350-401 Automation Practice Test 6 — 15 Questions

Question 1

An organization uses Cisco DNA Center to automate network provisioning. A network engineer deploys a new access switch but finds that the switch does not receive the intended configuration template. The switch appears in DNA Center inventory with status 'Managed'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch is not assigned to a site. In Cisco DNA Center, configuration templates are applied based on site assignment. A switch that appears as 'Managed' in inventory has been discovered and is under DNA Center's control, but if it is not assigned to a specific site, DNA Center cannot determine which template to push. Site assignment is a prerequisite for template-based provisioning; without it, the intended configuration will not be deployed.

Answer

The switch has not been discovered by DNA Center

Answer

The switch is not in Plug and Play mode

Answer

The switch does not have a valid DNA license

Question 2

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

Accepted Answer

Run ssh-add on the control node to add the private key to the SSH agent. The error 'Permission denied (publickey)' indicates that the SSH key is not being presented to the IOS device. Running ssh-add on the control node loads the private key into the SSH agent, which Ansible uses by default when connecting via SSH. This resolves the authentication failure without requiring a passphrase or changing the inventory.

Answer

Set ansible_ssh_private_key_file in the inventory but omit the passphrase

Answer

Set ansible_user to the correct username in the inventory

Answer

Enable keyboard-interactive authentication on the IOS devices

Question 3

A company uses Cisco Catalyst Center (formerly DNA Center) for intent-based networking. After upgrading the Catalyst Center appliance, the engineer notices that some devices are unreachable via the network, but the Catalyst Center GUI shows them as 'Managed'. What is the most likely cause?

Accepted Answer

The IP address of the Catalyst Center appliance changed after the upgrade. When the Catalyst Center appliance is upgraded, its IP address may change if the upgrade process resets network configuration or if the appliance is redeployed with a new IP. Devices are managed via IP-based communication (e.g., SSH, SNMP, NETCONF), and if the Catalyst Center IP changes, devices will still show as 'Managed' in the GUI because the database retains the device state, but the devices themselves cannot be reached because they are trying to communicate with the old IP address. This mismatch causes unreachability despite the managed status.

Answer

SNMP community strings are misconfigured

Answer

Devices were reassigned to different roles

Answer

Certificate trust between devices and Catalyst Center expired

Question 4

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The device's SSH server is not fully initialized. The error 'ValueError: SSH session not active' indicates that Netmiko attempted to establish an SSH connection but the session was not fully active. The most likely cause is that the device's SSH server is not fully initialized, which can happen if the device is still booting or the SSH process has not completed startup. This is distinct from reachability or credential issues, as the device responds to pings but the SSH daemon is not ready to accept connections.

Answer

The connection timeout is set too low

Answer

The device has reached the maximum number of SSH sessions

Answer

The device requires an enable password but none was provided

Question 5

A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?

Accepted Answer

Chef client. In a Chef-managed brownfield environment with Cisco IOS XE devices, the Chef client is the agent that runs on each device (or on a proxy like a guest shell) and applies the desired state defined in cookbooks. It is responsible for converging the device's configuration to match the policy, making it the correct component for state management.

Answer

Ohai

Answer

Chef workstation

Answer

Chef server

Question 6

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Accepted Answer

DNA Center uses a declarative model for network configuration.. Option C is correct because Cisco DNA Center is built around intent-based networking, where administrators define the desired end state (intent) declaratively and DNA Center translates that intent into device-level configurations, rather than requiring per-device imperative command sequences. Option D is correct because DNA Center offers a centralized, single-pane-of-glass dashboard that unifies assurance, monitoring, automation, and policy management across the fabric, giving one management view for the network. Options A, B, and E are not correct: DNA Center does not primarily rely on SNMP for management (it uses APIs such as REST, NETCONF, and SSH/CLI for automation and telemetry), it supports both greenfield and brownfield deployments rather than only greenfield, and it does not use an imperative model as its core configuration approach.

Answer

DNA Center primarily uses SNMP to manage devices.

Answer

DNA Center only supports greenfield deployments.

Answer

DNA Center uses an imperative model for network configuration.

Question 7

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Accepted Answer

description. In a YANG module for interface configuration, the 'description' leaf (option B) is a standard attribute used to set a human-readable interface description via the CLI equivalent 'description '. The 'mtu' leaf (option C) is also standard, representing the interface Maximum Transmission Unit, commonly configured with 'mtu ' and modeled in YANG as an unsigned integer. The 'ip address' node (option D) is included to assign an IPv4 address and subnet mask to an interface, typically modeled as a container or list with 'address' and 'prefix-length' leaves. Option A, 'switchport mode', is a Layer 2 switching attribute found in vendor-specific or Cisco YANG models (e.g., Cisco IOS XE native model) but is not a generic interface configuration attribute in standard IETF YANG models like ietf-interfaces. Option E, 'mac address', is usually a read-only operational state or a hardware-assigned value, not a typical configurable attribute in a YANG interface configuration module.

Answer

switchport mode

Answer

mac address

Question 8

A company has a large network of 500 Cisco IOS XE routers and switches spread across multiple sites. The network team wants to automate the collection of interface statistics every hour and store them in a central database for historical analysis. The team has a Linux server with Python 3 and access to all devices via SSH with key-based authentication. They have written a Python script using Netmiko to connect to each device, run 'show interfaces', and parse the output to extract key metrics (e.g., input/output errors, packets per second). The script works correctly when tested on a small subset of devices, but when run against all 500 devices, it takes too long (over 2 hours) and sometimes fails due to SSH connection timeouts. The team needs to reduce the execution time and improve reliability. Which approach should they take?

Accepted Answer

Implement multiprocessing or multithreading in the Python script to connect to devices concurrently. The primary bottleneck is sequential SSH connections to 500 devices. By using Python's multiprocessing or multithreading (e.g., concurrent.futures.ThreadPoolExecutor), the script can open multiple SSH sessions in parallel, drastically reducing total wall-clock time. Netmiko itself is not the issue; the serial execution pattern causes the 2-hour runtime and timeouts, which concurrent connections resolve by overlapping I/O wait times.

Answer

Reduce the collection frequency to every 4 hours

Answer

Replace Netmiko with SNMP polling using the pysnmp library

Answer

Use Ansible playbooks instead of a custom Python script

Question 9

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook runs successfully on most switches, but one switch fails with an error indicating that the VLAN configuration command is not recognized. What is the most likely cause?

Accepted Answer

The switch runs a different IOS version with different VLAN CLI syntax. The most likely cause is that the switch runs a different IOS version with different VLAN CLI syntax. Ansible executes commands via SSH, and if the switch expects a different command format (e.g., 'vlan 10' vs. 'vlan database' on older CatOS), the playbook will fail with a command-not-recognized error. This is a common issue when automating across heterogeneous network devices.

Answer

Ansible lacks the appropriate module for VLAN configuration

Answer

The inventory file has a syntax error for that specific host

Answer

SSH connectivity to the switch is blocked by an ACL

Question 10

A DevOps team is implementing a CI/CD pipeline that automates network configuration changes. Which design principle is most important to ensure that a failed deployment does not cause prolonged outages?

Accepted Answer

Ensure the automation framework supports rollback to a known good state. In a CI/CD pipeline for network automation, the ability to roll back to a known good state is the most critical design principle for minimizing downtime. If a deployment fails (e.g., a misapplied ACL or BGP configuration), the automation framework must be able to revert the network device to its previous stable configuration—often by reapplying a saved startup config or using a tool like Ansible's `network_backup` role or Cisco NSO's rollback mechanism. Without this, a failed deployment could leave the network in a broken state until manual intervention, causing prolonged outages.

Answer

Use a single source of truth for all configurations

Answer

Implement idempotent configuration scripts

Answer

Run the deployment in a lab environment first

Question 11

A network engineer is troubleshooting an automated configuration change that caused a routing loop. The change was pushed via an Ansible playbook that modified OSPF cost values on multiple routers simultaneously. What is the most likely reason for the loop?

Accepted Answer

The changes were applied simultaneously without allowing OSPF to converge between updates. Applying OSPF cost changes simultaneously on multiple routers without allowing convergence between updates can cause transient routing loops. OSPF relies on the SPF algorithm to calculate loop-free paths based on consistent link-state databases across the network. When costs are changed on multiple routers at once, some routers may have outdated LSAs, leading to inconsistent forwarding tables and temporary loops until all routers reconverge.

Answer

OSPF does not support changing costs on multiple routers at the same time

Answer

OSPF uses hop count as a metric, and the changes caused a count-to-infinity issue

Answer

The OSPF cost values were changed to non-standard values that OSPF cannot process

Question 12

An organization uses Chef to manage network device configurations. A cookbook that configures SNMP community strings is applied to a group of routers. After the run, one router loses SNMP access. The cookbook uses the following resource: snmp_community 'public' do action :remove end. What is the most likely cause of the issue?

Accepted Answer

The cookbook removed the only configured SNMP community string. The `snmp_community 'public' do action :remove end` resource explicitly removes the SNMP community string named 'public'. If 'public' was the only SNMP community string configured on the router, its removal would leave the router with no valid SNMP community, causing all SNMP access to be lost. Chef applies the resource as defined; the issue is not a syntax error or misapplication of a different string, but the direct consequence of removing the sole community.

Answer

The router's Chef client encountered a syntax error and stopped mid-execution

Answer

The cookbook accidentally applied a 'private' community string instead of 'public'

Answer

The cookbook is not idempotent and reapplied the change multiple times

Question 13

Which TWO statements about NETCONF and YANG are true?

Accepted Answer

YANG is a data modeling language used to define the structure of configuration and state data. YANG (RFC 7950) is a data modeling language specifically designed to define the structure of configuration and state data, as well as notifications and RPCs, for network devices. It provides a hierarchical, schema-based representation of data that can be serialized into XML or JSON, making it the standard for modeling NETCONF and RESTCONF datastores.

Answer

NETCONF sessions are stateless

Answer

YANG defines both the data model and the RPC operations for network devices

Answer

NETCONF uses TLS as the mandatory transport protocol

Question 14

Which THREE benefits does network automation provide over manual configuration?

Accepted Answer

Reduced risk of configuration errors. Network automation eliminates human error during repetitive configuration tasks. By using tools like Ansible, Python scripts, or NETCONF/YANG models, configurations are applied consistently without typos or missed commands, which are common in manual CLI entry. This directly reduces the risk of syntax errors, missing parameters, or inconsistent settings that can lead to network outages.

Answer

Increased security by eliminating the need for SSH access

Answer

Lower initial investment compared to manual processes

Question 15

A large enterprise uses a centralized automation platform based on Ansible Tower to manage its network infrastructure. The network consists of 500 Cisco IOS XE routers and switches distributed across multiple sites. The automation team has created a playbook that configures BGP peerings on all devices. The playbook uses the ios_bgp module. Recently, during a maintenance window, the playbook was run against a subset of devices that were supposed to be upgraded to a new IOS XE version. However, after the run, several devices lost their BGP configurations entirely. The team discovers that the new IOS XE version introduced a new BGP configuration model that is not fully compatible with the ios_bgp module's expected CLI commands. The playbook failed silently on those devices, and the existing BGP configuration was removed. The team needs to prevent this from happening in future maintenance windows. Which action should be taken?

Accepted Answer

Add a pre-task that validates the device's OS version and conditionally applies the appropriate module or command set. It directly addresses the root cause: the new IOS XE version uses an incompatible BGP configuration model. By adding a pre-task that validates the OS version, the playbook can conditionally apply the correct module (e.g., ios_bgp for older versions or a different module/CLI for the new model), preventing silent failures and configuration loss. This ensures the automation adapts to version-specific changes, maintaining idempotency and safety.

Answer

Implement idempotency checks in the playbook using the 'check_mode' option

Answer

Set 'gather_facts: no' in the playbook to speed up execution and avoid version detection issues

Answer

Replace the ios_bgp module with the ios_config module and use raw CLI commands for BGP configuration