350-501 Automation and Assurance — 20 Questions

Question 1

Which tool is used to validate YANG data models against device capabilities and to generate Python bindings for automation scripts?

Accepted Answer

pyang. B is correct because pyang is a YANG data modeling language validator and converter that can validate YANG modules against device capabilities (e.g., via RFC 7895 YANG Library) and generate Python bindings (e.g., using the `--plugindir` or `pyang --format pybind` options) for use in automation scripts. It directly supports the task of validating YANG models and producing Python code, unlike the other options which are protocols or automation frameworks.

Answer

RESTCONF

Answer

Ansible

Answer

NETCONF

Question 2

A network engineer is automating BGP configuration using the Cisco IOS-XE YANG model. They want to enable the 'always-compare-med' feature under BGP. Which XPath expression correctly targets this leaf?

Accepted Answer

/native/router/bgp/scope/global/always-compare-med. The Cisco IOS-XE native YANG model (urn:cisco:params:xml:ns:yang:cisco-native) structures BGP configuration under /native/router/bgp/scope/global/always-compare-med. The 'scope' container is required to differentiate between global and VRF-specific BGP settings, and 'always-compare-med' is a leaf within the global scope. This path accurately reflects the hierarchical model used by Cisco for BGP automation.

Answer

/bgp/global/always-compare-med

Answer

/native/router/bgp/always-compare-med

Answer

/router/bgp/global/always-compare-med

Question 3

A service provider uses RESTCONF to automate interface configuration. They need to add a new IPv4 address to an existing interface. Which HTTP method and URI should be used?

Accepted Answer

PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/1/ietf-ip:ipv4/address. PATCH is the appropriate HTTP method for a partial update to an existing resource, and the URI targets the IPv4 address list under the specific interface. This allows adding a new IPv4 address without replacing the entire interface configuration, which aligns with RESTCONF's support for partial resource modification as defined in RFC 8040.

Answer

DELETE /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/1

Answer

POST /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/1/ietf-ip:ipv4

Answer

PUT /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/1/ietf-ip:ipv4/address

Question 4

A service provider is deploying a new automation framework using Ansible to configure MPLS VPNs. They need to ensure that the Ansible playbook can handle configuration rollback in case of failure. Which Ansible feature should be used?

Accepted Answer

Use the 'backup' option in the ios_config module. The 'backup' option in the ios_config module instructs Ansible to save a copy of the running configuration to a local file before making any changes. If the playbook fails or produces an undesired state, the operator can restore the device to the previous configuration using that backup file. This provides a straightforward rollback mechanism for MPLS VPN deployments without requiring external version control or manual snapshots.

Answer

Use 'tags' to selectively apply tasks

Answer

Use 'check_mode' to validate changes before applying

Answer

Set 'ignore_errors' to true

Question 5

A network engineer is troubleshooting a NETCONF session that fails to establish between a controller and a router. The router supports NETCONF over SSH on port 830. The controller can reach the router but the session fails. What is the most likely cause?

Accepted Answer

The SSH host key of the router is not in the controller's known_hosts file. The most likely cause is that the SSH host key of the router is not in the controller's known_hosts file. NETCONF over SSH (RFC 6242) requires SSH transport, and the controller must authenticate the router's SSH host key during session establishment. If the host key is missing or mismatched, the SSH handshake fails, preventing the NETCONF session from starting, even though the router is reachable and NETCONF is enabled.

Answer

The router's NETCONF capability is disabled

Answer

The controller is using the wrong port (e.g., 22)

Answer

The router does not support YANG models

Question 6

You are a network automation engineer for a large service provider. Your team is tasked with automating the provisioning of new MPLS L3VPN services across a multi-vendor environment (Cisco and Juniper). The automation framework uses Ansible with Jinja2 templates and NETCONF as the transport protocol. During a pilot deployment, the automation successfully configures the Cisco devices but fails on Juniper devices with a 'syntax error' when applying the generated XML configuration. The Jinja2 templates are designed to generate Cisco-style configuration. You need to modify the automation to support both vendors. Which approach is most effective?

Accepted Answer

Use IETF YANG models and create separate Jinja2 templates for Cisco and Juniper that map to their respective native YANG models.. Using IETF YANG models (e.g., RFC 8299 for L3VPN) provides a vendor-neutral data model that both Cisco and Juniper support via NETCONF. Creating separate Jinja2 templates for each vendor ensures the generated XML conforms to each device's native YANG models, avoiding syntax errors. This approach maintains automation consistency while respecting vendor-specific implementations.

Answer

Write a Python script that translates Cisco XML to Juniper XML before sending.

Answer

Switch to CLI-based automation using SSH to avoid XML syntax issues.

Answer

Create a single Jinja2 template that uses conditional statements to generate different XML for each vendor.

Question 7

You are responsible for network assurance for a Tier-1 ISP that has deployed model-driven telemetry using gNMI with ON_CHANGE subscriptions on all core routers. Recently, the NMS team reported that some BGP route flaps are not being captured in the telemetry data, even though the routers' syslogs show the flaps occurred. The telemetry subscription is for the path '/bgp/neighbors/neighbor/state/messages/received'. The NMS is using a gNMI collector that supports both ON_CHANGE and SAMPLE subscriptions. You suspect the issue is with the subscription configuration. Upon reviewing the router configuration, you see that the telemetry subscription uses the SAMPLE mode instead of ON_CHANGE. What is the most appropriate action to ensure all BGP route flap events are captured?

Accepted Answer

Modify the subscription to use ON_CHANGE mode for the BGP neighbor paths.. The gNMI ON_CHANGE subscription mode is designed to stream telemetry updates only when the value of a subscribed path changes. Since the NMS is missing BGP flap events, the subscription must be using SAMPLE mode, which periodically polls the state and can miss transient events between sampling intervals. Changing the subscription to ON_CHANGE ensures that every state transition (e.g., BGP session up/down) is immediately pushed to the collector, capturing all flaps.

Answer

Configure the router to send syslogs to the NMS and parse them for BGP flaps.

Answer

Add a second subscription with ON_CHANGE for the same paths to ensure redundancy.

Answer

Change the subscription to SAMPLE with a 1-second interval to capture flaps more frequently.

Question 8

Match each multicast protocol to its role.

Accepted Answer

IGMP: Manages multicast group membership between hosts and local routers. These are essential multicast protocols for service provider IPTV and content delivery.

Answer

IGMP: Builds distribution trees for efficient multicast forwarding

Answer

PIM-SM: Shares active source information between different domains

Question 9

A network engineer wants to automate the backup of router configurations using Python and NETCONF. Which YANG model should the engineer use to access the running configuration?

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Answer

urn:ietf:params:netconf:capability:candidate:1.0

Answer

urn:ietf:params:netconf:capability:confirmed-commit:1.0

Answer

urn:ietf:params:netconf:capability:xpath:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Question 10

A team uses Ansible to automate configuration of Cisco devices. They want to ensure that configurations are applied only if the device is reachable and the current configuration differs from the intended. Which Ansible module or feature is best suited for this?

Accepted Answer

ios_config with check_mode. The `ios_config` module with `check_mode` (enabled via the `--check` flag or `check_mode: yes`) allows Ansible to first verify device reachability and then compare the intended configuration against the running configuration without making changes. Only when a difference is detected and `check_mode` is disabled will the module apply the configuration changes. This directly meets the requirement of applying configurations only when the device is reachable and the current configuration differs from the intended.

Answer

ios_system

Answer

net_get

Answer

ios_command

Answer

ios_facts

Question 11

A Cisco XR router is configured to stream telemetry via gRPC with TLS. The collector can connect but receives empty data. The telemetry configuration is as follows: sensor-group with 'openconfig-interfaces' paths. What is the likely cause?

Accepted Answer

The sensor-group path is not supported by the device. The collector can establish a gRPC-TLS connection but receives empty data because the sensor-group path 'openconfig-interfaces' is not supported on the Cisco XR router. Cisco IOS XR supports OpenConfig paths only if the corresponding YANG models are loaded and the device implements those models; if the path is unsupported, the router will accept the subscription but send no telemetry data for that path. This is a common misconfiguration when using gRPC telemetry with OpenConfig models on platforms that may not fully support all OpenConfig paths.

Answer

The router's CPU is overloaded

Answer

The collector does not support TLS

Answer

The telemetry interval is too short

Answer

The destination group is missing the 'encoding' configuration

Question 12

Which TWO are possible causes for a NETCONF session failing to establish with a Cisco IOS-XE device?

Accepted Answer

TCP port 830 is blocked by a firewall. Option D is correct because NETCONF over SSH uses TCP port 830 by default, so a firewall blocking that port prevents the session from ever being established. Option E is correct because NETCONF must be explicitly enabled on the IOS-XE device (for example, with the 'netconf-yang' command) and SSH must be configured to support the NETCONF subsystem; without this, the session cannot be established. Option A is not correct because IOS-XR is a different operating system, not a cause of a NETCONF session failure on an IOS-XE device. Option B is not correct because an incorrect YANG module namespace would affect data modeling or RPC payloads, not the initial NETCONF session establishment. Option C is not correct because NTP synchronization is not required for NETCONF session establishment.

Answer

The device is running IOS-XR

Answer

The YANG module namespace is incorrect

Answer

NTP is not synchronized

Question 13

Refer to the exhibit. A telemetry subscription is configured on an IOS-XR router. The collector at 10.1.1.100 is not receiving data. Which configuration error is present?

Accepted Answer

Missing 'protocol' specification in the destination-group. In IOS-XR telemetry, a destination-group must include the 'protocol' keyword (e.g., 'protocol grpc' or 'protocol tcp') to specify the transport protocol for the collector. Without this specification, the router does not know how to send the telemetry data, and the collector at 10.1.1.100 will not receive any data.

Answer

The destination IP address is incorrect

Answer

The sample-interval is too short

Answer

The subscription is not committed

Answer

The sensor-group path is invalid

Question 14

Refer to the exhibit. An engineer configures IP SLA for UDP jitter. The operation completes successfully, but the customer reports voice quality issues. What should the engineer check next?

Accepted Answer

The threshold is set too high. The IP SLA UDP jitter operation completed successfully, meaning the destination is reachable and the operation is running. However, if the threshold is set too high, the IP SLA will not trigger a reaction (e.g., an SNMP trap or route change) even when jitter exceeds acceptable levels for voice quality. The customer reports voice quality issues, so the engineer must check if the jitter threshold is configured too high, masking the problem.

Answer

The packet loss is 0%

Answer

The frequency is too low

Answer

The jitter value is within threshold

Answer

The destination is unreachable

Question 15

An SP engineer is configuring model-driven telemetry (MDT) to monitor interface utilization on Cisco routers. The telemetry receiver uses gRPC and is experiencing high CPU load due to excessive subscription data. Which MDT subscription parameter should be adjusted to reduce the data rate without losing critical threshold events?

Accepted Answer

Enable on-change reporting with suppression.. Enabling on-change reporting with suppression allows the router to send telemetry data only when a monitored value changes beyond a suppression threshold, drastically reducing data volume while still capturing critical threshold events. This is ideal for reducing CPU load on the receiver without missing important changes.

Answer

Use a smaller path XPath.

Answer

Increase the sensor-group period.

Answer

Increase the sample-interval.

Question 16

A network architect is designing a model-driven telemetry solution for a large SP network. Which three factors are critical to consider when configuring telemetry subscriptions? (Choose three.)

Accepted Answer

The collection protocol (gRPC vs gNMI vs native TCP).. Option B is correct because the collection protocol determines how telemetry data is transported and encoded between the network device and the collector — gRPC (with gNMI or gNMI-based dial-out), gNMI, and native TCP (e.g., Cisco MDT over TCP) each have different capabilities, session semantics, and overhead that directly affect subscription design. Option C is correct because telemetry streams can generate substantial traffic, so the available bandwidth to the collector must be sized to handle the aggregate data rate from all subscribed devices and sensors without drops or backpressure. Option D is correct because the sampling interval for periodic subscriptions controls how frequently data is pushed, directly trading off telemetry granularity against CPU, memory, and bandwidth consumption on both the device and the collector. Option A is not a critical configuration factor for a subscription — the YANG model size is a property of the schema, not a subscription parameter, and does not determine how the subscription is configured. Option E is not a critical factor to consider when configuring subscriptions because the encoding format is typically dictated by the chosen collection protocol (e.g., GPB with gRPC/gNMI) and is not an independent subscription design decision in the same way as protocol, bandwidth, and interval.

Answer

The size of the YANG data model.

Answer

The encoding format (GPB, JSON, XML).

Question 17

A network engineer at a service provider is using Cisco NSO to automate the provisioning of VLANs on thousands of access devices. The engineer creates a service using a custom YANG model and deploys it to a set of devices. However, the deployment fails with a 'failed to reach devices' error for some devices, while others succeed. The engineer checks device connectivity and confirms all devices are reachable via SSH and NETCONF. The engineer also verifies that the NSO device list is accurate and includes all target devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in sync with NSO.. When NSO deploys a service, it first checks whether the target devices are in sync with the NSO CDB (configuration database). If a device is out of sync (e.g., its running configuration differs from what NSO expects), NSO will refuse to push the new service configuration and will report a 'failed to reach devices' error, even though the device is reachable via SSH/NETCONF. This is a safety mechanism to prevent configuration conflicts or overwriting unmanaged changes.

Answer

The service model uses an unsupported feature on those devices.

Answer

The devices have insufficient memory to accept the configuration.

Answer

The NSO package is not loaded on those devices.

Question 18

A service provider has implemented model-driven telemetry to monitor the health of its core network. The telemetry collector is a single server running a custom application that receives and processes gRPC streams from 200 routers. The collector is experiencing high CPU usage and is falling behind in processing data, causing some telemetry data to be dropped. The engineer decides to offload processing to multiple collectors. The routers support dial-out mode and can be configured with a list of collector IPs. The engineer wants to distribute the load evenly across collectors without manual configuration per router. Which should the engineer implement?

Accepted Answer

Use a load balancer in front of the collectors and configure all routers to send to the load balancer VIP.. A load balancer distributes incoming gRPC streams from all 200 routers across multiple collectors based on a configured algorithm (e.g., round-robin or least connections), achieving even load distribution without per-router configuration. The routers simply send telemetry to a single virtual IP (VIP), and the load balancer forwards each stream to an available collector, preventing any single collector from being overwhelmed. This matches the requirement to offload processing and avoid manual configuration per router.

Answer

Use a multicast address for telemetry subscription so all collectors receive all data.

Answer

Configure each router with a round-robin DNS name that resolves to multiple collector IPs.

Answer

Divide the routers into groups and assign each group to a different collector IP via the router configuration.

Question 19

A service provider operator wants to push configuration changes to a fleet of Cisco IOS XE routers using NETCONF from an automation controller. The routers have NETCONF over SSH enabled on port 830. The controller's Python script uses ncclient and the candidate datastore. After sending the edits, the operator runs a validation step and then commits. Which NETCONF operation sequence correctly applies the configuration changes transactionally?

Accepted Answer

Send with target candidate, then with confirmed timeout, then wait for confirmation.. NETCONF provides transactional configuration through the candidate datastore. Edits are staged with targeting the candidate, then applied atomically with . A confirmed commit adds a rollback timer so an operator can verify and confirm; if confirmation does not arrive, the device reverts. This sequence is the standard safe pattern for automated configuration pushes to Cisco IOS XE devices.

Answer

Send directly to the running datastore, then send and rely on the device to reject invalid changes.

Answer

Send to read the running datastore, edit the XML locally, then send from running to startup.

Answer

Send on the running datastore, then to running, then without any commit operation.

Question 20

A service provider runs a large Cisco IOS XR network and wants to stream interface statistics to a collector. The operations team requires that the router send data only when a counter value changes, and that the subscription survive a router reload without manual reconfiguration. The collector listens on TCP port 57500 and uses a self-signed certificate. Which configuration step is required on the router to meet these requirements?

Accepted Answer

Configure a gRPC dial-out subscription with an ON_CHANGE trigger and enable the telemetry subscription to be persistent across reloads using the commit-time configuration.. Model-driven telemetry on IOS XR supports dial-out gRPC subscriptions that the router initiates toward a collector. An ON_CHANGE trigger streams data only when the monitored value changes, satisfying the change-only requirement. Because the subscription is stored in the running configuration, it persists across reloads. Configuring the collector destination on TCP port 57500 with the correct TLS parameters for the self-signed certificate completes the solution.

Answer

Configure a gRPC dial-in subscription with a SAMPLE interval and rely on the collector to reconnect after a reload.

Answer

Configure a syslog destination pointing to the collector and enable interface counter logging.

Answer

Enable SNMP traps for interface counters and configure a trap receiver on the collector at port 57500.