200-901 Infrastructure and Automation Practice Test 4 — 15 Questions

Question 1

A network automation engineer is writing a Python script to configure multiple devices. Which library is most appropriate for SSH-based interactions?

Accepted Answer

Netmiko. Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It provides high-level methods for sending commands, handling prompts, and managing device interactions, making it the most appropriate choice for automating configuration tasks across multiple devices.

Answer

requests

Answer

socket

Answer

paramiko

Question 2

In a CI/CD pipeline for network changes, which practice best ensures that a configuration push does not disrupt production traffic?

Accepted Answer

Canary deployment. Canary deployment is the correct practice because it gradually introduces the configuration change to a small subset of devices or traffic before full rollout. This allows monitoring for adverse effects and automatic rollback if issues arise, minimizing the risk of production disruption. In a CI/CD pipeline for network changes, this approach aligns with incremental validation and risk mitigation.

Answer

Disable rollback

Answer

Push all changes at once

Answer

Skip validation

Question 3

An engineer uses Ansible to push a configuration change to 100 switches. The playbook fails on 5 switches. What is the most efficient way to apply the change only to those 5?

Accepted Answer

Use Ansible's --limit with the retry file. Ansible generates a retry file by default when a playbook fails on some hosts. Using `--limit @<retry-file>` re-runs the playbook only against the failed hosts, avoiding unnecessary execution on the 95 successful switches. This is the most efficient method because it targets only the problematic devices without manual intervention or full re-runs.

Answer

Use --skip-tags on successful hosts

Answer

Re-run the playbook on all switches

Answer

Manually configure the 5 switches

Question 4

A company uses a centralized automation server that runs Ansible playbooks. What is the best security practice for storing SSH credentials?

Accepted Answer

Use Ansible Vault. Ansible Vault is the recommended security practice for encrypting sensitive data like SSH credentials. It allows you to store encrypted variables and files within your playbooks or inventory, protecting secrets at rest while enabling decryption at runtime via a password or key file. This avoids exposing credentials in plain text, which is critical for centralized automation servers that may be accessed by multiple users or integrated into CI/CD pipelines.

Answer

Store credentials in a public repository

Answer

Hardcode credentials in playbooks

Answer

Use plain text inventory files

Question 5

In a network automation workflow, a developer needs to ensure idempotency. What does idempotency mean in this context?

Accepted Answer

Running the script once produces the same result as running it multiple times. Idempotency in network automation means that executing an operation multiple times results in the same network state as executing it once. For example, using a REST API PUT request to set a VLAN configuration will leave the device in the same state whether the request is sent once or repeatedly, because PUT is inherently idempotent. This prevents unintended side effects like duplicate VLANs or interface misconfigurations when a script is retried due to network failures or timeouts.

Answer

The script uses a single API call

Answer

The script can recover from failures

Answer

The script can run on multiple devices simultaneously

Question 6

An engineer is tasked with automating the backup of running configurations from 50 routers. Which approach is most scalable?

Accepted Answer

Use an Ansible playbook with ios_config backup. An Ansible playbook with the ios_config module's backup option is the most scalable approach because it uses a push-based automation model that can manage all 50 routers from a single control node, leveraging SSH for secure transport and idempotent configuration management without requiring any agent on the routers.

Answer

SSH manually to each router and copy config

Answer

Schedule a cron job on each router to SCP config

Answer

Use SNMP to capture config

Question 7

Which data format is most commonly used in REST API requests and responses in modern network automation?

Accepted Answer

JSON. JSON (JavaScript Object Notation) is the most commonly used data format in REST API requests and responses for modern network automation because it is lightweight, language-agnostic, and natively supported by most programming languages and network devices. REST APIs typically use JSON over HTTP due to its ease of parsing, compact structure, and alignment with web development practices, making it the de facto standard for exchanging structured data in automation workflows like those with Cisco NSO, Ansible, or Python scripts.

Answer

YAML

Answer

XML

Answer

CSV

Question 8

Which TWO of the following are characteristics of a declarative automation model? (Select exactly 2.)

Accepted Answer

You specify the desired end state. Option B is correct because a declarative automation model is defined by describing the desired end state (for example, a Terraform HCL resource block or an Ansible task declaring 'state: present'), and the tool then works out how to reach that state. Option D is correct because in declarative tools the engine itself determines execution order and resolves dependencies, such as Terraform building a dependency graph from resource references or Ansible handling task ordering and handlers. Option A is incorrect because procedural scripts are the hallmark of imperative, not declarative, automation. Option C is incorrect because idempotency is a core concern and benefit of declarative models, ensuring repeated runs converge to the same state without unwanted changes. Option E is incorrect because specifying exact steps is the defining trait of an imperative model, whereas declarative models specify the outcome, not the steps.

Answer

It requires procedural scripts

Answer

Idempotency is not a concern

Answer

You specify the exact steps to achieve the state

Question 9

Which TWO of the following are benefits of using NETCONF over SNMP for network automation? (Select exactly 2.)

Accepted Answer

Structured data models (YANG). Option A is correct because NETCONF uses YANG data models to define configuration and state data in a structured, hierarchical, vendor-neutral way, which is far more suitable for programmatic automation than SNMP's flat MIB/OID model. Option D is correct because NETCONF supports transactional configuration changes via candidate datastores, commit, confirmed-commit, and rollback-on-error, so a set of edits either fully applies or is rolled back, unlike SNMP SET operations which are not transactionally grouped. Option B is not a defining benefit of NETCONF over SNMP; NETCONF over SSH can actually be more resource-intensive than lightweight SNMP polling, and CPU usage depends on implementation. Option C is wrong because NETCONF typically uses XML (text) encoding, not binary encoding, while SNMP can use BER binary encoding. Option E is wrong because simple polling is characteristic of SNMP monitoring, whereas NETCONF is designed for configuration management and uses RPC-based sessions, not simple polling.

Answer

Lower CPU usage on devices

Answer

Binary data encoding

Answer

Simple polling mechanism

Question 10

Which THREE of the following are valid methods to handle API rate limiting in a Python automation script? (Select exactly 3.)

Accepted Answer

Parse the Retry-After header from the response. Option A is correct because the Retry-After header, returned with HTTP 429 (Too Many Requests) or 503 responses, tells the client exactly how many seconds to wait before retrying, making it a standards-based way to honor server-imposed rate limits. Option B is correct because a token bucket algorithm explicitly controls the request rate by issuing tokens at a defined rate and consuming one per request, allowing bursts up to the bucket capacity while preventing sustained over-limit traffic. Option E is correct because retry logic with exponential backoff progressively increases the delay between attempts (e.g., 1s, 2s, 4s, 8s, often with jitter), which reduces request pressure and avoids hammering an API that is throttling the client. Option C is not among the marked answers because a fixed sleep interval is a crude, static approach that does not adapt to the server's actual limit signals and can either waste time or still exceed the quota. Option D is clearly wrong because ignoring the limit and sending requests faster will trigger further 429 responses, potential IP bans, or account suspension rather than handling the rate limit.

Answer

Sleep for a fixed amount of time between requests

Answer

Ignore the limit and send requests faster

Question 11

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

Accepted Answer

Use an idempotent Ansible module that checks for existing VLANs before creating them.. Ansible's idempotent modules, such as `ios_vlan` for Cisco IOS devices, are designed to check the current state of the device before making changes. If the VLAN already exists, the module will report 'ok' and not attempt to create it again, preventing the error and ensuring the playbook completes successfully. This aligns with Ansible's best practice of writing idempotent playbooks that produce the same result regardless of how many times they are run.

Answer

Modify the playbook to skip switches where the VLAN already exists.

Answer

Remove the VLAN from all switches before creating it again.

Answer

Add ignore_errors: yes to the VLAN creation task.

Question 12

Which TWO statements accurately describe characteristics of infrastructure as code (IaC) in network automation?

Accepted Answer

IaC tools use declarative or imperative models to define the desired state of network infrastructure.. Option D is correct because IaC tools such as Terraform, Ansible, and Puppet/Chef operate on either declarative models (defining the desired end state, e.g., Terraform HCL) or imperative models (defining step-by-step commands, e.g., shell scripts), so both paradigms are valid ways to express the intended state of network infrastructure. Option E is correct because a core IaC practice is treating configuration as code: storing templates and playbooks in version control systems like Git, enabling peer review, diffing, and automated testing (e.g., CI pipelines, linters, and unit/integration tests) before pushing changes to production devices. Option A is wrong because IaC does not remove human review; change control, pull-request approvals, and validation remain essential safeguards even when automation applies the change. Option B is wrong because IaC manages existing physical and virtual devices via APIs, SSH, NETCONF, or CLI—it does not require replacing hardware with software equivalents. Option C is wrong because IaC applies broadly to physical routers, switches, firewalls, and other appliances, not only to virtual network functions.

Answer

IaC eliminates the need for manual review of configuration changes before deployment.

Answer

IaC requires that all network devices be replaced with software-based equivalents.

Answer

IaC is only applicable to virtual network functions, not physical devices.

Question 13

A DevOps team manages a hybrid cloud environment with on-premises Cisco Nexus switches and AWS VPCs using Terraform. They have a configuration management tool that pushes VLAN and interface configurations to the Nexus switches. Recently, they noticed that after a Terraform run that updates the AWS VPC subnets, some on-premises switches lose connectivity to the cloud. The team suspects a mismatch between the VLAN configurations on the Nexus switches and the AWS VPC subnets. They have a centralized source of truth stored in a Git repository containing YAML files for network definitions. Which action should the team take first to resolve the issue and prevent future occurrences?

Accepted Answer

Compare the Git repository's YAML definitions with the actual switch configurations and AWS VPC subnets, then correct any discrepancies.. The team's centralized source of truth in Git (YAML files) should be the authoritative reference for network definitions. By comparing these definitions against both the actual Nexus switch configurations and AWS VPC subnets, the team can identify and correct any drift or mismatch. This aligns with Infrastructure as Code (IaC) best practices, ensuring that all environments are synchronized from a single, version-controlled source before making any changes.

Answer

Restore the Nexus switch configurations from the most recent backup.

Answer

Modify the Terraform scripts to automatically update Nexus switches when AWS VPC subnets change.

Answer

Manually reconfigure the VLANs on the Nexus switches to match the AWS VPC subnets.

Question 14

Drag and drop the steps to configure OSPF on a Cisco router into the correct order.

Accepted Answer

1. Enable OSPF routing process (router ospf [process-id]). 2. Configure Router ID (router-id [id]). 3. Advertise networks (network [network] [wildcard] area [area]).. OSPF configuration requires enabling the OSPF process, setting a router ID, and advertising networks in specific areas.

Answer

1. Configure Router ID (router-id [id]). 2. Enable OSPF routing process (router ospf [process-id]). 3. Advertise networks (network [network] [wildcard] area [area]).

Answer

1. Enable OSPF routing process (router ospf [process-id]). 2. Advertise networks (network [network] [wildcard] area [area]). 3. Configure Router ID (router-id [id]).

Answer

1. Advertise networks (network [network] [wildcard] area [area]). 2. Enable OSPF routing process (router ospf [process-id]). 3. Configure Router ID (router-id [id]).

Question 15

Match each JSON data type to its example.

Accepted Answer

String: "hello". JSON supports basic data types: string (e.g., "hello"), number (e.g., 42), boolean (true/false), null, array, and object. Common confusions include misidentifying boolean values as strings or strings as numbers.

Answer

String: true

Answer

Number: "hello"