200-901 Infrastructure and Automation — 25 Questions

Question 1

Which protocol is commonly used to retrieve real-time telemetry data from network devices in a streaming fashion?

Accepted Answer

gRPC. gRPC is correct because it is designed for high-performance, real-time streaming of telemetry data using HTTP/2 and Protocol Buffers. Network devices like Cisco IOS XR and NX-OS use gRPC to push telemetry data to collectors in a continuous stream, eliminating the need for polling and reducing latency.

Answer

SNMP polling

Answer

NETCONF

Answer

HTTP

Question 2

Which THREE of the following are best practices for writing Ansible playbooks for network automation? (Select exactly 3.)

Accepted Answer

Include a validation task after configuration changes. Option B is correct because including a validation task after configuration changes confirms the device reached the intended state and catches failed or partial deployments before moving on. Option C is correct because using variables for device-specific parameters (for example, hostnames, IPs, or interface names) keeps playbooks reusable across many devices instead of duplicating logic. Option E is correct because 'changed_when' lets you accurately report whether a task actually modified device state, which is essential for idempotency and reliable reporting in network modules that may not natively detect change. Option A is not a best practice because ignoring errors hides failures and can leave devices in an inconsistent state. Option D is not a best practice because hardcoding device IPs makes playbooks brittle and non-reusable; those values should come from inventory or variables.

Answer

Run all tasks without checking for errors

Answer

Hardcode device IPs in the playbook

Question 3

Refer to the exhibit. An automation script expects the interface IP address to be configured via DHCP. Based on the output, what is the current configuration source for the IP address?

Accepted Answer

Manual configuration (NVRAM). The output shows 'IP address is 192.168.1.1, subnet mask is 255.255.255.0' with no DHCP or BOOTP flags, and the configuration is stored in NVRAM (startup-config). This indicates the IP was manually configured (typed by an administrator) and saved, not obtained via DHCP. Option C is correct because the source is manual configuration from NVRAM.

Answer

DHCP

Answer

BOOTP

Answer

PPP negotiation

Question 4

Refer to the exhibit. A Python script uses the YANG model to configure the interface. After applying this JSON payload via a PATCH request, what is the expected operational state of the interface?

Accepted Answer

Administratively down. The PATCH request applies the provided JSON payload, which sets the interface's 'enabled' leaf to 'false' (or equivalent YANG leaf for administrative state). In YANG models for interfaces (e.g., RFC 8343 or Cisco native models), setting 'enabled' to false places the interface in an administratively down state. The PATCH operation is valid for modifying interface configuration, and the payload explicitly changes the administrative state to down, overriding any previous configuration.

Answer

Error because PATCH is not allowed on interfaces

Answer

No change, remains as previously configured

Answer

Administratively up and protocol up

Question 5

Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?

Accepted Answer

Wrong SSH username or password. The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.

Answer

The device is unreachable

Answer

The playbook syntax is incorrect

Answer

The device is not running IOS

Question 6

You are a network automation engineer at a large enterprise. The network consists of 200 Cisco Catalyst switches distributed across five data centers. Each switch runs IOS-XE and supports NETCONF. Your team uses a centralized Ansible control node to manage configurations. Recently, the security team mandated that all management access must use SSH keys instead of passwords. You updated the Ansible inventory to use SSH keys and tested on a few switches successfully. However, when you run the playbook against all switches, about 30 switches fail with the error: 'Authentication failed.' You verify that the SSH public key is correctly deployed on those switches via the console. What is the most likely cause of the failure?

Accepted Answer

The private key file on the Ansible control node has permissions 644, which SSH rejects. SSH strictly requires private key files to have permissions no more permissive than 600 (owner read/write) or 640 (owner read/write, group read) on Unix-like systems. A permission of 644 allows group and others to read the key, which SSH interprets as insecure and refuses to use, causing 'Authentication failed' even though the public key is correctly deployed on the switches.

Answer

The public key on the switches is not in the correct format

Answer

The Ansible become method is misconfigured

Answer

The switches are not reachable over the network

Question 7

You are automating the deployment of a new software image on a fleet of Cisco Nexus switches using Ansible. The switches are in a production environment and must have minimal downtime. You have a maintenance window of 30 minutes per switch. Your playbook performs the following steps: 1) Copy the image to the switch via SCP, 2) Set the boot variable to the new image, 3) Save the configuration, 4) Reload the switch. During a dry run on a test switch, you notice that the reload step takes 8 minutes, but the copy step takes 15 minutes due to slow link speed. For the production rollout, you need to reduce the overall time per switch. Which approach should you take?

Accepted Answer

Use a local file server with HTTP for image transfer to improve speed. The bottleneck is the SCP copy time (15 minutes), which exceeds the 30-minute maintenance window when combined with the reload (8 minutes). Using HTTP for image transfer leverages a more efficient protocol with better throughput and lower overhead than SCP, which uses SSH encryption and can be slower on low-bandwidth links. This directly reduces the copy time, bringing the total per-switch time under the maintenance window limit.

Answer

Skip the save configuration step to save time

Answer

Use a compressed image to reduce copy time

Answer

Reload all switches simultaneously in the same maintenance window

Question 8

Refer to the exhibit. A network engineer applies this JSON-based QoS policy to a Cisco device using NETCONF/YANG. Which statement best describes the expected behavior for traffic from 10.0.0.0/24 with DSCP EF?

Accepted Answer

Traffic from 10.0.0.0/24 with DSCP EF is re-marked to AF41 and limited to 100 Mbps; excess is dropped.. The JSON-based QoS policy uses a class map matching traffic from source 10.0.0.0/24 with DSCP EF, then applies a police action that re-marks exceeding traffic to AF41 and drops it when the rate exceeds 100 Mbps. This is a standard two-rate policer behavior in Cisco IOS QoS, where conforming traffic is transmitted unchanged and exceeding traffic is re-marked and dropped.

Answer

Traffic with DSCP EF from any source is re-marked to AF41 and dropped if exceeding 100 Mbps.

Answer

The policy is invalid because DSCP values cannot be changed in a QoS policy.

Answer

Traffic from 10.0.0.0/24 is re-marked to DSCP EF, then policed at 100 Mbps.

Question 9

An automation engineer wants to programmatically retrieve the interface configuration of a Cisco Nexus switch using NX-API. Which API call method is most appropriate?

Accepted Answer

GET. The NX-API on Cisco Nexus switches uses HTTP methods that map to CRUD operations. To retrieve (read) interface configuration without modifying any state, the GET method is the correct and most appropriate choice, as it corresponds to the 'show' commands in the CLI. POST, PUT, and DELETE are intended for creating, updating, or deleting resources, not for read-only queries.

Answer

POST

Answer

DELETE

Answer

PUT

Question 10

During a CI/CD pipeline for network changes, a Jenkins job runs an Ansible playbook that applies configuration to a device. The playbook fails with a timeout error. What is the most likely cause?

Accepted Answer

The device is under heavy CPU load causing slow responses. A timeout error in an Ansible playbook during a CI/CD pipeline typically indicates that the network device is responding too slowly to complete the SSH or API session within the configured timeout period. Heavy CPU load on the device can cause delayed responses to Ansible's control node, triggering the timeout before the playbook finishes applying the configuration. This is distinct from connectivity failures or authentication issues, which produce different error messages.

Answer

The playbook syntax is invalid

Answer

Incorrect credentials

Answer

Device is unreachable

Question 11

An organization implements zero-touch provisioning (ZTP) for new Cisco routers using DHCP and TFTP. The provision script is not being executed even though the device obtains an IP address. The DHCP server logs show the option 67 (bootfile-name) and option 150 (tftp-server) are set. What is the most probable reason?

Accepted Answer

The script file name in option 67 does not match the actual file on the TFTP server. The most common reason for a ZTP script not executing after a device obtains an IP address is a mismatch between the bootfile name specified in DHCP option 67 and the actual filename on the TFTP server. Even if the DHCP server logs show option 67 and 150 are set, the router will attempt to download the file specified in option 67; if that file does not exist or is named differently on the TFTP server, the download fails and the script is not executed.

Answer

The DHCP server is not authoritative

Answer

The TFTP server IP is unreachable from the router

Answer

The router does not support ZTP

Question 12

A network engineer uses Ansible to apply a standard ACL to multiple routers. The playbook runs without errors, but the ACL is not applied on some routers. Upon checking, those routers have a different configuration revision due to a previous manual change. What is the best practice to ensure consistent application?

Accepted Answer

Use the 'replace' parameter to overwrite the entire config. The 'replace' parameter in Ansible's ios_config module forces a full configuration replacement on the target device, overwriting the entire running configuration with the intended configuration. This ensures that any prior manual changes or configuration revisions are eliminated, guaranteeing consistent ACL application across all routers regardless of their current state.

Answer

Use the ansible_network_os variable correctly

Answer

Use the 'backup' option in ios_config

Answer

Use the 'ignore_errors' directive

Question 13

Which TWO of the following are characteristics of the YANG data modeling language that make it suitable for network automation? (Select two)

Accepted Answer

YANG defines data types and constraints. YANG is a data modeling language that defines the structure, syntax, and semantics of configuration and state data, including explicit data types (e.g., string, uint32) and constraints (e.g., range, pattern, mandatory). This strict typing and validation ensure that network devices receive well-formed data, reducing errors in automation workflows.

Answer

YANG is human-readable only

Answer

YANG is a markup language like XML

Answer

YANG supports both configuration and operational state data

Question 14

Which TWO tools are commonly used for automated network compliance checking against a desired state? (Select two)

Accepted Answer

Ansible. B is correct because Ansible is an automation tool that uses playbooks (YAML-based) to define a desired network state and can enforce compliance by comparing the current device configuration against the defined state using modules like `ios_config` or `nxos_config`. It is widely used for network compliance checking due to its agentless architecture and idempotent behavior.

Answer

SolarWinds

Answer

Microsoft Visio

Answer

Chef

Question 15

An automation engineer runs a Python script using the Cisco NXOS NX-API to retrieve the interface configuration. The JSON response shows the 'switchport access vlan' as '10'. However, VLAN 10 does not exist in the VLAN database. What is the expected behavior of the switch regarding this interface?

Accepted Answer

The interface will be operationally down. When a switchport is configured with an access VLAN that does not exist in the VLAN database, the interface remains administratively up but is placed in an operationally down state. This occurs because the switch cannot forward traffic for a non-existent VLAN, and the interface will not transition to a forwarding state until the VLAN is created. The NX-API response reflects the configured VLAN ID, but the operational status is determined by the VLAN's existence.

Answer

The interface will work but traffic will be dropped

Answer

The switch will automatically create the VLAN

Answer

The interface will be error-disabled

Question 16

A developer is using Python requests library to interact with a Cisco IOS XE device's REST API. The call returns a 400 Bad Request status. The payload is correctly formatted JSON. What is the most likely cause?

Accepted Answer

The authentication credentials are missing or incorrect in the request header. A 400 Bad Request status from a Cisco IOS XE REST API indicates a client-side error, typically related to malformed syntax or missing required elements. Since the JSON payload is confirmed as correctly formatted, the most likely cause is missing or incorrect authentication credentials in the request header, as the API requires valid credentials (e.g., Basic Auth with username:password encoded in Base64) to process the request. Without proper authentication, the server rejects the request with a 400 status before even evaluating the payload.

Answer

The device's API service is not enabled

Answer

The requested URL path is incorrect

Answer

The JSON payload contains a syntax error

Question 17

A Python script sends the above REST API request to a Cisco Catalyst 9000 switch running IOS XE. The response is a 400 Bad Request. Which field is most likely missing from the JSON payload?

Accepted Answer

interface. The REST API request is targeting the creation of a network interface on a Cisco Catalyst 9000 switch running IOS XE. The 400 Bad Request indicates a missing required field in the JSON payload. According to the Cisco IOS XE REST API documentation for the `/api/v1/interface` endpoint, the `interface` field (which specifies the interface name, e.g., 'GigabitEthernet1/0/1') is mandatory when creating a new interface. Without it, the API cannot determine which interface to configure, resulting in a 400 error.

Answer

vlanId

Answer

description

Answer

name

Question 18

A network engineer attempts to use RESTCONF to retrieve the running configuration of a Cisco IOS XE device. The GET request to '/restconf/data/Cisco-IOS-XE-native:native' returns a 405 Method Not Allowed error. What is the most likely cause?

Accepted Answer

RESTCONF is not enabled or the YANG module is not supported.. A 405 Method Not Allowed error indicates that the HTTP method (GET) is not supported for the requested resource. In RESTCONF, this typically occurs when the RESTCONF service is not enabled on the device or the specific YANG module (Cisco-IOS-XE-native) is not supported or loaded. Without the service or module, the server cannot process the GET request for the running configuration.

Answer

The API key provided is invalid.

Answer

The request body was malformed.

Answer

The device does not support HTTPS.

Question 19

A network automation engineer uses Ansible to manage a group of Cisco IOS XE devices. The playbook fails with 'unreachable' for some devices. Which TWO actions should the engineer take to troubleshoot the connectivity?

Accepted Answer

Use the 'ios_command' module to test connectivity.. The 'ios_command' module can be used to verify basic connectivity by sending a simple command (e.g., 'show version') to the device. If the module returns a response, it confirms that Ansible can reach the device and that the credentials are valid, isolating the issue to the specific task or playbook logic rather than connectivity.

Answer

Increase the timeout value in the playbook.

Answer

Ignore the unreachable devices and proceed.

Answer

Check if SNMP is enabled on the devices.

Question 20

A NETCONF RPC reply indicates a validation failure. Based on the exhibit, what is the most probable reason for the failure?

Accepted Answer

The MTU value provided is outside the allowed range.. The NETCONF RPC reply indicates a validation failure, which typically occurs when the data being configured does not conform to the YANG model's constraints. In this context, the MTU value provided is outside the allowed range defined in the YANG model for the interface, triggering a validation error before any configuration is applied.

Answer

The XML syntax in the edit operation was malformed.

Answer

The XML namespace 'Cisco-IOS-XE-native' is not supported.

Answer

The NETCONF session timed out before the operation completed.