CCNP Automation Practice Question
A network administrator is introducing infrastructure as code for Cisco IOS XE switches. The team wants to store device configurations in a version-controlled repository and apply changes only after peer review. They need a tool that can enforce the desired state and report drift without making changes during the review phase. Which tool should they use to meet these requirements?
⚠ Common exam trap
The trap here is assuming that any automation tool can perform dry runs, when in fact only some tools like Ansible have explicit check mode support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ansible with the ios_config module in check mode
Ansible's check mode allows the playbook to simulate changes and report drift without modifying the device. This supports peer review and infrastructure as code by validating the desired state before applying. The other tools either lack built-in dry-run capabilities or are not designed for configuration review workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP polling with a custom monitoring dashboard
Why it's wrong here
SNMP polling retrieves operational data but does not manage configuration state or enforce desired configurations. It cannot apply or validate configuration changes, nor does it support peer review workflows. Using SNMP for this purpose would not meet the requirement of storing configurations in version control or preventing changes during review. It is a monitoring tool, not a configuration management tool.
- ✗
Cisco Network Services Orchestrator (NSO) with commit queues
Why it's wrong here
Cisco NSO is a powerful orchestration platform that supports transactional commits and rollbacks. However, it is typically used for service orchestration and may require significant setup. While it can enforce desired state, the scenario emphasizes a simple review phase without changes. NSO's commit queues are for ordered deployment, not necessarily for dry-run validation. It is overkill and not the best fit.
- ✓
Ansible with the ios_config module in check mode
Why this is correct
Ansible's check mode (--check) allows the playbook to run without applying changes, reporting what would be modified. This supports peer review and drift detection. The ios_config module can compare the running configuration against the desired lines and indicate differences. This aligns with infrastructure as code principles by enabling safe validation before actual deployment, making it the correct choice.
- ✗
Python script using Netmiko to push configuration commands directly
Why it's wrong here
Netmiko is an SSH library that sends CLI commands to devices. It does not inherently support check mode or drift reporting; it executes commands as written. While it can be scripted to compare configurations, it lacks built-in idempotence and review safeguards. Using it would require custom logic to avoid changes, which is not as straightforward as Ansible's check mode.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.