CCNA AI and Network Operations Practice Question
A network operations team is implementing an automated system to detect and remediate interface flapping on core switches. The system must be able to query the network device for interface status and execute commands to disable or reconfigure the interface if a pattern of flapping is detected. Which protocol or technology enables the system to programmatically interact with the network device for both monitoring and configuration changes?
⚠ Common exam trap
Many candidates confuse SNMP with configuration protocols, but SNMP is not designed for robust configuration management; NETCONF and RESTCONF are the modern programmatic interfaces emphasized in CCNA automation topics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NETCONF
NETCONF is the correct choice because it is a standardized network configuration protocol that allows automated systems to retrieve operational data and push configuration changes securely. In this scenario, the system would use NETCONF to query interface status and then apply remediation configurations. SNMP can monitor but has limited configuration capabilities, CLI scripting is non-programmatic and error-prone, and Syslog is only for logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
SNMP is a UDP-based protocol that manages network devices by reading and writing MIB objects, but it is fundamentally oriented toward monitoring and simple metric collection. Its SET operations lack transactional safety, configuration rollback, or standardized YANG data models, so it cannot reliably support the validation and rollback needed for automated closed-loop remediation. Thus, while SNMP can alert an AI agent to a fault, it is not the tool for applying structured configuration changes.
- ✓
NETCONF
Why this is correct
NETCONF is the correct protocol because it defines IETF-standard XML-based RPCs executed over SSH, allowing an automation agent to retrieve, install, manipulate, and delete device configuration. It operates on multiple datastores (candidate, running, startup) with support for validation, commit, and rollback, and is coupled with YANG models to provide structured, vendor-neutral data. This transactional model-driven design makes NETCONF ideal for closed-loop remediation where an autonomous agent must reliably implement config changes and undo them on failure.
- ✗
CLI scripting
Why it's wrong here
CLI scripting, such as Expect or pexpect, automates network devices by sending text commands and parsing screen output, but it is brittle and platform-specific because it depends on exact command syntax and output formatting. It lacks machine-readable data models, structured RPC semantics, and transactional rollback, so any network change can fail silently or leave the device in an inconsistent state. Consequently, CLI scripting is not a robust or scalable mechanism for an AI-driven closed-loop remediation system.
- ✗
Syslog
Why it's wrong here
Syslog is a one-way logging protocol that transmits event messages from network devices to a collector; it cannot accept or execute configuration commands from a management system. It is useful for detecting faults and providing audit trails, but it does not provide any RPC mechanism for changing device state. Therefore, while syslog may feed data into a closed-loop detector, it is entirely incapable of carrying out automated remediation actions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓NETCONFCorrect answer▾
Why this is correct
NETCONF is the correct protocol because it defines IETF-standard XML-based RPCs executed over SSH, allowing an automation agent to retrieve, install, manipulate, and delete device configuration. It operates on multiple datastores (candidate, running, startup) with support for validation, commit, and rollback, and is coupled with YANG models to provide structured, vendor-neutral data. This transactional model-driven design makes NETCONF ideal for closed-loop remediation where an autonomous agent must reliably implement config changes and undo them on failure.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP is primarily used for monitoring and limited configuration via MIBs, but is not designed for executing arbitrary configuration commands like disabling an interface in a programmatic manner.
✗CLI scriptingWrong answer — click to see why▾
Why this is wrong here
CLI scripting relies on manual screen-scraping and is not a standardized, programmatic interface; it lacks the structured data exchange and error handling of protocols like NETCONF.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is a logging protocol used for sending system messages, not for querying device state or pushing configuration changes.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Agentic AI in Network Operations
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
SNMP
SNMP (Simple Network Management Protocol) is an application-layer protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.