CCNA AI and Network Operations Practice Question
Which TWO statements about network automation tools are true?
⚠ Common exam trap
Cisco often tests the confusion between push-based and pull-based models, as well as which tools use agents versus agentless architectures, to catch candidates who memorize buzzwords without understanding the underlying communication patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ansible uses an agentless architecture and communicates with network devices over SSH by default.
Ansible is agentless, meaning it does not require any software installed on managed network devices. It connects to devices over SSH by default (or API for some platforms) and pushes configuration modules directly, making it lightweight and easy to deploy in network environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ansible uses an agentless architecture and communicates with network devices over SSH by default.
Why this is correct
Ansible operates without any persistent agent installed on the target device. Instead, the Ansible controller connects over SSH (or other supported connection methods like NETCONF for network devices) and executes a transient module that performs the required task, then cleans up after itself. This agentless design simplifies initial setup and avoids compatibility issues with device firmware.
- ✓
Python is a general-purpose programming language often used with libraries like Netmiko and NAPALM to automate network tasks.
Why this is correct
Python is a full-fledged, general-purpose programming language, not a configuration management framework. Network engineers commonly use it with libraries such as Netmiko, which handles SSH connectivity to network devices, or NAPALM, which provides a vendor-neutral API for gathering and pushing configuration state. This approach gives maximum flexibility for writing custom automation scripts, but requires coding knowledge and does not include built-in orchestration features like playbooks or manifests.
- ✗
Puppet and Chef both use a push-based model where the master server initiates configuration changes on managed nodes.
Why it's wrong here
This statement reverses the architectural model used by Puppet and Chef. Both employ a pull-based model: a lightweight agent installed on each managed node periodically checks in with the central server, downloads the desired state (a catalog in Puppet, a run list in Chef), and applies it locally. The server never initiates the connection; it merely responds to agent requests, which allows nodes to apply changes even when they are offline or behind NAT.
- ✗
Chef playbooks are written in YAML, while Ansible uses a Ruby-based DSL for defining desired state.
Why it's wrong here
The statement mixes up the configuration languages for Chef and Ansible. Ansible uses YAML to write playbooks, which define hosts, tasks, and roles in a human-readable, declarative format. Chef uses Ruby for its domain-specific language (DSL) in recipe and cookbook files, not playbooks. Thus, 'playbooks' is an Ansible concept, while Ruby is the language associated with Chef, not the other way around.
- ✗
Ansible requires an agent to be installed on managed network devices, while Puppet does not.
Why it's wrong here
This is the exact opposite of how these tools work. Ansible is agentless—it requires no software installed on managed network devices; it connects via SSH or APIs on demand. Puppet, by contrast, relies on a Puppet agent daemon that must be installed and running on every managed node to pull configuration from the Puppet server. The statement would be correct only if the tool names were swapped.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Ansible uses an agentless architecture and communicates with network devices over SSH by default.Correct answer▾
Why this is correct
Ansible operates without any persistent agent installed on the target device. Instead, the Ansible controller connects over SSH (or other supported connection methods like NETCONF for network devices) and executes a transient module that performs the required task, then cleans up after itself. This agentless design simplifies initial setup and avoids compatibility issues with device firmware.
✗Puppet and Chef both use a push-based model where the master server initiates configuration changes on managed nodes.Wrong answer — click to see why▾
Why this is wrong here
Ansible is the tool known for push-based orchestration; Puppet and Chef rely on agent-initiated pull cycles.
✗Chef playbooks are written in YAML, while Ansible uses a Ruby-based DSL for defining desired state.Wrong answer — click to see why▾
Why this is wrong here
Mixing up the DSL/language associations: Ansible = YAML, Chef = Ruby, Puppet = Puppet DSL (declarative).
✗Ansible requires an agent to be installed on managed network devices, while Puppet does not.Wrong answer — click to see why▾
Why this is wrong here
This error stems from confusing the agentless nature of Ansible with the agent-based architecture of Puppet/Chef.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Agentic AI in Network Operations
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
API
An API is a set of rules that allows software applications to communicate and exchange data with each other.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.