200-901 Infrastructure and Automation Practice Test 3 — 15 Questions

Question 1

A network administrator is tasked with automating the deployment of a new VLAN configuration across a fabric of Cisco ACI switches. Which automation tool is best suited for interacting with the APIC REST API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ansible. Ansible is the best-suited tool because it provides a dedicated module (cisco.aci.aci_rest) that directly interacts with the APIC REST API, allowing declarative automation of VLAN and other ACI configurations. Unlike generic scripting, Ansible abstracts the HTTP requests and handles idempotency, authentication, and error handling natively for the ACI fabric.

Answer

Bash scripting with curl

Answer

Chef

Answer

Puppet

Question 2

During a CI/CD pipeline for network changes, a Jenkins job runs an Ansible playbook that applies configuration to a device. The playbook fails with a timeout error. What is the most likely cause?

Accepted Answer

The device is under heavy CPU load causing slow responses. A timeout error in an Ansible playbook during a CI/CD pipeline typically indicates that the network device is responding too slowly to complete the SSH or API session within the configured timeout period. Heavy CPU load on the device can cause delayed responses to Ansible's control node, triggering the timeout before the playbook finishes applying the configuration. This is distinct from connectivity failures or authentication issues, which produce different error messages.

Answer

The playbook syntax is invalid

Answer

Incorrect credentials

Answer

Device is unreachable

Question 3

A developer writes a Python script using Cisco's pyATS framework to test network reachability after a configuration change. What is a key advantage of using pyATS over a simple script that uses ping?

Accepted Answer

pyATS allows writing reusable test scripts with built-in test libraries. PyATS is a test automation framework designed for network engineers, providing built-in test libraries (e.g., `pyats.aetest`) that enable writing reusable, modular test scripts. Unlike a simple ping script, pyATS supports structured test cases, data-driven testing, and integration with Cisco devices via libraries like `Genie`, allowing for comprehensive validation beyond basic reachability.

Answer

pyATS requires less code than a ping script

Answer

pyATS can test multiple devices in parallel

Answer

pyATS automatically generates test reports

Question 4

An organization implements zero-touch provisioning (ZTP) for new Cisco routers using DHCP and TFTP. The provision script is not being executed even though the device obtains an IP address. The DHCP server logs show the option 67 (bootfile-name) and option 150 (tftp-server) are set. What is the most probable reason?

Accepted Answer

The script file name in option 67 does not match the actual file on the TFTP server. The most common reason for a ZTP script not executing after a device obtains an IP address is a mismatch between the bootfile name specified in DHCP option 67 and the actual filename on the TFTP server. Even if the DHCP server logs show option 67 and 150 are set, the router will attempt to download the file specified in option 67; if that file does not exist or is named differently on the TFTP server, the download fails and the script is not executed.

Answer

The DHCP server is not authoritative

Answer

The TFTP server IP is unreachable from the router

Answer

The router does not support ZTP

Question 5

A network engineer uses Ansible to apply a standard ACL to multiple routers. The playbook runs without errors, but the ACL is not applied on some routers. Upon checking, those routers have a different configuration revision due to a previous manual change. What is the best practice to ensure consistent application?

Accepted Answer

Use the 'replace' parameter to overwrite the entire config. The 'replace' parameter in Ansible's ios_config module forces a full configuration replacement on the target device, overwriting the entire running configuration with the intended configuration. This ensures that any prior manual changes or configuration revisions are eliminated, guaranteeing consistent ACL application across all routers regardless of their current state.

Answer

Use the ansible_network_os variable correctly

Answer

Use the 'backup' option in ios_config

Answer

Use the 'ignore_errors' directive

Question 6

In a CI/CD pipeline for network automation, a change is rolled back using a Git revert commit that triggers a new pipeline. The rollback playbook fails because the 'previous' configuration snapshot is missing. What should be implemented to prevent this?

Accepted Answer

Store configuration backups in a version-controlled repository before each change. Storing configuration backups in a version-controlled repository before each change ensures that a known good state is available for rollback, even if subsequent changes occur.

Answer

Use a single source of truth like NetBox

Answer

Use the 'check mode' only

Answer

Disable rollback pipelines

Question 7

Which TWO of the following are characteristics of the YANG data modeling language that make it suitable for network automation? (Select two)

Accepted Answer

YANG defines data types and constraints. YANG is a data modeling language that defines the structure, syntax, and semantics of configuration and state data, including explicit data types (e.g., string, uint32) and constraints (e.g., range, pattern, mandatory). This strict typing and validation ensure that network devices receive well-formed data, reducing errors in automation workflows.

Answer

YANG is human-readable only

Answer

YANG is a markup language like XML

Answer

YANG supports both configuration and operational state data

Question 8

Which TWO tools are commonly used for automated network compliance checking against a desired state? (Select two)

Accepted Answer

Ansible. B is correct because Ansible is an automation tool that uses playbooks (YAML-based) to define a desired network state and can enforce compliance by comparing the current device configuration against the defined state using modules like `ios_config` or `nxos_config`. It is widely used for network compliance checking due to its agentless architecture and idempotent behavior.

Answer

SolarWinds

Answer

Microsoft Visio

Answer

Chef

Question 9

Which THREE practices help ensure idempotent network automation? (Select three)

Accepted Answer

Using the 'state' parameter in Ansible modules to define desired state. Using the 'state' parameter in Ansible modules (e.g., 'state: present' or 'state: absent') explicitly declares the desired end state of a resource. This allows the module to compare the current state against the desired state and only make changes if necessary, ensuring that running the playbook multiple times produces the same result without unintended side effects.

Answer

Running commands multiple times to ensure they are applied

Answer

Always appending new configuration commands to the running config

Question 10

An automation script using Ansible tries to configure IP address 192.168.1.2 on GigabitEthernet0/1. After running, the interface remains administratively down. What is the first thing to check?

Accepted Answer

The 'no shutdown' command was not included in the configuration. The 'no shutdown' command is required to administratively enable an interface on Cisco IOS devices. Without it, the interface remains in an administratively down state regardless of IP configuration. Ansible automation scripts must include this command in the task or playbook to bring the interface up.

Answer

The VLAN configuration

Answer

The IP address is a duplicate

Answer

The interface is faulty

Question 11

An automation engineer runs a Python script using the Cisco NXOS NX-API to retrieve the interface configuration. The JSON response shows the 'switchport access vlan' as '10'. However, VLAN 10 does not exist in the VLAN database. What is the expected behavior of the switch regarding this interface?

Accepted Answer

The interface will be operationally down. When a switchport is configured with an access VLAN that does not exist in the VLAN database, the interface remains administratively up but is placed in an operationally down state. This occurs because the switch cannot forward traffic for a non-existent VLAN, and the interface will not transition to a forwarding state until the VLAN is created. The NX-API response reflects the configured VLAN ID, but the operational status is determined by the VLAN's existence.

Answer

The interface will work but traffic will be dropped

Answer

The switch will automatically create the VLAN

Answer

The interface will be error-disabled

Question 12

A NETCONF manager sends a get-config request to a Cisco device and receives the above reply. The automation script expected the interface to be enabled. Which of the following is the best course of action to remediate the issue?

Accepted Answer

Send an edit-config request with true for the interface. NETCONF uses the edit-config operation to modify device configuration programmatically. Since the automation script detected that the interface is disabled (enabled state is false), sending an edit-config request with true for that interface directly remediates the issue by setting the operational state to enabled, aligning with the expected state without manual intervention.

Answer

Send an rpc to reboot the device

Answer

Use CLI to enable the interface manually

Answer

Send a get request again

Question 13

A network engineer wants to automate the configuration of multiple Cisco IOS devices using Ansible. What is the minimum requirement on the control node to execute Ansible playbooks against these devices?

Accepted Answer

A Linux or macOS control node with Python installed. Ansible uses a push-based architecture where the control node must be a Linux or macOS system with Python installed to execute playbooks. Python is required because Ansible itself is written in Python and relies on it for modules, SSH connections, and Jinja2 templating. No additional database, license, or dedicated management server is needed for basic network automation against Cisco IOS devices.

Answer

Ansible Tower license for automated network configuration

Answer

A PostgreSQL database to store inventory and credentials

Answer

A dedicated management server with Ansible Tower installed

Question 14

A developer is using Python requests library to interact with a Cisco IOS XE device's REST API. The call returns a 400 Bad Request status. The payload is correctly formatted JSON. What is the most likely cause?

Accepted Answer

The authentication credentials are missing or incorrect in the request header. A 400 Bad Request status from a Cisco IOS XE REST API indicates a client-side error, typically related to malformed syntax or missing required elements. Since the JSON payload is confirmed as correctly formatted, the most likely cause is missing or incorrect authentication credentials in the request header, as the API requires valid credentials (e.g., Basic Auth with username:password encoded in Base64) to process the request. Without proper authentication, the server rejects the request with a 400 status before even evaluating the payload.

Answer

The device's API service is not enabled

Answer

The requested URL path is incorrect

Answer

The JSON payload contains a syntax error

Question 15

A DevOps team manages network infrastructure using Infrastructure as Code (IaC). They store configuration files in a Git repository and use CI/CD to deploy changes. What is the best practice to ensure that only validated configurations are applied to production devices?

Accepted Answer

Require a pull request with at least one approval before merging to the main branch. Requiring a pull request with at least one approval before merging to the main branch enforces peer review and validation of configuration changes. This ensures that only code that has been reviewed for correctness, syntax, and adherence to standards is merged, preventing erroneous or malicious configurations from reaching production via the CI/CD pipeline.

Answer

Allow any team member to push directly to the main branch after testing locally

Answer

Use a manual approval gate in the CI/CD pipeline that requires manager sign-off

Answer

Automate the deployment of every commit directly to production