200-901 Infrastructure and Automation Practice Test 8 — 15 Questions

Question 1

Which tool is specifically designed for model-driven programmability using YANG data models?

Accepted Answer

NETCONF. NETCONF is the correct answer because it is a network management protocol specifically designed to operate with YANG data models, using XML or JSON encoding to transport configuration and state data. YANG defines the structure of the data, and NETCONF provides the operations (get, edit-config, etc.) to manipulate that data in a model-driven, programmatic way. This makes NETCONF the standard tool for model-driven programmability in modern network automation.

Answer

SNMP

Answer

CLI

Answer

Ansible

Question 2

A network team is implementing automation to provision new switchports across a campus network. They decide to use a controller-based approach with Cisco DNA Center. What is the primary advantage of using DNA Center for this task?

Accepted Answer

It allows intent-based automation where the desired state is defined and the controller pushes the necessary configuration.. Cisco DNA Center uses an intent-based networking model where the administrator defines the desired state (e.g., 'provision a switchport for access VLAN 10') and the controller automatically translates that intent into the necessary device configurations (CLI or NETCONF/YANG). This abstraction reduces manual errors and enforces consistency across the campus network without requiring per-device CLI scripting.

Answer

It automatically rolls back any configuration that deviates from the standard.

Answer

It replaces all existing CLI commands with a graphical interface.

Answer

It eliminates the need for any human intervention in network management.

Question 3

An engineer is writing a Python script using the Cisco DevNet sandbox to configure OSPF on a CSR1000v via RESTCONF. What authentication method is typically used for RESTCONF requests?

Accepted Answer

Basic authentication over HTTPS. RESTCONF typically uses Basic authentication over HTTPS (RFC 7235) because it is a lightweight, stateless mechanism that sends a base64-encoded username:password pair in the Authorization header. In the Cisco DevNet sandbox CSR1000v environment, this is the standard method for authenticating RESTCONF requests, as the sandbox provides a username and password for access.

Answer

No authentication

Answer

OAuth2

Answer

API token only

Question 4

A company uses Ansible to automate network configuration. They have an Ansible control node that must reach all network devices. Which transport protocol does Ansible use by default to connect to Cisco IOS devices?

Accepted Answer

SSH. Ansible uses SSH as its default transport protocol to connect to Cisco IOS devices because SSH provides encrypted, secure remote access and is the standard for network device management in modern environments. Ansible's native architecture relies on SSH for agentless communication, executing modules and playbooks over this secure channel without requiring additional software on the target devices.

Answer

HTTP

Answer

Telnet

Answer

SNMP

Question 5

An engineer is troubleshooting a NETCONF session that fails to establish with a Cisco IOS XE device. The SSH connection succeeds, but NETCONF capabilities are not exchanged. What is the most likely cause?

Accepted Answer

The device's NETCONF server is not enabled.. NETCONF uses a client-server model where the server (the Cisco IOS XE device) must have the NETCONF server explicitly enabled. If the SSH transport succeeds but capabilities are not exchanged, it indicates the NETCONF subsystem is not active on the device. The `netconf-yang` feature must be enabled via `netconf-yang` in global configuration mode to start the NETCONF server and allow capability exchange.

Answer

The device requires authentication via SSH keys but password was used.

Answer

The firewall is blocking port 830.

Answer

The device is running an older IOS version that does not support NETCONF.

Question 6

A DevOps team uses a CI/CD pipeline to deploy network configurations. They want to ensure that only authorized network engineers can trigger changes to production devices. Which integration is most appropriate?

Accepted Answer

Implement Role-Based Access Control (RBAC) on the CI/CD tool. Role-Based Access Control (RBAC) on the CI/CD tool directly restricts which users or groups can trigger pipeline jobs that modify production network devices. This ensures that only authorized network engineers have the permissions to execute changes, aligning with the principle of least privilege in deployment pipelines.

Answer

Encrypt the Ansible vault password

Answer

Use a separate staging environment

Answer

Use a pre-commit hook in Git to validate YAML syntax

Question 7

An engineer is automating the configuration of SNMP on Cisco routers using Ansible. Which two modules are commonly used for this purpose? (Select TWO)

Accepted Answer

cisco.ios.ios_config. The cisco.ios.ios_config module is correct because it allows you to push raw CLI configuration lines to Cisco IOS devices, including SNMP-related commands like 'snmp-server community' or 'snmp-server host'. The cisco.ios.ios_snmp_server module is correct because it is a dedicated Ansible module that provides structured, idempotent management of SNMP server settings (e.g., communities, hosts, traps) without requiring raw CLI lines.

Answer

cisco.ios.ios_interface

Answer

cisco.ios.ios_command

Answer

cisco.ios.ios_banner

Question 8

A network automation solution uses YANG data models to describe network configurations. Which THREE statements about YANG are true? (Select THREE)

Accepted Answer

YANG can be used in conjunction with NETCONF and RESTCONF.. YANG is a data modeling language that defines the structure and constraints of configuration and state data, and it is designed to be used with NETCONF (RFC 6241) and RESTCONF (RFC 8040) as the transport protocols. This makes option A correct because YANG models are encoded in XML or JSON and exchanged via these protocols.

Answer

YANG models are always written in XML syntax.

Answer

YANG is a replacement for SNMP.

Question 9

A large enterprise uses Cisco DNA Center to manage their campus network. They have deployed fabric technology for SD-Access. The network team wants to use the DNA Center REST API to automate the addition of new wireless users to a specific virtual network (VN) based on their location (building). They have identified the API endpoint for creating a user device in the fabric. However, when they send a POST request with the appropriate JSON body, they receive a 400 Bad Request error. The JSON payload includes the mandatory fields for hostname, MAC address, and VN name. What is the most likely cause of the error?

Accepted Answer

The virtual network name provided does not exist in the fabric.. The 400 Bad Request error indicates that the server cannot process the request due to a client-side issue, such as invalid data in the payload. Since the mandatory fields (hostname, MAC address, VN name) are provided, the most likely cause is that the virtual network (VN) name does not match any existing VN in the fabric. DNA Center validates the VN name against its fabric configuration; if the VN is not defined, the API rejects the request with a 400 error.

Answer

The API call requires an authentication token that is missing or expired.

Answer

The MAC address format is incorrect (e.g., lowercase vs uppercase).

Answer

The user making the API call does not have sufficient privileges.

Question 10

An engineer needs to automate the deployment of VLAN configurations on a fleet of Cisco Catalyst 9000 switches running IOS-XE. The team uses Ansible Tower for automation. Which Ansible module should be used to push VLAN configuration idempotently?

Accepted Answer

ios_vlan. The ios_vlan module is purpose-built for idempotent VLAN management on Cisco IOS-XE devices. It ensures that a VLAN with the specified VLAN ID, name, and state (active/suspend) is present or absent without affecting other VLANs, making it the correct choice for automating VLAN deployment idempotently.

Answer

ios_command

Answer

ios_config

Answer

ios_interface

Question 11

Which TWO of the following are true about NETCONF capabilities as defined in RFC 6241?

Accepted Answer

The operation supports 'merge', 'replace', 'create', 'delete', and 'remove' operations.. RFC 6241 defines the operation with the 'merge', 'replace', 'create', 'delete', and 'remove' operations. These allow granular modification of configuration data, with 'merge' being the default behavior if no operation attribute is specified.

Answer

The <edit-config> operation replaces the entire configuration by default.

Answer

The :rollback-on-error capability is mandatory.

Answer

The <running> configuration datastore is optional.

Question 12

Based on the exhibit, what is the frequency of the telemetry subscription?

Accepted Answer

Every 500 milliseconds. The exhibit shows a telemetry subscription with a 'period' of 500, which in Cisco model-driven telemetry (MDT) is expressed in milliseconds. Therefore, the frequency is every 500 milliseconds, making option B correct.

Answer

Every 500 seconds

Answer

When the management connection is re-established

Answer

On-change only

Question 13

A large enterprise uses Cisco DNA Center to manage over 500 network devices across multiple sites. The network operations team wants to automate the validation of device compliance with a baseline configuration. They have a Python script that uses the Cisco DNA Center REST API to retrieve the device configuration and compare it against a golden configuration stored in a local file. Recently, the script started failing with a 401 HTTP response code when trying to authenticate. The team confirmed the username and password are correct and that the DNA Center server is reachable. The script uses the /api/system/v1/auth/token endpoint to obtain a token. Which of the following is the most likely cause of the 401 error?

Accepted Answer

The authentication token has expired and the script is not refreshing it.. The 401 HTTP response code indicates an authentication failure. Since the username and password are confirmed correct and the server is reachable, the most likely cause is that the script obtained a token earlier but is now using an expired token without refreshing it. Cisco DNA Center tokens have a configurable timeout (default 1 hour), and the script must re-authenticate or refresh the token before it expires.

Answer

The API endpoint requires a different HTTP method (e.g., POST vs GET).

Answer

The script is using an incorrect API version path (e.g., /v2 instead of /v1).

Answer

CORS (Cross-Origin Resource Sharing) is blocking the request.

Question 14

A junior developer is writing a Python script to gather interface statistics from a Cisco IOS-XE device using NETCONF. They use the 'ncclient' library and successfully connect. They want to retrieve the operational status of all interfaces. Which YANG model and XPATH expression should they use to get the operational data?

Accepted Answer

Model: ietf-interfaces, XPATH: /interfaces-state/interface. The 'ietf-interfaces' YANG model defines the '/interfaces-state' container specifically for operational state data (e.g., status, counters), as per RFC 7223. The XPATH '/interfaces-state/interface' retrieves the list of all interfaces with their operational status, which is exactly what the developer needs. The 'ncclient' library can filter using this XPATH to get read-only operational data from a NETCONF-enabled Cisco IOS-XE device.

Answer

Model: cisco-native, XPATH: /native/interface

Answer

Model: ietf-interfaces, XPATH: /interfaces/interface

Answer

Model: ietf-interfaces, XPATH: /interfaces-state

Question 15

Refer to the exhibit. A developer receives this response when making a POST request to the Cisco DNA Center API to create a new device. What is the most likely issue?

Accepted Answer

The request body is missing the required field 'ipAddress'.. The error response includes a field 'missingParameters' with the value 'ipAddress', which explicitly indicates that the request body did not include the required 'ipAddress' field. Cisco DNA Center's API for device creation requires this field to identify the device on the network. Without it, the API cannot proceed with adding the device, resulting in a 400 Bad Request.

Answer

The API endpoint is incorrect.

Answer

The device IP address is already in use.

Answer

The API token has expired.