350-401 Automation Practice Test 9 — 15 Questions

Question 1

A network automation team is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The team writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script includes a valid authentication token in the headers, but the response returns a 403 Forbidden error. The token was obtained successfully using the /dna/system/api/v1/auth/token endpoint. What is the most likely reason for the 403 error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user account associated with the token does not have the necessary RBAC permissions to access the network device API.. In Cisco DNA Center, authentication tokens are obtained via the /dna/system/api/v1/auth/token endpoint. However, possessing a valid token does not guarantee access to all APIs. Each API endpoint requires specific RBAC permissions. A 403 Forbidden error indicates that the authenticated user does not have the required role or permission to access the network-device API. The team should verify the user's role and adjust RBAC settings accordingly.

Answer

The API endpoint requires a different HTTP method, such as POST.

Answer

The API request is missing the required 'X-Auth-Token' header.

Answer

The authentication token has expired and must be refreshed.

Question 2

A network engineer is developing a Python script that uses the requests library to send a RESTCONF PATCH request to a Cisco IOS XE device. The script includes the header 'Content-Type: application/yang-data+json' and sends a JSON payload to update the description of an interface. The device returns HTTP 400 Bad Request. Which is the most likely cause?

Accepted Answer

The JSON payload is not formatted according to the YANG model structure for the interface description.. An HTTP 400 Bad Request from a RESTCONF PATCH typically indicates that the request body does not conform to the YANG model structure. The payload must be correctly nested according to the model, such as including the module name and proper containers. The Content-Type is correct for RESTCONF JSON. The PATCH method is supported. Therefore, the most likely cause is a malformed JSON payload that violates the YANG model.

Answer

The PATCH method is not supported by RESTCONF; PUT should be used instead.

Answer

The Content-Type header should be 'application/json' instead of 'application/yang-data+json'.

Answer

The device does not support RESTCONF and requires NETCONF for configuration changes.

Question 3

A network engineer is implementing a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate using basic authentication over HTTPS and retrieve the configured hostname. Which Python code snippet correctly performs this task using the requests library?

Accepted Answer

import requests
url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)
hostname = response.json()['Cisco-IOS-XE-native:hostname']. The correct RESTCONF request must use the proper URL for the hostname leaf, set the Accept header to 'application/yang-data+json', provide basic authentication, and parse the response using the fully qualified key 'Cisco-IOS-XE-native:hostname'. The other options use the wrong URL, wrong header, wrong JSON key, or omit authentication.

Answer

import requests
url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)
hostname = response.json()['name']

Answer

import requests
url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, verify=False)
hostname = response.json()['Cisco-IOS-XE-native:hostname']

Answer

import requests
url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Content-Type': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)
hostname = response.json()['hostname']

Question 4

A network automation team is using the NETCONF protocol to manage a fleet of Cisco IOS XE devices. They need to ensure that configuration changes are applied atomically and that they can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities must be supported and used to achieve these requirements? (Choose two.)

Accepted Answer

:rollback-on-error. To achieve atomic configuration changes and rollback, the :candidate and :rollback-on-error capabilities are required. The :candidate capability enables editing a candidate datastore and committing changes atomically. The :rollback-on-error capability ensures that if any part of the commit fails, the entire transaction is rolled back. Together, they provide the transactional integrity and error recovery the team needs.

Answer

:validate

Answer

:startup

Answer

:writable-running

Question 5

A network engineer is designing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer needs to perform a partial modification of the interface description without affecting other configured parameters. Which two HTTP methods and payload considerations are appropriate for this task? (Choose two.)

Accepted Answer

Use the PATCH method with a JSON payload containing only the fields to be changed.. Partial modification of a RESTCONF resource is achieved with the PATCH method, which updates only the specified fields. Both JSON and XML payloads are supported, provided the Content-Type header matches the encoding. Using PUT would replace the entire resource, and POST or DELETE are not appropriate for modifying an existing leaf. Therefore, the two correct approaches are PATCH with JSON and PATCH with XML.

Answer

Use the POST method to create a new data node for the description under the interface.

Answer

Use the DELETE method to remove the existing description and then POST a new one.

Answer

Use the PUT method with a JSON payload containing only the fields to be changed.

Question 6

A network engineer is building a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate, retrieve interface configuration, and handle the response. Which two actions are required to successfully complete this task? (Choose two.)

Accepted Answer

Enable the RESTCONF agent on the device by entering the 'restconf' global configuration command and ensuring the HTTPS server is active.. Successful RESTCONF interaction requires enabling the RESTCONF agent and HTTPS server on the device, then issuing proper HTTP requests to the correct RESTCONF data URIs with appropriate media type headers. NETCONF libraries, SNMP settings, and client-side YANG tools do not enable or perform RESTCONF operations, so only enabling RESTCONF and using correct HTTP GET requests are required.

Answer

Configure the device with an SNMP community string so RESTCONF can authenticate the API session.

Answer

Use the 'ncclient' library to establish a NETCONF session on port 830 and then issue RESTCONF calls through that session.

Answer

Install the 'yangsuite' package on the IOS XE device to validate the RESTCONF payloads before sending them.

Question 7

A network engineer is using the YANG Suite tool to explore YANG models on a Cisco IOS XE device. The engineer wants to retrieve the operational state of all interfaces using NETCONF. The engineer sends a <get> RPC with a filter that selects the 'interfaces-state' container from the ietf-interfaces YANG module. The device returns an empty response. The engineer confirms that interfaces are up and running. What is the most likely reason for the empty response?

Accepted Answer

The 'interfaces-state' container is deprecated in favor of the 'interfaces' container with 'config false' nodes.. The ietf-interfaces YANG module has evolved. In RFC 8343, the 'interfaces-state' container was deprecated and its contents merged into the 'interfaces' container. State data is now represented as 'config false' nodes within the same tree. If a device implements the newer revision, a filter for 'interfaces-state' will not match any data, resulting in an empty response. The engineer should adjust the filter to target the 'interfaces' container and look for state nodes.

Answer

The ietf-interfaces YANG module is not supported by the device.

Answer

The NETCONF session is using the 'candidate' datastore, which does not contain operational data.

Answer

The filter is using the wrong namespace for the ietf-interfaces module.

Question 8

A network engineer is using Cisco SD-WAN vManage APIs to automate the deployment of a new branch site. The engineer needs to retrieve a list of all devices in the overlay network. Which REST API endpoint should the engineer use?

Accepted Answer

GET /dataservice/device. The vManage REST API provides the /dataservice/device endpoint to retrieve a list of all devices in the SD-WAN overlay. This endpoint returns details such as device IP, hostname, model, and status. It is the standard way to obtain device inventory for automation scripts. Other endpoints serve different purposes, such as templates or connections.

Answer

GET /dataservice/network/connections

Answer

GET /dataservice/template/device

Answer

GET /dataservice/system/device

Question 9

A network engineer is building a Python script to configure a Cisco IOS XE device via RESTCONF. The script sends a POST request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces with the JSON payload shown. The device returns HTTP 415 Unsupported Media Type. Which change to the script will resolve the error?

Accepted Answer

Add the header 'Content-Type: application/yang-data+json' to the request.. RESTCONF uses HTTP and requires standard headers to indicate payload format. When sending JSON, the Content-Type header must be set to application/yang-data+json. The server uses this to select the correct parser. Without it, the device returns 415 Unsupported Media Type, indicating it cannot process the body.

Answer

Add the header 'Accept: application/yang-data+json' to the request.

Answer

Include authentication credentials in the request body.

Answer

Change the HTTP method from POST to PUT.

Question 10

A network engineer is using Ansible to manage a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module to push a set of configuration lines. After running the playbook, the engineer notices that the configuration changes are not being saved to the startup configuration, and the devices revert to the previous configuration after a reboot. Which parameter should be added to the 'ios_config' task to ensure the running configuration is saved to the startup configuration?

Accepted Answer

save_when: always. The 'save_when' parameter with the value 'always' forces the ios_config module to save the running configuration to the startup configuration after every change. This ensures that configuration persists across reboots. Other parameters like 'backup', 'diff_against', and 'replace' serve different purposes and do not save the configuration. Thus, 'save_when: always' is the correct solution.

Answer

diff_against: startup

Answer

replace: config

Answer

backup: yes

Question 11

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices in the overlay network. The engineer writes a Python script that sends a GET request to https://vmanage-ip/dataservice/device but receives a 401 Unauthorized error. What is the most likely reason for this error?

Accepted Answer

The script has not obtained a valid session token via the /j_security_check endpoint.. The Cisco SD-WAN vManage REST API requires authentication via a session token. The client must POST credentials to /j_security_check to obtain a JSESSIONID cookie, which is then used in subsequent requests. Without this token, any request to protected endpoints like /dataservice/device returns 401 Unauthorized. The engineer must implement the authentication step before retrieving device data.

Answer

The script is missing the X-XSRF-TOKEN header.

Answer

The script is using the wrong HTTP method; it should use POST instead of GET.

Answer

The script is using HTTP instead of HTTPS.

Question 12

A network engineer is using the Cisco DNA Center Intent API to create a new site hierarchy. The engineer sends a POST request to /dna/intent/api/v1/site with a JSON payload defining the site. The API returns a 202 Accepted response with a task ID. What should the engineer do next to confirm the site was created successfully?

Accepted Answer

Use the task ID to poll the GET /dna/intent/api/v1/task/{taskId} endpoint until the task status is 'SUCCESS'.. When the DNA Center Intent API returns 202 Accepted, it means the request is being processed asynchronously. The response includes a task ID. The engineer must poll the task endpoint with that ID until the status indicates success. This ensures the site creation is complete before proceeding with dependent tasks.

Answer

Check the DNA Center audit logs to see if the site creation was logged.

Answer

Resend the POST request with the same payload to ensure the site is created.

Answer

Immediately send a GET request to /dna/intent/api/v1/site to verify the site exists.

Question 13

A network administrator wants to use a declarative, agentless automation tool to push VLAN configurations to a group of Cisco IOS XE switches. The tool should connect over SSH, use YAML playbooks, and require no software installation on the switches. Which tool best fits these requirements?

Accepted Answer

Ansible with the cisco.ios collection and an inventory of the switches. Ansible is the only option that is agentless, connects via SSH, and uses YAML playbooks. The cisco.ios collection supplies modules purpose-built for IOS XE VLAN and configuration management. Puppet, Chef, and SaltStack all generally require an agent on managed nodes, which cannot be installed on Cisco IOS XE switches, so they do not satisfy the agentless requirement.

Answer

SaltStack with minions deployed on each switch and states written in YAML

Answer

Chef Infra Client installed on each switch with recipes written in Ruby

Answer

Puppet with the Cisco IOS module installed on each switch

Question 14

A network automation team is designing a solution to manage configuration changes across a fleet of Cisco IOS XE devices. They want to use model-driven programmability with YANG data models. Which two protocols can be used to programmatically retrieve and modify configuration using YANG models on these devices? (Choose two.)

Accepted Answer

RESTCONF over HTTPS. NETCONF and RESTCONF are the two primary protocols for model-driven programmability using YANG models on Cisco IOS XE. NETCONF uses SSH and XML, while RESTCONF uses HTTPS and JSON/XML. Both allow structured configuration and state retrieval. SNMP, Telnet, and CLI-based SSH do not natively support YANG and are not considered model-driven.

Answer

SSH with CLI commands

Answer

CLI over Telnet

Answer

SNMPv3 with YANG models

Question 15

A network engineer is new to automation and wants to start by writing a simple Python script to interact with a Cisco IOS XE device using RESTCONF. Which Python library is specifically designed to simplify sending HTTP requests to RESTCONF APIs?

Accepted Answer

Requests. The Requests library is designed for making HTTP requests in Python, which is exactly what RESTCONF uses. It abstracts the complexities of HTTP and allows easy interaction with RESTCONF APIs, including authentication and data formatting. Other libraries like Netmiko and Ncclient are for SSH and NETCONF, respectively, and are not suited for RESTCONF. Paramiko is for SSH and not HTTP.

Answer

Netmiko

Answer

Ncclient

Answer

Paramiko