350-601 Automation — 50 Questions

Question 1

Refer to the exhibit. An engineer is trying to automate configuration using NX-API on a Nexus 9000 switch. They have enabled 'feature nxapi' but when they attempt to send a POST request to the NX-API endpoint, they receive '400 Bad Request' with 'Invalid message format'. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NX-API HTTP/HTTPS server is not configured with a port (e.g., 'nxapi http port 80').. The 400 Bad Request with 'Invalid message format' error occurs because the NX-API HTTP/HTTPS server has not been configured with a port. Without commands like 'nxapi http port 80' or 'nxapi https port 443', the NX-API service does not start on any port. When the POST request is sent to the switch, the management interface receives the request but cannot dispatch it to the NX-API handler, resulting in a 400 error indicating the request format is not understood.

Answer

The switch does not have the 'nxapi' feature enabled.

Answer

The engineer is using the wrong URL path; should be /ins instead of /api.

Answer

The authentication method is set to 'none' but should be 'basic'.

Question 2

A DevOps team uses Infrastructure as Code (IaC) for data center network automation. They want to adopt a vendor-neutral YANG data model for configuration management. Which YANG model set should they use?

Accepted Answer

OpenConfig YANG models. OpenConfig is a vendor-neutral YANG model initiative supported by multiple vendors.

Answer

Cisco native YANG models

Answer

IETF YANG models

Answer

NX-OS-specific YANG models

Question 3

A data center engineer is using Ansible to automate NX-OS configuration. They want to ensure that the running configuration is updated and saved to the startup configuration after applying changes to VLANs. Which Ansible module attribute should be used in the nxos_vlan module?

Accepted Answer

save: yes. The nxos_vlan module does not have a 'save', 'backup', 'startup_config', or 'running_config' parameter. To save the running configuration to startup configuration, use the nxos_config module with the 'save_when' parameter set to 'always' or 'changed'.

Answer

backup: yes

Answer

startup_config: yes

Answer

running_config: yes

Question 4

A network engineer wants to automate the deployment of a new VLAN across all Cisco Nexus switches in a data center using Python scripts. Which tool is most appropriate for this task?

Accepted Answer

Cisco NX-API with Python requests. Cisco NX-API provides a RESTful API interface on Nexus switches, allowing direct HTTP/HTTPS calls to configure VLANs programmatically. Using Python's requests library, you can send structured JSON payloads to the API endpoint, making it the most direct and efficient method for script-driven automation without requiring intermediate tools or protocols.

Answer

SSH CLI commands via Paramiko

Answer

Ansible playbook

Answer

SNMP SET commands

Question 5

A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?

Accepted Answer

Invalid or expired authentication token. A 401 Unauthorized error in REST API communication indicates that the request lacks valid authentication credentials. For Cisco Nexus 9000 switches, REST API access typically requires a token-based authentication (e.g., using HTTP Basic Auth to obtain a session token or cookie). If the token is invalid or expired, the API server rejects the request with a 401 status code, as the script cannot prove its identity.

Answer

API rate limiting has been exceeded

Answer

Network connectivity issue between the script and the switch

Answer

The user account does not have admin privileges

Question 6

An engineer is designing an automation solution for a large data center with multiple Cisco UCS Manager domains. Which approach best ensures idempotent configuration operations?

Accepted Answer

Using a declarative automation tool like Ansible with idempotent modules. Ansible's declarative modules for Cisco UCS Manager (e.g., `ucs_*` modules) are designed to be idempotent: they compare the current state of the configuration against the desired state defined in the playbook and only apply changes when necessary. This ensures that running the same playbook multiple times yields the same result without unintended side effects, which is critical for large-scale automation across multiple UCS domains.

Answer

Writing imperative Python scripts that execute CLI commands

Answer

Directly calling UCS Manager XML API using POST requests

Answer

Using SNMP to set configuration parameters

Question 7

A DevOps team uses Ansible to automate the configuration of Cisco Nexus switches. After running a playbook, some switches have the correct configuration but others do not. The playbook uses the 'nxos_config' module. Which action should be taken to ensure consistent configuration?

Accepted Answer

Use the 'backup' option to save the running config before changes. The 'nxos_config' module's 'backup' option saves the running configuration to a file before applying changes. This ensures that if a switch fails to apply the configuration correctly, the original configuration is preserved for rollback, enabling consistent recovery across all switches. Without this, some switches may have partial or incorrect configurations that cannot be easily reverted.

Answer

Set 'ignore_errors' to true in the playbook

Answer

Use 'serial' directive to run the playbook on one switch at a time

Answer

Enable check mode to verify changes before applying

Question 8

A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?

Accepted Answer

Fast-map synchronization. Fast-map synchronization is the correct NSO feature because it is specifically designed to detect and reconcile configuration changes made directly on managed devices (out-of-band changes). It compares the device's running configuration against NSO's CDB and generates the necessary NETCONF or CLI operations to bring the device back into sync with NSO's desired state, ensuring consistency without manual intervention.

Answer

Configuration Database (CDB) snapshots

Answer

Service model templates

Answer

Rollback and recovery mechanism

Question 9

Which TWO statements about Cisco NX-API are correct? (Choose two.)

Accepted Answer

NX-API uses HTTP/HTTPS as the transport protocol.. Cisco NX-API is a programmatic interface that uses HTTP/HTTPS as the transport protocol, allowing RESTful API calls to configure and monitor Nexus switches. It supports both XML and JSON output formats, enabling flexible data parsing in automation scripts. This makes options C and E correct.

Answer

NX-API uses SSH for transport.

Answer

NX-API only supports GET requests.

Answer

NX-API is only available on Nexus 3000 series switches.

Question 10

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Accepted Answer

Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.. The Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.

Answer

The API uses SNMP for configuration changes.

Answer

The UCS Manager XML API uses RESTful JSON format.

Question 11

Refer to the exhibit. An automation script is used to configure a new VLAN 40 on Eth1/2 trunk. The script sends the following NX-API command: 'switchport trunk allowed vlan add 40'. After execution, the engineer runs 'show running-config interface eth1/2' and sees that the trunk allowed VLAN list shows '10,20,30'. The automation script logs indicate success for adding VLAN 40, but the running config does not show the change. What is the most likely issue?

Accepted Answer

The engineer is viewing a different switch or the configuration was reverted by another process.. The running config output shows that VLAN 40 is not included in the allowed list (10,20,30), indicating the command did not take effect on this device. The script logs showing success suggest the command was executed successfully on some device, but likely not the one the engineer is viewing. This could be due to a configuration rollback or the engineer viewing a different switch. Therefore, option B is correct.

Answer

The command syntax is incorrect; 'add' is not a valid keyword.

Answer

The script actually removed the existing VLANs and replaced them with only VLAN 40.

Answer

The NX-API command was sent to the wrong interface.

Question 12

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Accepted Answer

The script uses strict type checking, and the values are returned as strings instead of integers.. The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.

Answer

The JSON output is malformed and cannot be parsed.

Answer

The interface is administratively down.

Answer

The JSON output is missing the 'switchportMode' field.

Question 13

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Accepted Answer

Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.. APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

Answer

Change the authentication method in the script from password-based to certificate-based authentication.

Answer

Regenerate the API key for the service account and update the script with the new key.

Answer

Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.

Question 14

Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.

Accepted Answer

Step 1: Create the port-channel interface. Step 2: Configure the port-channel interface (e.g., switchport mode). Step 3: Assign physical interfaces to the port-channel using the channel-group command. Step 4: Verify the port-channel status.. Port-channel creation involves interface creation, mode setting, member addition, and verification.

Answer

Step 1: Assign physical interfaces to the port-channel using the channel-group command. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Verify the port-channel status.

Answer

Step 1: Configure the port-channel interface. Step 2: Create the port-channel interface. Step 3: Assign physical interfaces to the port-channel. Step 4: Verify the port-channel status.

Answer

Step 1: Verify the port-channel status. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Assign physical interfaces to the port-channel.

Question 15

Arrange the steps to recover a lost admin password on a Cisco Nexus switch.

Accepted Answer

Interrupt boot, then change boot register to bypass startup config, then boot the switch, then set new admin password, then save configuration and reload. Password recovery involves boot interruption, register change, boot, password reset, and save.

Answer

Interrupt boot, then boot the switch, then change boot register, then set new password, then save configuration

Answer

Change boot register, then boot the switch, then interrupt boot, then set new password, then save configuration

Answer

Interrupt boot, then change boot register, then set new password, then boot the switch, then save configuration

Question 16

Match each Cisco ACI component to its role.

Accepted Answer

APIC: Centralized controller for policy and fabric management. Correct matches: APIC is the central policy controller; Spine switches connect leaves; Leaf switches connect endpoints. Common confusions include mistaking APIC as a forwarding switch and associating EPG with spine switches.

Answer

APIC: Physical switch that forwards traffic

Answer

Spine: Endpoint group (EPG) concept

Question 17

Match each Cisco data center high availability feature to its description.

Accepted Answer

VRRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.. The correct matches are: VRRP is an open standard protocol for router redundancy; GLBP provides load balancing across gateways; NSF allows forwarding to continue during switchover; VPC bundles links from two switches. Common confusions include mistaking HSRP for VRRP (HSRP is proprietary) and confusing SSO (state synchronization) with NSF (forwarding continuity).

Answer

HSRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.

Answer

SSO: Feature that continues packet forwarding during a supervisor switchover.

Question 18

An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?

Accepted Answer

nxapi. The `nxapi` library is specifically designed for automating configuration backups and other management tasks on Cisco NX-OS switches. It provides a Pythonic interface to the NX-API, which uses HTTP/HTTPS-based REST or XML/JSON-RPC calls to execute CLI commands and retrieve structured output, making it the correct choice for this purpose.

Answer

requests

Answer

paramiko

Answer

cli

Question 19

A Python script using NX-API returns HTTP 401. What is the most likely cause?

Accepted Answer

Invalid credentials. HTTP 401 Unauthorized indicates that the server understood the request but authentication is required and has failed or has not been provided. In the context of NX-API, this error is most directly caused by providing invalid or missing credentials (Option D). If NX-API is not enabled on the switch, the endpoint is unavailable and typically results in an HTTP 404 Not Found or a connection error, not a 401.

Answer

Wrong NX-API version in URL

Answer

Firewall blocking port 443

Answer

NX-API not enabled on the switch

Question 20

In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?

Accepted Answer

Use Ansible with state: present in the cisco.aci collections. Ansible's `state: present` in the `cisco.aci` collection inherently provides idempotency: it checks the current state of the ACI object and only applies changes if the desired state differs, ensuring no duplicate or conflicting configurations. This aligns with best practices for automation, as it avoids manual error handling and guarantees consistent policy deployment without side effects.

Answer

Use the REST API with POST method for each creation

Answer

Write CLI scripts using expect or pexpect

Answer

Use Python SDK with a check-and-create loop