200-901 Infrastructure and Automation — Timed 40 Questions

Question 1

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

Accepted Answer

Ansible. Ansible is the correct tool because it is an agentless automation platform that uses SSH to push configuration changes, such as VLAN deployment, to network devices. It allows engineers to define the desired state of VLANs in YAML playbooks and apply them consistently across multiple switches without manual intervention.

Answer

NetFlow

Answer

Syslog

Answer

SNMP

Question 2

A DevOps team wants to version control their network configurations. Which tool should they use?

Accepted Answer

Git. Git is a distributed version control system that tracks changes in source code and configuration files, making it the ideal tool for version controlling network configurations. Unlike configuration management tools, Git provides commit history, branching, and rollback capabilities specifically designed for version control.

Answer

Puppet

Answer

Jenkins

Answer

Docker

Question 3

During an automation script run, a network device returns HTTP 429. What does this indicate?

Accepted Answer

Rate limiting. HTTP 429 (Too Many Requests) indicates the client has sent too many requests in a given amount of time, triggering rate limiting on the server. In network automation, devices like routers or switches enforce rate limits to prevent resource exhaustion, often based on RFC 6585. This is common when automation scripts exceed API call thresholds, requiring retry logic with exponential backoff.

Answer

Internal server error

Answer

Authentication failure

Answer

Resource not found

Question 4

A network automation engineer is writing a Python script to configure multiple devices. Which library is most appropriate for SSH-based interactions?

Accepted Answer

Netmiko. Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It provides high-level methods for sending commands, handling prompts, and managing device interactions, making it the most appropriate choice for automating configuration tasks across multiple devices.

Answer

requests

Answer

socket

Answer

paramiko

Question 5

In a CI/CD pipeline for network changes, which practice best ensures that a configuration push does not disrupt production traffic?

Accepted Answer

Canary deployment. Canary deployment is the correct practice because it gradually introduces the configuration change to a small subset of devices or traffic before full rollout. This allows monitoring for adverse effects and automatic rollback if issues arise, minimizing the risk of production disruption. In a CI/CD pipeline for network changes, this approach aligns with incremental validation and risk mitigation.

Answer

Disable rollback

Answer

Push all changes at once

Answer

Skip validation

Question 6

An engineer uses Ansible to push a configuration change to 100 switches. The playbook fails on 5 switches. What is the most efficient way to apply the change only to those 5?

Accepted Answer

Use Ansible's --limit with the retry file. Ansible generates a retry file by default when a playbook fails on some hosts. Using `--limit @<retry-file>` re-runs the playbook only against the failed hosts, avoiding unnecessary execution on the 95 successful switches. This is the most efficient method because it targets only the problematic devices without manual intervention or full re-runs.

Answer

Use --skip-tags on successful hosts

Answer

Re-run the playbook on all switches

Answer

Manually configure the 5 switches

Question 7

Which protocol is commonly used to retrieve real-time telemetry data from network devices in a streaming fashion?

Accepted Answer

gRPC. gRPC is correct because it is designed for high-performance, real-time streaming of telemetry data using HTTP/2 and Protocol Buffers. Network devices like Cisco IOS XR and NX-OS use gRPC to push telemetry data to collectors in a continuous stream, eliminating the need for polling and reducing latency.

Answer

SNMP polling

Answer

NETCONF

Answer

HTTP

Question 8

A company uses a centralized automation server that runs Ansible playbooks. What is the best security practice for storing SSH credentials?

Accepted Answer

Use Ansible Vault. Ansible Vault is the recommended security practice for encrypting sensitive data like SSH credentials. It allows you to store encrypted variables and files within your playbooks or inventory, protecting secrets at rest while enabling decryption at runtime via a password or key file. This avoids exposing credentials in plain text, which is critical for centralized automation servers that may be accessed by multiple users or integrated into CI/CD pipelines.

Answer

Store credentials in a public repository

Answer

Hardcode credentials in playbooks

Answer

Use plain text inventory files

Question 9

In a network automation workflow, a developer needs to ensure idempotency. What does idempotency mean in this context?

Accepted Answer

Running the script once produces the same result as running it multiple times. Idempotency in network automation means that executing an operation multiple times results in the same network state as executing it once. For example, using a REST API PUT request to set a VLAN configuration will leave the device in the same state whether the request is sent once or repeatedly, because PUT is inherently idempotent. This prevents unintended side effects like duplicate VLANs or interface misconfigurations when a script is retried due to network failures or timeouts.

Answer

The script uses a single API call

Answer

The script can recover from failures

Answer

The script can run on multiple devices simultaneously

Question 10

An engineer is tasked with automating the backup of running configurations from 50 routers. Which approach is most scalable?

Accepted Answer

Use an Ansible playbook with ios_config backup. An Ansible playbook with the ios_config module's backup option is the most scalable approach because it uses a push-based automation model that can manage all 50 routers from a single control node, leveraging SSH for secure transport and idempotent configuration management without requiring any agent on the routers.

Answer

SSH manually to each router and copy config

Answer

Schedule a cron job on each router to SCP config

Answer

Use SNMP to capture config

Question 11

Which data format is most commonly used in REST API requests and responses in modern network automation?

Accepted Answer

JSON. JSON (JavaScript Object Notation) is the most commonly used data format in REST API requests and responses for modern network automation because it is lightweight, language-agnostic, and natively supported by most programming languages and network devices. REST APIs typically use JSON over HTTP due to its ease of parsing, compact structure, and alignment with web development practices, making it the de facto standard for exchanging structured data in automation workflows like those with Cisco NSO, Ansible, or Python scripts.

Answer

YAML

Answer

XML

Answer

CSV

Question 12

Which TWO of the following are characteristics of a declarative automation model? (Select exactly 2.)

Accepted Answer

You specify the desired end state. In a declarative automation model, you specify the desired end state of the system, not the steps to achieve it. This is a core characteristic because the automation tool (e.g., Ansible, Terraform, Puppet) interprets the desired state and determines the necessary actions to reach it, making option B correct.

Answer

It requires procedural scripts

Answer

Idempotency is not a concern

Answer

You specify the exact steps to achieve the state

Question 13

Which THREE of the following are best practices for writing Ansible playbooks for network automation? (Select exactly 3.)

Accepted Answer

Include a validation task after configuration changes. Option B is correct because after applying configuration changes via modules like `ios_config` or `junos_config`, a validation task (e.g., using `wait_for` or `assert` to verify operational state) ensures the device is reachable and the changes took effect before proceeding. This prevents cascading failures in multi-device playbooks and aligns with network automation best practices for reliability.

Answer

Run all tasks without checking for errors

Answer

Hardcode device IPs in the playbook

Question 14

Which TWO of the following are benefits of using NETCONF over SNMP for network automation? (Select exactly 2.)

Accepted Answer

Structured data models (YANG). Option A is correct because NETCONF uses YANG (RFC 6020/7950) to define structured, hierarchical data models, enabling consistent and predictable configuration and state data retrieval. This contrasts with SNMP's flat MIB structure, which is less flexible for complex automation tasks. Option D is correct because NETCONF supports candidate configurations and confirmed commits (RFC 6241, Section 8.4), allowing transactional changes that can be validated and rolled back atomically, whereas SNMP lacks built-in transaction support.

Answer

Lower CPU usage on devices

Answer

Binary data encoding

Answer

Simple polling mechanism

Question 15

Which THREE of the following are valid methods to handle API rate limiting in a Python automation script? (Select exactly 3.)

Accepted Answer

Parse the Retry-After header from the response. Option A is correct because the Retry-After header is a standard HTTP mechanism (defined in RFC 7231) that explicitly tells the client how long to wait before making the next request. Parsing this header allows your Python script to respect the server's rate limit dynamically, rather than using a fixed or arbitrary delay. This is a common pattern when interacting with REST APIs that enforce rate limiting.

Answer

Sleep for a fixed amount of time between requests

Answer

Ignore the limit and send requests faster

Question 16

Refer to the exhibit. An automation script expects the interface IP address to be configured via DHCP. Based on the output, what is the current configuration source for the IP address?

Accepted Answer

Manual configuration (NVRAM). The output shows 'IP address is 192.168.1.1, subnet mask is 255.255.255.0' with no DHCP or BOOTP flags, and the configuration is stored in NVRAM (startup-config). This indicates the IP was manually configured (typed by an administrator) and saved, not obtained via DHCP. Option C is correct because the source is manual configuration from NVRAM.

Answer

DHCP

Answer

BOOTP

Answer

PPP negotiation

Question 17

Refer to the exhibit. A Python script uses the YANG model to configure the interface. After applying this JSON payload via a PATCH request, what is the expected operational state of the interface?

Accepted Answer

Administratively down. The PATCH request applies the provided JSON payload, which sets the interface's 'enabled' leaf to 'false' (or equivalent YANG leaf for administrative state). In YANG models for interfaces (e.g., RFC 8343 or Cisco native models), setting 'enabled' to false places the interface in an administratively down state. The PATCH operation is valid for modifying interface configuration, and the payload explicitly changes the administrative state to down, overriding any previous configuration.

Answer

Error because PATCH is not allowed on interfaces

Answer

No change, remains as previously configured

Answer

Administratively up and protocol up

Question 18

Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?

Accepted Answer

Wrong SSH username or password. The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.

Answer

The device is unreachable

Answer

The playbook syntax is incorrect

Answer

The device is not running IOS

Question 19

You are a network automation engineer at a large enterprise. The network consists of 200 Cisco Catalyst switches distributed across five data centers. Each switch runs IOS-XE and supports NETCONF. Your team uses a centralized Ansible control node to manage configurations. Recently, the security team mandated that all management access must use SSH keys instead of passwords. You updated the Ansible inventory to use SSH keys and tested on a few switches successfully. However, when you run the playbook against all switches, about 30 switches fail with the error: 'Authentication failed.' You verify that the SSH public key is correctly deployed on those switches via the console. What is the most likely cause of the failure?

Accepted Answer

The private key file on the Ansible control node has permissions 644, which SSH rejects. SSH strictly requires private key files to have permissions no more permissive than 600 (owner read/write) or 640 (owner read/write, group read) on Unix-like systems. A permission of 644 allows group and others to read the key, which SSH interprets as insecure and refuses to use, causing 'Authentication failed' even though the public key is correctly deployed on the switches.

Answer

The public key on the switches is not in the correct format

Answer

The Ansible become method is misconfigured

Answer

The switches are not reachable over the network

Question 20

You are automating the deployment of a new software image on a fleet of Cisco Nexus switches using Ansible. The switches are in a production environment and must have minimal downtime. You have a maintenance window of 30 minutes per switch. Your playbook performs the following steps: 1) Copy the image to the switch via SCP, 2) Set the boot variable to the new image, 3) Save the configuration, 4) Reload the switch. During a dry run on a test switch, you notice that the reload step takes 8 minutes, but the copy step takes 15 minutes due to slow link speed. For the production rollout, you need to reduce the overall time per switch. Which approach should you take?

Accepted Answer

Use a local file server with HTTP for image transfer to improve speed. Option B is correct because the bottleneck is the SCP copy time (15 minutes), which exceeds the 30-minute maintenance window when combined with the reload (8 minutes). Using HTTP for image transfer leverages a more efficient protocol with better throughput and lower overhead than SCP, which uses SSH encryption and can be slower on low-bandwidth links. This directly reduces the copy time, bringing the total per-switch time under the maintenance window limit.

Answer

Skip the save configuration step to save time

Answer

Use a compressed image to reduce copy time

Answer

Reload all switches simultaneously in the same maintenance window