CCNP REST APIs and Data Models — 10 Questions

Question 1

A network engineer is automating the configuration of a new VLAN on a Cisco Catalyst 9000 switch using RESTCONF. The engineer sends a PUT request to the URI 'https://switch/restconf/data/Cisco-NX-OS-device:Native/VlanList' with a JSON payload containing the VLAN details. The switch responds with a 405 Method Not Allowed error. What is the most likely cause of this error?

Accepted Answer

The engineer should have used the POST method instead of PUT to create a new list entry.. The PUT method is typically used to create or replace a resource, but for list entries in RESTCONF, the POST method is used to add a new entry. The 405 error indicates that the method is not allowed for the specified URI. The engineer should use POST to add a new VLAN entry to the list.

Answer

The engineer used the wrong URI; the correct URI should include a specific VLAN ID.

Answer

The payload format is incorrect; the engineer must use XML instead of JSON.

Answer

The switch does not support RESTCONF for VLAN configuration; NETCONF must be used instead.

Question 2

An engineer is using a Python script to retrieve interface statistics from a Cisco IOS-XE device via the REST API. The script sends a GET request to 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/statistics' and receives a 404 Not Found response. The interface exists and is operational. What is the most likely issue?

Accepted Answer

The URI is incorrect; statistics are under 'interfaces-state' not 'interfaces'.. The 404 error indicates the resource was not found. In RESTCONF, the URI must use the correct encoding for interface names, especially if they contain special characters like a slash. The interface name 'GigabitEthernet1' should be URL-encoded as 'GigabitEthernet1' (no encoding needed here), but the issue is that the URI path must match the YANG module structure exactly. The statistics data is often under a separate container like 'interfaces-state' in the ietf-interfaces model, not directly under 'interface'. The correct URI for operational statistics is typically 'ietf-interfaces:interfaces-state/interface=GigabitEthernet1/statistics'.

Answer

The interface name must be URL-encoded because it contains a slash.

Answer

The device requires authentication; the script must include a valid token.

Answer

The REST API is not enabled on the device; the engineer must enable it first.

Question 3

A network team is using Ansible with the iosxr_config module to push configuration changes to a Cisco IOS-XR router. The playbook uses the REST API via the 'ansible_connection: restconf' setting. The engineer notices that the changes are applied but the playbook reports 'changed: false' even when changes were made. What is the most likely reason for this behavior?

Accepted Answer

The engineer should use the 'uri' module with the REST API instead of the 'iosxr_config' module.. When using RESTCONF, the Ansible module may not detect changes if the module does not properly parse the response from the device. However, in this scenario, the issue is that the 'iosxr_config' module is designed for CLI-based connections, not RESTCONF. The correct approach is to use a module like 'iosxr_restconf' or a generic 'uri' module. The 'ansible_connection: restconf' is not a valid connection type for Ansible; Ansible uses 'network_cli' or 'ansible.netcommon.restconf' connection plugin. The engineer should use the 'uri' module or a dedicated RESTCONF module.

Answer

The REST API on the router does not return a proper response, so Ansible cannot determine if a change occurred.

Answer

The playbook is missing the 'gather_facts: no' directive, causing Ansible to skip change detection.

Answer

The router requires a commit operation after configuration changes, and Ansible does not perform that.

Question 4

An engineer is developing a script to automate the backup of running configurations from multiple Cisco IOS-XE devices using RESTCONF. The script sends a GET request to 'https://device/restconf/data/Cisco-IOS-XE-native:native/configuration' and receives a 501 Not Implemented error. What is the most likely cause?

Accepted Answer

The URI is incorrect; the running configuration is accessed via the 'Cisco-IOS-XE-native:native' module without the '/configuration' suffix.. The 501 error indicates that the server does not support the functionality required to fulfill the request. In this case, the URI is incorrect because the running configuration is typically accessed via the 'ietf-netconf-monitoring' module or a specific Cisco module like 'Cisco-IOS-XE-native:native' but the path should be '/restconf/data/Cisco-IOS-XE-native:native' without '/configuration'. However, the more common issue is that the running configuration is not directly available via RESTCONF; it is available via NETCONF or via the 'operational' datastore. The correct approach is to use the 'ietf-netconf-monitoring' module or the 'cisco-native' module with the correct path.

Answer

The device does not support RESTCONF; the engineer must use NETCONF for configuration backup.

Answer

The URI is incorrect; the running configuration is under 'ietf-netconf-monitoring:netconf-state/capabilities'.

Answer

The request must use the POST method instead of GET to retrieve the running configuration.

Question 5

A network engineer is using the Cisco DNA Center REST API to retrieve the list of network devices. The engineer sends a GET request to '/dna/intent/api/v1/network-device' and receives a 400 Bad Request response. The API documentation indicates that the request requires a query parameter 'siteId'. What should the engineer do to resolve the issue?

Accepted Answer

Include the 'siteId' query parameter in the request URL.. A 400 Bad Request typically indicates a malformed request, such as missing required parameters. The API documentation specifies that 'siteId' is required, so the engineer must include it as a query parameter in the request.

Answer

Change the HTTP method to POST because GET is not supported for this endpoint.

Answer

Add an 'Authorization' header with a valid token because the API requires authentication.

Answer

Use a different API endpoint, such as '/dna/intent/api/v1/site', to retrieve device information.

Question 6

An engineer is using a Python script to configure a new VLAN on a Cisco Nexus 9000 switch using the NX-API REST API. The script sends a POST request to 'https://switch/api/mo/org.json' with a JSON payload containing the VLAN configuration. The switch responds with a 403 Forbidden error. What is the most likely cause?

Accepted Answer

The user account does not have the required RBAC privileges to configure VLANs.. A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. In NX-API, this often occurs when the user does not have sufficient privileges to perform the operation. The engineer should check that the user account used for authentication has the necessary RBAC roles to configure VLANs.

Answer

The payload format is incorrect; the engineer must use XML instead of JSON.

Answer

The switch does not support NX-API; the engineer must use NETCONF instead.

Answer

The URI is incorrect; the correct URI should be 'https://switch/api/node/mo/org.json'.

Question 7

A network engineer is using the Cisco Meraki REST API to update the SSID settings for a wireless network. The engineer sends a PUT request to 'https://api.meraki.com/api/v1/networks/{networkId}/wireless/ssids/{ssidNumber}' with a JSON payload containing the new settings. The API returns a 429 Too Many Requests error. What should the engineer do to resolve this issue?

Accepted Answer

Implement exponential backoff and retry the request after a delay.. A 429 error indicates rate limiting; the API has received too many requests from the client within a given time frame. The engineer should implement exponential backoff and retry logic, or reduce the request rate.

Answer

Change the HTTP method to POST because PUT is not supported for this endpoint.

Answer

Add an 'X-Cisco-Meraki-API-Key' header with a higher rate limit key.

Answer

Use a different API endpoint, such as 'https://api.meraki.com/api/v1/organizations/{orgId}/ssids'.

Question 8

An engineer is using the Cisco SD-WAN vManage REST API to retrieve the list of WAN edge devices. The engineer sends a GET request to 'https://vmanage/dataservice/device' and receives a 401 Unauthorized error. The engineer has already obtained a JSESSIONID cookie by authenticating with the API. What is the most likely cause of the error?

Accepted Answer

The JSESSIONID cookie must be included in the request headers for authentication.. A 401 error indicates that authentication is required or has failed. Even with a JSESSIONID cookie, the engineer must include it in the request headers. Additionally, vManage APIs often require a CSRF token for state-changing operations, but for GET requests, the JSESSIONID should suffice. The most likely cause is that the cookie is not being sent with the request, or the session has expired.

Answer

The engineer must use a different authentication method, such as OAuth2, instead of cookies.

Answer

The URI is incorrect; the correct URI should be 'https://vmanage/dataservice/device/wanedge'.

Answer

The engineer must include a CSRF token in the request header for GET requests.

Question 9

A network engineer is using the Cisco IOS-XE REST API to configure a static route. The engineer sends a PATCH request to 'https://device/restconf/data/Cisco-IOS-XE-native:native/ip/route/ip-route-interface-forwarding-list=192.168.1.0,255.255.255.0,GigabitEthernet1' with a JSON payload containing the route details. The device responds with a 204 No Content status. What does this response indicate?

Accepted Answer

The request was successful, and the static route has been configured.. A 204 No Content response indicates that the request was successful, but there is no content to return. In RESTCONF, a successful PATCH request that updates an existing resource typically returns 204 No Content. The engineer should verify that the route was applied by retrieving the configuration.

Answer

The request failed because the route already exists; the engineer must use PUT instead.

Answer

The device does not support PATCH; the engineer must use POST to update the route.

Answer

The payload was empty; the engineer must include the route parameters in the body.

Question 10

A network engineer writes the following Python script using the Requests library to retrieve interface information from a Cisco IOS-XE device via RESTCONF:

```python
import requests
import json

url = "https://10.1.1.1:443/restconf/data/ietf-interfaces:interfaces"
headers = {
    "Accept": "application/yang-data+json",
    "Content-Type": "application/yang-data+json"
}
auth = ("admin", "password")
response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the primary issue with this code?

Accepted Answer

The 'Content-Type' header is misspelled as 'Contet-Type', which will cause the server to reject the request.. The code does not disable SSL warnings, which will cause a warning message but not an error. However, the real issue is that the URL uses HTTPS port 443, which is correct for RESTCONF, but the code lacks a context to handle self-signed certificates. The most critical problem is that the 'verify' parameter is set to False, but the code does not suppress the InsecureRequestWarning, which can clutter output. However, the question focuses on a functional issue: the URL path is missing the module name for the YANG model. The correct path should be '/restconf/data/ietf-interfaces:interfaces' which is present. Actually, the code is correct syntactically. The deliberate bug is that the 'verify=False' is used without disabling warnings, but that is not a functional error. The intended bug is that the 'Accept' header should be 'application/yang-data+json' but the code uses it correctly. The real bug is that the URL uses 'https' but the device might only support HTTP. However, the most common mistake is forgetting to disable SSL warnings. The correct answer is that the code will run but produce warnings; however, the question expects a functional issue: the code will fail because the device requires certificate verification. But verify=False bypasses that. Let me re-evaluate: The code is actually correct. The deliberate bug is that the URL should be '/restconf/data/ietf-interfaces:interfaces' but it is correct. I need to adjust. The bug is that the 'headers' dictionary has a typo: 'Contet-Type' instead of 'Content-Type'. That is the deliberate bug. So the answer is that the request will fail due to incorrect header.

Answer

The URL uses HTTPS but the device only supports HTTP, causing a connection error.

Answer

The 'verify=False' parameter is not valid for the requests library; it should be 'ssl_verify=False'.

Answer

The 'auth' tuple should be passed as a dictionary with 'username' and 'password' keys.