CCNA AI and Network Operations Questions

NETCONF uses XML‑encoded RPCs over SSH or TLS, not HTTP methods; HTTP methods are used by RESTCONF.

RESTCONF does not have a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's explicit commit step.

BGP (Border Gateway Protocol) is a path-vector routing protocol used to exchange routing information between autonomous systems, not a data serialization format. It is unrelated to REST API data formatting.

STP (Spanning Tree Protocol) is a Layer 2 protocol that prevents loops in Ethernet networks, not a data format for APIs. It operates at the data link layer and has no role in REST API responses.

ARP (Address Resolution Protocol) is used to map IP addresses to MAC addresses in local networks, not a data serialization format. It is a network layer protocol, not an API data format.

POST is used to create a new resource or submit data to be processed, which often results in a change in server state. It is not idempotent and is not designed for retrieval without modification.

PUT is used to update or replace an existing resource, which modifies the resource. It is not a safe or idempotent method for retrieval without side effects.

DELETE is used to remove a resource, not retrieve it. Using DELETE would modify the resource by deleting it, which contradicts the requirement of not modifying the resource.

The specific factual error is that the ietf-interfaces model's operational data cannot be modified via PATCH; the writable description is under Cisco-IOS-XE-native. Also, the Accept header should be application/yang-data+json.

The specific factual error is that the GET request should use ietf-interfaces for operational data, and the PATCH request should use the native model with correct Content-Type.

The specific factual error is that the Content-Type header must be application/yang-data+json, not application/json, to indicate the payload is YANG-encoded JSON.

Option C is incorrect because YANG is not a routing protocol and does not handle OSPF adjacency formation or any routing functions.

Option D is incorrect as YANG is a modeling language, not a data format like JSON. Although YANG models can be encoded in JSON, they are not the same thing.

Option E is incorrect because YANG does not perform network discovery functions such as automatically discovering neighbors on a LAN; that is outside its scope.

The configuration omits the 'ip flow ingress' (or any) interface command, so NetFlow will not collect any traffic.

The 'ip flow egress' command monitors outbound traffic, not the specified inbound traffic on GigabitEthernet0/0.

The 'ip flow monitor FLOW-MONITOR input' command references a flexible NetFlow monitor that does not exist; traditional 'ip flow ingress' is required.

POST is incorrect because it is used to create or submit data, not to retrieve data without changes.

PUT is incorrect as it replaces or updates a resource, which modifies the data rather than just retrieving it.

DELETE is incorrect since it removes a resource, not retrieves data.

Incorrect. Providing dashboards to end users is a function related to northbound APIs or management applications, not southbound APIs that interface with network devices.

Incorrect. DNS name resolution is unrelated to southbound APIs, which focus on device communication and management rather than network services like DNS.

Incorrect. Synchronizing switch clocks with NTP is a network service function independent of southbound APIs, which do not handle time synchronization tasks.

The specific factual error: The 'ntp server' command does not have a 'source' parameter; source is set globally. Also, 'logging trap warnings' does not meet the requirement to send informational messages.

The specific factual error: 'logging trap debugging' sends all messages, including debugging (severity 7), which is unnecessary and can cause excessive log traffic. The requirement is for informational and above, which is severity 6, not 7.

The specific factual error: The default trap level may not be 'informational'; it is often 'warnings' or 'debugging' depending on the IOS version. The requirement to send informational messages necessitates explicit configuration of 'logging trap informational'.

This option describes traditional monitoring systems that only alert humans, not agentic AI which takes autonomous actions. Agentic AI agents do not just alert; they actively diagnose and remediate issues.

Closed-loop remediation implies full automation without manual approval; requiring human approval breaks the loop and defeats the purpose of autonomous remediation. The workflow is designed to act automatically.

Option C is incorrect because JSON arrays are data structures for organizing information, whereas OSPF areas are routing domains; they are unrelated concepts in networking and automation.

Option D is incorrect because JSON arrays can contain any number of items, including zero or many, not just exactly one item; this flexibility is important in API responses and configurations.

Option E is incorrect because arrays do not replace keys; keys are used in JSON objects to define named values, while arrays represent ordered collections without keys.

Running scripts directly in production without validation bypasses all safety checks, increasing the likelihood of misconfigurations that can cause outages or security breaches. This practice directly contradicts the principle of minimizing risk during network changes.

Disabling backups removes the ability to restore the network to a known good state after a failed change, significantly increasing risk. Backups are a fundamental safety net, and disabling them for speed is never justified.

The trap host line uses 'version 3' and a community string ('public'), but SNMPv3 traps require a security name (the user) and an authentication level, not a community.

The SNMPv3 user is configured with MD5 and DES56, while the requirement is SHA authentication and AES 128‑bit encryption.

The NetFlow export version is set to 5 instead of the required version 9.

Creating a new resource is typically done using the POST method, not GET. GET is designed for safe and idempotent retrieval of data, not for creating resources.

Replacing the entire resource configuration is the purpose of the PUT method, which is idempotent and used for updates. GET is not intended for modifying resources.

Deleting a resource is performed using the DELETE method. GET is a safe method that should not have side effects like deletion.

Option C is incorrect because subnet masks are related to IP addressing and have no connection to SDN or NFV concepts, which focus on network control and virtualization.

Option D is wrong since SDN and NFV do not eliminate routing protocols; routing remains necessary for path determination and packet forwarding in networks.

Option E is incorrect because SDN and NFV are broad network architecture concepts and do not exclusively refer to wireless client roaming or mobility management.

JSON is a lightweight data-interchange format, not a transport protocol. HTTPS is a secure version of HTTP used for communication, and JSON does not replace it; instead, JSON data is often transmitted over HTTPS.

JSON is a platform-independent data format used by many APIs and services, not just Cisco DNA Center. It is supported by virtually all programming languages and is a standard for web APIs across different vendors.

JSON does not use XML tags; it uses a syntax of curly braces, colons, and commas to define objects and arrays. XML uses angle brackets for tags, which is a different markup language.

logging trap 4 sets the severity to warning (4), so it does not include notifications (5).

The missing source interface causes NTP to use an incorrect source address, likely resulting in unsynchronized status.

The NTP server address is incorrect and 'logging trap 7' sends all debug messages instead of limiting to notifications and above.

Replacing a failed power supply is a physical hardware task that requires hands-on intervention, not a software-based or configuration task that network automation tools can perform.

Tracing a cable by hand is a physical, manual task that cannot be automated with network automation tools, which focus on software-based configuration and monitoring.

Listening for fan noise is a physical inspection task that relies on human senses and cannot be performed by network automation software, which deals with digital data and configurations.

APIs are software interfaces that enable communication with the controller, but they do not replace forwarding devices like switches and routers. These devices still handle packet forwarding based on policies set via the controller; the controller does not eliminate the need for physical or virtual forwarding hardware.

APIs do not remove the need for authentication and authorization. In fact, secure API access typically requires credentials, tokens, or certificates to ensure only authorized users or systems can interact with the controller. Removing these controls would create severe security vulnerabilities.

APIs are software interfaces, not physical cabling standards. Ethernet cabling standards like Cat5e, Cat6, or fiber optics define physical layer specifications for wired network connections. Confusing APIs with cabling is a fundamental category error.

Option B is incorrect because YANG does not replace IPv4 or IPv6 addressing schemes. IP addressing remains a core network function independent of data modeling languages.

Option C is wrong since YANG does not remove the need for routing protocols. Routing protocols like OSPF and EIGRP continue to operate and are configured using data models but are not replaced by them.

Option D is false because YANG’s scope is much broader than naming wireless SSIDs. It models a wide range of network configurations and operational data beyond wireless settings.

Anomaly detection identifies unusual patterns like latency spikes, but it does not include automatic corrective action. The scenario requires both detection and automated response, which anomaly detection alone cannot provide.

Predictive analytics forecasts future events (e.g., predicting when a link will fail), but it does not automatically take corrective action. The scenario involves detecting and correcting an existing anomaly, not predicting a future one.

Machine learning classification categorizes data (e.g., classifying traffic as normal or anomalous), but it does not inherently include automated corrective actions. The scenario requires a system that both detects and corrects.

The specific factual error is that an administratively down interface results in a hard failure, not intermittent connectivity.

The specific factual error is that a complete ARP entry indicates no Layer 2 problem, contradicting the symptom of intermittent connectivity.

The specific factual error is that a missing route results in consistent unreachability, not intermittent problems.

The specific factual error: RESTCONF mandates the use of application/yang-data+json for Accept and Content-Type headers; application/json is not supported. Also, the JSON body must follow the YANG data structure.

The specific factual error: The question explicitly requires the ietf-interfaces YANG model, not the Cisco-native model. Using the wrong model will not retrieve or modify the intended data.

The specific factual error: The question context indicates JSON is the target format (since it mentions Accept: application/json would fail). Using XML is a different format and would require different media types.

Incorrect connection type 'ssh' and uses CIDR notation /24 instead of subnet mask.

Uses 'shutdown' command, which disables the interface instead of enabling it.

Uses the 'parents' argument, which is explicitly prohibited by the requirement.

HTTPS adds encryption overhead, which can reduce throughput compared to HTTP, not improve it.

HTTPS provides transport-layer encryption but does not replace authentication. API access still requires authentication mechanisms such as API keys, OAuth tokens, or certificates to verify the identity of the client.

JSON is a data format that can be carried over any transport protocol, including HTTP, HTTPS, or even raw TCP. HTTPS is not required for JSON; it is used to secure the transport, not to enable a specific data format.

Option C is incorrect because JSON is not a protocol like HTTPS. HTTPS is a secure transport protocol, whereas JSON is a data format used within protocols or APIs for data representation, not for transport or security.

Option D is wrong since JSON is not tied to IPv6 networks or any specific IP version. JSON is a general-purpose data format used across various network environments and protocols, independent of IP addressing schemes.

Option E is incorrect because JSON has no relation to spanning-tree modes or any Layer 2 network protocol functions. JSON is purely a data format and does not influence or configure network protocols like STP.

This option is incorrect because controller-based networking does not eliminate the need for physical network devices like switches and routers; these devices still forward traffic.

This option is incorrect since authentication and authorization remain necessary to secure access to the controller and protect network integrity.

This option is incorrect because controller-based networking applies to both wired and wireless networks and is not limited to wireless environments.

Option B is incorrect because JSON is a data format and does not provide encryption. Encryption is handled by protocols like TLS or HTTPS, not by JSON itself, so this option confuses data formatting with security.

Option C is wrong since JSON does not replace authentication. Authentication and access control are separate concerns managed by security protocols or API gateways, not by the data format used in responses.

Option D is false because JSON is a data format, whereas HTTPS is a transport and security protocol. They serve different purposes and are not interchangeable concepts.

Incorrect because tokens do not replace HTTPS; transport security remains necessary to protect data and tokens during transmission.

Incorrect as token usage is unrelated to IP address assignment, which is managed by protocols like DHCP or static configuration, not authentication tokens.

Incorrect because tokens do not convert API data into VLAN tags; VLAN tagging is a Layer 2 network function unrelated to API authentication mechanisms.

SNMPv2c uses community strings transmitted in plain text, lacking encryption and authentication. Polling every 30 seconds is low-frequency and cannot provide high-frequency, low-latency data collection required for real-time monitoring.

NetFlow v9 is export-based and not a real-time push mechanism; it typically sends data in batches, introducing latency. SNMPv3 encryption does not apply to NetFlow data, so the combination does not provide secure, high-frequency streaming.

IPFIX over UDP lacks built-in encryption, making data vulnerable to interception. MD5 hashing provides integrity but not encryption or authentication for the entire data stream, failing to meet the security requirements.

The specific factual error is that interfaces-state is an operational data node, not configurable. RESTCONF requires the /data path for configuration and /operations for RPCs.

The specific factual error is that RESTCONF requires the media type application/yang-data+json for JSON encoding of YANG data, not generic application/json.

The specific factual error is that in RESTCONF, when modifying data from a specific YANG module, the JSON key must include the module prefix to avoid ambiguity.

The specific factual error is that the switch port is manually set to half duplex, not full duplex. Also, runts and FCS errors are not the primary indicators of a duplex mismatch.

The specific factual error is that a duplex mismatch requires different duplex settings; both half duplex would not cause a mismatch. Faulty cables are a different issue.

The specific factual error is that auto-negotiation would likely result in half duplex on both sides, avoiding a mismatch. The scenario states the switch port is manually set to half duplex, not auto.

The trap level 'informational' captures messages of severity 6 and lower, but notifications are severity 5, which is higher and thus not included.

The NTP source interface must be explicitly set to ensure the server can reply to the correct IP; omitting it can lead to unsynchronized state.

The debugging level includes all severities, which is too broad; the requirement is to capture only notifications (level 5) and above, which requires 'notifications' level.

The option 'device' is incorrect because it refers to the key in the JSON structure, not the value associated with the 'hostname' key. The question specifically asks for the value of 'hostname'.

Option B is incorrect because it simply repeats the key 'hostname' from the JSON structure without providing the actual value associated with it, which is what the question asks for.

This option is wrong because the question specifically asks for the value of 'hostname', which is defined as 'R1' in the JSON snippet. '192.0.2.10' is the value of 'mgmt_ip', not 'hostname'.

While reinforcement learning has been studied for routing optimization, it is not a mainstream, production‑grade AI/ML application in today's enterprise networks and is considered experimental.

Fully autonomous AI that replaces all manual configuration is aspirational, not a current operational reality; network engineers still design, validate, and override AI suggestions.

Static threshold-based alerting uses fixed numerical triggers and does not employ machine learning algorithms, making it a legacy monitoring approach, not an AI/ML application.

Uses outdated security algorithms MD5/DES for SNMPv3 and sets NetFlow version 5 instead of 9.

Omits the critical step of applying the NetFlow exporter to an interface, so flows are not captured.

Incorrectly uses 'show ip flow export' for verification; the correct command to view NetFlow cache is 'show ip cache flow'.

The specific factual error: RESTCONF requires 'application/yang-data+json', not 'application/json'.

The specific factual error: 415 relates to Content-Type, not Accept. Accept errors yield 406.

The specific factual error: RESTCONF does not silently fall back; it returns a 406 error.

This option is incorrect because APIs typically require authentication to ensure secure access and prevent unauthorized use, which is a fundamental aspect of API design.

APIs are not related to Ethernet duplex settings; they are software interfaces that enable communication between different applications or systems. This option misrepresents the fundamental purpose of APIs in network automation.

APIs are not limited to devices running Telnet; they can be implemented on various platforms and protocols, including HTTP and REST, which are widely used in modern network automation.

YANG is a modeling language used to define the structure and constraints of network data but does not represent the actual data payload format. The question describes data output starting with curly braces and name-value pairs, which is a data format, not a model, so YANG is incorrect.

Syslog is a protocol used for sending event messages and logs from network devices. Its message format does not use curly braces or name-value pairs as JSON does, so it does not match the described API output format.

SMTP is a protocol for sending email messages and does not relate to network device data formats or API outputs. It does not use curly braces or name-value pairs in its message structure, making it irrelevant to the question.

Option C is incorrect because YANG does not replace IP addressing on routed interfaces. IP addressing is a network-layer function, while YANG models the data representing such configurations but does not perform addressing itself.

Option D is wrong as YANG has no role in spanning-tree optimization or Layer 2 loop prevention. YANG is a data modeling language and does not influence protocol operations like STP.

AI-driven operations can minimize downtime but cannot eliminate it entirely due to unpredictable hardware failures and external factors.

New network devices still require initial configuration and policy assignment; AI may assist but cannot achieve zero configuration.

Human engineers remain essential for strategic planning, complex troubleshooting, and overseeing AI-driven processes.

A northbound API does not replace authentication or authorization; it relies on those mechanisms to secure API access.

VLAN tagging is a data‑plane feature independent of the northbound API; the API does not make VLAN tagging unnecessary.

HTTP status code 401 specifically indicates unauthorized access due to missing or invalid authentication. A 'resource not found' is indicated by 404, not 401.

HTTP 401 indicates authentication failure, not successful completion. A 200-level code would indicate success.

HTTP 401 indicates authentication failure, not a request entity too large. The '413 Payload Too Large' status code is used when the request body exceeds the server's limit.

Retrieval is performed by the GET method, not PUT.

JSON is popular but not exclusive; XML is widely used, and many REST implementations support both.

DELETE is used to remove a resource, which maps to the Delete operation, not Update.

Metric is a routing concept representing route cost and does not relate to API access or authorization credentials, so it is incorrect.

Lease refers to DHCP IP address assignment duration and is unrelated to API credentials or authorization, making it incorrect.

Tuple is a data structure term and does not describe any form of authorization credential for API access, so it is incorrect.