350-501 Automation and Assurance Practice Test 5 — 15 Questions

Question 1

A service provider runs Cisco Network Services Orchestrator (NSO) to manage multivendor devices. A service template that deploys L3VPN services must be updated to add a new QoS policy parameter. The template currently uses a single service instance for all customers. The operations team wants to minimize the risk of configuration drift and rollback issues during the change. Which approach best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the service template to include the new QoS parameter, then commit the change using the NSO commit queue with a dry-run first.. NSO service templates should be modified to reflect the new intent, and changes should be validated with a dry-run commit before being applied. The commit queue ensures that concurrent changes are serialized, preventing conflicts and reducing the risk of drift or failed rollbacks. This approach maintains the transactional integrity of NSO and keeps device configuration aligned with service intent.

Answer

Create a new service template for the QoS policy and deploy it as a separate service instance, leaving the original template unchanged.

Answer

Use NSO's reactive fastmap to push the new QoS parameter directly to all devices without modifying the service template.

Answer

Log into each device individually and apply the QoS configuration manually, then update the NSO template to match.

Question 2

A Tier-1 service provider uses Cisco NSO to manage a multi-vendor network. An engineer must design a service model that references existing device models without duplicating their configuration nodes, and the service must be able to map customer intent to device-specific parameters. Which NSO feature should the engineer use?

Accepted Answer

A service package with a YANG service model and a FastMap mapping logic that maps service attributes to device configuration. NSO service packages pair a YANG service model with mapping logic such as FastMap. The service model defines customer-facing intent, while FastMap computes the corresponding device configuration by referencing existing device models. This avoids duplicating device nodes and lets NSO react to changes in service or device state, which is exactly what the engineer needs.

Answer

A YANG service model that uses leafrefs and deviations to reference existing device models

Answer

A NETCONF NED with a custom YANG model that replaces the native device model

Answer

A RESTCONF API gateway that proxies requests directly to each device's native YANG model

Question 3

A service provider uses Cisco NSO to manage a multi-vendor network. An automation engineer needs to add a new device type to NSO. The device exposes its configuration schema and operational data through a standards-based, model-driven interface over SSH, and the vendor has not published a NSO Network Element Driver (NED) for it. Which action should the engineer take to onboard the device?

Accepted Answer

Generate a NETCONF NED from the vendor's YANG models using the NSO ncs-make-package command with the netconf NED template, then load it.. The device already exposes a standards-based, model-driven interface over SSH, which is NETCONF. NSO needs a matching NED to manage it. Since no vendor NED exists, the engineer must generate a NETCONF NED from the vendor's YANG models using ncs-make-package with the netconf template, then load it. This preserves schema validation and transactional behavior, unlike CLI or SNMP approaches that bypass the native data model.

Answer

Build a CLI NED by capturing the device's command-line prompts and parsing the text output.

Answer

Register the device as a generic NETCONF device and let NSO auto-generate the YANG model from the device's hello message.

Answer

Configure the device as a SNMP-managed element and use NSO's SNMP NED to poll and set MIB objects.

Question 4

A service provider is deploying model-driven telemetry using gNMI dial-out to a collector. The collector is reachable via a management VRF. The network engineer notices that telemetry data is not arriving at the collector, even though the router shows the subscription as active. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the telemetry source-address to an interface in the management VRF and ensure the collector's IP is reachable in that VRF.. For gNMI dial-out telemetry, the router initiates the connection to the collector. When the collector resides in a management VRF, the telemetry source-address must be an interface in that VRF, and the VRF must have a route to the collector. Without this, the subscription may appear active but no data is sent because the TCP session cannot be established in the correct VRF.

Answer

Enable gNMI dial-out on the collector and configure the router as the target.

Answer

Increase the telemetry cadence interval to allow more time for the TCP session to establish.

Answer

Change the subscription from dial-out to dial-in and configure the collector to initiate the connection to the router.

Question 5

A network engineer is using RESTCONF to retrieve operational data from a Cisco IOS XE device. The engineer sends a GET request to the URL https://device/restconf/data/ietf-interfaces:interfaces. The device returns a 401 Unauthorized error. Which action should the engineer take first?

Accepted Answer

Verify that the correct credentials are provided and that the user has the appropriate privilege level.. A 401 Unauthorized response from RESTCONF means the request lacks valid authentication credentials. The engineer should first verify the username and password and ensure the account has the required privilege level. Other issues like disabled RESTCONF or incorrect URL would produce different HTTP status codes.

Answer

Ensure the request includes the correct Content-Type header set to application/yang-data+json.

Answer

Verify that the URL path is correct and that the ietf-interfaces module is supported.

Answer

Check that the RESTCONF API is enabled on the device using the restconf command.

Question 6

A service provider runs Cisco NSO to manage a fleet of Cisco ASR 9000 routers. The operations team needs to verify that a new customer VPN service was deployed exactly as intended, comparing the live device configuration against the service intent stored in NSO. Which NSO capability should the engineer use to detect configuration drift on the managed devices?

Accepted Answer

Run the NSO compliance report against the device's out-of-sync configuration and reconcile the differences.. NSO's compliance reporting engine checks each managed device against the service intent and flags any out-of-sync configuration, which is exactly what is needed to prove the VPN was deployed as intended. The compliance report enumerates the specific differences so operators can remediate drift before it affects customers.

Answer

Issue a sync-from operation on the device and then review the resulting transaction log.

Answer

Enable NETCONF trace logging on the NSO CLI and inspect the raw RPC exchange with the device.

Answer

Query the NSO CDB operational data store for the service instance and compare it to the device's config.

Question 7

A network engineer is comparing automation approaches for a service provider network. The team wants to use a model-driven approach that allows configuration and operational data to be retrieved over HTTPS using RESTful operations. Which protocol should the engineer choose?

Accepted Answer

RESTCONF over HTTPS on port 443. RESTCONF is the IETF standard for accessing YANG-modeled data using RESTful HTTP methods over HTTPS. It allows both configuration and operational data retrieval, and it is widely supported on Cisco service provider platforms. NETCONF is model-driven but not RESTful, SNMP is not YANG-based, and gRPC is used primarily for telemetry. The engineer should choose RESTCONF for RESTful HTTPS access.

Answer

NETCONF over SSH on port 830

Answer

gRPC with protocol buffers for configuration

Answer

SNMPv3 with MIB polling

Question 8

A network engineer is enabling model-driven telemetry on a Cisco IOS XE router to stream CPU utilization to a collector. The engineer wants the router to push updates only when the CPU value changes rather than at a fixed interval. Which telemetry subscription type should be configured?

Accepted Answer

On-change subscription. An on-change subscription instructs the router to emit telemetry only when the subscribed value differs from the last reported value, which is exactly the desired behavior for CPU utilization. It minimizes traffic while still capturing every change, unlike a periodic subscription that pushes on a fixed timer.

Answer

Dial-in subscription

Answer

Periodic subscription

Answer

Event-triggered subscription on the syslog stream

Question 9

A service provider uses Cisco NSO for service orchestration. An engineer needs to ensure that a service activation is applied atomically across multiple devices. The NSO transaction must either commit all device changes or roll back all of them if any device fails. Which NSO feature provides this behavior?

Accepted Answer

Transactional commit with rollback. Cisco NSO is designed for service orchestration with transactional integrity. When a service is committed, NSO treats the changes to all affected devices as a single transaction. If any device fails to apply its part, NSO rolls back the changes on the devices that already succeeded. This transactional commit with rollback is what ensures atomic service activation across multiple devices, which is essential for reliable service delivery.

Answer

Device groups with commit queues

Answer

CDB subscription notifications

Answer

NETCONF confirmed commit on each device

Question 10

A service provider is using a RESTCONF-capable controller to retrieve interface statistics from Cisco IOS XE devices. The engineer finds that a GET request to the operational datastore returns a 404 with a message that the resource is not found, even though the same YANG path works on another device model. Which action should the engineer take first to resolve the discrepancy?

Accepted Answer

Verify that the YANG module providing the requested path is installed and supported on that device, and confirm the exact path from the device's YANG library.. A RESTCONF 404 indicates the requested resource is not present in the device's implemented model. Because different IOS XE releases and platforms expose different YANG modules and paths, the engineer should first confirm which modules and paths that specific device supports before changing headers or methods.

Answer

Change the request method from GET to POST and send an empty body to force the controller to read operational state.

Answer

Add an Accept header of application/yang-data+json and resend the same GET request.

Answer

Increase the RESTCONF request timeout on the controller to allow the device more time to build the response.

Question 11

A service provider runs Cisco NSO to manage its MPLS L3VPN services. An engineer must add a new device to the NSO inventory so that NSO can manage its configuration. The device uses SSH and NETCONF. Which NSO component must be used to add the device and assign it to the correct device group?

Accepted Answer

Use the NSO CLI configuration mode to add the device under `devices device ` with its address and authgroup, then assign it to a device group.. NSO device onboarding is performed by adding a device entry in configuration mode under `devices device `, specifying connection parameters such as address, authgroup, and device type, and then assigning the device to a device group. This enables NSO to manage the device and apply service configurations. Other commands like sync-from are used after onboarding to reconcile configuration state.

Answer

Use the NSO Web UI to upload a device configuration file and let NSO automatically import the device.

Answer

Use the `ncs_cli -u admin` command to start a NETCONF session to the device and add it to NSO automatically.

Answer

Use the NSO CLI operational mode command `devices device <name> sync-from` to discover and add the device.

Question 12

A network engineer is new to automation and wants to use a simple, human-readable data serialization format for configuring a Cisco IOS XE device via NETCONF. The engineer needs to ensure that the configuration data is easily readable and editable. Which data serialization format should the engineer choose?

Accepted Answer

XML. NETCONF uses XML as its standard encoding for protocol messages and configuration data. XML is human-readable, hierarchical, and well-suited for representing YANG-modeled data. While other formats like JSON are used in RESTCONF, NETCONF specifically relies on XML. For a new engineer, XML is the correct choice because it is natively supported on Cisco IOS XE and is the foundation of NETCONF operations.

Answer

YAML

Answer

JSON

Answer

Protocol Buffers

Question 13

A service provider is implementing model-driven telemetry using gRPC dial-out with TLS. The network operations team wants to ensure that the telemetry data is securely transmitted and that the receiver can validate the sender's identity. Which two configurations are required on the Cisco IOS XE router to enable TLS for the telemetry session? (Choose two.)

Accepted Answer

Configure a trustpoint with a certificate and import the CA certificate.. To enable TLS for gRPC dial-out telemetry, the router must have a trustpoint with a certificate and the CA certificate to establish trust. Additionally, the telemetry configuration must specify TLS and reference that trustpoint. These two steps ensure encryption and mutual authentication, allowing the receiver to validate the sender's identity.

Answer

Configure a username and password for the telemetry receiver.

Answer

Enable the NETCONF-YANG management interface.

Answer

Configure an ACL to permit TCP port 57500.

Question 14

A service provider network engineer must push a configuration change to 40 Cisco IOS XE routers. The team wants a single, declarative source of truth where the desired device configuration is stored as YANG-modeled data rather than sending CLI line-by-line over SSH. Which Cisco solution should be used to achieve this declarative, model-driven configuration management?

Accepted Answer

Cisco NSO (Network Services Orchestrator). A declarative, model-driven configuration system needs a YANG-based datastore that computes and applies the delta between intended and actual state with transactional commit and rollback. Cisco NSO is built on exactly that model: it stores service and device configuration as YANG data and uses FASTMAP to render the required device configuration, then commits it. The other choices push CLI, target enterprise fabrics, or use legacy MIBs, none of which provide YANG-modeled declarative management.

Answer

SNMP set operations against the CISCO-CONFIG-COPY-MIB

Answer

Cisco DNA Center with Intent-Based Networking

Answer

Ansible with the ios_config module

Question 15

An ISP runs a Cisco NSO cluster to manage thousands of devices. A new device is added, and the NSO operator runs a sync-from operation. The operation completes but reports that some config was not imported because the device has configuration that does not map to any loaded NSO YANG model. The operator wants to understand why NSO silently dropped that configuration. Which statement explains this behavior?

Accepted Answer

NSO discards any device config that has no corresponding NED model mapping, because sync-from only imports data that maps to the device's loaded NED models.. NSO is a model-driven orchestrator: its CDB only holds data that conforms to the YANG models compiled into each device's NED. When sync-from encounters device configuration with no matching model path, that configuration cannot be represented and is therefore not imported. Understanding this limitation is essential when onboarding devices whose configuration includes features not covered by the installed NED, since the operator must extend or upgrade the NED to manage those elements.

Answer

NSO stores unmatched config in a hidden shadow CDB that requires a manual commit to become visible.

Answer

SNMP community restrictions on the device blocked NSO from importing the unmatched config during sync-from.

Answer

NSO imports all device config but marks unmatched entries as read-only, which is why they appear missing in the UI.