mediumMultiple Select
CCNP Practice Question: Which two statements about Ansible automation in…
Which two statements about Ansible automation in a Cisco environment are true? (Choose two.)
⚠ Common exam trap
350-401 often tests Ansible's agentless push model and the YAML vs INI distinction — candidates mistakenly believe Ansible requires agents or that playbooks are Python, or confuse inventory format with playbook format.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ansible uses a push-based model to configure network devices.
Option A is correct because Ansible operates on a push-based (agentless) model: the control node connects to managed Cisco devices over SSH (or NETCONF/RESTCONF via connection plugins) and pushes modules/playbooks to them, so no persistent agent is needed. Option C is correct because Ansible Tower (now Red Hat Ansible Automation Platform's controller) provides a web-based GUI, REST API, and role-based access control (RBAC) for managing inventories, credentials, and job templates. Option B is wrong because Ansible is agentless and does not require installing software on managed Cisco devices. Option D is wrong because the default Ansible inventory file is INI-formatted (hosts), though YAML inventories are supported. Option E is wrong because playbooks are written in YAML, not Python (Python is used for modules and plugins).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ansible uses a push-based model to configure network devices.
Why this is correct
Ansible operates push-based: the control node connects to managed devices and pushes modules over SSH or network APIs, rather than agents pulling configuration. This suits Cisco environments where no persistent agent runs on the device.
- ✗
Ansible requires an agent to be installed on managed Cisco devices.
Why it's wrong here
Ansible is agentless, connecting over SSH or network APIs, so no agent is installed on managed Cisco devices. It is tempting because agent-based configuration tools do require software on each node, and an agent would be correct for a pull-model tool such as Puppet, but Ansible pushes modules at runtime.
- ✓
Ansible Tower provides a web-based GUI and role-based access control.
Why this is correct
Ansible Tower adds a web-based GUI plus role-based access control on top of core Ansible, letting teams delegate jobs by permission. This satisfies the question's requirement for a management layer with centralised access control in Cisco environments.
- ✗
The default Ansible inventory file is written in YAML format.
Why it's wrong here
The default inventory is an INI-format file (hosts), not YAML; YAML is used for playbooks, not inventory. YAML inventory is possible only as an alternative plugin, so YAML is the right answer when a question explicitly asks about a YAML-formatted inventory source.
- ✗
Ansible playbooks are written in Python.
Why it's wrong here
Playbooks are YAML documents, not Python; Python is the language Ansible itself is implemented in and the language of custom modules. The confusion arises because Ansible modules are Python files, so Python is the correct answer when a question asks what language modules are written in.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.