350-601 Automation Practice Test 2 — 15 Questions

Question 1

Match each Cisco ACI component to its role.

Accepted Answer

APIC: Centralized controller for policy and fabric management. Correct matches: APIC is the central policy controller; Spine switches connect leaves; Leaf switches connect endpoints. Common confusions include mistaking APIC as a forwarding switch and associating EPG with spine switches.

Answer

APIC: Physical switch that forwards traffic

Answer

Spine: Endpoint group (EPG) concept

Question 2

Match each Cisco data center high availability feature to its description.

Accepted Answer

VRRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.. The correct matches are: VRRP is an open standard protocol for router redundancy; GLBP provides load balancing across gateways; NSF allows forwarding to continue during switchover; VPC bundles links from two switches. Common confusions include mistaking HSRP for VRRP (HSRP is proprietary) and confusing SSO (state synchronization) with NSF (forwarding continuity).

Answer

HSRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.

Answer

SSO: Feature that continues packet forwarding during a supervisor switchover.

Question 3

An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?

Accepted Answer

nxapi. The `nxapi` library is specifically designed for automating configuration backups and other management tasks on Cisco NX-OS switches. It provides a Pythonic interface to the NX-API, which uses HTTP/HTTPS-based REST or XML/JSON-RPC calls to execute CLI commands and retrieve structured output, making it the correct choice for this purpose.

Answer

requests

Answer

paramiko

Answer

cli

Question 4

A Python script using NX-API returns HTTP 401. What is the most likely cause?

Accepted Answer

Invalid credentials. HTTP 401 Unauthorized indicates that the server understood the request but authentication is required and has failed or has not been provided. In the context of NX-API, this error is most directly caused by providing invalid or missing credentials (Option D). If NX-API is not enabled on the switch, the endpoint is unavailable and typically results in an HTTP 404 Not Found or a connection error, not a 401.

Answer

Wrong NX-API version in URL

Answer

Firewall blocking port 443

Answer

NX-API not enabled on the switch

Question 5

In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?

Accepted Answer

Use Ansible with state: present in the cisco.aci collections. Ansible's `state: present` in the `cisco.aci` collection inherently provides idempotency: it checks the current state of the ACI object and only applies changes if the desired state differs, ensuring no duplicate or conflicting configurations. This aligns with best practices for automation, as it avoids manual error handling and guarantees consistent policy deployment without side effects.

Answer

Use the REST API with POST method for each creation

Answer

Write CLI scripts using expect or pexpect

Answer

Use Python SDK with a check-and-create loop

Question 6

Which protocol is recommended for streaming model-driven telemetry from NX-OS to a collector?

Accepted Answer

gRPC. gRPC (Google Remote Procedure Call) is the recommended protocol for streaming model-driven telemetry from NX-OS to a collector because it provides efficient, bidirectional streaming over HTTP/2, supports structured data encoding (e.g., Protobuf or JSON), and is natively supported in NX-OS for high-frequency, push-based telemetry. Unlike polling-based protocols, gRPC enables the device to continuously stream operational data to the collector with low latency and minimal overhead.

Answer

FTP

Answer

SNMP

Answer

HTTP

Question 7

Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?

Accepted Answer

The 'ansible_become_password' or 'enable' password in the playbook. The error 'privilege escalation required' indicates that Ansible cannot execute commands with the necessary elevated privileges on the NX-OS switch. In Ansible, privilege escalation is handled via the 'become' mechanism, and for network devices like NX-OS, the 'ansible_become_password' (or 'enable' password) is required to enter privileged EXEC mode. Without this password, Ansible remains in user EXEC mode, which lacks the authority to apply VLAN configurations.

Answer

The 'host_key_checking' setting

Answer

The 'ansible_user' variable

Answer

The inventory file syntax

Question 8

An engineer is writing a Python script to automate ACI fabric discovery using the APIC SDK. The script needs to wait until the fabric formation is complete before proceeding. Which approach is most reliable?

Accepted Answer

Periodically poll the fabric membership state via REST API. The most reliable method to wait for ACI fabric formation to complete is to periodically poll the fabric membership state via the REST API. The APIC SDK provides access to the fabric membership endpoint (e.g., /api/node/class/fabricNode.json), which returns the current state of each node. By polling this endpoint until all expected nodes report an 'active' or 'in-pod' status, the script can accurately determine when the fabric is fully formed, avoiding race conditions or incomplete discovery.

Answer

Implement asynchronous callbacks using the SDK

Answer

Use the configExportP object to monitor discovery

Answer

Use time.sleep() for a fixed duration

Question 9

A NETCONF session to an NX-OS switch fails with 'Connection refused'. What is the most likely cause?

Accepted Answer

NETCONF is not enabled on the switch. NETCONF uses SSH port 830 by default, but the 'Connection refused' error specifically indicates that the TCP connection was actively rejected by the switch, not that it timed out or was unreachable. This occurs when the NETCONF subsystem is not available because the 'netconf' feature has not been enabled on the NX-OS device, which is required to start the NETCONF server process.

Answer

All of the above

Answer

Wrong SSH port (default 830)

Answer

The switch is unreachable

Question 10

For consistent multi-data-center automation, which tool is best suited to orchestrate both NX-OS and ACI across sites?

Accepted Answer

Cisco NSO. Cisco NSO (Network Services Orchestrator) is the correct tool because it provides multi-domain, multi-vendor orchestration with native support for both NX-OS and ACI through its Network Element Drivers (NEDs). NSO uses a model-driven approach with YANG data models and NETCONF/RESTCONF protocols to manage configuration consistency across distributed data centers, enabling service-level abstraction and closed-loop automation that other tools lack.

Answer

Puppet

Answer

Ansible

Answer

Chef

Question 11

A Python script uses NX-API's XML output to extract interface status. Which method is most robust and recommended for parsing the XML?

Accepted Answer

Use xml.etree.ElementTree. xml.etree.ElementTree is the recommended method because it is part of Python's standard library, provides robust tree-based parsing that handles XML namespaces and nested structures correctly, and is specifically designed for programmatic XML manipulation. For NX-API XML output, which follows a consistent schema, ElementTree allows reliable extraction of interface status using XPath or tag traversal without fragility.

Answer

Split the string by tags

Answer

Use regular expressions to find patterns

Answer

Use BeautifulSoup

Question 12

Which TWO methods are supported for authenticating to the APIC REST API?

Accepted Answer

Certificate-based authentication. The APIC REST API supports certificate-based authentication (option B) and local AAA user authentication with a username and password (option C). Certificate-based authentication uses X.509 certificates for secure, non-interactive API access, while local AAA authentication relies on credentials stored directly on the APIC. Both methods are explicitly documented as valid for REST API calls.

Answer

SAML authentication

Answer

RADIUS/TACACS+ authentication

Answer

LDAP authentication

Question 13

Which THREE statements about Cisco Network Services Orchestrator (NSO) are true?

Accepted Answer

It can manage both NX-OS and ACI. Cisco NSO is a multi-domain orchestration platform that can manage both NX-OS and ACI environments, making option A correct. It uses NETCONF as the primary southbound protocol to communicate with devices, and it leverages YANG models to define and enforce device configurations, which validates options B and E.

Answer

It can only be used for layer 3 services

Answer

It requires a separate database for device states

Question 14

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Accepted Answer

Use the cisco.aci collection. The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Answer

Set validate_certs: no to avoid certificate errors

Answer

Store credentials in plain text in playbooks

Answer

Use delegate_to: localhost for all tasks

Question 15

Refer to the exhibit. An NX-API request returns this JSON error. What is the most likely cause?

Accepted Answer

The command is not allowed via NX-API. The JSON error indicates that the NX-API request was rejected because the command is not permitted through the NX-API interface. NX-API enforces a strict allowlist of commands; any command not explicitly allowed (e.g., certain show commands or configuration commands that could destabilize the switch) will return this error. This is a security and stability feature of the NX-API RESTful interface.

Answer

The API version in the request is mismatched

Answer

Invalid credentials

Answer

The switch is in maintenance mode