350-401 Automation Practice Test 13 — 15 Questions

Question 1

A network engineer is evaluating Cisco SD-WAN (Viptela) for a large enterprise. The engineer needs to automate the deployment of vEdge routers using zero-touch provisioning. Which two components are required to enable zero-touch provisioning for vEdge routers? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vManage NMS. Zero-touch provisioning for vEdge routers requires the vBond orchestrator and vManage. vBond authenticates the vEdge and provides the addresses of the other controllers. vManage then delivers the configuration. vSmart is not required for initial provisioning, though it is needed for control plane functionality. DNA Center and APIC-EM are unrelated to SD-WAN.

Answer

vSmart controller

Answer

APIC-EM

Answer

Cisco DNA Center

Question 2

A network engineer is using the Cisco SD-WAN vManage API to automate the creation of a new VPN template. The engineer sends a POST request to /dataservice/template/feature with a JSON body and receives an HTTP 400 Bad Request error. The JSON payload is syntactically valid. What is the most likely cause of this error?

Accepted Answer

The JSON payload contains a field value that violates the template schema, such as an invalid IP address format.. An HTTP 400 Bad Request from the vManage API indicates that the server cannot process the request due to client error, often because the JSON payload fails schema validation. Even with valid JSON syntax, incorrect field values or missing required attributes cause rejection. The engineer should validate the payload against the template schema and correct any semantic errors.

Answer

The API endpoint URL is incorrect and should include the '/template/feature' path without '/dataservice'.

Answer

The request must use HTTP instead of HTTPS because vManage does not support TLS for API calls.

Answer

The request is missing the 'X-XSRF-TOKEN' header required for CSRF protection.

Question 3

A network automation team is using NETCONF to configure a Cisco IOS XE device. They send an <edit-config> RPC with the default-operation set to 'merge'. The target configuration already has an interface GigabitEthernet0/1 with an IP address of 10.1.1.1/24. The RPC payload includes a new IP address of 10.1.1.2/24 for the same interface. What will be the result on the device?

Accepted Answer

The existing IP address will be replaced with the new IP address.. The NETCONF 'merge' operation (default-operation='merge') combines the RPC's configuration with the device's existing configuration. For a leaf node such as an IP address, which can only have one value, the merge results in the new value overwriting the old one. Therefore, the interface's IP address is replaced with 10.1.1.2/24. This behavior is consistent with the NETCONF RFC 6241, where merge updates existing data and creates new data as needed.

Answer

The interface will have both IP addresses configured as secondary addresses.

Answer

The device will ignore the new IP address and keep the existing one.

Answer

The RPC will fail with a 'data-exists' error because the IP address is already configured.

Question 4

A network engineer at a logistics company is building a Python script that must retrieve the running configuration of a Cisco IOS XE router without parsing CLI screen-scraping output. The engineer wants a programmatic, model-driven interface that returns structured data over HTTPS. Which approach best satisfies this requirement?

Accepted Answer

Use RESTCONF over HTTPS on TCP port 443 with the Accept header set to application/yang-data+json to read the configuration datastore.. RESTCONF is the IETF-defined protocol that exposes YANG-modeled data through HTTP methods and runs over HTTPS on port 443. By setting the Accept header to application/yang-data+json, the client receives JSON-encoded structured data instead of XML, avoiding CLI parsing entirely. NETCONF uses SSH on port 830, SNMP does not expose the configuration datastore, and Telnet screen-scraping is neither secure nor model-driven.

Answer

Use SNMPv3 with the get-bulk operation to walk the ifTable and reconstruct the running configuration from MIB objects.

Answer

Use NETCONF over an SSH subsystem on TCP port 830 and parse the XML reply for the running configuration datastore.

Answer

Use the Cisco IOS XE CLI over a Telnet session and capture the output of 'show running-config' with a regular expression parser.

Question 5

A network engineer is using the ncclient Python library to send NETCONF RPCs to a Cisco IOS XE device. The engineer wants to lock the running configuration datastore before making changes to prevent other NETCONF sessions from modifying it concurrently. Which NETCONF operation should be used?

Accepted Answer

with . NETCONF provides a operation to lock a datastore, preventing other sessions from modifying it. The element specifies the datastore to lock. On Cisco IOS XE, only the running datastore is supported, so the correct target is . Locking ensures that no other NETCONF session can edit the configuration until the lock is released with . This is essential for maintaining configuration integrity during automation.

Answer

Answer

Answer

with replace

Question 6

A network automation engineer is developing a Python script that will retrieve interface statistics from a Cisco IOS XE device using NETCONF. The engineer needs to discover which YANG models are supported by the device before constructing the RPC. Which NETCONF capability exchange message should the script send first to obtain this information?

Accepted Answer

Establish an SSH session and read the message sent by the device immediately after the NETCONF subsystem is started.. The NETCONF protocol requires a capability exchange during session establishment. The server sends a message containing a element that lists all supported YANG models and protocol features. The client must parse this message to discover available models before sending any RPCs. This is fundamental to NETCONF operation and is defined in RFC 6241.

Answer

Send a RESTCONF GET request to the /restconf/data/ietf-yang-library:modules-state endpoint.

Answer

Issue a NETCONF <get-config> RPC with a filter specifying the urn:ietf:params:xml:ns:yang:ietf-interfaces namespace.

Answer

Send an message with a operation targeting the ietf-netconf-monitoring model.

Question 7

A network engineer is using Ansible to manage a fleet of Cisco IOS XE devices. The engineer wants to ensure that the playbook is idempotent and only makes changes when necessary. The playbook uses the ios_config module with a set of lines to configure an interface. After running the playbook, the engineer notices that the task always reports 'changed' even when the configuration is already present. What is the most likely reason for this behavior?

Accepted Answer

One of the configuration lines contains a value that the device automatically modifies, such as a timestamp or a sequence number, causing a mismatch.. The ios_config module achieves idempotency by comparing the desired lines with the running configuration. If a line contains a value that the device automatically alters, such as a timestamp or a sequence number, the comparison will always show a difference, causing the task to report 'changed' and reapply the line. The engineer should remove or template such dynamic values to restore idempotency.

Answer

The Ansible control node is using an outdated version of the ios_config module that has a known bug with idempotency.

Answer

The playbook is using the 'lines' parameter without the 'parents' parameter, causing the module to miscompare the configuration.

Answer

The ios_config module does not support idempotency; it always applies the configuration and reports changed.

Question 8

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer needs to authenticate to the API. Which authentication method should be used to obtain a token for subsequent API calls?

Accepted Answer

POST to the /dna/system/api/v1/auth/token endpoint with Basic authentication.. The Cisco DNA Center Intent API uses token-based authentication. The client must POST to the /dna/system/api/v1/auth/token endpoint with Basic authentication credentials. The response includes a token that is then used in the X-Auth-Token header for subsequent API calls. This is the documented and required method for API access.

Answer

OAuth 2.0 client credentials grant flow.

Answer

API key passed in the X-Auth-Token header.

Answer

Basic authentication with username and password in the Authorization header.

Question 9

A healthcare provider runs a Python script that issues a RESTCONF PATCH to a Cisco IOS XE switch to modify an interface description. The device returns HTTP 400 with an error-tag of 'invalid-value'. The JSON body is syntactically valid and the URI targets the correct interface. Which action most directly resolves this error?

Accepted Answer

Correct the payload so the description node matches the YANG model's expected type and namespace, then resend the PATCH.. RESTCONF error-tags are diagnostic: 'invalid-value' points to a data value that violates the YANG model's constraints, such as a wrong type, an out-of-range number, or a leaf placed under the wrong namespace. Since the URI and method are correct and the JSON is syntactically valid, the remaining cause is the payload content. Correcting the value and its model placement makes the PATCH succeed.

Answer

Increase the RESTCONF request timeout on the client because the switch is slow to apply configuration changes.

Answer

Change the HTTP method from PATCH to GET and re-read the interface container before writing.

Answer

Add a Content-Type header of application/yang-data+xml while keeping the existing JSON body unchanged.

Question 10

A retail company wants its network engineers to push consistent OSPF configurations to dozens of Cisco IOS XE routers using a declarative, agentless automation tool that connects over SSH and does not require installing software on the managed devices. Which tool best fits these requirements?

Accepted Answer

Ansible, using modules such as ios_config with an inventory of IOS XE devices and SSH credentials.. Ansible is the agentless, declarative tool that connects over SSH and uses network-specific modules to configure Cisco IOS XE devices. It needs no software installed on the routers, relying instead on SSH and Python executed on the control node. Puppet, Chef, and SaltStack in their default forms require an agent on the managed node, which IOS XE cannot host, so they fail the stated agentless requirement.

Answer

Puppet, using a master-agent architecture with the Puppet agent installed on each IOS XE router.

Answer

Chef, using a Chef client installed directly on each Cisco IOS XE router to converge configuration.

Answer

SaltStack, using Salt minions installed locally on every IOS XE device to receive configuration commands.

Question 11

A network engineer is designing a Python script to interact with a Cisco Catalyst Center (formerly DNA Center) appliance using its Intent API. The script must retrieve a list of all network devices and then update the location of a specific device. Which two steps are required to authenticate and authorize the API requests? (Choose two.)

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with Basic Authentication credentials to obtain a token.. To authenticate with the Catalyst Center Intent API, the engineer must first obtain a token by sending a POST request to the authentication endpoint with Basic Authentication. Then, that token must be included in the X-Auth-Token header for all subsequent API calls. This two-step process ensures secure, token-based access to the API.

Answer

Configure a separate API user with role-based access control (RBAC) permissions to allow read and write operations.

Answer

Enable the Intent API on the Catalyst Center appliance by running the intent-api enable command in the CLI.

Answer

Include the username and password in every API request as query parameters.

Question 12

A network automation team is evaluating YANG as the data modeling language underpinning its Cisco IOS XE automation. Which two statements accurately describe YANG in this context? (Choose two.)

Accepted Answer

YANG modules can include constraints such as type, range, and pattern on leaves, and devices enforce these during configuration validation.. YANG is a hierarchical data modeling language that defines configuration and state schemas transported by NETCONF and RESTCONF. Its leaves carry constraints such as type, range, and pattern that devices validate on write, which is why model-driven automation is more robust than CLI scraping. YANG is an open standard, is not a transport itself, and its data can be encoded in XML or JSON depending on the protocol and media type.

Answer

YANG replaces the need for underlying transport protocols by embedding its own session and encryption layer for device communication.

Answer

YANG data can only be serialized as XML, so JSON payloads are invalid for any NETCONF or RESTCONF operation.

Answer

YANG models are proprietary to Cisco and cannot be extended or reused across different vendors' network operating systems.

Question 13

A network engineer is using the Cisco Catalyst Center (formerly DNA Center) Intent API to retrieve a list of all network devices. The engineer sends a GET request to /dna/intent/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token from /dna/system/api/v1/auth/token. What is the most likely reason for the 401 error?

Accepted Answer

The token must be included in the request header as 'X-Auth-Token: <token>'.. The Cisco Catalyst Center Intent API uses a custom authentication header named 'X-Auth-Token' to pass the token obtained from the authentication endpoint. Failure to include this header, or using a different scheme like Bearer, results in a 401 Unauthorized error. The engineer must set 'X-Auth-Token' with the token value in all subsequent API calls.

Answer

The token has expired and must be refreshed every 60 minutes.

Answer

The token must be URL-encoded before being placed in the header.

Answer

The API endpoint requires the token to be sent as a Bearer token in the Authorization header.

Question 14

A network engineer is using a Python script with the requests library to retrieve interface information from a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://192.168.1.1/restconf/data/ietf-interfaces:interfaces but receives a 401 Unauthorized error. The engineer has verified that the device has RESTCONF enabled and the URL is correct. Which action should the engineer take to resolve the error?

Accepted Answer

Include a valid username and password in the request using HTTP Basic Authentication.. A 401 Unauthorized error means the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires HTTP Basic Authentication. The engineer must include a valid username and password in the request headers. This is the correct and secure way to authenticate RESTCONF requests.

Answer

Enable the RESTCONF-YANG feature on the device using the restconf-yang command in global configuration mode.

Answer

Change the request method from GET to POST to retrieve the interface information.

Answer

Configure the device to allow unauthenticated access by adding the 'restconf no-auth' command.

Question 15

A financial services firm wants to automate configuration backups of 200 Cisco IOS XE switches. The team prefers an imperative, script-driven approach where Python code calls a structured API and stores the retrieved configuration in a version-controlled repository. Which method best aligns with this goal?

Accepted Answer

Write a Python script using the requests library to issue RESTCONF GET requests against each switch and save the JSON responses to files.. RESTCONF GET requests return model-driven, structured data over HTTPS, and Python's requests library can issue them programmatically from a central control host. Saving the structured responses to a repository supports version control and diffing. Guest shell Bash scripting, SNMP, and TFTP all either rely on CLI output, cannot retrieve full configurations, or lack structured API semantics, so they miss the stated goal.

Answer

Schedule a TFTP copy of the startup configuration from each switch to a central server using a cron job.

Answer

Use SNMP set operations to write the running configuration into a management server's MIB database.

Answer

Enable the Cisco IOS XE guest shell and run a Bash script that executes 'show running-config' on a schedule.