-based, uses a different architecture and terminology.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 13

A network team is evaluating automation tools to manage a large Cisco IOS XE environment. They need a tool that uses a declarative, agentless approach and can be run from a central server without installing software on managed devices. Which tool best fits this requirement?

Accepted Answer

Ansible. Ansible is agentless, using SSH or NETCONF to connect to devices, and uses declarative YAML playbooks. It runs from a central control node without installing agents on managed devices. Puppet, Chef, and SaltStack typically require agents, making them less suitable for this specific requirement.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 14

A network administrator is comparing configuration management tools and wants to use one that is agentless, uses YAML for playbooks, and communicates with Cisco IOS XE devices over SSH. Which tool best meets these requirements?

Accepted Answer

Ansible. Ansible is designed as an agentless automation tool that communicates over SSH and uses YAML playbooks. It provides network-specific modules for Cisco IOS XE, allowing configuration and command execution without installing software on the managed devices. This combination of agentless architecture, YAML syntax, and SSH transport exactly matches the administrator's requirements, distinguishing it from agent-based tools like Puppet, Chef, and SaltStack.

Answer

Puppet

Answer

Chef

Answer

SaltStack

Question 15

A network engineer is using the Python 'requests' library to interact with a Cisco DNA Center controller. The engineer wants to retrieve a list of all network devices. Which HTTP method and URL should be used?

Accepted Answer

GET https://<dnac-ip>/dna/intent/api/v1/network-device. Cisco DNA Center's Intent API provides RESTful endpoints for managing network devices. To retrieve a list of devices, a GET request to '/dna/intent/api/v1/network-device' is used. This returns JSON data with device details. Other HTTP methods like POST, PUT, or DELETE are for creating, updating, or deleting resources. The correct base path is essential; omitting '/dna/intent' leads to failure.

Answer

POST https://<dnac-ip>/dna/intent/api/v1/network-device

Answer

GET https://<dnac-ip>/api/v1/network-device

Answer

PUT https://<dnac-ip>/dna/intent/api/v1/network-device