Courseiva

350-401 · domain

Automation

This domain covers network automation and programmability on Cisco IOS XE and related platforms: controller-based and agent-based tools, data formats, APIs, and Python scripting. Questions present operational scenarios and ask you to select the correct tool, protocol, or command, or to interpret JSON/YAML/XML payloads and RESTCONF/NETCONF responses.

122 questions33 easy52 medium37 hard

Focused practice

Practice Automation questions

Scored sessions drawing only from this domain — pick a length below.

Start 20-question practice test →

What this domain covers

What to know about Automation

Be able to choose the right automation tool for a scenario and explain its transport and data format. The single most important thing is mapping Ansible to agentless SSH/YAML, NETCONF to SSH/XML, and RESTCONF to HTTP/JSON on IOS XE.

Ansible agentless playbooks over SSH versus Puppet, Chef, and SaltStack agent-based models

NETCONF and RESTCONF APIs using YANG models on Cisco IOS XE devices

Data serialization formats JSON, XML, and YAML and their syntax rules

Python scripting with Cisco SDKs, NETCONF libraries, and REST API calls

Watch out for

Common Automation exam traps

  • ▸Assuming Ansible needs an agent on managed devices; it is agentless and relies on SSH or API transport.
  • ▸Confusing NETCONF, which uses SSH and XML, with RESTCONF, which uses HTTP methods and JSON or XML.
  • ▸Treating YANG as a data format rather than a modeling language that defines the structure exposed by NETCONF and RESTCONF.

Question index

All Automation questions (122)

Click any question to see the full explanation, or start a practice session above.

1

A network engineer is using a Python script to retrieve the operational status of all interfaces on a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state but receives an HTTP 401 Unauthorized response. The engineer can successfully ping the device and has verified that the RESTCONF feature is enabled with 'restconf' in global configuration. Which action will resolve the issue?

Medium
2

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write the automation tasks in YAML and does not want to install any software on the switches. Which tool should be used?

Easy
3

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS devices. The administrator prefers a tool that uses YAML for playbooks and does not require installing software on the managed devices. Which tool should the administrator use?

Easy
4

A network engineer is writing a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device. The script connects using NETCONF over SSH on port 830. The engineer wants to filter the response to only include interface configuration data. Which NETCONF operation should be used to retrieve the configuration with a filter?

Medium
5

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices. The engineer sends a GET request to /dataservice/device but receives a 403 Forbidden error. The engineer has already authenticated successfully and obtained a valid session cookie. What is the most likely reason for this error?

Easy
6

A network administrator is new to automation and wants to start using Ansible to manage a group of Cisco IOS XE switches. The administrator has installed Ansible on a Linux control node and created an inventory file listing the switches. The administrator now needs to create a playbook that will gather facts from the switches and display them. Which Ansible module should the administrator use in the playbook to collect operational facts from the Cisco IOS XE devices?

Easy
7

A network engineer is using Python with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script connects successfully but receives an RPC error when trying to apply a candidate configuration. The engineer inspects the device capabilities and sees 'urn:ietf:params:netconf:capability:candidate:1.0' is NOT listed. What is the most likely reason for the failure?

Medium
8

A network administrator is using Cisco SD-WAN to manage a large enterprise network. They want to automate the deployment of a new branch site using a template. Which component of Cisco SD-WAN is responsible for pushing the configuration to the WAN edge devices?

Easy
9

A company uses Cisco Catalyst Center (formerly DNA Center) for intent-based networking. After upgrading the Catalyst Center appliance, the engineer notices that some devices are unreachable via the network, but the Catalyst Center GUI shows them as 'Managed'. What is the most likely cause?

Easy
10

A network automation team is evaluating configuration management tools. They need a tool that uses a declarative, agentless architecture and communicates over SSH to push configuration to Cisco IOS XE devices. Which tool best fits these requirements?

Easy
11

A network engineer is using the Python 'requests' library to interact with a Cisco DNA Center controller. The engineer wants to retrieve a list of all network devices. Which HTTP method and URL should be used?

Medium
12

A network automation engineer is using NETCONF to configure a Cisco IOS XE device. The engineer wants to ensure that the configuration changes are applied atomically and that the device can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities should the engineer verify are supported by the device? (Choose two.)

Hard
13

A healthcare provider runs a Python script that issues a RESTCONF PATCH to a Cisco IOS XE switch to modify an interface description. The device returns HTTP 400 with an error-tag of 'invalid-value'. The JSON body is syntactically valid and the URI targets the correct interface. Which action most directly resolves this error?

Hard
14

A network engineer is building a Python script that must retrieve the operational state of all interfaces from a Cisco IOS XE device using RESTCONF. The engineer sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state and receives an HTTP 401 Unauthorized response. The device is reachable, RESTCONF is enabled, and the correct credentials are being used in the request. What is the most likely cause of the 401 response?

Medium
15

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook runs successfully on most switches, but one switch fails with an error indicating that the VLAN configuration command is not recognized. What is the most likely cause?

Medium
16

A network engineer is using Ansible to manage a fleet of Cisco IOS XE devices. The engineer wants to ensure that the playbook is idempotent and only makes changes when necessary. The playbook uses the ios_config module with a set of lines to configure an interface. After running the playbook, the engineer notices that the task always reports 'changed' even when the configuration is already present. What is the most likely reason for this behavior?

Hard
17

A network automation team is using YANG models with NETCONF to configure a Cisco IOS XE device. They want to change the description of a loopback interface. The engineer writes an <edit-config> RPC with the 'operation' attribute set to 'merge' on the <description> leaf. The RPC is accepted, but the description is not changed. The engineer verifies that the YANG path is correct and that the interface exists. What is the most likely reason the description was not updated?

Hard
18

A network automation team is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The team writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script includes a valid authentication token in the headers, but the response returns a 403 Forbidden error. The token was obtained successfully using the /dna/system/api/v1/auth/token endpoint. What is the most likely reason for the 403 error?

Medium
19

A network engineer is writing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer wants to retrieve the current configuration of a specific interface. Which HTTP method and URI should be used?

Easy
20

Match each network automation tool to its purpose.

Medium
21

A network automation engineer is developing a Python script that will retrieve interface statistics from a Cisco IOS XE device using NETCONF. The engineer needs to discover which YANG models are supported by the device before constructing the RPC. Which NETCONF capability exchange message should the script send first to obtain this information?

Medium
22

Which THREE benefits does network automation provide over manual configuration?

Easy
23

A network engineer is evaluating Cisco SD-WAN (Viptela) for a large enterprise. The engineer needs to automate the deployment of vEdge routers using zero-touch provisioning. Which two components are required to enable zero-touch provisioning for vEdge routers? (Choose two.)

Medium
24

A financial services firm wants to automate configuration backups of 200 Cisco IOS XE switches. The team prefers an imperative, script-driven approach where Python code calls a structured API and stores the retrieved configuration in a version-controlled repository. Which method best aligns with this goal?

Medium
25

A network automation engineer is using the ncclient Python library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The engineer writes a script that establishes a NETCONF session and sends a <get-config> RPC. However, the script fails with an error indicating the source datastore is not specified. What should the engineer do to correct the script?

Medium
26

Which TWO statements are true about RESTCONF and NETCONF in a Cisco IOS XE environment? (Choose two.)

Hard
27

A network engineer is writing a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script uses the <get-config> RPC with the source datastore set to 'running'. After running the script, the engineer receives a large XML response but needs to extract only the interface configuration. Which NETCONF capability allows the engineer to filter the response to include only specific configuration data?

Easy
28

A network engineer is using Ansible to manage a group of Cisco IOS XE devices. The engineer wants to ensure that the playbook can securely connect to the devices without prompting for passwords and without storing passwords in plaintext in the playbook. Which method should be used to provide the credentials?

Medium
29

A network engineer is using Cisco SD-WAN vManage APIs to automate the deployment of a new branch site. The engineer needs to retrieve a list of all devices in the overlay network. Which REST API endpoint should the engineer use?

Easy
30

A network automation team is using the Cisco DNA Center Intent API to create a new site hierarchy and assign devices. The API call to create the site returns HTTP 202 Accepted, but a subsequent call to assign a device to that site fails with an error that the site does not exist. The team is polling the task endpoint but has not yet received a success status. What is the most likely explanation?

Hard
31

A network engineer is comparing YANG models used in Cisco IOS XE automation. The engineer needs to distinguish between standard IETF YANG models and Cisco-specific YANG models. Which two statements accurately describe these YANG model types? (Choose two.)

Medium
32

A network engineer is new to automation and wants to use a Python library that provides a simple, high-level interface for interacting with network devices, including Cisco IOS XE, without dealing with low-level SSH or NETCONF details. The engineer needs to quickly script configuration changes and command execution. Which Python library is best suited for this requirement?

Easy
33

A network engineer needs to programmatically retrieve the operational status of all GigabitEthernet interfaces on a Cisco IOS XE device. The engineer wants to use a REST-based protocol that returns data in JSON and uses HTTP methods. The device is configured with 'restconf' and 'ip http secure-server'. Which protocol should the engineer use?

Medium
34

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

Hard
35

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write playbooks in YAML and use SSH for connectivity. Which tool should the engineer choose?

Easy
36

A network automation team uses a Python script with the ncclient library to configure a Cisco IOS XE router via NETCONF. The script sends an <edit-config> RPC with a candidate datastore, but the router returns an error indicating the candidate datastore is not supported. The team wants to make configuration changes without affecting the running configuration until they are verified. Which NETCONF capability should the team ensure is enabled on the router to allow this workflow?

Hard
37

A network automation engineer is using the Python 'ncclient' library to manage a Cisco IOS XE device via NETCONF. The engineer wants to retrieve the running configuration. Which NETCONF operation should be used to accomplish this?

Easy
38

A network team is evaluating automation tools to manage a large Cisco IOS XE environment. They need a tool that uses a declarative, agentless approach and can be run from a central server without installing software on managed devices. Which tool best fits this requirement?

Easy
39

A network automation engineer is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The engineer writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script receives an HTTP 403 Forbidden response. The engineer has verified that the username and password are correct and that the user has the SUPER-ADMIN-ROLE. What is the most likely cause of the issue?

Hard
40

An organization uses Cisco DNA Center to automate network provisioning. A network engineer deploys a new access switch but finds that the switch does not receive the intended configuration template. The switch appears in DNA Center inventory with status 'Managed'. What is the most likely cause?

Medium
41

A network engineer is writing a Python script to retrieve the operational status of all GigabitEthernet interfaces from a Cisco IOS XE device using NETCONF. The script establishes an SSH session to the device on port 830 and sends a <get> RPC with a subtree filter. The device responds with an <rpc-error> indicating 'unknown-element' for the filter. Which action should the engineer take to resolve this issue?

Medium
42

A network engineer is using Cisco SD-WAN vManage APIs to automate the creation of a new VPN template. The engineer needs to authenticate to the vManage REST API using a Python script. Which authentication method is natively supported by the vManage API for programmatic access?

Easy
43

A retail company wants its network engineers to push consistent OSPF configurations to dozens of Cisco IOS XE routers using a declarative, agentless automation tool that connects over SSH and does not require installing software on the managed devices. Which tool best fits these requirements?

Easy
44

A network engineer is designing a Python script to interact with a Cisco Catalyst Center (formerly DNA Center) appliance using its Intent API. The script must retrieve a list of all network devices and then update the location of a specific device. Which two steps are required to authenticate and authorize the API requests? (Choose two.)

Hard
45

A network automation team uses a Python script with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script establishes a session and sends an <edit-config> RPC with a candidate datastore. After sending the RPC, the script immediately sends a <commit> RPC, but the device returns an error indicating that the candidate datastore is not supported. Which statement explains the cause of this error?

Hard
46

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to Cisco IOS XE devices. The administrator prefers using YAML for playbook definitions and wants to avoid installing software on the managed devices. Which tool best fits these requirements?

Easy
47

A network engineer is using Cisco DNA Center's Intent API to create a new site hierarchy for a branch office. The engineer sends a POST request to the /dna/intent/api/v1/site endpoint with a JSON payload containing the site name and parent site. The API returns HTTP 202 Accepted. The engineer immediately sends a GET request to retrieve the newly created site but receives a 404 Not Found. What is the most likely explanation?

Medium
48

A network engineer is writing a Python script to retrieve the configured hostname from a Cisco IOS XE device using RESTCONF. The device has RESTCONF enabled, and the engineer sends a GET request to https://10.1.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname with the header 'Accept: application/yang-data+json'. However, the request fails with HTTP 401 Unauthorized. The engineer verifies that the device is reachable and RESTCONF is enabled. What is the most likely reason for the failure?

Medium
49

A network automation team needs to securely retrieve the running configuration from 200 Cisco IOS XE routers daily using a Python script. The script must authenticate with individual user credentials, use a structured data format, and avoid screen-scraping. Which approach best meets these requirements?

Medium
50

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer needs to authenticate to the API. Which authentication method should be used to obtain a token for subsequent API calls?

Medium
51

A network engineer is using the Cisco DNA Center Intent API to create a new site hierarchy. The engineer sends a POST request to /dna/intent/api/v1/site with a JSON payload defining the site. The API returns a 202 Accepted response with a task ID. What should the engineer do next to confirm the site was created successfully?

Medium
52

A network engineer is using the Python requests library to interact with a Cisco IOS XE device's RESTCONF API. The engineer wants to retrieve the configured hostname. Which HTTP method and URI should be used?

Easy
53

A network automation team is evaluating RESTCONF as a replacement for CLI scraping on Cisco IOS XE devices. They need to understand the operational characteristics of RESTCONF to design their tooling. Which two statements accurately describe RESTCONF behavior on Cisco IOS XE? (Choose two.)

Hard
54

A network automation engineer is writing a Python script to retrieve interface statistics from a Cisco IOS XE device using NETCONF. The script uses the 'ncclient' library and connects to the device on port 830. However, the connection fails with a 'Could not open socket' error. The engineer confirms that the device is reachable via ping and SSH on port 22. What is the most likely reason for the failure?

Medium
55

A network administrator wants to use a declarative, agentless automation tool to push VLAN configurations to a group of Cisco IOS XE switches. The tool should connect over SSH, use YAML playbooks, and require no software installation on the switches. Which tool best fits these requirements?

Easy
56

A DevOps team is implementing a CI/CD pipeline that automates network configuration changes. Which design principle is most important to ensure that a failed deployment does not cause prolonged outages?

Hard
57

A network automation team is designing a solution to manage configuration changes across a fleet of Cisco IOS XE devices. They want to use model-driven programmability with YANG data models. Which two protocols can be used to programmatically retrieve and modify configuration using YANG models on these devices? (Choose two.)

Hard
58

A network engineer is building a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate, retrieve interface configuration, and handle the response. Which two actions are required to successfully complete this task? (Choose two.)

Medium
59

A network administrator is comparing configuration management tools and wants to use one that is agentless, uses YAML for playbooks, and communicates with Cisco IOS XE devices over SSH. Which tool best meets these requirements?

Easy
60

A network engineer at a logistics company is building a Python script that must retrieve the running configuration of a Cisco IOS XE router without parsing CLI screen-scraping output. The engineer wants a programmatic, model-driven interface that returns structured data over HTTPS. Which approach best satisfies this requirement?

Medium
61

A network engineer is designing a Python script to automate configuration changes on a fleet of Cisco IOS XE devices using the NETCONF protocol. The script must ensure that changes are atomic and that the device validates the configuration before committing. Which two NETCONF capabilities must the script check for during the capability exchange to guarantee these requirements? (Choose two.)

Medium
62

A network engineer is new to automation and wants to use a Python script to configure a Cisco IOS XE device. The engineer prefers a protocol that uses HTTP methods and JSON for data encoding, as it is easier to read and debug. Which protocol should the engineer choose?

Easy
63

A network automation team is using Ansible to push configuration changes to a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module with the 'backup: yes' option. During a recent run, the playbook failed on one device due to a syntax error in the configuration lines. The team wants to ensure that if a failure occurs, the device automatically reverts to its previous configuration without manual intervention. Which Ansible feature should be used to achieve this?

Hard
64

A network engineer is using a Python script with the requests library to retrieve interface information from a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://192.168.1.1/restconf/data/ietf-interfaces:interfaces but receives a 401 Unauthorized error. The engineer has verified that the device has RESTCONF enabled and the URL is correct. Which action should the engineer take to resolve the error?

Easy
65

A large enterprise uses a centralized automation platform based on Ansible Tower to manage its network infrastructure. The network consists of 500 Cisco IOS XE routers and switches distributed across multiple sites. The automation team has created a playbook that configures BGP peerings on all devices. The playbook uses the ios_bgp module. Recently, during a maintenance window, the playbook was run against a subset of devices that were supposed to be upgraded to a new IOS XE version. However, after the run, several devices lost their BGP configurations entirely. The team discovers that the new IOS XE version introduced a new BGP configuration model that is not fully compatible with the ios_bgp module's expected CLI commands. The playbook failed silently on those devices, and the existing BGP configuration was removed. The team needs to prevent this from happening in future maintenance windows. Which action should be taken?

Hard
66

A network engineer is writing a Python script to retrieve the operational state of all GigabitEthernet interfaces from a Cisco IOS XE device using RESTCONF. The device is configured with HTTPS and the engineer has valid credentials. The script uses the 'requests' library to send a GET request to the RESTCONF API. Which HTTP header must be included in the request to specify that the client expects JSON-formatted data in the response?

Medium
67

A network engineer is writing a Python script using the requests library to interact with a Cisco IOS XE device's RESTCONF API. The script needs to authenticate using basic authentication and retrieve interface details. The engineer writes the following code snippet: import requests url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces' headers = {'Accept': 'application/yang-data+json'} response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False) However, the script returns a 401 Unauthorized error. What is the most likely cause?

Medium
68

A network automation team is evaluating YANG models to manage Cisco IOS XE devices. They need to ensure that the models they choose can be used with both NETCONF and RESTCONF. Which two statements about YANG models are true in this context? (Choose two.)

Hard
69

A network engineer is writing a Python script to retrieve the list of interfaces from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces and receives a 401 Unauthorized response. The device is reachable, and RESTCONF is enabled. The engineer verifies that the username and password are correct. Which action should the engineer take to resolve the issue?

Medium
70

A network engineer is designing a Python script that uses the YANG models supported by a Cisco IOS XE device to configure interface descriptions via RESTCONF. The engineer wants to ensure the script uses the correct data model and avoids errors. Which TWO actions should the engineer take? (Choose two.)

Hard
71

A network engineer is designing a Python script that uses the YANG models supported by a Cisco IOS XE device to retrieve interface statistics via NETCONF. The engineer wants to ensure the script can parse the response and extract the operational data. Which two steps are necessary when using the ncclient library to retrieve and process the data? (Choose two.)

Medium
72

A network engineer is building a Python script to configure a Cisco IOS XE device via RESTCONF. The script sends a POST request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces with the JSON payload shown. The device returns HTTP 415 Unsupported Media Type. Which change to the script will resolve the error?

Medium
73

A network automation engineer is using the ncclient Python library to retrieve configuration from a Cisco IOS XE device via NETCONF. The engineer sends a <get-config> RPC with a filter for the interface configuration. The device returns a large XML response, but the engineer only needs the interface description and IP address. Which NETCONF capability should the engineer use to filter the response to only the required data?

Hard
74

A network administrator is introducing infrastructure as code for Cisco IOS XE switches. The team wants to store device configurations in a version-controlled repository and apply changes only after peer review. They need a tool that can enforce the desired state and report drift without making changes during the review phase. Which tool should they use to meet these requirements?

Easy
75

A network engineer is developing a Python script that uses the requests library to send a RESTCONF PATCH request to a Cisco IOS XE device. The script includes the header 'Content-Type: application/yang-data+json' and sends a JSON payload to update the description of an interface. The device returns HTTP 400 Bad Request. Which is the most likely cause?

Hard
76

A network engineer is using the ncclient Python library to send NETCONF RPCs to a Cisco IOS XE device. The engineer wants to lock the running configuration datastore before making changes to prevent other NETCONF sessions from modifying it concurrently. Which NETCONF operation should be used?

Medium
77

A company has a large network of 500 Cisco IOS XE routers and switches spread across multiple sites. The network team wants to automate the collection of interface statistics every hour and store them in a central database for historical analysis. The team has a Linux server with Python 3 and access to all devices via SSH with key-based authentication. They have written a Python script using Netmiko to connect to each device, run 'show interfaces', and parse the output to extract key metrics (e.g., input/output errors, packets per second). The script works correctly when tested on a small subset of devices, but when run against all 500 devices, it takes too long (over 2 hours) and sometimes fails due to SSH connection timeouts. The team needs to reduce the execution time and improve reliability. Which approach should they take?

Medium
78

A network engineer is building a Python script to retrieve the operational status of all GigabitEthernet interfaces from a Cisco IOS XE device. The script uses the requests library and sends a GET request to the RESTCONF URL https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state. The device returns HTTP 401 Unauthorized. The engineer has verified that the RESTCONF service is enabled and the URL is correct. Which action should be taken to resolve the issue?

Medium
79

A network engineer is using Cisco DNA Center's Intent API to automate the configuration of a new branch site. The engineer needs to create a new site hierarchy, assign devices to the site, and apply a template that configures VLANs and QoS. The engineer writes a Python script that calls the DNA Center APIs in sequence. After running the script, the site is created, and devices are assigned, but the template application fails with an error indicating that the device is not provisioned. What is the most likely missing step in the automation workflow?

Hard
80

A network automation team is using the NETCONF protocol to manage a fleet of Cisco IOS XE devices. They need to ensure that configuration changes are applied atomically and that they can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities must be supported and used to achieve these requirements? (Choose two.)

Hard
81

A network engineer is using a Python script with the ncclient library to retrieve interface statistics from a Cisco IOS XE router. The script connects successfully, but when it sends a <get> RPC, the router returns an error stating that the requested data model is not supported. The engineer verifies that the YANG model is present on the device. What is the most likely cause of this error?

Medium
82

A network engineer is using the Cisco SD-WAN vManage API to automate the creation of a new VPN template. The engineer sends a POST request to /dataservice/template/feature with a JSON body and receives an HTTP 400 Bad Request error. The JSON payload is syntactically valid. What is the most likely cause of this error?

Medium
83

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices in the overlay network. The engineer writes a Python script that sends a GET request to https://vmanage-ip/dataservice/device but receives a 401 Unauthorized error. What is the most likely reason for this error?

Easy
84

A network team is using Ansible to manage a fleet of Cisco IOS XE switches. The team wants to ensure that the Ansible playbook can connect to the switches without prompting for passwords and without storing passwords in plaintext. The team has generated an SSH key pair and copied the public key to the switches. Which Ansible connection method and authentication mechanism should the team use?

Medium
85

A network engineer is implementing a CI/CD pipeline for network configuration changes. The pipeline uses Git for version control and Jenkins for orchestration. The engineer wants to ensure that configuration changes are validated before deployment to production devices. Which approach best integrates validation into the pipeline?

Medium
86

A network engineer is comparing the characteristics of agent-based and agentless automation tools for managing Cisco IOS XE devices. Which two statements accurately describe agentless automation? (Choose two.)

Medium
87

A network automation team is using Cisco NSO (Network Services Orchestrator) to manage a multi-vendor network. They have created a service model in YANG and deployed it. A network engineer notices that when a device configuration is changed manually outside of NSO, NSO does not automatically correct it. Which NSO feature should be configured to ensure that NSO re-applies the intended configuration when a device drifts from the service model?

Hard
88

A network engineer is using Ansible to manage a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module to push a set of configuration lines. After running the playbook, the engineer notices that the configuration changes are not being saved to the startup configuration, and the devices revert to the previous configuration after a reboot. Which parameter should be added to the 'ios_config' task to ensure the running configuration is saved to the startup configuration?

Hard
89

A network automation team is using the Cisco SD-WAN vManage REST API to monitor the status of WAN Edge devices. The team writes a Python script that authenticates using basic authentication and then sends a GET request to /dataservice/device. The script receives a 401 Unauthorized error even though the credentials are correct. The team verifies that the user account has the 'admin' role. What is the most likely cause of the authentication failure?

Hard
90

A network engineer is developing a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. The script sends a GET request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces. The device returns a 401 Unauthorized error. The engineer verifies that the RESTCONF API is enabled and the URI is correct. Which action should the engineer take to resolve this issue?

Medium
91

A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?

Easy
92

A network engineer is implementing a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate using basic authentication over HTTPS and retrieve the configured hostname. Which Python code snippet correctly performs this task using the requests library?

Hard
93

A network engineer is new to network automation and wants to use a declarative, agentless tool that uses YAML playbooks to push configuration to Cisco IOS devices over SSH. Which tool should the engineer choose?

Easy
94

A network engineer is designing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer needs to perform a partial modification of the interface description without affecting other configured parameters. Which two HTTP methods and payload considerations are appropriate for this task? (Choose two.)

Medium
95

A network engineer is designing an automation solution that uses Python with the ncclient library to manage Cisco IOS XE devices via NETCONF. The engineer needs to ensure that the solution can retrieve interface configurations, modify them, and verify the changes. Which two NETCONF operations should the engineer use to accomplish these tasks? (Choose two.)

Medium
96

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

Hard
97

A network engineer is developing a Python script to configure OSPF on a Cisco IOS XE device using the NETCONF protocol. The script establishes an SSH session and sends a <edit-config> RPC with the target datastore set to 'running'. The configuration is applied successfully, but after a device reload, the OSPF configuration is missing. The engineer verifies that the <edit-config> operation included the 'default-operation' parameter set to 'merge'. What is the most likely reason for the configuration loss?

Hard
98

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Easy
99

A network automation team is evaluating YANG as the data modeling language underpinning its Cisco IOS XE automation. Which two statements accurately describe YANG in this context? (Choose two.)

Medium
100

A network engineer is using a Python script with the 'requests' library to interact with a Cisco IOS XE device via RESTCONF. The script sends a GET request to the URI 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1' but receives a 401 Unauthorized error. The engineer has verified that the RESTCONF service is enabled and the URI is correct. What is the most likely cause of the error?

Hard
101

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer sends a GET request to the URL https://dnac.example.com/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token. What is the most likely cause of the error?

Medium
102

A network engineer wants to automate configuration backups for a fleet of Cisco IOS XE devices using Ansible. The engineer uses the ios_config module with the backup: yes option and sets the backup directory via the ANSIBLE_BACKUP_DIR environment variable. After running the playbook, the engineer finds that no backup files are created on the control node. What is the most likely cause?

Medium
103

A network engineer is using the RESTCONF API on a Cisco IOS XE device to configure an interface. The engineer sends a PATCH request to the URL https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 with the following JSON payload: {"ietf-interfaces:interface": {"description": "Uplink to Core"}}. The request returns a 400 Bad Request error. What is the most likely reason for this error?

Hard
104

A network engineer is using the YANG Suite tool to explore YANG models on a Cisco IOS XE device. The engineer wants to retrieve the operational state of all interfaces using NETCONF. The engineer sends a <get> RPC with a filter that selects the 'interfaces-state' container from the ietf-interfaces YANG module. The device returns an empty response. The engineer confirms that interfaces are up and running. What is the most likely reason for the empty response?

Hard
105

A network automation team wants to programmatically configure a Cisco Catalyst 9300 switch using RESTCONF. The switch is running Cisco IOS XE 17.x. Which HTTP method should be used to create a new VLAN by sending a JSON payload to the RESTCONF URI /restconf/data/Cisco-IOS-XE-vlan:vlan?

Easy
106

An organization uses Chef to manage network device configurations. A cookbook that configures SNMP community strings is applied to a group of routers. After the run, one router loses SNMP access. The cookbook uses the following resource: snmp_community 'public' do action :remove end. What is the most likely cause of the issue?

Medium
107

Match each QoS feature to its description.

Medium
108

A network engineer is writing a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces but receives an HTTP 406 Not Acceptable response. The engineer verifies that the device has RESTCONF enabled and the credentials are correct. Which action should the engineer take to resolve this issue?

Medium
109

A network engineer is writing a Python script to query interface statistics from a Cisco IOS XE device using NETCONF. The script must establish a secure session that supports configuration and state data retrieval. Which transport protocol and port should the engineer use for the NETCONF session?

Easy
110

A network engineer is writing a Python script to retrieve the operational state of a GigabitEthernet interface from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 but receives a 406 Not Acceptable response. The device supports RESTCONF and the interface exists. Which HTTP header should the engineer add to the request to resolve this error?

Medium
111

A network engineer is new to automation and wants to start by writing a simple Python script to interact with a Cisco IOS XE device using RESTCONF. Which Python library is specifically designed to simplify sending HTTP requests to RESTCONF APIs?

Easy
112

A network engineer is using a Python script with the ncclient library to retrieve configuration from a Cisco IOS XE device via NETCONF. The script uses the <get-config> RPC with a source of <running/> and a filter of <native xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-native"/>. The script successfully retrieves the configuration but the output is in XML format. The engineer wants to convert this XML into a Python dictionary for easier manipulation. Which Python library is specifically designed to parse XML into a dictionary structure?

Hard
113

A network engineer is troubleshooting an automated configuration change that caused a routing loop. The change was pushed via an Ansible playbook that modified OSPF cost values on multiple routers simultaneously. What is the most likely reason for the loop?

Easy
114

Which TWO statements about NETCONF and YANG are true?

Hard
115

A network engineer is learning about data models used in network automation. The engineer needs to choose a data modeling language that is human-readable, supports hierarchical data structures, and is used by NETCONF and RESTCONF to define the structure of configuration and state data. Which data modeling language should the engineer choose?

Easy
116

A network architect is designing a Python script that will retrieve interface statistics from a Cisco IOS XE device using the RESTCONF API. The script must authenticate with a username and password, and all communication must be encrypted. The device is configured with the 'restconf' and 'ip http secure-server' commands. Which HTTP method and authentication mechanism should the script use to retrieve the data?

Medium
117

A network engineer is using the YANG Suite tool to explore YANG models supported by a Cisco IOS XE device. The engineer wants to retrieve the list of available YANG modules from the device using NETCONF. Which NETCONF operation should be used to obtain this information?

Medium
118

A network automation engineer is developing a Python script using the ncclient library to configure a Cisco IOS XE device via NETCONF. The engineer wants to lock the running datastore, apply a candidate configuration, validate it, and then commit it. Which sequence of ncclient operations correctly performs this workflow?

Hard
119

A network automation team is using NETCONF to configure a Cisco IOS XE device. They send an <edit-config> RPC with the default-operation set to 'merge'. The target configuration already has an interface GigabitEthernet0/1 with an IP address of 10.1.1.1/24. The RPC payload includes a new IP address of 10.1.1.2/24 for the same interface. What will be the result on the device?

Hard
120

A network engineer is using the Cisco Catalyst Center (formerly DNA Center) Intent API to retrieve a list of all network devices. The engineer sends a GET request to /dna/intent/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token from /dna/system/api/v1/auth/token. What is the most likely reason for the 401 error?

Hard
121

A network automation team is using the ncclient Python library to configure a Cisco IOS XE router via NETCONF. The engineer wants to ensure the configuration changes are applied atomically and that the device automatically rolls back if any part of the change fails. Which NETCONF capability must the engineer verify is advertised by the device before relying on this behavior?

Hard
122

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Medium

Frequently asked questions

What does the Automation domain cover on the 350-401 exam?
Be able to choose the right automation tool for a scenario and explain its transport and data format. The single most important thing is mapping Ansible to agentless SSH/YAML, NETCONF to SSH/XML, and RESTCONF to HTTP/JSON on IOS XE.
How many questions are in this domain?
This page lists all 122 Automation questions in the 350-401 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?
Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only Automation questions?
Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.