350-401 Automation — Timed 10 Questions

Question 1

A network engineer needs to automate the backup of running configurations from multiple Cisco IOS XE devices to a central TFTP server. Which tool is best suited for this task in a Python-based automation framework?

Accepted Answer

Paramiko. Paramiko is a Python library that implements the SSHv2 protocol, allowing direct, low-level SSH connections to network devices. For backing up running configurations to a TFTP server, Paramiko can execute the `copy running-config tftp:` command on each device, providing the necessary interactive session handling. While Netmiko is built on Paramiko, it is a higher-level library that abstracts away some of the low-level control; for a simple, script-driven backup task, Paramiko offers the direct SSH access needed without additional overhead.

Answer

RESTCONF

Answer

Ansible

Answer

Netmiko

Question 2

An organization uses Cisco DNA Center to automate network provisioning. A network engineer deploys a new access switch but finds that the switch does not receive the intended configuration template. The switch appears in DNA Center inventory with status 'Managed'. What is the most likely cause?

Accepted Answer

The switch is not assigned to a site. In Cisco DNA Center, configuration templates are applied based on site assignment. A switch that appears as 'Managed' in inventory has been discovered and is under DNA Center's control, but if it is not assigned to a specific site, DNA Center cannot determine which template to push. Site assignment is a prerequisite for template-based provisioning; without it, the intended configuration will not be deployed.

Answer

The switch has not been discovered by DNA Center

Answer

The switch is not in Plug and Play mode

Answer

The switch does not have a valid DNA license

Question 3

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

Accepted Answer

Run ssh-add on the control node to add the private key to the SSH agent. The error 'Permission denied (publickey)' indicates that the SSH key is not being presented to the IOS device. Running ssh-add on the control node loads the private key into the SSH agent, which Ansible uses by default when connecting via SSH. This resolves the authentication failure without requiring a passphrase or changing the inventory.

Answer

Set ansible_ssh_private_key_file in the inventory but omit the passphrase

Answer

Set ansible_user to the correct username in the inventory

Answer

Enable keyboard-interactive authentication on the IOS devices

Question 4

A company uses Cisco Catalyst Center (formerly DNA Center) for intent-based networking. After upgrading the Catalyst Center appliance, the engineer notices that some devices are unreachable via the network, but the Catalyst Center GUI shows them as 'Managed'. What is the most likely cause?

Accepted Answer

The IP address of the Catalyst Center appliance changed after the upgrade. When the Catalyst Center appliance is upgraded, its IP address may change if the upgrade process resets network configuration or if the appliance is redeployed with a new IP. Devices are managed via IP-based communication (e.g., SSH, SNMP, NETCONF), and if the Catalyst Center IP changes, devices will still show as 'Managed' in the GUI because the database retains the device state, but the devices themselves cannot be reached because they are trying to communicate with the old IP address. This mismatch causes unreachability despite the managed status.

Answer

SNMP community strings are misconfigured

Answer

Devices were reassigned to different roles

Answer

Certificate trust between devices and Catalyst Center expired

Question 5

A network engineer is creating a Python script using the Cisco IOS XE RESTCONF API to configure a loopback interface. The script sends a PUT request to the URI /restconf/data/Cisco-IOS-XE-native:native/interface/Loopback=100 with a JSON body that includes the IP address. The API returns a 201 Created status, but the loopback interface does not appear in the running configuration. What is the most likely issue?

Accepted Answer

The PUT request should be a POST request to create a new resource. D is correct because RESTCONF uses PUT to create or replace a resource only when the client specifies the entire resource URI, including the resource identifier (e.g., Loopback=100). However, for a new resource, the API may require a POST to the parent collection (e.g., /restconf/data/Cisco-IOS-XE-native:native/interface/Loopback) to trigger creation, depending on the YANG module's data model. A 201 Created response indicates the request was accepted, but if the resource was not actually created in the running configuration, it suggests the PUT was treated as a no-op or the data was not applied due to a mismatch in the expected resource state.

Answer

The RESTCONF API returned an error but the script ignored it

Answer

The loopback interface number is incorrect in the URI

Answer

The script is not authenticated properly

Question 6

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The device's SSH server is not fully initialized. The error 'ValueError: SSH session not active' indicates that Netmiko attempted to establish an SSH connection but the session was not fully active. The most likely cause is that the device's SSH server is not fully initialized, which can happen if the device is still booting or the SSH process has not completed startup. This is distinct from reachability or credential issues, as the device responds to pings but the SSH daemon is not ready to accept connections.

Answer

The connection timeout is set too low

Answer

The device has reached the maximum number of SSH sessions

Answer

The device requires an enable password but none was provided

Question 7

A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?

Accepted Answer

Chef client. In a Chef-managed brownfield environment with Cisco IOS XE devices, the Chef client is the agent that runs on each device (or on a proxy like a guest shell) and applies the desired state defined in cookbooks. It is responsible for converging the device's configuration to match the policy, making it the correct component for state management.

Answer

Ohai

Answer

Chef workstation

Answer

Chef server

Question 8

A network engineer is troubleshooting an Ansible playbook that uses the ios_config module to apply ACLs. The playbook runs without errors, but the ACLs are not applied to the device. The engineer verifies that the device is reachable and the credentials are correct. What is the most likely cause?

Accepted Answer

The playbook is missing the connection parameter set to 'network_cli'. The ios_config module requires the connection parameter to be set to 'network_cli' (or 'ansible.netcommon.network_cli') to use the CLI transport for sending configuration commands to network devices. Without this, Ansible defaults to the 'smart' connection, which may not properly interact with network device CLIs, causing the playbook to run without errors but not apply the ACLs.

Answer

The device is in a different VRF and not reachable

Answer

The ACL syntax in the playbook is incorrect

Answer

The ios_config module requires the netmiko library to be installed on the control node

Question 9

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Accepted Answer

DNA Center uses a declarative model for network configuration.. Option C is correct because Cisco DNA Center uses a declarative model for network configuration. In a declarative model, the administrator specifies the desired end-state of the network (e.g., 'VLAN 10 should exist on all access switches'), and DNA Center's automation engine determines the necessary steps to achieve that state, handling dependencies and ordering automatically. This contrasts with imperative models where each step must be explicitly scripted.

Answer

DNA Center primarily uses SNMP to manage devices.

Answer

DNA Center only supports greenfield deployments.

Answer

DNA Center uses an imperative model for network configuration.

Question 10

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Accepted Answer

description. Option B is correct because the 'description' leaf is a standard attribute in YANG models for interface configuration, providing a human-readable text string to document the interface's purpose. It is defined in the IETF interface model (RFC 8343) and is widely supported across Cisco IOS-XE and NX-OS YANG models.

Answer

switchport mode

Answer

mac address