CCNA AI and Network Operations Questions

This option describes traditional monitoring systems that only alert humans, not agentic AI which takes autonomous actions. Agentic AI agents do not just alert; they actively diagnose and remediate issues.

Closed-loop remediation implies full automation without manual approval; requiring human approval breaks the loop and defeats the purpose of autonomous remediation. The workflow is designed to act automatically.

Option C is incorrect because JSON arrays are data structures for organizing information, whereas OSPF areas are routing domains; they are unrelated concepts in networking and automation.

Option D is incorrect because JSON arrays can contain any number of items, including zero or many, not just exactly one item; this flexibility is important in API responses and configurations.

Option E is incorrect because arrays do not replace keys; keys are used in JSON objects to define named values, while arrays represent ordered collections without keys.

Running scripts directly in production without validation bypasses all safety checks, increasing the likelihood of misconfigurations that can cause outages or security breaches. This practice directly contradicts the principle of minimizing risk during network changes.

Disabling backups removes the ability to restore the network to a known good state after a failed change, significantly increasing risk. Backups are a fundamental safety net, and disabling them for speed is never justified.

The trap host line uses 'version 3' and a community string ('public'), but SNMPv3 traps require a security name (the user) and an authentication level, not a community.

The SNMPv3 user is configured with MD5 and DES56, while the requirement is SHA authentication and AES 128‑bit encryption.

The NetFlow export version is set to 5 instead of the required version 9.

Creating a new resource is typically done using the POST method, not GET. GET is designed for safe and idempotent retrieval of data, not for creating resources.

Replacing the entire resource configuration is the purpose of the PUT method, which is idempotent and used for updates. GET is not intended for modifying resources.

Deleting a resource is performed using the DELETE method. GET is a safe method that should not have side effects like deletion.

Option C is incorrect because subnet masks are related to IP addressing and have no connection to SDN or NFV concepts, which focus on network control and virtualization.

Option D is wrong since SDN and NFV do not eliminate routing protocols; routing remains necessary for path determination and packet forwarding in networks.

Option E is incorrect because SDN and NFV are broad network architecture concepts and do not exclusively refer to wireless client roaming or mobility management.

JSON is a lightweight data-interchange format, not a transport protocol. HTTPS is a secure version of HTTP used for communication, and JSON does not replace it; instead, JSON data is often transmitted over HTTPS.

JSON is a platform-independent data format used by many APIs and services, not just Cisco DNA Center. It is supported by virtually all programming languages and is a standard for web APIs across different vendors.

JSON does not use XML tags; it uses a syntax of curly braces, colons, and commas to define objects and arrays. XML uses angle brackets for tags, which is a different markup language.

logging trap 4 sets the severity to warning (4), so it does not include notifications (5).

The missing source interface causes NTP to use an incorrect source address, likely resulting in unsynchronized status.

The NTP server address is incorrect and 'logging trap 7' sends all debug messages instead of limiting to notifications and above.

Replacing a failed power supply is a physical hardware task that requires hands-on intervention, not a software-based or configuration task that network automation tools can perform.

Tracing a cable by hand is a physical, manual task that cannot be automated with network automation tools, which focus on software-based configuration and monitoring.

Listening for fan noise is a physical inspection task that relies on human senses and cannot be performed by network automation software, which deals with digital data and configurations.

APIs are software interfaces that enable communication with the controller, but they do not replace forwarding devices like switches and routers. These devices still handle packet forwarding based on policies set via the controller; the controller does not eliminate the need for physical or virtual forwarding hardware.

APIs do not remove the need for authentication and authorization. In fact, secure API access typically requires credentials, tokens, or certificates to ensure only authorized users or systems can interact with the controller. Removing these controls would create severe security vulnerabilities.

APIs are software interfaces, not physical cabling standards. Ethernet cabling standards like Cat5e, Cat6, or fiber optics define physical layer specifications for wired network connections. Confusing APIs with cabling is a fundamental category error.

Option B is incorrect because YANG does not replace IPv4 or IPv6 addressing schemes. IP addressing remains a core network function independent of data modeling languages.

Option C is wrong since YANG does not remove the need for routing protocols. Routing protocols like OSPF and EIGRP continue to operate and are configured using data models but are not replaced by them.

Option D is false because YANG’s scope is much broader than naming wireless SSIDs. It models a wide range of network configurations and operational data beyond wireless settings.

Anomaly detection identifies unusual patterns like latency spikes, but it does not include automatic corrective action. The scenario requires both detection and automated response, which anomaly detection alone cannot provide.

Predictive analytics forecasts future events (e.g., predicting when a link will fail), but it does not automatically take corrective action. The scenario involves detecting and correcting an existing anomaly, not predicting a future one.

Machine learning classification categorizes data (e.g., classifying traffic as normal or anomalous), but it does not inherently include automated corrective actions. The scenario requires a system that both detects and corrects.

Incorrect connection type 'ssh' and uses CIDR notation /24 instead of subnet mask.

Uses 'shutdown' command, which disables the interface instead of enabling it.

Uses the 'parents' argument, which is explicitly prohibited by the requirement.

HTTPS adds encryption overhead, which can reduce throughput compared to HTTP, not improve it.

HTTPS provides transport-layer encryption but does not replace authentication. API access still requires authentication mechanisms such as API keys, OAuth tokens, or certificates to verify the identity of the client.

JSON is a data format that can be carried over any transport protocol, including HTTP, HTTPS, or even raw TCP. HTTPS is not required for JSON; it is used to secure the transport, not to enable a specific data format.

Option C is incorrect because JSON is not a protocol like HTTPS. HTTPS is a secure transport protocol, whereas JSON is a data format used within protocols or APIs for data representation, not for transport or security.

Option D is wrong since JSON is not tied to IPv6 networks or any specific IP version. JSON is a general-purpose data format used across various network environments and protocols, independent of IP addressing schemes.

Option E is incorrect because JSON has no relation to spanning-tree modes or any Layer 2 network protocol functions. JSON is purely a data format and does not influence or configure network protocols like STP.

This option is incorrect because controller-based networking does not eliminate the need for physical network devices like switches and routers; these devices still forward traffic.

This option is incorrect since authentication and authorization remain necessary to secure access to the controller and protect network integrity.

This option is incorrect because controller-based networking applies to both wired and wireless networks and is not limited to wireless environments.

Option B is incorrect because JSON is a data format and does not provide encryption. Encryption is handled by protocols like TLS or HTTPS, not by JSON itself, so this option confuses data formatting with security.

Option C is wrong since JSON does not replace authentication. Authentication and access control are separate concerns managed by security protocols or API gateways, not by the data format used in responses.

Option D is false because JSON is a data format, whereas HTTPS is a transport and security protocol. They serve different purposes and are not interchangeable concepts.

Incorrect because tokens do not replace HTTPS; transport security remains necessary to protect data and tokens during transmission.

Incorrect as token usage is unrelated to IP address assignment, which is managed by protocols like DHCP or static configuration, not authentication tokens.

Incorrect because tokens do not convert API data into VLAN tags; VLAN tagging is a Layer 2 network function unrelated to API authentication mechanisms.

SNMPv2c uses community strings transmitted in plain text, lacking encryption and authentication. Polling every 30 seconds is low-frequency and cannot provide high-frequency, low-latency data collection required for real-time monitoring.

NetFlow v9 is export-based and not a real-time push mechanism; it typically sends data in batches, introducing latency. SNMPv3 encryption does not apply to NetFlow data, so the combination does not provide secure, high-frequency streaming.

IPFIX over UDP lacks built-in encryption, making data vulnerable to interception. MD5 hashing provides integrity but not encryption or authentication for the entire data stream, failing to meet the security requirements.

The specific factual error is that the switch port is manually set to half duplex, not full duplex. Also, runts and FCS errors are not the primary indicators of a duplex mismatch.

The specific factual error is that a duplex mismatch requires different duplex settings; both half duplex would not cause a mismatch. Faulty cables are a different issue.

The specific factual error is that auto-negotiation would likely result in half duplex on both sides, avoiding a mismatch. The scenario states the switch port is manually set to half duplex, not auto.

The option 'device' is incorrect because it refers to the key in the JSON structure, not the value associated with the 'hostname' key. The question specifically asks for the value of 'hostname'.

Option B is incorrect because it simply repeats the key 'hostname' from the JSON structure without providing the actual value associated with it, which is what the question asks for.

This option is wrong because the question specifically asks for the value of 'hostname', which is defined as 'R1' in the JSON snippet. '192.0.2.10' is the value of 'mgmt_ip', not 'hostname'.

The specific factual error: RESTCONF requires 'application/yang-data+json', not 'application/json'.

The specific factual error: 415 relates to Content-Type, not Accept. Accept errors yield 406.

The specific factual error: RESTCONF does not silently fall back; it returns a 406 error.

This option is incorrect because APIs typically require authentication to ensure secure access and prevent unauthorized use, which is a fundamental aspect of API design.

APIs are not related to Ethernet duplex settings; they are software interfaces that enable communication between different applications or systems. This option misrepresents the fundamental purpose of APIs in network automation.

APIs are not limited to devices running Telnet; they can be implemented on various platforms and protocols, including HTTP and REST, which are widely used in modern network automation.

YANG is a modeling language used to define the structure and constraints of network data but does not represent the actual data payload format. The question describes data output starting with curly braces and name-value pairs, which is a data format, not a model, so YANG is incorrect.

Syslog is a protocol used for sending event messages and logs from network devices. Its message format does not use curly braces or name-value pairs as JSON does, so it does not match the described API output format.

SMTP is a protocol for sending email messages and does not relate to network device data formats or API outputs. It does not use curly braces or name-value pairs in its message structure, making it irrelevant to the question.

Option C is incorrect because YANG does not replace IP addressing on routed interfaces. IP addressing is a network-layer function, while YANG models the data representing such configurations but does not perform addressing itself.

Option D is wrong as YANG has no role in spanning-tree optimization or Layer 2 loop prevention. YANG is a data modeling language and does not influence protocol operations like STP.

AI-driven operations can minimize downtime but cannot eliminate it entirely due to unpredictable hardware failures and external factors.

New network devices still require initial configuration and policy assignment; AI may assist but cannot achieve zero configuration.

Human engineers remain essential for strategic planning, complex troubleshooting, and overseeing AI-driven processes.

A northbound API does not replace authentication or authorization; it relies on those mechanisms to secure API access.

VLAN tagging is a data‑plane feature independent of the northbound API; the API does not make VLAN tagging unnecessary.

HTTP status code 401 specifically indicates unauthorized access due to missing or invalid authentication. A 'resource not found' is indicated by 404, not 401.

HTTP 401 indicates authentication failure, not successful completion. A 200-level code would indicate success.

HTTP 401 indicates authentication failure, not a request entity too large. The '413 Payload Too Large' status code is used when the request body exceeds the server's limit.

Retrieval is performed by the GET method, not PUT.

JSON is popular but not exclusive; XML is widely used, and many REST implementations support both.

DELETE is used to remove a resource, which maps to the Delete operation, not Update.

Metric is a routing concept representing route cost and does not relate to API access or authorization credentials, so it is incorrect.

Lease refers to DHCP IP address assignment duration and is unrelated to API credentials or authorization, making it incorrect.

Tuple is a data structure term and does not describe any form of authorization credential for API access, so it is incorrect.

SNMP does not use YANG data models and typically operates over UDP, not SSH.

RESTCONF uses HTTP/HTTPS for transport, not SSH, so it does not meet the requirement of operating over SSH.

CLI scripting lacks a standardized data model like YANG and is not a protocol that operates over SSH in the same structured manner as NETCONF.

Requires agents and is pull‑based, failing both the agentless and push requirements.

Agents are mandatory, and the pull mechanism contradicts the push requirement.

Lacks built‑in push‑based orchestration, idempotency, and agentless design without significant custom development, making it less suitable than a purpose‑built tool.

The DELETE method is used to remove a resource from the server, which directly modifies the state of the device's configuration. Since the question specifies that the script must retrieve the configuration without making any modifications, DELETE is not appropriate.

The PUT method is used to update or replace a resource on a server, which contradicts the requirement of retrieving the current configuration state without making any modifications.

The POST method is used to send data to a server to create or update a resource, which contradicts the requirement of retrieving the current configuration state without modifying anything.

This option is incorrect because controllers do not eliminate the need for switches and routers; these devices still perform the actual packet forwarding in the network.

This option is incorrect since controllers are highly relevant to automation, providing APIs and centralized control that enable automated network management workflows.

This option is incorrect because controller communication is not universally based on Telnet; modern controllers use secure protocols and APIs rather than relying solely on Telnet.

The specific factual error is that RESTCONF requires the media type application/yang-data+json for YANG data, not generic application/json.

The specific factual error is that the duplex setting is defined in the ietf-interfaces YANG model, not in Cisco-IOS-XE-native. The URI path must match the data model.

The specific factual errors are: (1) The PATCH body must be structured as {"ietf-interfaces:interface":{"duplex":"full"}} to match the YANG data tree; (2) The success response for PATCH is 204 No Content, not 200 OK.

STP (Spanning Tree Protocol) is a network protocol used for preventing loops in Ethernet networks, and it is not a data format used with REST APIs. Therefore, it does not represent objects, arrays, or key-value pairs.

EIGRP (Enhanced Interior Gateway Routing Protocol) is a routing protocol used for exchanging routing information within an autonomous system, not a data format for representing objects or key-value pairs in APIs.

802.1Q is a networking standard used for VLAN tagging in Ethernet frames, not a data format for representing objects or key-value pairs in APIs. It does not relate to REST API data representation.

Option C is incorrect because JSON does not require closing tags like XML; it uses braces and brackets to delimit data structures, making this statement false.

Option D is incorrect as JSON supports a variety of data types beyond numeric values, including strings, booleans, arrays, objects, and null, so it is not limited to numbers.

Option A is incorrect because a 301 status code indicates that the requested resource has been moved permanently to a new URL, not an authentication issue. Confusing 301 with 401 can lead to misdiagnosing API errors.

Option B is incorrect since a 204 status code means the request was successful but no content was returned. It does not indicate any authentication problem, unlike 401 which specifically relates to authorization failures.

Option D is incorrect because a server's inability to parse JSON usually results in a 400 Bad Request error, not a 401 Unauthorized. The 401 code is strictly about authentication, not parsing or syntax errors.

This option is incorrect because JSON objects do contain fields; they are collections of key-value pairs representing attributes of a single entity, so the claim that objects cannot contain fields is false.

This option is wrong because JSON arrays are a general data structure used for any list of items, not exclusively for IPv6 interfaces; interface type does not dictate JSON structure.

This option is incorrect because the choice of JSON data structure (array vs. object) does not affect API authentication or security; these are separate concerns unrelated to data formatting.

Option A is incorrect because the POST method is not used for retrieving resources; instead, it is intended for creating new resources or submitting data for processing in a RESTful API context.

The POST method is used to create or submit data, not to delete resources. Option C incorrectly describes the function of the DELETE method in RESTful APIs, which is responsible for removing resources.

Option D is incorrect because the POST method is not idempotent and does not replace an existing resource; it is primarily used to create new resources or submit data.

The specific factual error is that the question asks about the error when the Content-Type header is wrong, not the URI path. The URI path error is a separate issue.

The specific factual error is that a wrong Content-Type header causes a rejection before any body parsing, so the request does not succeed.

The specific factual error is that RESTCONF does accept JSON; the issue is the exact media type string, not the format.

SNMP is limited to monitoring and basic sets, not suited for complex remediation workflows.

CLI scripting lacks structured programmability and is error-prone for automation.

Syslog is a logging protocol and cannot be used to push configuration changes.

RESTful APIs do not require SNMP traps; they use HTTP methods for communication, and SNMP traps are unrelated to REST API operations.

RESTful APIs are format-agnostic and commonly support both XML and JSON, with JSON being the more prevalent format due to its lightweight nature. The statement that RESTful APIs can only return XML is incorrect.

The group keyword 'auth' only enables authentication, not encryption. AES 128 requires the 'priv' keyword.

The 'snmp-server user' command requires a group name. Omitting the group will result in an error or incomplete configuration.

The command 'ip flow-export destination' sets the collector IP and port, not the export version. The version is set with 'ip flow-export version 9'.

Tokens do not eliminate security controls; they still require mechanisms like expiration, revocation, and secure storage.

Tokens are unrelated to VLAN creation; VLANs are configured via switch CLI or network management protocols, not API tokens.

Tokens do not replace routing protocols; routing protocols handle packet forwarding, while tokens handle API access authentication.

Syslog severity levels use inverse numbering: level 4 (warning) is more severe than level 5 (notice), so the statement is false.

Syslog level 0 (emergency) is the highest severity, indicating a catastrophic system failure, not a normal operational message.

NTP stratum 0 is the reference clock itself; devices synchronized directly to it are stratum 1, not stratum 0.

SDN controllers do not replace AI; AI can augment control and decision-making, making this statement false.

AI in SDN applies to security, compliance, and analytics, not only traffic engineering, so this statement is incorrect.

Intent-based networking requires continuous monitoring and feedback loops to ensure match with intent, so this statement is false.

The specific factual error is that the 'copy' command in Cisco IOS requires a confirmation (pressing Enter) when the destination filename is provided. The script must send an additional newline to complete the operation.

The specific factual error is that the 'copy' command generates an intermediate prompt ('[confirm]') before returning to the router prompt. The script should wait for that intermediate prompt, not the final prompt.

The specific factual error is that including a newline in the command string does not simulate an interactive response to a subsequent prompt. The script must send the newline separately after the command is issued.

Option C is incorrect because JSON does not use angle-bracket tags; that syntax belongs to XML. Confusing JSON with XML is a common mistake but not accurate for this question.

Option D is incorrect as JSON is not a routing protocol. It is a data format used for representing information, not for routing or control plane functions in networks.

Option E is incorrect because JSON can carry various data types beyond integers, including strings, booleans, arrays, objects, and null values. Limiting JSON to integers is a misunderstanding.

This option is incorrect because idempotency does not relate to the transport layer protocols like TCP or UDP; it focuses on the behavior of operations in terms of repeated execution leading to the same outcome.

Option C is incorrect because idempotency does not relate to the encryption of device credentials; it refers to the property of operations that can be applied multiple times without changing the result beyond the initial application.

Option D is incorrect because idempotency does not dictate the use of a single management protocol; rather, it refers to the property of operations yielding the same result regardless of how many times they are executed.

This option is wrong because the response is in JSON format, not XML. JSON uses curly braces and key-value pairs, while XML uses tags to define elements.

The hostname field is a string, not a list, as it contains a single value ('Dist-1') and does not represent multiple items or entries.

This option is wrong because the format shown in the response is JSON, not YAML. YAML uses indentation and a different syntax for data representation, which is not present here.

Option B is incorrect because POST does not always replace an existing resource completely; it usually creates new resources or triggers processing. PUT is the method associated with full resource replacement.

Option D is incorrect because REST APIs do not require SNMP as the transport mechanism; they typically use HTTP or HTTPS protocols for communication.

This is incorrect because spam classification is a supervised learning problem, not a reinforcement learning one.

This is incorrect because clustering groups data, it doesn't forecast numeric values like bandwidth usage.

This is incorrect because predictive analytics typically involves dynamic ML models, not just static thresholds.

POST is incorrect because it is used to create new resources or submit data that modifies the server state, not for retrieving existing data. Selecting POST would imply changing the resource, which contradicts the question's requirement for a non-modifying method.

PUT is incorrect as it replaces or updates an existing resource entirely. It modifies the resource state, which is not the intended action when simply retrieving data from a REST API.

DELETE is incorrect because it removes a resource from the server. Using DELETE would modify the resource by deleting it, which is the opposite of the question's intent to retrieve data without modification.