350-601 Automation — 50 Questions

Question 1

A DevOps team uses Ansible to automate the configuration of Cisco Nexus switches. After running a playbook, some switches have the correct configuration but others do not. The playbook uses the 'nxos_config' module. Which action should be taken to ensure consistent configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'backup' option to save the running config before changes. The 'nxos_config' module's 'backup' option saves the running configuration to a file before applying changes. This ensures that if a switch fails to apply the configuration correctly, the original configuration is preserved for rollback, enabling consistent recovery across all switches. Without this, some switches may have partial or incorrect configurations that cannot be easily reverted.

Answer

Set 'ignore_errors' to true in the playbook

Answer

Use 'serial' directive to run the playbook on one switch at a time

Answer

Enable check mode to verify changes before applying

Question 2

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Accepted Answer

Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.. APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

Answer

Change the authentication method in the script from password-based to certificate-based authentication.

Answer

Regenerate the API key for the service account and update the script with the new key.

Answer

Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.

Question 3

Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.

Accepted Answer

Step 1: Create the port-channel interface. Step 2: Configure the port-channel interface (e.g., switchport mode). Step 3: Assign physical interfaces to the port-channel using the channel-group command. Step 4: Verify the port-channel status.. Port-channel creation involves interface creation, mode setting, member addition, and verification.

Answer

Step 1: Assign physical interfaces to the port-channel using the channel-group command. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Verify the port-channel status.

Answer

Step 1: Configure the port-channel interface. Step 2: Create the port-channel interface. Step 3: Assign physical interfaces to the port-channel. Step 4: Verify the port-channel status.

Answer

Step 1: Verify the port-channel status. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Assign physical interfaces to the port-channel.

Question 4

Arrange the steps to recover a lost admin password on a Cisco Nexus switch.

Accepted Answer

Interrupt boot, then change boot register to bypass startup config, then boot the switch, then set new admin password, then save configuration and reload. Password recovery involves boot interruption, register change, boot, password reset, and save.

Answer

Interrupt boot, then boot the switch, then change boot register, then set new password, then save configuration

Answer

Change boot register, then boot the switch, then interrupt boot, then set new password, then save configuration

Answer

Interrupt boot, then change boot register, then set new password, then boot the switch, then save configuration

Question 5

Match each Cisco ACI component to its role.

Accepted Answer

APIC: Centralized controller for policy and fabric management. Correct matches: APIC is the central policy controller; Spine switches connect leaves; Leaf switches connect endpoints. Common confusions include mistaking APIC as a forwarding switch and associating EPG with spine switches.

Answer

APIC: Physical switch that forwards traffic

Answer

Spine: Endpoint group (EPG) concept

Question 6

Match each Cisco data center high availability feature to its description.

Accepted Answer

VRRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.. The correct matches are: VRRP is an open standard protocol for router redundancy; GLBP provides load balancing across gateways; NSF allows forwarding to continue during switchover; VPC bundles links from two switches. Common confusions include mistaking HSRP for VRRP (HSRP is proprietary) and confusing SSO (state synchronization) with NSF (forwarding continuity).

Answer

HSRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.

Answer

SSO: Feature that continues packet forwarding during a supervisor switchover.

Question 7

An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?

Accepted Answer

nxapi. The `nxapi` library is specifically designed for automating configuration backups and other management tasks on Cisco NX-OS switches. It provides a Pythonic interface to the NX-API, which uses HTTP/HTTPS-based REST or XML/JSON-RPC calls to execute CLI commands and retrieve structured output, making it the correct choice for this purpose.

Answer

requests

Answer

paramiko

Answer

cli

Question 8

A NETCONF session to an NX-OS switch fails with 'Connection refused'. What is the most likely cause?

Accepted Answer

NETCONF is not enabled on the switch. NETCONF uses SSH port 830 by default, but the 'Connection refused' error specifically indicates that the TCP connection was actively rejected by the switch, not that it timed out or was unreachable. This occurs when the NETCONF subsystem is not available because the 'netconf' feature has not been enabled on the NX-OS device, which is required to start the NETCONF server process.

Answer

All of the above

Answer

Wrong SSH port (default 830)

Answer

The switch is unreachable

Question 9

A Python script uses NX-API's XML output to extract interface status. Which method is most robust and recommended for parsing the XML?

Accepted Answer

Use xml.etree.ElementTree. xml.etree.ElementTree is the recommended method because it is part of Python's standard library, provides robust tree-based parsing that handles XML namespaces and nested structures correctly, and is specifically designed for programmatic XML manipulation. For NX-API XML output, which follows a consistent schema, ElementTree allows reliable extraction of interface status using XPath or tag traversal without fragility.

Answer

Split the string by tags

Answer

Use regular expressions to find patterns

Answer

Use BeautifulSoup

Question 10

Which TWO methods are supported for authenticating to the APIC REST API?

Accepted Answer

Certificate-based authentication. The APIC REST API supports certificate-based authentication (option B), where a client presents an X.509 certificate signed by a trusted CA and the APIC validates it against a local or remote trust store to establish the session. It also supports local AAA user authentication (option C), where credentials are sent via the aaaLogin POST to /api/aaaLogin.json and the APIC returns a token used in subsequent requests. SAML (A), RADIUS/TACACS+ (D), and LDAP (E) are not natively supported as direct REST API authentication methods; remote authentication protocols like TACACS+, RADIUS, and LDAP can be configured as AAA providers for user login, but the REST API itself only accepts certificate-based or local AAA username/password authentication.

Answer

SAML authentication

Answer

RADIUS/TACACS+ authentication

Answer

LDAP authentication

Question 11

Refer to the exhibit. An NX-API request returns this JSON error. What is the most likely cause?

Accepted Answer

The command is not allowed via NX-API. The JSON error indicates that the NX-API request was rejected because the command is not permitted through the NX-API interface. NX-API enforces a strict allowlist of commands; any command not explicitly allowed (e.g., certain show commands or configuration commands that could destabilize the switch) will return this error. This is a security and stability feature of the NX-API RESTful interface.

Answer

The API version in the request is mismatched

Answer

Invalid credentials

Answer

The switch is in maintenance mode

Question 12

Refer to the exhibit. An Ansible playbook targeting an NX-OS switch fails with this error. What is the most likely cause?

Accepted Answer

The password is incorrect. The error message indicates an authentication failure during the SSH connection from Ansible to the NX-OS switch. Since Ansible uses SSH to execute tasks, a 'Permission denied' error most commonly points to incorrect credentials. The playbook likely specifies the wrong password for the given username, causing the SSH session to be rejected.

Answer

The username is incorrect

Answer

SSH is not enabled on the switch

Answer

The Ansible version is incompatible with the switch

Question 13

An organization is deploying Ansible for network automation across multiple Nexus 9000 leaf switches. They need to ensure that configuration tasks are idempotent and only apply changes when necessary. Which best practice should be followed when using the cisco.nxos.nxos_config module?

Accepted Answer

Use the 'replace' option with a provided configuration file to enforce desired state.. The 'replace' option in the cisco.nxos.nxos_config module allows you to provide a configuration file that defines the desired state, and the module will only apply changes if the current configuration does not match, ensuring idempotency. This is a best practice for network automation with Ansible on Nexus switches.

Answer

Write idempotent playbooks by checking 'show running-config' before each task.

Answer

Set 'always_run' parameter to 'yes' to force execution.

Answer

Use the 'backup' option to always restore previous configuration.

Question 14

A network team is planning to automate configuration management of a brownfield Nexus 9000 fabric using YANG data models and NETCONF. Which consideration is critical when implementing this solution?

Accepted Answer

The operational state must be modeled against the device-specific YANG model to avoid configuration drift.. In a brownfield Nexus 9000 fabric, the operational state (e.g., interface status, routing table) must be modeled against the device-specific YANG model to detect and correct configuration drift. NETCONF uses YANG models to define both configuration and operational data, but only the device-specific native model accurately reflects the actual running state. Without this alignment, automated remediation may push incorrect configurations, leading to network instability.

Answer

NETCONF replaces CLI entirely; no fallback necessary.

Answer

Using NETCONF for configuration ensures zero touch provisioning.

Answer

All NX-OS versions support the same YANG models; no compatibility check needed.

Question 15

An Ansible playbook using the cisco.nxos.nxos_config module fails with the error: 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting'. What is the most likely cause?

Accepted Answer

The playbook includes an invalid parameter 'connection: network_cli' inside the task block.. The error 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting' occurs because the `connection: network_cli` parameter is being passed inside the task block of the playbook. The `cisco.nxos.nxos_config` module does not accept a `connection` parameter at the task level; connection settings must be defined at the play or inventory level. This is a common syntax error when using Ansible network modules.

Answer

The SSH key authentication is misconfigured.

Answer

The module is not installed correctly.

Answer

The playbook is targeting a device running an unsupported NX-OS version.

Question 16

Refer to the exhibit. An engineer is trying to automate configuration using NX-API on a Nexus 9000 switch. They have enabled 'feature nxapi' but when they attempt to send a POST request to the NX-API endpoint, they receive '400 Bad Request' with 'Invalid message format'. What is the most likely missing configuration?

Accepted Answer

The NX-API HTTP/HTTPS server is not configured with a port (e.g., 'nxapi http port 80').. The 400 Bad Request with 'Invalid message format' error occurs because the NX-API HTTP/HTTPS server has not been configured with a port. Without commands like 'nxapi http port 80' or 'nxapi https port 443', the NX-API service does not start on any port. When the POST request is sent to the switch, the management interface receives the request but cannot dispatch it to the NX-API handler, resulting in a 400 error indicating the request format is not understood.

Answer

The switch does not have the 'nxapi' feature enabled.

Answer

The engineer is using the wrong URL path; should be /ins instead of /api.

Answer

The authentication method is set to 'none' but should be 'basic'.

Question 17

A Nexus switch configured with 'feature nxapi' and 'nxapi https port 443' fails to respond to REST API calls from a monitoring system. The engineer can ping the management IP. Which troubleshooting step should be taken first?

Accepted Answer

Verify that the NX-API process is running with 'show nxapi'. The first step when NX-API is configured but not responding is to verify that the NX-API process is actually running. The 'feature nxapi' command enables the feature, but the NX-API service may not have started due to a configuration error, resource issue, or process crash. The 'show nxapi' command displays the operational status of the NX-API service, including whether it is listening on the configured port (443 in this case). Since the engineer can ping the management IP, basic network connectivity exists, so the issue is likely at the application layer.

Answer

Check if the monitoring system is using the correct HTTP method

Answer

Review the switch's ACL for the management VRF

Answer

Confirm that the SSL certificate is trusted

Question 18

An engineer needs to collect streaming telemetry from a Nexus 9000 switch. Which two protocols can be used to transmit telemetry data to a collector? (Choose two.)

Accepted Answer

gNMI. gNMI (option B) is correct because it is a gRPC-based protocol specifically designed for streaming telemetry on Nexus 9000 switches, using a subscribe RPC to push model-driven data to a collector. gRPC (option E) is also correct because it is the underlying transport framework that carries the telemetry streams, and Nexus 9000 supports dial-out telemetry over gRPC to a collector. NETCONF (option A) is a configuration and RPC protocol, not a streaming telemetry transport, so it does not belong. HTTP (option C) is not used as the streaming telemetry transport for Nexus 9000 telemetry data. SNMP traps (option D) are event-driven notifications, not streaming telemetry, so they are not correct.

Answer

NETCONF

Answer

HTTP

Answer

SNMP traps

Question 19

A large enterprise data center uses Cisco UCS Manager to manage hundreds of blade servers. The automation team has been using Python SDK scripts to provision service profiles. Recently, after a UCS Manager firmware upgrade, several scripts that previously worked are now failing with 'AttributeError: 'ServiceProfile' object has no attribute 'set_vnic_order''. The team confirms that the UCS Manager version changed from 4.0 to 4.2. Which course of action should the engineer take to resolve the issue?

Accepted Answer

Update the Python SDK to the version that supports UCS Manager 4.2 and modify scripts accordingly. The Python SDK for UCS Manager is version-specific; upgrading UCS Manager from 4.0 to 4.2 introduces API changes that can deprecate or remove methods like `set_vnic_order`. Updating the SDK to a version compatible with UCS Manager 4.2 ensures the Python scripts use the correct API calls, and modifying the scripts to align with any new method signatures or attributes resolves the AttributeError.

Answer

Use the UCS Manager XML API directly without the SDK

Answer

Downgrade UCS Manager back to version 4.0 to restore compatibility

Answer

Replace Python scripts with Ansible modules that use the UCS API

Question 20

A financial services company operates a multi-site data center with Cisco ACI. The automation team uses Ansible Tower to manage configurations. They have a playbook that configures EPGs using the 'aci_epg' module. The playbook runs successfully for most sites but fails on one site with the error 'Object 'uni/tn-Tenant1/ap-AP1/epg-EPG1' doesn't exist'. The engineer checks the ACI fabric and confirms that the tenant, application profile, and EPG exist on that site. The playbook uses the same credentials and variables across all sites. What is the most likely cause of the failure?

Accepted Answer

The fabric name in the Ansible inventory is incorrect for that site. The error 'Object doesn't exist' despite the EPG being present on the ACI fabric indicates that Ansible is targeting the wrong fabric or APIC. Since the playbook uses the same credentials and variables across all sites, the most likely cause is an incorrect fabric name in the Ansible inventory for that specific site, causing the module to query a different APIC cluster where the object does not exist.

Answer

The Ansible Tower job runs with a different user that lacks permissions on that site

Answer

The ACI APIC version is incompatible with the Ansible module

Answer

The EPG name in the playbook has a typo that only affects this site