CCNP Automation — Timed 40 Questions

Question 1

A network engineer needs to automate the backup of running configurations from multiple Cisco IOS XE devices to a central TFTP server. Which tool is best suited for this task in a Python-based automation framework?

40 minute time limit — choose an answer to begin.

Accepted Answer

Netmiko. Netmiko is a Python library built on Paramiko that simplifies SSH automation for network devices. It can connect to multiple Cisco IOS XE devices and execute the `copy running-config tftp:` command with robust prompt handling and minimal custom code, making it well suited for scripted backups. Ansible is an external automation framework, RESTCONF is an API interface, and Paramiko requires lower-level SSH handling and more custom code for the same task.

Answer

RESTCONF

Answer

Ansible

Answer

Paramiko

Question 2

A network engineer is creating a Python script using the Cisco IOS XE RESTCONF API to configure a loopback interface. The script sends a PUT request to the URI /restconf/data/Cisco-IOS-XE-native:native/interface/Loopback=100 with a JSON body that includes the IP address. The API returns a 201 Created status, but the loopback interface does not appear in the running configuration. What is the most likely issue?

Accepted Answer

The PUT request should be a POST request to create a new resource. The 201 Created status indicates that the server accepted the request, but the loopback interface was not actually created because the PUT method is not appropriate for creating a new list resource in the Cisco IOS XE RESTCONF implementation. According to the RESTCONF protocol, POST is used to create a new data resource when the client does not provide the exact resource identifier, while PUT is used to replace or create a resource when the client specifies the entire URI. However, for list entries in YANG data models, some implementations (including Cisco IOS XE) require POST to the list node to create a new instance, as PUT to a specific instance may only be effective if the instance already exists or may be accepted but not committed to the running configuration. Therefore, even though a 201 was returned, the configuration was not applied, indicating that a POST request to /restconf/data/Cisco-IOS-XE-native:native/interface/Loopback would have been the correct approach.

Answer

The RESTCONF API returned an error but the script ignored it

Answer

The loopback interface number is incorrect in the URI

Answer

The script is not authenticated properly

Question 3

A network engineer is troubleshooting an Ansible playbook that uses the ios_config module to apply ACLs. The playbook runs without errors, but the ACLs are not applied to the device. The engineer verifies that the device is reachable and the credentials are correct. What is the most likely cause?

Accepted Answer

The playbook is missing the connection parameter set to 'network_cli'. The ios_config module requires the connection parameter to be set to 'network_cli' (or 'ansible.netcommon.network_cli') to use the CLI transport for sending configuration commands to network devices. Without this, Ansible defaults to the 'smart' connection, which may not properly interact with network device CLIs, causing the playbook to run without errors but not apply the ACLs.

Answer

The device is in a different VRF and not reachable

Answer

The ACL syntax in the playbook is incorrect

Answer

The ios_config module requires the netmiko library to be installed on the control node

Question 4

Which THREE are valid methods for automating network device configuration using Cisco IOS XE? (Choose three.)

Accepted Answer

NETCONF/YANG. NETCONF/YANG (A) is a valid automation method on Cisco IOS XE because IOS XE supports NETCONF over SSH (port 830) with YANG data models, allowing programmatic configuration via <edit-config> operations. CLI via SSH with Python, such as Netmiko (D), is valid because Netmiko establishes an SSH session and sends IOS/IOS XE CLI commands, which is a widely used automation approach even though it is screen-scraping rather than model-driven. RESTCONF (E) is valid because IOS XE exposes RESTCONF over HTTPS (port 443) with YANG-modeled resources, enabling configuration through HTTP methods like POST, PUT, PATCH, and DELETE. SNMP Set requests (B) are not a valid configuration-automation method here, since SNMP is primarily used for monitoring and its Set operations are limited and not a supported model-driven configuration interface on IOS XE. Telnet with Expect scripts (C) is not valid because Telnet is an insecure, legacy protocol and Expect-based CLI scripting is not a supported or recommended IOS XE automation method.

Answer

SNMP Set requests

Answer

Telnet with Expect scripts

Question 5

Refer to the exhibit. A network engineer wants to use Ansible to change the IP address of Loopback100 from 10.1.100.1/24 to 10.1.200.1/24. The playbook uses the ios_config module. The playbook runs successfully, but the IP address remains unchanged. What is the most likely reason?

Accepted Answer

The ios_config module is not configured to replace the existing configuration. The ios_config module in Ansible, by default, uses a 'set' operation that appends commands to the running configuration. To change an existing IP address on an interface, the module must be configured with the 'replace' option or use a 'before'/'parents' directive to remove the old address first. Without this, the new IP command is added but the old one remains, and the interface retains the original address because Cisco IOS allows multiple IP addresses on a single interface only if the secondary keyword is used, which the module does not automatically apply.

Answer

The loopback interface is administratively down

Answer

The playbook is sending the wrong CLI commands

Answer

The SNMP community strings are not configured correctly

Question 6

Refer to the exhibit. A Python script sends the JSON payload shown via a POST request to the RESTCONF URI /restconf/data/ietf-interfaces:interfaces on a Cisco IOS XE device. The API returns 201 Created, but the interface GigabitEthernet1 is not configured. What is the most likely cause?

Accepted Answer

The payload is missing a required field for the interface. The 201 Created response indicates the RESTCONF request was accepted and the resource was created, but the interface GigabitEthernet1 is not configured because the JSON payload is missing a required field. In the ietf-interfaces YANG model, the 'type' leaf under an interface is mandatory; without it, the device cannot complete the interface configuration, even though the API returns a success status for the creation of the container.

Answer

The script is not authenticated

Answer

The URI should be /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Answer

The JSON syntax is invalid

Question 7

A service provider uses Cisco IOS XE routers with NETCONF/YANG for configuration management. They have a centralized automation system that pushes configuration changes via NETCONF. Recently, after a maintenance window, several routers lost connectivity to the NETCONF server. The automation system can still SSH to the routers and execute CLI commands. The engineer suspects that the NETCONF server's SSH key changed, causing the routers to reject the connection. However, checking the routers' configuration, the engineer finds that the 'netconf ssh' command is present and the SSH server is enabled. The engineer also notices that the routers have an 'ip ssh server algorithm publickey' configuration specifying a list of allowed public keys. What is the most likely cause of the NETCONF connectivity loss?

Accepted Answer

The NETCONF server's SSH public key is not in the allowed list on the routers. The routers have an 'ip ssh server algorithm publickey' configuration that explicitly lists allowed public keys. If the NETCONF server's SSH key was changed during the maintenance window, its new public key would not match any entry in this allowed list, causing the routers to reject the SSH connection for NETCONF even though SSH itself is enabled and the 'netconf ssh' command is present. This is a common security hardening practice that restricts which SSH clients can connect.

Answer

The NETCONF server is using a non-standard port

Answer

The routers have reached the maximum number of SSH sessions

Answer

The 'netconf ssh' command was removed from the router configuration

Question 8

A network engineer is automating configuration backups using Ansible. The playbook uses the ios_config module to retrieve running configurations from Cisco IOS XE devices. However, the playbook fails with a timeout error on a specific device. Other devices respond correctly. What is the most likely cause of the failure?

Accepted Answer

The device has incorrect SSH credentials configured in the Ansible vault.. The ios_config module in Ansible uses SSH to connect to Cisco IOS XE devices and execute commands. A timeout error on a specific device while others succeed strongly indicates an authentication or authorization failure, such as incorrect SSH credentials stored in the Ansible vault. This prevents the SSH session from being established, causing the playbook to wait until the timeout threshold is reached.

Answer

The device is configured for HTTP/HTTPS access only.

Answer

The device has NetFlow enabled, consuming CPU cycles.

Answer

The device has SNMPv3 enabled with authentication traps.

Question 9

Refer to the exhibit. A network engineer sends a RESTCONF PATCH request with the above JSON payload to the URL https://192.168.1.100/restconf/data/ietf-interfaces:interface=GigabitEthernet0/0/0. What is the expected outcome?

Accepted Answer

The description and IP address of the existing interface are updated, and the interface remains enabled.. A RESTCONF PATCH request uses the HTTP PATCH method to apply a partial update to an existing resource. The payload contains only the fields to be modified (description and IP address), and the request URL targets the specific interface resource. Since the interface already exists, the PATCH updates only those fields without affecting other configuration, such as the interface's enabled state. This is why the interface remains enabled and only the description and IP address are updated.

Answer

A new interface GigabitEthernet0/0/0 is created with the specified IP address.

Answer

The request fails because a GET request must be sent first to retrieve the current configuration.

Answer

The entire interface configuration is replaced with only the fields in the payload.

Question 10

Drag and drop the steps for the three-way TCP handshake into the correct order.

Accepted Answer

Client sends SYN, server responds with SYN-ACK, client sends ACK. TCP uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a connection before data transfer.

Answer

Client sends SYN, client sends ACK, server sends SYN-ACK

Answer

Server sends SYN-ACK, client sends SYN, client sends ACK

Answer

Client sends ACK, client sends SYN, server sends SYN-ACK

Question 11

Which of the following represents the correct order of steps to configure an extended access control list (ACL) on a Cisco router?

Accepted Answer

Step 1: Enter global configuration mode. Step 2: Create extended ACL statements using the access-list command. Step 3: Enter interface configuration mode. Step 4: Apply the ACL to the interface using the ip access-group command.. Extended ACLs filter based on source/destination IP, protocol, and port; must be applied to an interface.

Answer

Step 1: Enter global configuration mode. Step 3: Enter interface configuration mode. Step 2: Create extended ACL statements using the access-list command. Step 4: Apply the ACL to the interface using the ip access-group command.

Answer

Step 1: Enter global configuration mode. Step 2: Create extended ACL statements using the access-list command. Step 4: Apply the ACL to the interface using the ip access-group command. Step 3: Enter interface configuration mode.

Answer

Step 2: Create extended ACL statements using the access-list command. Step 1: Enter global configuration mode. Step 3: Enter interface configuration mode. Step 4: Apply the ACL to the interface using the ip access-group command.

Question 12

A network engineer is using the Python ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script connects successfully, but the RPC returns an empty element even though the requested configuration clearly exists on the device. The engineer confirms the correct datastore is targeted. Which action should the engineer take to resolve this?

Accepted Answer

Specify a subtree filter in the RPC that matches the desired configuration hierarchy.. NETCONF can return an empty if the filter is malformed or matches no nodes. The most common cause in scripts is an empty or incorrect subtree filter. Specifying a valid subtree filter that matches the intended configuration branch ensures the device returns the expected data. Timeouts, transport changes, and with-defaults do not explain a successful RPC with no data.

Answer

Add a <with-defaults> capability element to the RPC to include default configuration values.

Answer

Switch the transport from SSH to TLS by using the ncclient 'transport' parameter.

Answer

Increase the SSH timeout value in the ncclient connect parameters to allow more time for the response.

Question 13

A network engineer is writing a Python script that uses the requests library to interact with a Cisco IOS XE device via RESTCONF. The script authenticates with basic authentication and sends a GET request to retrieve interface statistics. The device returns a 401 Unauthorized error even though the username and password are correct and have privilege level 15. Which configuration is most likely missing on the device?

Accepted Answer

The HTTP server must be enabled with the 'ip http server' command, and the user must have the 'privilege 15' and 'ip http authentication local' configured.. RESTCONF on Cisco IOS XE depends on the HTTP server and its authentication configuration. A 401 Unauthorized despite valid credentials usually means the HTTP server is not enabled or is not set to use local authentication. Enabling 'ip http server' and 'ip http authentication local' ensures the device accepts basic authentication for RESTCONF requests, resolving the error.

Answer

The 'ip http secure-server' command must be disabled to allow basic authentication over HTTP.

Answer

The RESTCONF API must be enabled with the 'restconf' global configuration command.

Answer

The user account must be configured with the 'username privilege 15 secret ' command and no other authentication method.

Question 14

A network engineer is building a Python script to retrieve interface statistics from a Cisco IOS XE device using the RESTCONF API. The device is configured with the 'restconf' and 'netconf-yang' commands. The engineer sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state/interface=GigabitEthernet1 and receives a 404 Not Found error. The interface GigabitEthernet1 exists and is up. What is the most likely cause of the error?

Accepted Answer

The engineer is querying operational data, but the device's RESTCONF implementation only supports configuration data by default, requiring the 'operational' query parameter.. RESTCONF on Cisco IOS XE separates configuration and operational data. Configuration data is under 'interfaces', while operational state is under 'interfaces-state'. The URI in the scenario uses 'interfaces-state', which is correct for operational data, but a 404 indicates the resource is not found. The most likely cause is that the device does not support the 'interfaces-state' container or requires a different path. The correct answer points to the need for the 'operational' query parameter or correct path usage.

Answer

The URI is incorrect because RESTCONF uses a different path for operational data, such as /restconf/data/ietf-interfaces:interfaces-state/interface=GigabitEthernet1/statistics.

Answer

The interface name in the URI is case-sensitive and must match the device's exact casing, such as 'GigabitEthernet1' instead of 'GigabitEthernet1'.

Answer

The RESTCONF API requires the 'Accept: application/yang-data+json' header, and without it, the server returns a 404 error.

Question 15

A network automation team is using a Python script with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script sends an <edit-config> RPC with a candidate datastore and then commits the configuration. After running the script, the team notices that the configuration changes are not present in the running configuration. The script completes without errors. Which is the most likely cause?

Accepted Answer

The script did not send a RPC after the operation, so the candidate configuration was not applied to the running configuration.. With NETCONF and the candidate datastore, configuration changes are first written to the candidate datastore and then applied to the running datastore via a RPC. If the script does not send a commit, the changes are not activated. The absence of errors indicates the edit-config succeeded, but the commit is a separate, required operation.

Answer

The NETCONF session was not closed properly, so the commit was not applied.

Answer

The device does not support the candidate datastore, so the <edit-config> was applied to the running datastore instead.

Answer

The <commit> RPC was sent to the wrong datastore, such as the running datastore instead of the candidate datastore.

Question 16

A network engineer is using the Python ncclient library to retrieve interface statistics from a Cisco IOS XE device. The script connects successfully but the returned data is a large XML document that is difficult to parse. The engineer wants to work with data in a structured, vendor-neutral format that can be validated against a model. Which action should be taken to achieve this?

Accepted Answer

Use the YANG models supported by the device to filter and structure the data, then parse the XML using the model's schema.. The engineer needs a structured, vendor-neutral way to handle NETCONF data. YANG models provide the schema that defines the data, allowing the engineer to parse and validate the XML response. By using the YANG models, the data becomes structured and can be manipulated programmatically. This is the standard approach for NETCONF automation, as it leverages the model-driven nature of the protocol. Other options either suggest non-existent features or switch protocols without addressing the modeling need.

Answer

Switch from NETCONF to RESTCONF and request the data in JSON format using the Accept: application/json header.

Answer

Convert the NETCONF RPC reply from XML to JSON using the ncclient library's built-in to_json() method.

Answer

Enable the 'format json' option in the NETCONF hello message to receive JSON-encoded responses.

Question 17

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of devices. The API requires authentication via a session token. The engineer successfully obtains a token using the /j_security_check endpoint but then receives a 403 Forbidden error when calling /dataservice/device. What is the most likely cause?

Accepted Answer

The token is not included in the request headers as a cookie named JSESSIONID.. The vManage REST API uses session cookies for authentication. After a successful login to /j_security_check, the server returns a JSESSIONID cookie that must be included in subsequent requests. A 403 Forbidden error typically means the session cookie is missing or invalid. Including the cookie in the request headers authenticates the API call and allows retrieval of device information.

Answer

The engineer must use HTTP Basic Authentication instead of session-based authentication.

Answer

The engineer must use the /dataservice/client/token endpoint to obtain a CSRF token and include it as a header.

Answer

The API call must use the POST method instead of GET to retrieve device information.

Question 18

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices managed by the controller. The engineer sends a GET request to https://vmanage.example.com:8443/dataservice/device with the header 'Accept: application/json' and receives an HTTP 200 OK response containing a JSON payload. The engineer now needs to extract only the device IDs of the devices that are in a 'reachable' state. Which Python code snippet correctly parses the response and filters the devices?

Accepted Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['deviceId'] for dev in data['data'] if dev['reachability'] == 'reachable']. The vManage REST API returns device data under the 'data' key, with each device represented as a dictionary containing 'deviceId' and 'reachability'. To extract device IDs of reachable devices, you must iterate over data['data'] and filter by the 'reachability' field. The correct snippet does exactly that, while others use incorrect keys or iterate over the wrong structure.

Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['id'] for dev in data['devices'] if dev['status'] == 'up']

Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['deviceId'] for dev in data['data'] if dev['status'] == 'reachable']

Answer

import requests
response = requests.get('https://vmanage.example.com:8443/dataservice/device', headers={'Accept': 'application/json'}, verify=False)
data = response.json()
reachable_devices = [dev['deviceId'] for dev in data if dev['reachability'] == 'reachable']

Question 19

A network engineer is designing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer wants to ensure the script can perform both read and write operations on the device's configuration. Which two actions must be taken to enable RESTCONF and allow the script to authenticate? (Choose two.)

Accepted Answer

Configure an HTTP client with a valid username and password for authentication.. To use RESTCONF on Cisco IOS XE, the service must be enabled with the restconf command. Additionally, the script must authenticate using valid credentials, typically via HTTP Basic Authentication. These two steps are mandatory for any RESTCONF interaction. Enabling NETCONF is unrelated, and additional YANG models or certificates are not required for basic read/write operations.

Answer

Install a CA-signed certificate on the device to enable HTTPS.

Answer

Configure a YANG model repository on the device to store custom models.

Answer

Enable the NETCONF service on the device using the netconf-yang command.

Question 20

A network engineer is using Ansible to configure a Cisco IOS XE device. The playbook uses the 'ios_config' module to apply an ACL. The playbook runs successfully, but the ACL is not present on the device. The engineer verifies that the device is reachable and credentials are correct. Which action should the engineer take to troubleshoot the issue?

Accepted Answer

Run the playbook with the '-vvv' flag to enable verbose output and inspect the exact commands sent to the device.. When an Ansible playbook runs without errors but the configuration is not applied, the issue is often that the commands were not sent or were rejected silently. Running with '-vvv' shows the exact commands and device responses, helping pinpoint the problem. Other actions like saving configuration or checking syslog are less direct. The correct approach is to increase verbosity to see what Ansible is actually doing.

Answer

Add the 'save_when: modified' parameter to the ios_config task to ensure the configuration is saved to startup.

Answer

Use the 'debug' module to enable debugging on the device and capture the configuration commands sent by Ansible.

Answer

Check the device's syslog for errors related to ACL configuration and verify that the ACL name matches the one in the playbook.