350-401 Ansible Automation — 15 Questions

Question 1

A network engineer is automating the deployment of VLAN configurations on a set of Cisco IOS-XE switches using Ansible. The playbook uses the ios_vlans module and runs successfully on the first switch, but fails on the second switch with an error indicating that the module is not found. Both switches are running the same IOS-XE version and have the same management access configured. What is the most likely cause of this issue?

Accepted Answer

The cisco.ios collection is not installed on the Ansible control node.. The ios_vlans module is part of the cisco.ios collection, which must be installed on the Ansible control node, not on the managed devices. The error 'module not found' typically indicates the collection is missing or not properly referenced in the playbook. The switches themselves do not need to have the module installed.

Answer

The second switch does not have the ios_vlans module installed locally.

Answer

The second switch has a different SSH key that is not accepted by the Ansible control node.

Answer

The playbook uses a fully qualified collection name (FQCN) incorrectly.

Question 2

An engineer is writing an Ansible playbook to configure OSPF on a fleet of Cisco Nexus 9000 switches. The playbook uses the nxos_ospf module. When executed, the playbook reports 'changed' for every switch, even on subsequent runs when no configuration changes are made. The engineer wants to achieve idempotent behavior. What is the most likely cause of the non-idempotent results?

Accepted Answer

The playbook does not specify all OSPF parameters, such as 'router-id', causing the module to detect a difference with the running configuration.. The nxos_ospf module may report changes if the OSPF process configuration includes parameters that are not fully idempotent, such as the 'router-id' being set dynamically. However, a common cause is that the module compares the current state with the desired state, and if the switch returns extra default parameters (like 'log-adjacency-changes' or 'auto-cost') that are not specified in the playbook, the module may see a difference and report 'changed'. The most direct cause here is that the playbook does not specify all parameters that the module manages, leading to a mismatch.

Answer

The Ansible control node is using an outdated version of the nxos_ospf module that does not support idempotency.

Answer

The switches have different NX-OS versions, causing the module to behave inconsistently.

Answer

The engineer forgot to use the '--check' flag to verify idempotency.

Question 3

A network team uses Ansible Tower to manage configuration backups of 500 Cisco IOS routers. They have a playbook that uses the ios_config module with the 'backup: yes' option. Recently, backups started failing for a subset of routers, with errors like 'backup destination path does not exist'. The playbook uses a variable 'backup_dir' set in the Tower job template. What is the most likely cause of these failures?

Accepted Answer

The 'backup_dir' variable is not defined for those specific routers in their host_vars or group_vars, causing the playbook to use an undefined path.. The backup option in ios_config saves the backup file to a local directory on the Ansible control node. If the directory specified by 'backup_dir' does not exist on the control node, the module will fail. Since the error is specific to a subset of routers, it is likely that the variable is not being resolved correctly for those routers, possibly due to host_vars or group_vars overriding the job template variable.

Answer

The routers have insufficient storage space to save the backup locally.

Answer

The ios_config module requires the 'backup_options' sub-option to specify the directory, and the playbook is using the deprecated 'backup' parameter.

Answer

The routers are not reachable via SSH during the backup window.

Question 4

An engineer is automating the configuration of SNMPv3 on a large number of Cisco IOS-XE devices using Ansible. The playbook uses the ios_snmp_server module. The engineer wants to ensure that the SNMP configuration is applied only if the device is running a specific IOS version that supports SNMPv3. Which Ansible feature should the engineer use to conditionally execute the task?

Accepted Answer

Use the 'when' clause with a condition on the 'ansible_net_version' fact.. Ansible provides the 'when' clause to conditionally execute tasks based on variables or facts. The engineer can gather facts from the device (e.g., ansible_net_version) and use a 'when' condition to check the IOS version before applying the SNMP configuration.

Answer

Use the 'tags' feature to selectively run the SNMP task only on certain devices.

Answer

Use the 'register' directive to capture the output and then use 'failed_when' to skip the task.

Answer

Use the 'block' and 'rescue' structure to handle version mismatches.

Question 5

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Accepted Answer

The playbook uses 'direction: outbound' but the module expects 'direction: out'.. The ios_acl_interfaces module requires the direction to be specified in lowercase (e.g., 'out'). If the playbook uses 'outbound' instead of 'out', the module may not recognize the value and could default to 'in' or ignore the parameter. The module documentation clearly states the valid values are 'in' or 'out'.

Answer

The routers have a different IOS version that interprets 'outbound' as 'in'.

Answer

The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.

Answer

The ACL itself is defined with the wrong direction in the playbook.

Question 6

An organization uses Ansible to manage network device configurations. They have a playbook that uses the ios_command module to execute 'show ip route' on multiple routers and then uses the 'debug' module to print the output. Recently, the playbook started failing with 'Timeout (12s) waiting for privilege escalation prompt'. The routers are reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The 'ansible_connection' is set to 'network_cli' but the 'ansible_become_method' is not set to 'enable'.. The error 'Timeout waiting for privilege escalation prompt' indicates that Ansible is trying to enter enable mode (or similar) but is not receiving the expected prompt (usually '#'). This often happens when the 'ansible_become' method is not set correctly for network devices. For Cisco IOS, the become method should be 'enable', and the become password must be provided. If the become method is missing or set to 'sudo', the privilege escalation will fail.

Answer

The routers are configured with a different enable secret that does not match the one in the Ansible vault.

Answer

The SSH key exchange is taking longer than the default 12-second timeout.

Answer

The ios_command module requires a different privilege level to execute 'show ip route'.

Question 7

A network engineer is using Ansible to automate the deployment of a new VLAN on a Cisco Nexus switch. The playbook uses the nxos_vlan module. The engineer wants to ensure that if the VLAN already exists, the playbook does not make any changes (idempotent). However, the playbook always reports 'changed' even when the VLAN exists with the same configuration. What is a likely reason?

Accepted Answer

The playbook does not include the 'vlan_state' parameter, and the existing VLAN is in 'suspend' state, while the module defaults to 'active'.. The nxos_vlan module compares the desired state with the current state. If the playbook specifies parameters that the module does not fully manage or if the switch returns additional default parameters (e.g., 'state: active' vs 'state: suspend'), the module may detect a difference. A common cause is that the playbook does not specify the 'vlan_state' parameter, and the module defaults to 'active', but if the switch has the VLAN in a different state (e.g., 'suspend'), the module will report 'changed'.

Answer

The playbook uses the 'vlan_id' parameter but not the 'name' parameter, causing the module to ignore the name mismatch.

Answer

The nxos_vlan module is not idempotent by design and always reports changes.

Answer

The engineer is using the '--diff' flag, which forces the module to report changes.

Question 8

A company uses Ansible to manage the configuration of 1000 Cisco IOS routers. They have a playbook that uses the ios_config module with the 'src' parameter pointing to a Jinja2 template. The playbook runs successfully for months, but after a recent IOS upgrade on a subset of routers, the playbook fails with 'ERROR! Syntax error while loading YAML script'. The template has not been changed. What is the most likely cause?

Accepted Answer

The IOS upgrade changed the output of a 'show' command that is used to set a fact, and that fact now contains characters that break YAML syntax.. The error 'Syntax error while loading YAML script' suggests that the playbook itself has a YAML syntax issue, not the template. However, if the template is included in the playbook via a variable that contains special characters, it could cause a YAML parsing error. But since the template hasn't changed, the most likely cause is that the IOS upgrade changed the output of a command that is used to generate a fact, and that fact is now being passed to the template in a way that breaks YAML. Alternatively, the playbook might be using a 'vars_prompt' or 'set_fact' that now produces invalid YAML.

Answer

The Jinja2 template now contains syntax errors because the IOS upgrade changed the configuration requirements.

Answer

The ios_config module is incompatible with the new IOS version.

Answer

The playbook file was corrupted during the IOS upgrade process.

Question 9

An engineer is using Ansible to automate the configuration of NTP on a group of Cisco IOS-XE switches. The playbook uses the ios_ntp module. The engineer wants to ensure that the NTP configuration is applied only to switches that are in the 'core' group, not the 'access' group. The inventory file defines these groups. Which Ansible feature should the engineer use to restrict the playbook to the 'core' group?

Accepted Answer

Set the 'hosts' field in the play to 'core' instead of 'all'.. Ansible playbooks can target specific groups by specifying the group name in the 'hosts' field of the play. This is the simplest and most direct way to restrict execution to a particular inventory group.

Answer

Use the 'when' clause to check if the switch is in the 'core' group using the 'group_names' variable.

Answer

Use the 'limit' option when running the ansible-playbook command to specify the 'core' group.

Answer

Define a variable in the 'core' group and use 'vars_prompt' to ask the engineer which group to run on.

Question 10

A network engineer writes the following Ansible playbook to configure an interface on a Cisco IOS-XE device:

---
- hosts: routers
  gather_facts: no
  tasks:
    - name: Configure interface
      cisco.ios.ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
        parents: interface GigabitEthernet0/1

What is the issue with this playbook?

Accepted Answer

The playbook will fail because the 'cisco.ios.ios_config' module requires the 'connection: network_cli' parameter in the play or inventory.. The playbook uses the cisco.ios.ios_config module but does not specify the provider or connection details. In Ansible 2.9+, the connection type must be set to 'network_cli' or the module will fail. The correct answer identifies this missing connection parameter.

Answer

The playbook will work correctly because the module automatically detects the device type.

Answer

The playbook will fail because 'cisco.ios.ios_config' is not a valid module name.

Answer

The playbook will work but only if the device is running IOS-XE 16.9 or later.

Question 11

A Python script using Netmiko is written to send a command to a Cisco router:

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
    'secret': 'enable'
}

connection = ConnectHandler(**device)
connection.enable()
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()

What is the potential issue with this script?

Accepted Answer

The script lacks exception handling for authentication or connection failures, which can cause the script to crash.. The script does not handle authentication failures or connection timeouts. If the device is unreachable or credentials are wrong, the script will throw an unhandled exception and crash. The correct answer identifies the lack of exception handling.

Answer

The script will fail because 'device_type' should be 'cisco_ios_telnet' for telnet connections.

Answer

The script will work correctly without any issues.

Answer

The script will fail because 'secret' is misspelled; it should be 'enable_secret'.

Question 12

A REST API call is made to Cisco DNA Center to get the list of network devices:

GET /dna/intent/api/v1/network-device
Headers:
  X-Auth-Token: <token>

The response is:

{
  "response": [
    {
      "id": "123456",
      "managementIpAddress": "10.10.10.1",
      "platformId": "C9300-24P",
      "role": "ACCESS"
    }
  ],
  "version": "1.0"
}

What does this response indicate?

Accepted Answer

The response contains a single device with management IP 10.10.10.1 and role ACCESS.. The response shows a list of devices; each device has an id, management IP, platform ID, and role. The correct answer correctly interprets the JSON structure.

Answer

The response indicates an error because the 'version' field is missing a value.

Answer

The response contains multiple devices, but only one is shown due to pagination.

Answer

The response requires authentication because the token is missing.

Question 13

An Ansible playbook uses the cisco.nxos.nxos_config module to configure a Nexus switch:

---
- hosts: nxos_switches
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure VLAN
      cisco.nxos.nxos_config:
        lines:
          - vlan 100
          - name Test_VLAN
        parents: vlan 100

What will be the result of this playbook?

Accepted Answer

The playbook will fail because the 'parents' parameter cannot be the same as the lines.. The playbook attempts to configure VLAN 100 with a name. However, the 'parents' parameter is incorrectly set to 'vlan 100', which is the same as the lines being configured. This can cause idempotency issues or errors because the module may try to enter the same configuration mode again. The correct answer identifies this logical error.

Answer

The playbook will successfully create VLAN 100 and set its name to Test_VLAN.

Answer

The playbook will fail because 'cisco.nxos.nxos_config' does not support VLAN configuration.

Answer

The playbook will work but only if the Nexus switch runs NX-OS 7.0 or later.

Question 14

A Python script uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device:

from napalm import get_network_driver

driver = get_network_driver('ios')
device = driver('192.168.1.1', 'admin', 'cisco')
device.open()
arp_table = device.get_arp_table()
print(arp_table)
device.close()

What is the issue with this script?

Accepted Answer

The script will fail because the driver name 'ios' is incorrect; it should be 'iosxe' for IOS-XE devices.. The NAPALM driver for IOS-XE is 'ios' but the correct driver for IOS-XE is 'iosxe'. Using 'ios' may work for some devices but is deprecated. The correct answer identifies the driver name mismatch.

Answer

The script will work correctly because 'ios' is the correct driver for all Cisco IOS devices.

Answer

The script will fail because the 'get_arp_table()' method requires an argument.

Answer

The script will work but only if the device is running IOS-XE 16.12 or later.

Question 15

A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics:

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1
Accept: application/yang-data+json

Response:

{
  "ietf-interfaces:interface": [
    {
      "name": "GigabitEthernet1",
      "type": "iana-if-type:ethernetCsmacd",
      "enabled": true,
      "ietf-ip:ipv4": {
        "address": [
          {
            "ip": "192.168.1.1",
            "netmask": "255.255.255.0"
          }
        ]
      }
    }
  ]
}

What does the response indicate about the interface?

Accepted Answer

The interface GigabitEthernet1 is enabled and has an IPv4 address of 192.168.1.1/24.. The response shows the interface configuration, including its name, type, enabled status, and IPv4 address. The correct answer correctly interprets the JSON structure.

Answer

The interface is disabled because the 'enabled' field is missing.

Answer

The response indicates an error because the interface type is incorrect.

Answer

The response shows that the interface has no IP address configured.