350-601 Automation Practice Question
A large financial institution has recently migrated its data center network to a new Cisco ACI fabric. The operations team is tasked with automating the provisioning of new application tenants, including EPGs, contracts, and bridge domains, using the APIC REST API. They have developed a comprehensive set of Python scripts that successfully performed these actions in their lab environment. However, when deploying the scripts to production, they receive an 'SSL: CERTIFICATE_VERIFY_FAILED' error from the requests library. The production APIC cluster uses a self-signed certificate for HTTPS, and the corporate security policy strictly prohibits the use of HTTP or disabling certificate verification. Additionally, the policy does not allow replacing the self-signed certificate with a CA-signed one without a lengthy approval process that could delay the automation project. The team needs an immediate solution that maintains security best practices. What should the team do?
⚠ Common exam trap
Cisco often tests the misconception that disabling SSL verification (`verify=False`) is an acceptable workaround for self-signed certificates, but the trap is that the security policy explicitly prohibits disabling verification, and the correct solution is to trust the specific certificate via the `verify` parameter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the self-signed certificate to the Python trust store by using the cert file in the verify parameter.
The Python requests library allows you to pass a self-signed certificate file via the `verify` parameter, which adds that certificate to the trusted store for that session. This satisfies the security policy by maintaining HTTPS encryption and certificate verification without disabling SSL checks or requiring a CA-signed certificate. The team can export the APIC's self-signed certificate (e.g., from the APIC GUI or CLI) and use it in their scripts as `requests.get(url, verify='/path/to/cert.pem')`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use HTTP instead of HTTPS for the API calls.
Why it's wrong here
HTTP transmits data in cleartext, violating security best practices and likely corporate policy.
- ✓
Add the self-signed certificate to the Python trust store by using the cert file in the verify parameter.
Why this is correct
This enables verification against the specific certificate, maintaining security without policy changes.
- ✗
Disable SSL certificate verification in the Python requests by setting verify=False.
Why it's wrong here
Disabling verification exposes the connection to man-in-the-middle attacks, violating security policy.
- ✗
Request an exception to the security policy to allow a CA-signed certificate.
Why it's wrong here
This would take time and may not be approved immediately; the team needs an immediate solution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.