350-401 Automation Practice Test 4 — 15 Questions

Question 1

A network engineer is using a Python script with the requests library to send a RESTCONF PATCH request to a Cisco IOS XE device. The script receives an HTTP 400 Bad Request response. The engineer confirms the URL is correct and the device supports RESTCONF. Which two actions should the engineer take to resolve the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the Content-Type header is set to 'application/yang-data+json'.. HTTP 400 Bad Request in RESTCONF typically stems from a malformed request body or incorrect headers. The Content-Type header must be 'application/yang-data+json' for JSON payloads, and the PATCH body must conform to the YANG data model with all mandatory nodes present. These two fixes address the most common causes of a 400 response when the URL and service availability are already confirmed.

Answer

Verify that the device's RESTCONF API is enabled with 'restconf' and that the correct port 443 is used.

Answer

Use the 'Accept' header with 'application/yang-data+json' to specify the desired response format.

Answer

Change the HTTP method to POST and include an 'If-Match' header with the ETag value.

Question 2

A network engineer is using the Cisco SD-WAN vManage API to retrieve a list of all devices in the overlay. The engineer sends a GET request to https://vmanage.example.com/dataservice/device and receives a 403 Forbidden response. The engineer is using a valid username and password with the 'basic' authentication method. Which action should the engineer take to successfully retrieve the device list?

Accepted Answer

Include a valid X-XSRF-TOKEN header obtained from a previous authentication request.. The vManage API uses session-based authentication with CSRF protection. After logging in via /j_security_check, the server returns a session cookie and an XSRF token. All subsequent API requests must include the X-XSRF-TOKEN header with that token. A 403 Forbidden indicates the token is missing or invalid. The engineer should extract the token from the login response and include it in the request headers. The other options do not address the CSRF requirement.

Answer

Change the request method from GET to POST.

Answer

Switch to using OAuth 2.0 authentication instead of basic authentication.

Answer

Ensure the user account has the 'admin' role in vManage.

Question 3

A network engineer is building a Python script to query the operational state of interfaces on a Cisco IOS XE device using RESTCONF. The engineer needs to ensure the request is sent with the correct HTTP method and headers to retrieve configuration data. Which action should the engineer take?

Accepted Answer

Send a GET request with the Accept header set to application/yang-data+json.. To retrieve data via RESTCONF, a GET request must be used. The Accept header tells the server what media type the client expects in the response. For JSON-encoded YANG data, the correct media type is application/yang-data+json. This combination ensures the operational state is returned in a parseable format.

Answer

Send a GET request with the Content-Type header set to application/yang-data+json.

Answer

Send a PUT request with the Accept header set to application/yang-data+xml.

Answer

Send a POST request with the Content-Type header set to application/yang-data+json.

Question 4

A network engineer is developing a Python script to configure OSPF on a Cisco IOS XE router using RESTCONF. The script sends a PATCH request to the URI /restconf/data/Cisco-IOS-XE-ospf:ospf-processes with a JSON payload. The device returns HTTP 400 Bad Request. The engineer verifies that the URI is correct and that the JSON is well-formed. Which is the most likely cause of the error?

Accepted Answer

The Content-Type header is set to application/xml instead of application/yang-data+json.. A 400 Bad Request in RESTCONF often stems from incorrect headers. The Content-Type must be application/yang-data+json for JSON payloads. If it is set to application/xml, the server cannot parse the JSON, resulting in a 400 error. The other options are less likely given the symptoms and the engineer's verification of URI and JSON validity.

Answer

The HTTP method should be PUT instead of PATCH for creating a new OSPF process.

Answer

The URI is missing the data store identifier, such as /restconf/data/ietf-restconf:data/.

Answer

The device does not support the Cisco-IOS-XE-ospf YANG model in its software version.

Question 5

A network engineer writes a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script connects successfully but when it sends a RPC with source , the device returns an error indicating the requested data is not available. The engineer verifies that the NETCONF service is enabled and the SSH connection is working. What is the most likely cause of the error?

Accepted Answer

The RPC requires a element to specify which portions of the configuration to retrieve; without it, some IOS XE versions return an error.. The NETCONF RPC on Cisco IOS XE commonly requires a filter element to define the scope of the configuration data being requested. Without a filter, some IOS XE versions cannot process the request and return an error or no data. Adding a subtree or XPath filter that specifies the desired configuration branch resolves the issue and allows the engineer to retrieve the running configuration successfully.

Answer

The NETCONF username must be configured with privilege level 15 and the 'netconf-yang' feature must be enabled, otherwise <get-config> returns an error.

Answer

The NETCONF session must be established over TLS instead of SSH for <get-config> operations.

Answer

The engineer must use instead of because only works with the startup datastore on IOS XE.

Question 6

A network administrator needs to securely retrieve configuration data from a Cisco IOS XE router using a programmatic interface that supports YANG models and uses SSH as the transport. The administrator wants to filter the response to only the interface description fields. Which protocol and operation should be used?

Accepted Answer

NETCONF with a operation and a subtree filter on the interface description node. NETCONF uses SSH as its transport and operates on YANG-modeled data. The operation retrieves configuration from a specified datastore, and a subtree filter restricts the response to only the requested nodes, such as interface descriptions. This combination satisfies the need for secure SSH transport, YANG support, and targeted filtering of configuration data.

Answer

SNMP with a GETBULK request against the ifDescr OID

Answer

RESTCONF with a GET request and a fields query parameter

Answer

NETCONF with a <get> operation and an XPath filter on the running datastore

Question 7

A network automation engineer is comparing NETCONF and RESTCONF for managing Cisco IOS XE devices. Which two statements correctly describe differences between these protocols? (Choose two.)

Accepted Answer

RESTCONF supports JSON encoding, while NETCONF only supports XML.. NETCONF and RESTCONF differ primarily in transport and encoding. NETCONF uses SSH and XML, while RESTCONF uses HTTP/HTTPS and supports both JSON and XML. These differences influence tool selection and integration with web services. Understanding these distinctions is essential for choosing the right protocol for automation tasks.

Answer

NETCONF provides transactional capabilities with candidate datastores, while RESTCONF does not support transactions.

Answer

RESTCONF uses YANG models, while NETCONF does not.

Answer

NETCONF requires a separate port for each operation, while RESTCONF uses a single port.

Question 8

A network engineer is using the Cisco SD-WAN vManage API to automate device onboarding. The engineer writes a Python script that sends a POST request to the /dataservice/device endpoint with a JSON payload containing device details. The script receives an HTTP 403 Forbidden response. The engineer verifies that the username and password are correct. What is the most likely cause?

Accepted Answer

The vManage API requires a session token obtained via /dataservice/client/token, which must be included in the X-XSRF-TOKEN header.. The vManage API enforces token-based authentication. After a successful login, the server issues a session token that must be sent in the X-XSRF-TOKEN header for all subsequent API calls. Omitting this token results in HTTP 403 Forbidden, even with valid credentials. This is a common pitfall in vManage automation. The other options describe issues that would produce different errors or are less likely given the scenario.

Answer

The script must use HTTPS instead of HTTP to connect to the vManage API.

Answer

The JSON payload is missing the required 'deviceIP' field, causing the server to reject the request.

Answer

The user account lacks the necessary RBAC permissions to onboard devices.

Question 9

A network engineer is designing a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must perform a PUT request to replace the configuration of an interface. Which two headers are required in the HTTP request to ensure successful processing? (Choose two.)

Accepted Answer

Accept: application/yang-data+json. For RESTCONF operations with JSON payloads, the Content-Type header must be set to application/yang-data+json to indicate the format of the request body. The Accept header should also be set to application/yang-data+json to request the response in the same format. These headers ensure proper parsing and formatting.

Answer

Authorization: Basic <base64-credentials>

Answer

Accept: application/xml

Answer

Content-Type: application/json

Question 10

A network engineer is designing a Python script to interact with a Cisco IOS XE device using NETCONF. The script uses the ncclient library and establishes a connection over SSH. The engineer wants to retrieve the configured hostname of the device. Which YANG model and filter should be used to accomplish this task?

Accepted Answer

Use the ietf-system YANG model with a subtree filter for the 'hostname' leaf.. The ietf-system YANG model is a standard model that includes the hostname as a leaf under the system container. Using a subtree filter to select that leaf retrieves the configured hostname. This approach is vendor-neutral and supported on Cisco IOS XE devices that implement the IETF system model. Other models either do not contain hostname or are vendor-specific.

Answer

Use the Cisco-IOS-XE-native YANG model with an XPath filter for '/native/hostname'.

Answer

Use the ietf-netconf-monitoring YANG model with a filter for 'hostname'.

Answer

Use the ietf-interfaces YANG model with a subtree filter for the 'interfaces' container.

Question 11

A network automation engineer is using the YANG Suite tool to explore YANG models on a Cisco IOS XE device. The engineer wants to retrieve the operational state of all interfaces using NETCONF. After selecting the ietf-interfaces module and building a get RPC, the response includes only configuration data, not operational state. What should the engineer do to obtain the operational state?

Accepted Answer

Use the get RPC with a filter that selects the ietf-interfaces:interfaces-state container.. The ietf-interfaces model separates configuration and operational state into different containers: interfaces and interfaces-state. The get RPC retrieves both, but without a filter, it may return only configuration or the default view. To get operational state, the filter must target interfaces-state. The other options either use the wrong RPC or suggest unnecessary protocol changes.

Answer

Switch to RESTCONF and send a GET request to /restconf/data/ietf-interfaces:interfaces-state.

Answer

Add a filter to the get RPC to include the 'oper-status' leaf under interfaces.

Answer

Use the get-config RPC with a filter on the interfaces container.

Question 12

A network automation team is using a YANG model to configure a Cisco IOS XE device via RESTCONF. The team notices that when they send a PATCH request to update an interface description, the request succeeds, but the description is not applied. They verify that the JSON payload is correctly formatted and the URI is correct. What is the most likely reason for this behavior?

Accepted Answer

The device is using a YANG model that does not support the 'description' leaf under the interface, despite the URI being valid.. A successful RESTCONF PATCH response does not always guarantee that the configuration was applied. If the targeted leaf is not supported by the device's YANG model for that specific interface, the server may silently ignore it or return a success without modification. The engineer should validate the YANG model schema for the interface and ensure the leaf is supported. Checking the device's operational data can confirm whether the change took effect.

Answer

The JSON payload is missing the 'ietf-interfaces:interface' container, so the leaf is not correctly targeted.

Answer

The PATCH request is using the 'merge' operation, but the YANG model requires the 'replace' operation for this leaf.

Answer

The RESTCONF PATCH method is not supported for configuration data; only PUT and POST are allowed.

Question 13

A network automation team is using Ansible to manage a large number of Cisco IOS XE devices. They want to ensure that their playbooks are idempotent and can be run repeatedly without causing unintended changes. A playbook uses the 'ios_config' module to enforce a set of banner commands. After the first run, the playbook reports changes; on subsequent runs, it reports no changes. However, the team notices that the banner text on the devices includes an extra line with the delimiter 'EOF' that they did not intend. Which Ansible module parameter should they use to ensure the exact banner text is applied without the delimiter?

Accepted Answer

src. The 'src' parameter in the ios_config module allows loading a configuration from a file, which can include the banner with the exact delimiter. When using inline 'lines', the module may add the delimiter automatically or mishandle multiline commands. By using a source file, the engineer can specify the banner exactly as desired, including the delimiter, and ensure it is applied correctly. This approach provides precise control and avoids unintended additions.

Answer

backup

Answer

match

Answer

lines

Question 14

A network automation team is deploying a Python script that must retrieve interface statistics from a Cisco IOS XE device using the RESTCONF API. The script sends a GET request to https://<device>/restconf/data/ietf-interfaces:interfaces and receives an HTTP 401 Unauthorized response. The team wants to resolve this issue without disabling security. Which two actions should the team take? (Choose two.)

Accepted Answer

Configure the HTTP client to include a valid username and password using Basic authentication.. The HTTP 401 Unauthorized response indicates that the RESTCONF request lacks valid authentication credentials. The team must provide valid credentials, typically via Basic authentication, and ensure the user account has sufficient privilege (level 15) to access the RESTCONF API. Without both, the request will continue to fail even if the API is enabled and reachable.

Answer

Enable the RESTCONF API on the device with the 'restconf' command under global configuration.

Answer

Configure an ACL to permit TCP port 443 from the management station to the device.

Answer

Ensure the request includes the 'Accept: application/yang-data+json' header.

Question 15

A network engineer is designing a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. The script must authenticate with a username and password, and the device requires that credentials be sent securely. The engineer wants to ensure that the authentication mechanism is not vulnerable to replay attacks. Which authentication method should be used?

Accepted Answer

Basic authentication over HTTPS. RESTCONF on Cisco IOS XE uses HTTPS as the transport and supports HTTP Basic authentication, where credentials are sent in the Authorization header. When used over HTTPS, the credentials are encrypted by TLS, preventing eavesdropping. Although Basic authentication does not inherently prevent replay attacks, the combination with TLS and proper certificate validation provides a secure channel. Other options like OAuth or SNMPv3 are not natively supported for RESTCONF authentication on IOS XE.

Answer

SNMPv3 with authPriv

Answer

SSH key-based authentication

Answer

OAuth 2.0 with JWT tokens