350-401 · topic practice
Practise ENCOR 350-401 Python For Network Automation practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
Python For Network Automation questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Simplifies SSH connections to network devices
Provides a unified API for configuration and state retrieval
Enables parallel task execution across inventory
Supports asynchronous network device communication
Offers raw SSH protocol implementation
Trap 1: YAML files in Python cannot contain comments, so all inventory data…
Incorrect because YAML supports comments using the '#' character, and Python's PyYAML library can parse files that include comments (though comments are not preserved when dumping).
Trap 2: JSON is always more human-readable than YAML for complex inventory…
Incorrect because YAML is often considered more human-readable due to its use of indentation and less verbose syntax; JSON can be harder to read for deeply nested structures.
A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.
Correct because this is a common pattern: use PyYAML to load a YAML inventory file, iterate over devices, and use Netmiko or NAPALM to collect facts.
The json module in Python can be used to serialize a dictionary containing device inventory data into a JSON string for storage or transmission.
Correct because Python's built-in json module provides json.dumps() to convert Python objects (like dicts) into JSON strings, which is useful for saving inventory data or sending it to other systems.
CSV files can be parsed using Python's csv module to import device inventory data, such as hostname, IP, and credentials, into a script.
Correct because the csv module allows reading and writing CSV files, which are commonly used for inventory lists in network automation.
YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.
Why wrong: Incorrect because YAML supports comments using the '#' character, and Python's PyYAML library can parse files that include comments (though comments are not preserved when dumping).
JSON is always more human-readable than YAML for complex inventory structures.
Why wrong: Incorrect because YAML is often considered more human-readable due to its use of indentation and less verbose syntax; JSON can be harder to read for deeply nested structures.
Trap 1: Tuples are commonly used to store device credentials because they…
Incorrect because tuples are immutable; they cannot be modified after creation, making them unsuitable for dynamic credential storage.
Trap 2: Sets are ordered and allow indexing to retrieve specific elements.
Incorrect because sets are unordered and do not support indexing; they are used for unique elements and set operations.
Trap 3: Strings are mutable and ideal for storing multiple device…
Incorrect because strings are immutable in Python and are not designed to hold multiple separate values; they are single sequences of characters.
Tuples are commonly used to store device credentials because they can be modified easily.
Why wrong: Incorrect because tuples are immutable; they cannot be modified after creation, making them unsuitable for dynamic credential storage.
Dictionaries are used to store key-value pairs such as device IP, username, and password.
Correct because dictionaries map keys to values, which is perfect for storing device parameters like IP, username, and password.
Sets are ordered and allow indexing to retrieve specific elements.
Why wrong: Incorrect because sets are unordered and do not support indexing; they are used for unique elements and set operations.
Lists are ordered and can be used to store multiple device names for iteration.
Correct because lists maintain order and allow iteration, making them suitable for storing a list of device names or IPs.
Strings are mutable and ideal for storing multiple device configurations.
Why wrong: Incorrect because strings are immutable in Python and are not designed to hold multiple separate values; they are single sequences of characters.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: The vEdge routers have not been rebooted after the policy change.
Incorrect because policy changes take effect immediately without reboot.
Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…
Incorrect because OMP graceful restart affects route convergence, not policy application.
Trap 3: The BFD sessions between vEdge and vSmart are flapping.
Incorrect because BFD is for data plane failure detection, not for policy distribution.
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.
Trap 1: The engineer used 'ip default-network' which is not supported in…
Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
Trap 2: The internal routers have a route to the default network with a…
Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
Trap 3: The engineer needs to configure 'eigrp stub' on the router to allow…
Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.
The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.
Why wrong: Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
Correct. The static default route must be correctly configured with a next-hop IP address. If the static route is missing or uses an interface instead of a next-hop, it may not be valid, and the redistribution will not propagate the route to internal routers, despite appearing in the topology table with a metric.
The internal routers have a route to the default network with a better metric from another source.
Why wrong: Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.
Why wrong: Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.
Trap 1: gNMI telemetry subscriptions can only use YANG paths from…
Incorrect because gNMI can use any YANG model path—native, OpenConfig, or IETF—as long as the device supports it.
Trap 2: gNMI relies on NETCONF for session establishment and data encoding.
Incorrect because gNMI is independent of NETCONF; it uses gRPC (HTTP/2) for transport and Protocol Buffers for encoding, not NETCONF's XML-based encoding.
gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.
Correct because gRPC is built on HTTP/2 for multiplexed, low-latency communication and uses Protocol Buffers for serialization and service definition.
gNMI (gRPC Network Management Interface) is a gRPC-based protocol that can be used for both telemetry and configuration operations.
Correct because gNMI defines RPCs for Subscribe (telemetry), Get, Set, and Capabilities, making it suitable for both monitoring and configuration.
gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.
Why wrong: Incorrect because gNMI can use any YANG model path—native, OpenConfig, or IETF—as long as the device supports it.
gNMI relies on NETCONF for session establishment and data encoding.
Why wrong: Incorrect because gNMI is independent of NETCONF; it uses gRPC (HTTP/2) for transport and Protocol Buffers for encoding, not NETCONF's XML-based encoding.
gNMI supports both periodic and on-change telemetry subscriptions.
Correct because gNMI's Subscribe RPC allows specifying a subscription mode of SAMPLE (periodic) or ON_CHANGE.
Drag a concept onto its matching description — or click a concept then click the description.
Generates the Network LSA and maintains full adjacencies with all routers on the segment
Monitors the DR and assumes the DR role if the DR fails
Forms full adjacencies only with the DR and BDR
Connects multiple areas and advertises inter-area routes
Redistributes external routes into OSPF
Drag a concept onto its matching description — or click a concept then click the description.
Virtualized network function software (e.g., virtual router)
Physical and virtual resources (compute, storage, networking)
Orchestration and lifecycle management framework
Manages NFVI resources (e.g., OpenStack)
Manages lifecycle of individual VNFs
Trap 1: The supplicant is the device that provides authentication services,…
Incorrect; the supplicant is the client requesting access, not the authentication server.
Trap 2: 802.1X is only supported on wireless networks and cannot be used on…
Incorrect; 802.1X is widely used on both wired and wireless networks.
The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.
Correct; EAPoL is the encapsulation used for 802.1X on wired LANs.
The authenticator is typically a network switch or wireless access point.
Correct; the authenticator enforces access control and relays EAP messages.
The supplicant is the device that provides authentication services, such as a RADIUS server.
Why wrong: Incorrect; the supplicant is the client requesting access, not the authentication server.
The authentication server is usually a RADIUS server that validates credentials.
Correct; RADIUS is the standard protocol for 802.1X authentication servers.
802.1X is only supported on wireless networks and cannot be used on wired switches.
Why wrong: Incorrect; 802.1X is widely used on both wired and wireless networks.
A network engineer runs the following command on Switch SW1:
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1
Port Vlans allowed on trunk Gi0/1 1-1005 Gi0/2 1-1005
Port Vlans allowed and active in management domain Gi0/1 1,10,20 Gi0/2 1,10,20
Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Gi0/2 1,10,20
Based on this output, what can be concluded?
Trap 1: The trunk is using ISL encapsulation.
The encapsulation is shown as 802.1q.
Trap 2: VLAN 1 is pruned from the trunk.
VLAN 1 is in the forwarding state, so it is not pruned.
Trap 3: Only VLANs 10 and 20 are forwarding traffic.
VLAN 1 is also forwarding.
VLANs 2-9 are allowed but not active on the trunk.
The 'allowed' list includes 1-1005, but only VLANs 1,10,20 are active; thus VLANs 2-9 are allowed but not active (not created in VLAN database).
The trunk is using ISL encapsulation.
Why wrong: The encapsulation is shown as 802.1q.
VLAN 1 is pruned from the trunk.
Why wrong: VLAN 1 is in the forwarding state, so it is not pruned.
Only VLANs 10 and 20 are forwarding traffic.
Why wrong: VLAN 1 is also forwarding.
A network engineer runs the following command on Switch SW7:
SW7# show monitor session 7
Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20
Encapsulation : Native
Ingress : Enabled
Based on this output, what can be concluded?
Trap 1: This is an RSPAN session with a remote VLAN.
The type is Local, not Remote.
Trap 2: Only egress traffic from Gi1/0/1 is mirrored.
Both directions are captured.
Trap 3: The destination port is configured to block all incoming traffic.
Ingress is enabled, so traffic is not blocked.
The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.
Ingress enabled allows the port to forward received traffic.
This is an RSPAN session with a remote VLAN.
Why wrong: The type is Local, not Remote.
Only egress traffic from Gi1/0/1 is mirrored.
Why wrong: Both directions are captured.
The destination port is configured to block all incoming traffic.
Why wrong: Ingress is enabled, so traffic is not blocked.
Trap 1: Change the HTTP method to POST because GET is not supported for…
Incorrect because the endpoint supports GET; the error is due to missing parameters.
Trap 2: Add an 'Authorization' header with a valid token because the API…
Incorrect because a missing authentication would result in a 401 error, not 400.
Trap 3: Use a different API endpoint, such as '/dna/intent/api/v1/site', to…
Incorrect because the correct endpoint for network devices is '/network-device'; the issue is the missing parameter.
Include the 'siteId' query parameter in the request URL.
Correct because the API requires the 'siteId' parameter to filter devices by site.
Change the HTTP method to POST because GET is not supported for this endpoint.
Why wrong: Incorrect because the endpoint supports GET; the error is due to missing parameters.
Add an 'Authorization' header with a valid token because the API requires authentication.
Why wrong: Incorrect because a missing authentication would result in a 401 error, not 400.
Use a different API endpoint, such as '/dna/intent/api/v1/site', to retrieve device information.
Why wrong: Incorrect because the correct endpoint for network devices is '/network-device'; the issue is the missing parameter.
Trap 1: RESTCONF supports only XML encoding for data.
Incorrect because RESTCONF supports both XML and JSON encoding.
Trap 2: RESTCONF uses SSH as the transport protocol.
Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.
Trap 3: RESTCONF defines its own data modeling language.
Incorrect because RESTCONF uses YANG as the data modeling language.
RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.
Correct because RESTCONF maps HTTP methods to CRUD operations on YANG data.
RESTCONF supports only XML encoding for data.
Why wrong: Incorrect because RESTCONF supports both XML and JSON encoding.
RESTCONF uses SSH as the transport protocol.
Why wrong: Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.
RESTCONF provides a 'data' resource as the entry point for accessing YANG data stores.
Correct because the base URI for RESTCONF includes the 'data' resource to access configuration and state data.
RESTCONF defines its own data modeling language.
Why wrong: Incorrect because RESTCONF uses YANG as the data modeling language.
Trap 1: YANG defines the transport protocol for data exchange.
Incorrect because YANG is a data modeling language and does not specify transport; NETCONF or RESTCONF provide the transport.
Trap 2: The 'leaf' statement in YANG defines a list of key-value pairs.
Incorrect because 'leaf' defines a single scalar value; 'list' defines a collection of key-value pairs.
YANG is used to model both configuration and operational state data.
Correct because YANG models can include both config true and config false nodes for configuration and state data.
YANG models can be augmented using the 'augment' statement.
Correct because the 'augment' statement allows extending an existing YANG module with additional nodes.
YANG defines the transport protocol for data exchange.
Why wrong: Incorrect because YANG is a data modeling language and does not specify transport; NETCONF or RESTCONF provide the transport.
The 'leaf' statement in YANG defines a list of key-value pairs.
Why wrong: Incorrect because 'leaf' defines a single scalar value; 'list' defines a collection of key-value pairs.
YANG uses XML or JSON encoding for data instances.
Correct because YANG data can be encoded in XML (as in NETCONF) or JSON (as in RESTCONF).
Given the following configuration on a Cisco IOS-XE device:
router ospf 1 network 10.0.0.0 0.255.255.255 area 0
!
interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip ospf cost 10
!
interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.0
!
Which statement is true about OSPF operation?
Trap 1: Both interfaces will have an OSPF cost of 10.
Incorrect. Only GigabitEthernet0/0 has the explicit cost of 10. GigabitEthernet0/1 will use the default cost based on its bandwidth (e.g., 1 for GigabitEthernet).
Trap 2: Both interfaces will have the same OSPF cost because they are in…
Incorrect. OSPF cost is interface-specific and not determined by area membership alone.
Trap 3: OSPF will not run on either interface because the network command…
Incorrect. The wildcard mask 0.255.255.255 matches all addresses starting with 10.x.x.x, so both interfaces are included.
Both interfaces will have an OSPF cost of 10.
Why wrong: Incorrect. Only GigabitEthernet0/0 has the explicit cost of 10. GigabitEthernet0/1 will use the default cost based on its bandwidth (e.g., 1 for GigabitEthernet).
GigabitEthernet0/0 will have an OSPF cost of 10, and GigabitEthernet0/1 will have a default cost based on its bandwidth.
Correct. The explicit cost applies only to the interface it is configured on. The other interface uses the default cost.
Both interfaces will have the same OSPF cost because they are in the same area.
Why wrong: Incorrect. OSPF cost is interface-specific and not determined by area membership alone.
OSPF will not run on either interface because the network command uses a wildcard mask of 0.255.255.255.
Why wrong: Incorrect. The wildcard mask 0.255.255.255 matches all addresses starting with 10.x.x.x, so both interfaces are included.
Examine the following EIGRP configuration on a Cisco IOS-XE device:
router eigrp 100 network 10.0.0.0 0.255.255.255 passive-interface default no passive-interface GigabitEthernet0/0
!
interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.0
Which statement is true?
Trap 1: EIGRP will form adjacencies on both GigabitEthernet0/0 and…
Incorrect. Only GigabitEthernet0/0 is explicitly set to not be passive. GigabitEthernet0/1 remains passive and will not form adjacencies.
Trap 2: EIGRP will not form any adjacencies because the network command…
Incorrect. The network 10.0.0.0 0.255.255.255 matches both interfaces (10.1.1.1 and 10.2.2.1).
Trap 3: EIGRP will form adjacencies on all interfaces except those with…
Incorrect. The 'passive-interface default' makes all interfaces passive unless overridden with 'no passive-interface'.
EIGRP will form adjacencies on both GigabitEthernet0/0 and GigabitEthernet0/1.
Why wrong: Incorrect. Only GigabitEthernet0/0 is explicitly set to not be passive. GigabitEthernet0/1 remains passive and will not form adjacencies.
EIGRP will form an adjacency only on GigabitEthernet0/0.
Correct. GigabitEthernet0/0 is not passive, so it will send and receive hellos. GigabitEthernet0/1 is passive by default.
EIGRP will not form any adjacencies because the network command does not match the interface subnets.
Why wrong: Incorrect. The network 10.0.0.0 0.255.255.255 matches both interfaces (10.1.1.1 and 10.2.2.1).
EIGRP will form adjacencies on all interfaces except those with 'passive-interface' configured.
Why wrong: Incorrect. The 'passive-interface default' makes all interfaces passive unless overridden with 'no passive-interface'.
Trap 1: The AS-path contains the local AS number.
This is incorrect. While an AS-path containing the local AS number can cause routes to be rejected due to loop prevention, the typical symptom is routes not being received at all or being marked as invalid, not the specific 'received but not valid' status. The most common cause for 'not valid' is next-hop unreachability.
Trap 2: BGP synchronization is enabled.
This is incorrect. BGP synchronization is a legacy feature that requires the route to be in the IGP before it is advertised. In modern networks, synchronization is disabled by default. Even if enabled, it affects advertisement, not the validity of received routes in the BGP table.
Trap 3: The maximum-prefix limit has been exceeded.
This is incorrect. Exceeding the maximum-prefix limit typically causes the BGP session to reset or routes to be withdrawn, not to be marked as 'not valid' in the BGP table. Routes would likely be removed entirely, not just marked invalid.
The AS-path contains the local AS number.
Why wrong: This is incorrect. While an AS-path containing the local AS number can cause routes to be rejected due to loop prevention, the typical symptom is routes not being received at all or being marked as invalid, not the specific 'received but not valid' status. The most common cause for 'not valid' is next-hop unreachability.
The next-hop IP address is not reachable.
Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.
BGP synchronization is enabled.
Why wrong: This is incorrect. BGP synchronization is a legacy feature that requires the route to be in the IGP before it is advertised. In modern networks, synchronization is disabled by default. Even if enabled, it affects advertisement, not the validity of received routes in the BGP table.
The maximum-prefix limit has been exceeded.
Why wrong: This is incorrect. Exceeding the maximum-prefix limit typically causes the BGP session to reset or routes to be withdrawn, not to be marked as 'not valid' in the BGP table. Routes would likely be removed entirely, not just marked invalid.
Trap 1: Check if the syslog messages are in the correct format.
Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
Trap 2: Ensure that the switch is in the Inventory and managed by DNA…
Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
Trap 3: Restart the syslog collector service on DNA Center.
Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Correct because syslog uses UDP 514, and if the port is blocked, messages will not reach DNA Center.
Check if the syslog messages are in the correct format.
Why wrong: Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
Ensure that the switch is in the Inventory and managed by DNA Center.
Why wrong: Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
Restart the syslog collector service on DNA Center.
Why wrong: Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Python For Network Automation sessions
Every question in these sessions is drawn from the Python For Network Automation domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Sharpen your 350-401 knowledge of Architecture.
Work through 350-401 questions on Virtualization.
Practise 350-401 questions linked to Infrastructure.
Sharpen your 350-401 knowledge of Network Assurance.
Security practice questions for 350-401.
Work through 350-401 questions on Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
Python For Network Automation only
Mixed 350-401 sessionA free account saves results across sessions and highlights which topics need work.
Sign up free