75 of 128 questions · Page 1/2 · Automation · Answers revealed
An engineer uses the APIC REST API to create a new EPG. The API endpoint for creating an EPG under a specific tenant and application profile uses which object class?
EPG object class.
Why this answer
The EPG object class in the ACI MIT is 'fvAEPg' (Application Endpoint Group).
Which tool provides a programmatic HTTP-based interface to execute CLI commands on Cisco Nexus switches and returns structured JSON data?
NX-API is the HTTP/HTTPS interface that accepts CLI commands and returns JSON/XML.
Why this answer
NX-API (Option D) is the correct answer because it provides a programmatic HTTP/HTTPS-based interface that allows you to send CLI commands to Cisco Nexus switches and receive structured JSON (or XML) responses. This enables automation and integration without requiring an SSH session, directly fulfilling the question's requirement for an HTTP-based interface with structured JSON output.
Exam trap
Cisco often tests the distinction between tools that provide a direct HTTP-based API (like NX-API) versus automation or scripting libraries (like Ansible, pyATS, or Netmiko) that use other protocols (SSH) or are higher-level frameworks, leading candidates to confuse the interface layer with the tool that consumes it.
How to eliminate wrong answers
Option A is wrong because Ansible is an automation framework that uses playbooks to manage devices, but it does not itself provide an HTTP-based interface for executing CLI commands on Nexus switches; it typically relies on NX-API or SSH via modules like nxos_command. Option B is wrong because pyATS (Python Test Automation System) is a testing framework for network devices, not a tool that exposes an HTTP-based CLI execution interface; it uses other transports like SSH or NX-API to interact with devices. Option C is wrong because Netmiko is a Python library for simplifying SSH connections to network devices, not an HTTP-based interface; it uses SSH, not HTTP, and returns unstructured text, not structured JSON.
An engineer is writing a Python script using the cisco_nxapi library to configure a Nexus switch. Which of the following is a valid step to establish a connection using NX-API?
Correct: The NXAPI class from cisco_nxapi accepts these parameters.
Why this answer
The cisco_nxapi library provides an NXAPI class that can be instantiated with switch IP, username, password, and transport protocol to connect.
A network automation engineer is developing a CI/CD pipeline for network configuration changes. Which tool would best serve as a version control system for Infrastructure as Code (IaC) files in a data center network?
Correct. Git is the standard version control system for IaC.
Why this answer
Git is the industry-standard version control system for IaC, enabling branching, merging, and collaboration. Terraform and Ansible are automation tools, not version control. Jenkins is a CI/CD server, not version control.
A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?
Fast-map syncs device configurations with NSO and detects drift.
Why this answer
Fast-map synchronization is the correct NSO feature because it is specifically designed to detect and reconcile configuration changes made directly on managed devices (out-of-band changes). It compares the device's running configuration against NSO's CDB and generates the necessary NETCONF or CLI operations to bring the device back into sync with NSO's desired state, ensuring consistency without manual intervention.
Exam trap
Cisco often tests the distinction between features that manage NSO's internal state (CDB snapshots, rollback) versus features that synchronize with external devices (fast-map), leading candidates to confuse backup mechanisms with reconciliation tools.
How to eliminate wrong answers
Option A is wrong because CDB snapshots are used for backup and restore of NSO's own configuration database, not for detecting or reconciling out-of-band device changes. Option C is wrong because service model templates define service-level configurations and are used for deploying services, not for detecting or reconciling direct device modifications. Option D is wrong because the rollback and recovery mechanism reverts NSO's own transaction history to a previous state, but it does not detect or reconcile out-of-band changes made directly on devices.
An engineer is designing an automation solution for a large data center with multiple Cisco UCS Manager domains. Which approach best ensures idempotent configuration operations?
Declarative tools ensure the desired state is achieved regardless of current state.
Why this answer
Ansible's declarative modules for Cisco UCS Manager (e.g., `ucs_*` modules) are designed to be idempotent: they compare the current state of the configuration against the desired state defined in the playbook and only apply changes when necessary. This ensures that running the same playbook multiple times yields the same result without unintended side effects, which is critical for large-scale automation across multiple UCS domains.
Exam trap
Cisco often tests the misconception that any API or script-based approach (like XML API or Python CLI) is automatically idempotent, when in fact only declarative tools with built-in state reconciliation (like Ansible) guarantee idempotency without additional custom logic.
How to eliminate wrong answers
Option A is wrong because imperative Python scripts that execute CLI commands are not inherently idempotent; they blindly send commands each time they run, potentially causing errors or duplicate configurations unless the script explicitly checks the current state. Option C is wrong because directly calling the UCS Manager XML API using POST requests is a procedural method that requires custom logic to check existing state before applying changes; without such checks, repeated POST requests can create duplicate objects or overwrite configurations. Option D is wrong because SNMP is a monitoring protocol (RFC 1157) designed for reading MIB variables and sending traps, not for idempotent configuration operations; it lacks the state comparison and transactional guarantees needed for reliable configuration management.
Which THREE statements about Cisco Network Services Orchestrator (NSO) are true?
NSO has NEDs for both NX-OS and ACI.
Why this answer
Cisco NSO is a multi-domain orchestration platform that can manage both NX-OS and ACI environments, making option A correct. It uses NETCONF as the primary southbound protocol to communicate with devices, and it leverages YANG models to define and enforce device configurations, which validates options B and E.
Exam trap
The trap here is that candidates often assume NSO requires an external database for state management, but it actually uses its own integrated CDB, and they may also mistakenly think NSO is limited to Layer 3 services when it is a multi-layer orchestrator.
An automation engineer is using the cisco_nxapi Python library to configure a Nexus switch. Which step is required before using the library?
NX-API must be enabled to accept REST/CLI calls.
Why this answer
The cisco_nxapi library uses NX-API, which must be enabled on the Nexus switch via 'feature nxapi'.
Refer to the exhibit. An Ansible playbook targeting an NX-OS switch fails with this error. What is the most likely cause?
'authentication failed' indicates wrong password or username, and password is the most common issue.
Why this answer
The error message indicates an authentication failure during the SSH connection from Ansible to the NX-OS switch. Since Ansible uses SSH to execute tasks, a 'Permission denied' error most commonly points to incorrect credentials. The playbook likely specifies the wrong password for the given username, causing the SSH session to be rejected.
Exam trap
Cisco often tests the distinction between SSH connectivity errors (e.g., 'Connection refused') and authentication errors (e.g., 'Permission denied'), leading candidates to mistakenly blame SSH configuration when the real issue is incorrect credentials.
How to eliminate wrong answers
Option B is wrong because if the username were incorrect, the error would typically be 'Authentication failed' or 'User not found', but the error message shown does not distinguish between username and password; however, the most common cause in Ansible playbooks is a password mismatch, not a username typo. Option C is wrong because if SSH were not enabled, the error would be 'Connection refused' or 'No route to host', not 'Permission denied'. Option D is wrong because Ansible version incompatibility with NX-OS would manifest as module execution failures or unsupported features, not an SSH authentication error.
A network engineer wants to automate the deployment of a new VLAN across all Cisco Nexus switches in a data center using Python scripts. Which tool is most appropriate for this task?
NX-API provides RESTful API for direct configuration via Python.
Why this answer
Cisco NX-API provides a RESTful API interface on Nexus switches, allowing direct HTTP/HTTPS calls to configure VLANs programmatically. Using Python's requests library, you can send structured JSON payloads to the API endpoint, making it the most direct and efficient method for script-driven automation without requiring intermediate tools or protocols.
Exam trap
Cisco often tests the distinction between direct programmatic APIs (NX-API) and higher-level automation tools (Ansible) or legacy methods (SNMP, SSH), expecting candidates to recognize that the question's emphasis on 'Python scripts' points to a library-based API call rather than a separate automation framework.
How to eliminate wrong answers
Option B is wrong because SSH CLI commands via Paramiko emulate a terminal session, which is slower, less reliable for large-scale automation, and requires parsing CLI output, whereas NX-API offers structured data exchange. Option C is wrong because Ansible is a configuration management tool that abstracts the underlying API or CLI, but the question specifically asks for a Python script-based tool; Ansible playbooks are written in YAML, not Python scripts, and while Ansible can use NX-API modules, the question's context demands a direct Python scripting approach. Option D is wrong because SNMP SET commands are designed for monitoring and simple configuration changes, not for complex tasks like VLAN deployment, and they lack the transactional reliability and structured data handling of NX-API.
A financial services company operates a multi-site data center with Cisco ACI. The automation team uses Ansible Tower to manage configurations. They have a playbook that configures EPGs using the 'aci_epg' module. The playbook runs successfully for most sites but fails on one site with the error 'Object 'uni/tn-Tenant1/ap-AP1/epg-EPG1' doesn't exist'. The engineer checks the ACI fabric and confirms that the tenant, application profile, and EPG exist on that site. The playbook uses the same credentials and variables across all sites. What is the most likely cause of the failure?
Leads to connection to wrong APIC where EPG doesn't exist.
Why this answer
The error 'Object doesn't exist' despite the EPG being present on the ACI fabric indicates that Ansible is targeting the wrong fabric or APIC. Since the playbook uses the same credentials and variables across all sites, the most likely cause is an incorrect fabric name in the Ansible inventory for that specific site, causing the module to query a different APIC cluster where the object does not exist.
Exam trap
Cisco often tests the concept that Ansible inventory variables (like fabric hostname or APIC IP) must match the target site, and candidates mistakenly focus on credentials or module syntax instead of verifying the inventory configuration for each site.
How to eliminate wrong answers
Option A is wrong because the playbook uses the same credentials across all sites, and if a different user lacked permissions, the error would typically be an authentication or authorization failure, not an 'object doesn't exist' error. Option B is wrong because an APIC version incompatibility would likely cause module-level errors (e.g., missing parameters or API changes), not a specific object-not-found error for an existing EPG. Option C is wrong because a typo in the EPG name would cause the same error across all sites, not just one, and the engineer confirmed the EPG exists with the correct name on the failing site.
Which feature on Nexus switches provides a Linux shell environment to run Python scripts and tools directly on the switch?
Correct: Guest Shell is a Linux shell environment on Nexus for running Python and other scripts.
Why this answer
The Guest Shell provides a secure Linux container environment for running custom scripts and tools on Nexus switches.
In an ACI fabric, an automation engineer needs to create a new tenant with an application profile and EPG using the APIC REST API. The engineer decides to use the Cobra SDK for Python. Which statement about the Cobra SDK is true?
Cobra mirrors the MIT with Python objects.
Why this answer
Cobra SDK provides Python bindings for the APIC REST API, allowing direct manipulation of the MIT.
A data center team is automating network changes and wants to ensure that only validated configurations are deployed to production. Which CI/CD practice specifically addresses this?
Automated testing validates configurations in a pipeline.
Why this answer
Automated testing (e.g., unit tests, integration tests) in the CI/CD pipeline validates changes before deployment.
A Python script using NX-API returns HTTP 401. What is the most likely cause?
Invalid credentials cause 401, but more specifically, missing or wrong username/password.
Why this answer
HTTP 401 Unauthorized indicates that the server understood the request but authentication is required and has failed or has not been provided. In the context of NX-API, this error is most directly caused by providing invalid or missing credentials (Option D). If NX-API is not enabled on the switch, the endpoint is unavailable and typically results in an HTTP 404 Not Found or a connection error, not a 401.
Exam trap
Cisco may attempt to mislead candidates into thinking that a 401 error is due to the API not being enabled, exploiting the common confusion between service unavailability and authentication failures. However, standard HTTP semantics dictate that 401 is specifically tied to failed authentication.
How to eliminate wrong answers
Option A is wrong because an incorrect NX-API version in the URL would typically result in a 404 Not Found or a different HTTP error, not a 401 Unauthorized, as the request would reach a non-existent endpoint. Option B is wrong because a firewall blocking port 443 would cause a connection timeout or a TCP reset, not an HTTP 401 response, which requires the TCP handshake to complete and the HTTP server to respond. Option D is wrong because invalid credentials would indeed produce a 401 error, but the question asks for the 'most likely' cause; in practice, NX-API being disabled is a more common initial misconfiguration than entering wrong credentials, and the 401 in that case is a generic response from the switch's HTTP server when the API feature is off.
A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?
401 Unauthorized indicates authentication failure.
Why this answer
A 401 Unauthorized error in REST API communication indicates that the request lacks valid authentication credentials. For Cisco Nexus 9000 switches, REST API access typically requires a token-based authentication (e.g., using HTTP Basic Auth to obtain a session token or cookie). If the token is invalid or expired, the API server rejects the request with a 401 status code, as the script cannot prove its identity.
Exam trap
Cisco often tests the distinction between 401 Unauthorized (authentication failure) and 403 Forbidden (authorization failure), and candidates mistakenly choose 'insufficient privileges' (Option C) because they confuse authentication with authorization.
How to eliminate wrong answers
Option A is wrong because API rate limiting (e.g., exceeding requests per second) typically returns a 429 Too Many Requests error, not 401 Unauthorized. Option B is wrong because a network connectivity issue would result in a timeout or connection refused error (e.g., HTTP 0 or socket error), not a 401 HTTP status code. Option C is wrong because insufficient privileges (e.g., non-admin role) would cause a 403 Forbidden error after successful authentication, not a 401 Unauthorized error.
An engineer is writing a Python script to interact with a Nexus 9000 switch using the NX-API REST interface. Which Python library is designed for this purpose?
Specifically built for NX-API REST.
Why this answer
The cisco_nxapi library provides methods to call NX-API REST endpoints from Python.
A network engineer wants to use Ansible to automate the configuration of Nexus switches. Which two statements about the cisco.nxos Ansible collection are correct? (Choose two.)
nxos_config sends arbitrary NX-OS commands.
Why this answer
The collection includes modules like nxos_config and nxos_vlan, and it is supported on NX-OS platforms.
What is the primary purpose of NX-API on Cisco Nexus switches in a data center automation context?
NX-API translates CLI commands into JSON/REST calls, returning structured data for automation.
Why this answer
NX-API provides a RESTful API interface on Cisco Nexus switches, enabling programmatic access to CLI commands and returning structured data in formats like JSON or XML. This is essential for data center automation because it allows external tools (e.g., Ansible, Python scripts) to configure and retrieve state from the switch without requiring interactive CLI sessions, directly supporting infrastructure-as-code workflows.
Exam trap
Cisco often tests the distinction between a programmatic API (NX-API) and a web-based GUI, leading candidates to confuse NX-API with the Device Manager web interface, which is a separate feature for manual browser-based management.
How to eliminate wrong answers
Option A is wrong because NX-API is not designed to replace SNMP for monitoring and alerting; SNMP remains the standard for trap-based alerts and performance monitoring, while NX-API focuses on configuration and operational data retrieval via REST. Option B is wrong because NX-API does not enable direct configuration from a web browser without CLI; it is an API endpoint consumed by programs, not a browser-based GUI. Option C is wrong because NX-API is not a web-based GUI for manual switch configuration; Cisco Nexus switches offer a separate web GUI (e.g., Device Manager), but NX-API is strictly a programmatic interface.
A network team is planning to automate configuration management of a brownfield Nexus 9000 fabric using YANG data models and NETCONF. Which consideration is critical when implementing this solution?
In brownfield, understanding the current state via YANG is needed to plan incremental changes and avoid drift.
Why this answer
In a brownfield Nexus 9000 fabric, the operational state (e.g., interface status, routing table) must be modeled against the device-specific YANG model to detect and correct configuration drift. NETCONF uses YANG models to define both configuration and operational data, but only the device-specific native model accurately reflects the actual running state. Without this alignment, automated remediation may push incorrect configurations, leading to network instability.
Exam trap
Cisco often tests the misconception that NETCONF is a complete CLI replacement, but the trap here is that operational state modeling against device-specific YANG is critical for drift detection in brownfield environments, not just configuration push.
How to eliminate wrong answers
Option B is wrong because NETCONF does not replace the CLI entirely; CLI remains a fallback for troubleshooting, emergency access, and operations not covered by YANG models. Option C is wrong because NETCONF is a configuration protocol that can be used for initial provisioning, but zero-touch provisioning (ZTP) typically relies on DHCP, TFTP, and scripts, not NETCONF alone. Option D is wrong because NX-OS versions support different YANG models (e.g., OpenConfig vs.
Cisco native), and compatibility must be verified; assuming uniform support can cause schema mismatches and failed operations.
Which TWO are features of the Embedded Event Manager (EEM) with Python applets on Cisco NX-OS? (Choose two.)
Correct. EEM applets can issue CLI commands.
Why this answer
EEM with Python applets allows event-driven automation on-box. Python applets can run without external scripting, and they can react to events like syslog messages. EEM applets do not require an external server; they run on the switch.
Python applets support libraries like cisco_nxapi, but EEM itself does not require a separate Python environment.
Which protocol is used by NETCONF to transport YANG-defined configuration data between a controller and a network device?
NETCONF uses SSH as transport with XML encoding.
Why this answer
NETCONF uses XML over SSH (RFC 6241) for secure transport.
A DevOps team uses Ansible to automate the configuration of Cisco Nexus switches. After running a playbook, some switches have the correct configuration but others do not. The playbook uses the 'nxos_config' module. Which action should be taken to ensure consistent configuration?
Backup provides a restore point for rollback.
Why this answer
The 'nxos_config' module's 'backup' option saves the running configuration to a file before applying changes. This ensures that if a switch fails to apply the configuration correctly, the original configuration is preserved for rollback, enabling consistent recovery across all switches. Without this, some switches may have partial or incorrect configurations that cannot be easily reverted.
Exam trap
The trap here is that candidates confuse 'backup' with a simple logging feature, when in fact it is a critical rollback mechanism that directly addresses configuration drift and failed deployments in network automation.
How to eliminate wrong answers
Option A is wrong because 'ignore_errors: true' would cause Ansible to continue executing tasks even if the 'nxos_config' module fails on a switch, masking configuration errors and leading to inconsistent states without any indication of failure. Option C is wrong because the 'serial' directive controls the number of hosts processed in parallel but does not address configuration consistency or rollback; it only affects execution order and can actually slow down deployment without solving the core issue. Option D is wrong because check mode (--check) only simulates changes without applying them, so it cannot ensure consistent configuration across switches; it is useful for validation but does not provide a mechanism to recover from failed applications.
A network engineer wants to send NX-OS CLI commands via HTTP/HTTPS to a Nexus switch programmatically. Which API should be used?
Correct: NX-API CLI is designed to send NX-OS CLI commands via API calls.
Why this answer
NX-API CLI allows sending NX-OS CLI commands via HTTP/HTTPS using XML or JSON.
A network administrator wants to send NX-OS CLI commands to a Nexus switch via HTTP/HTTPS. Which API should be used?
Correct API for CLI commands over HTTP/HTTPS.
Why this answer
NX-API CLI allows sending NX-OS commands via HTTP/HTTPS in either XML or JSON format.
Which three components are part of the ACI Management Information Tree (MIT)? (Choose three.)
EPG is a child of AP.
Why this answer
Tenant, Application Profile, and Endpoint Group are managed objects in the MIT hierarchy.
Match each Cisco data center high availability feature to its description.
Drag a concept onto its matching description — or click a concept then click the description.
First-hop redundancy for default gateway
Multi-chassis link aggregation with loop prevention
Transparent interconnection of lots of links (TRILL-based)
Non-Stop Forwarding during supervisor switchover
Stateful Switchover for control plane redundancy
Why these pairings
The correct matches are: VRRP is an open standard protocol for router redundancy; GLBP provides load balancing across gateways; NSF allows forwarding to continue during switchover; VPC bundles links from two switches. Common confusions include mistaking HSRP for VRRP (HSRP is proprietary) and confusing SSO (state synchronization) with NSF (forwarding continuity).
Which TWO methods are supported by Cisco NX-API for automating Nexus switches? (Choose two.)
Correct. NX-API CLI sends NX-OS commands via API.
Why this answer
NX-API supports both REST (JSON/XML over HTTP/HTTPS) and CLI (sending NX-OS commands via API). NETCONF and RESTCONF are separate protocols, not part of NX-API. SNMP is not a NX-API method.
Refer to the exhibit. What is the intended effect of this Ansible playbook task?
The nxos_config module pushes the provided lines, ensuring they are present.
Why this answer
The Ansible playbook task uses the `cisco.nxos.nxos_vlans` module with the `state: merged` directive, which ensures that the specified VLAN configuration (VLAN 10 with name 'Automation_VLAN') is present on the target Nexus switches. If VLAN 10 does not exist, it will be created; if it exists with a different name, it will be updated. The `merged` operation does not delete or reboot; it only applies the configuration to align the device's state with the playbook's desired state.
Exam trap
Cisco often tests the distinction between `merged`, `replaced`, `overridden`, and `deleted` states in Ansible modules, and the trap here is that candidates mistakenly associate any configuration task with a reboot or save operation, or assume `merged` implies deletion of existing configuration.
How to eliminate wrong answers
Option A is wrong because the `state: merged` operation adds or updates configuration, not deletes; deleting VLANs would require `state: absent` or a separate task. Option B is wrong because saving the running configuration to startup is not part of the `nxos_vlans` module; it would require a separate task using `cisco.nxos.nxos_config` with `save_when: always` or the `nxos_command` module to issue `copy running-config startup-config`. Option C is wrong because rebooting switches is not an action of the `nxos_vlans` module; a reboot would require a task using `nxos_reboot` or `nxos_command` with a reload command, and the `merged` state does not trigger any reboot.
A network engineer needs to automate the configuration of BGP on a Nexus switch using Ansible. Which Ansible module from the cisco.nxos collection is appropriate for managing BGP configuration?
Directly manages BGP configuration.
Why this answer
The nxos_bgp module is specifically designed to manage BGP settings on NX-OS devices.
Refer to the exhibit. A Python script is processing the response from NX-API. It attempts to extract the interface state using `response['ins_api']['outputs']['output']['body']['ROW_interface']['state']` but receives a KeyError. What is the most likely reason?
Some NX-API outputs wrap rows in a table key; the script missed that level.
Why this answer
The NX-API response for interface commands includes a 'TABLE_interface' key that wraps the 'ROW_interface' key. The script attempts to access 'ROW_interface' directly under 'body', but the correct path is `response['ins_api']['outputs']['output']['body']['TABLE_interface']['ROW_interface']['state']`. Option B correctly identifies this missing intermediate level.
Exam trap
The trap here is that candidates assume the JSON path directly mirrors the CLI output structure, forgetting that NX-API wraps tabular data in an intermediate 'TABLE_' key that must be included in the dictionary traversal.
How to eliminate wrong answers
Option A is wrong because the 'output' key is a dictionary, not a list; if it were a list, the error would be a TypeError, not a KeyError. Option C is wrong because the 'ins_api' key is at the top level of the JSON response, not nested inside another object. Option D is wrong because if the command had failed, the 'body' key would still exist but contain an error message or be empty; a missing 'body' would cause a different error, not a KeyError on 'ROW_interface'.
In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?
Ansible modules are idempotent and widely used in ACI automation.
Why this answer
Ansible's `state: present` in the `cisco.aci` collection inherently provides idempotency: it checks the current state of the ACI object and only applies changes if the desired state differs, ensuring no duplicate or conflicting configurations. This aligns with best practices for automation, as it avoids manual error handling and guarantees consistent policy deployment without side effects.
Exam trap
The trap here is that candidates often assume any API-based approach (like REST POST or Python SDK) is inherently idempotent, but Cisco tests the understanding that true idempotency requires a declarative or state-checking mechanism, which Ansible's `state: present` provides out-of-the-box.
How to eliminate wrong answers
Option A is wrong because the REST API POST method is not idempotent by default; repeated POST requests create duplicate objects or cause errors unless the client implements explicit pre-checks, which violates the principle of idempotent deployment. Option C is wrong because CLI scripts using expect or pexpect are inherently non-idempotent; they rely on screen scraping and sequential commands, which can fail unpredictably due to timing issues or state changes, and they lack built-in state reconciliation. Option D is wrong because while a Python SDK with a check-and-create loop can achieve idempotency, it requires custom error handling and is less maintainable than using a declarative tool like Ansible, which abstracts the idempotency logic and is a recognized best practice in ACI automation.
Which statement accurately describes the APIC REST API?
Correct description.
Why this answer
APIC REST API is a RESTful API that uses JSON over HTTPS and allows management of the ACI fabric.
Which YANG model is commonly used for vendor-neutral network configuration and operations?
OpenConfig provides vendor-neutral YANG models.
Why this answer
OpenConfig is a vendor-neutral YANG model initiative. Cisco native YANG models are vendor-specific. NETCONF and RESTCONF are protocols, not models.
Which two of the following are benefits of using YANG data models for network automation? (Choose two.)
Standard models like OpenConfig support multi-vendor.
Why this answer
YANG models provide structured, standardized data models, enabling automation and vendor interoperability. They reduce manual CLI commands and allow validation. YANG is not tied to a specific transport.
Which YANG-based protocol uses RESTful operations (GET, POST, PUT, DELETE) over HTTP/HTTPS for network configuration?
Correct: RESTCONF uses REST over HTTP/HTTPS.
Why this answer
RESTCONF (RFC 8040) is a RESTful protocol that uses HTTP methods and YANG data models.
An engineer is writing a Python script to automate ACI fabric discovery using the APIC SDK. The script needs to wait until the fabric formation is complete before proceeding. Which approach is most reliable?
Polling is reliable and adaptive to actual state changes.
Why this answer
The most reliable method to wait for ACI fabric formation to complete is to periodically poll the fabric membership state via the REST API. The APIC SDK provides access to the fabric membership endpoint (e.g., /api/node/class/fabricNode.json), which returns the current state of each node. By polling this endpoint until all expected nodes report an 'active' or 'in-pod' status, the script can accurately determine when the fabric is fully formed, avoiding race conditions or incomplete discovery.
Exam trap
Cisco often tests the misconception that a fixed delay (time.sleep) or a configuration export object can reliably synchronize with asynchronous fabric discovery, when in fact only direct polling of the fabric membership state provides deterministic confirmation.
How to eliminate wrong answers
Option A is wrong because asynchronous callbacks in the APIC SDK are not designed for monitoring fabric discovery completion; they are typically used for event-driven notifications on specific object changes, not for polling the overall fabric formation state, and they may miss transient states or require complex setup. Option C is wrong because the configExportP object is used for exporting configuration snapshots, not for monitoring fabric discovery; it has no mechanism to indicate fabric formation status. Option D is wrong because using time.sleep() for a fixed duration is unreliable; fabric discovery time varies based on network conditions, hardware, and scale, so a fixed sleep may either waste time or proceed before discovery is complete, leading to script failures.
A DevOps engineer is building a CI/CD pipeline for network changes. After a configuration change is pushed to a Nexus switch, which step should be included to verify that the change did not cause any operational issues?
Automated validation ensures the change is safe.
Why this answer
Automated validation using show commands or YANG-based telemetry can confirm operational state. Manual verification defeats automation. Rolling back without validation may be premature.
Logging is passive.
An organization is migrating from traditional SNMP monitoring to model-driven telemetry on their Nexus 9000 switches. They have configured a telemetry destination using gRPC and have defined sensor paths for interface statistics. After several hours, the collector (a Linux server running Telegraf) reports no data received. The engineer verifies that the switch can reach the collector via ICMP. On the switch, 'show telemetry data collector details' indicates the destination is 'connected', but the 'last data sent' timestamp is several hours old. Which action should the engineer take next?
Most likely cause: sensor path not matching actual data.
Why this answer
The 'show telemetry data collector details' output shows the destination is 'connected' and the switch can reach the collector, ruling out network or connectivity issues. The stale 'last data sent' timestamp indicates the telemetry process is running but no data is being published, which typically means the configured sensor paths are not producing data—either because the paths are incorrect, the MIB objects are not supported, or the interfaces are not generating the expected statistics. Option C is correct because verifying the sensor paths and ensuring data generation addresses the root cause without unnecessary changes or reboots.
Exam trap
Cisco often tests the misconception that a 'connected' telemetry destination implies data is flowing, when in fact the connection state only reflects the gRPC session, not the subscription health—candidates may waste time on transport or connectivity fixes instead of verifying the sensor paths.
How to eliminate wrong answers
Option A is wrong because changing the transport protocol from gRPC to HTTP would not fix the issue; the problem is that no data is being sent, not that the transport is failing (the collector is reachable and the destination shows 'connected'). Option B is wrong because rebooting the switch is an extreme, unnecessary step that would disrupt operations and does not address the likely misconfiguration of sensor paths; the telemetry process is already running (destination 'connected'). Option D is wrong because increasing the sampling interval would reduce the frequency of data collection, but if no data is being generated at all, changing the interval will not cause data to appear—it would only delay the problem further.
Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?
This is required for privilege escalation on NX-OS.
Why this answer
The error 'privilege escalation required' indicates that Ansible cannot execute commands with the necessary elevated privileges on the NX-OS switch. In Ansible, privilege escalation is handled via the 'become' mechanism, and for network devices like NX-OS, the 'ansible_become_password' (or 'enable' password) is required to enter privileged EXEC mode. Without this password, Ansible remains in user EXEC mode, which lacks the authority to apply VLAN configurations.
Exam trap
Cisco often tests the distinction between authentication (ansible_user/ansible_password) and authorization (ansible_become_password), leading candidates to mistakenly check SSH credentials or inventory syntax instead of the privilege escalation password.
How to eliminate wrong answers
Option A is wrong because 'host_key_checking' controls SSH host key verification, not privilege escalation; disabling it would only skip SSH fingerprint prompts. Option C is wrong because 'ansible_user' specifies the SSH username for login, which is unrelated to the privilege level after authentication. Option D is wrong because inventory file syntax errors would cause a parsing failure or host unreachability, not a specific 'privilege escalation required' message during task execution.
Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Port-channel creation involves interface creation, mode setting, member addition, and verification.
A network automation engineer wants to use EEM with Python applets on a Nexus switch to trigger a script when an interface goes down. Which EEM configuration is required to invoke the Python script?
Correct: This runs the Python script in the Guest Shell or OnEX.
Why this answer
EEM applets can use the 'action' command with 'python' to run a Python script in the Guest Shell or OnEX environment.
Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)
Idempotency is achieved by targeting specific objects.
Why this answer
The Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.
Exam trap
Cisco often tests the distinction between XML-based APIs (like UCS Manager) and RESTful JSON APIs (like Cisco DNA Center or ACI REST API), so the trap here is assuming that UCS Manager uses JSON or SNMP for configuration, when it strictly uses XML over HTTP/HTTPS.
Which THREE components are required to successfully use NETCONF for configuration automation on a Nexus 9000 switch?
NETCONF uses SSH as its transport protocol (RFC 6242).
Why this answer
B is correct because NETCONF operates over SSH as its transport protocol (RFC 6242), so SSH connectivity to the switch is mandatory for establishing the NETCONF session. Without SSH, the NETCONF client cannot connect to the NETCONF server running on the Nexus 9000.
Exam trap
Cisco often tests the misconception that NX-API is a prerequisite or fallback for NETCONF, but in reality they are independent automation interfaces with different transport and data encoding methods.
Which of the following is a benefit of using OpenConfig YANG models for network automation?
Correct: OpenConfig models are vendor-agnostic.
Why this answer
OpenConfig YANG models are vendor-neutral, allowing consistent configuration across multi-vendor environments.
A network administrator needs to automate ACI configuration using a Python library that abstracts the APIC REST API. Which library should be used?
acitoolkit is a Python library for ACI automation.
Why this answer
The acitoolkit is a Python library that provides an abstraction layer over the APIC REST API. Cobra SDK is a lower-level Python SDK. cisco_nxapi is for Nexus, not ACI. Ansible is not a Python library.
Which TWO of the following are valid methods to run Python scripts on a Cisco Nexus switch? (Choose two.)
Correct: OnEX is a native Python interpreter on NX-OS.
Why this answer
Guest Shell provides a Linux environment for Python, and OnEX is a Python interpreter built into NX-OS.
Which THREE are valid characteristics of using Terraform for ACI automation? (Choose three.)
Correct. Terraform uses HCL.
Why this answer
Terraform uses a declarative approach, defining desired state. It manages the full lifecycle of infrastructure. It uses HCL for configuration, not JSON.
Terraform state is used to track real-world resources. Terraform is not agent-based; it uses APIs.
A network engineer needs to automate the configuration of BGP on a Nexus 9000 switch using Ansible. The playbook uses the cisco.nxos.nxos_bgp module. Which of the following parameters is required in the module to specify the local AS number?
Correct: 'local_as' is the parameter in nxos_bgp.
Why this answer
The nxos_bgp module requires the 'local_as' parameter to configure the BGP autonomous system number.
Which Ansible module from the cisco.nxos collection is used to apply a set of CLI commands on a Nexus switch?
nxos_config applies CLI commands to NX-OS.
Why this answer
nxos_config applies raw CLI commands or configuration snippets. nxos_vlan, nxos_interface, and nxos_bgp are purpose-built for specific features.
A network engineer needs to retrieve the operational state of interfaces from a Nexus switch using a YANG-based protocol. Which protocol should be used to get structured data via REST?
RESTCONF is RESTful and supports YANG data models.
Why this answer
RESTCONF uses RESTful operations and can return data in JSON or XML over HTTP/HTTPS. NETCONF uses SSH. NX-API CLI returns text.
SNMP is not YANG-based.
An engineer needs to trigger a Python script on a Nexus switch when a specific syslog message appears. Which Cisco technology allows event-driven execution of Python applets?
EEM can trigger actions based on events like syslog patterns.
Why this answer
EEM (Embedded Event Manager) with Python applets can monitor syslog events and run scripts.
An engineer is implementing CI/CD for network changes. Which tool is commonly used for version control of network configuration files and infrastructure code?
Correct: Git is used for version control.
Why this answer
Git is the industry-standard version control system used for managing infrastructure as code, including network configurations.
A Python script uses NX-API's XML output to extract interface status. Which method is most robust and recommended for parsing the XML?
ElementTree is built-in and efficient for XML parsing.
Why this answer
xml.etree.ElementTree is the recommended method because it is part of Python's standard library, provides robust tree-based parsing that handles XML namespaces and nested structures correctly, and is specifically designed for programmatic XML manipulation. For NX-API XML output, which follows a consistent schema, ElementTree allows reliable extraction of interface status using XPath or tag traversal without fragility.
Exam trap
Cisco often tests the distinction between built-in vs. third-party libraries and between string manipulation vs. proper parsing, leading candidates to choose BeautifulSoup (which is overkill and non-standard for XML) or regex (which seems flexible but is technically incorrect for XML).
How to eliminate wrong answers
Option A is wrong because splitting by tags is brittle and fails if the XML contains whitespace, attributes, or nested elements; it cannot handle the structured hierarchy of NX-API responses. Option B is wrong because regular expressions are not designed for parsing XML's nested tree structure and will break on attribute order changes, CDATA sections, or escaped characters, leading to incorrect or incomplete data extraction. Option C is wrong because BeautifulSoup is a third-party library primarily for HTML parsing and requires additional installation, whereas the exam expects a built-in, lightweight solution for XML parsing in automation scripts.
A network engineer wants to automate the configuration of VLANs on a Nexus 9000 switch using REST-based APIs. Which approach should be used to send NX-OS commands via HTTP/HTTPS in JSON format?
NX-API REST uses XML/JSON over HTTP/HTTPS for configuration.
Why this answer
NX-API REST supports XML or JSON over HTTP/HTTPS and allows configuration via RESTful operations. NX-API CLI sends CLI commands over HTTP, not REST. Guest Shell runs bash scripts.
NETCONF uses XML over SSH.
Which two statements about the Cisco NX-API REST interface are true? (Choose two.)
NX-API CLI allows sending CLI commands.
Why this answer
NX-API REST supports JSON and XML over HTTP/HTTPS, and can be used to send CLI commands (via NX-API CLI) as well as structured data.
A developer wants to run a Python script directly on a Nexus switch to automate local operations. Which feature allows executing a Python script in a Linux environment on the switch?
Guest Shell provides a bash shell environment for running Python scripts.
Why this answer
Guest Shell provides a secure Linux environment on Nexus switches where Python scripts can run. EEM with Python applets runs scripts triggered by events. OnEX is not a standard feature.
NX-API is for remote API access.
Refer to the exhibit. A Python script using the Cisco ACI Cobra SDK fails with 'AuthenticationError'. Which of the following is the most likely cause?
AuthenticationError directly indicates failed login due to credentials.
Why this answer
The 'AuthenticationError' in the Cisco ACI Cobra SDK indicates that the APIC rejected the login credentials. This error is raised specifically when the username or password provided in the script's login method (e.g., 'Login('apic_url', 'username', 'password')') does not match a valid APIC local or AAA-authenticated user. The SDK performs an HTTP POST to the APIC's '/api/aaaLogin.json' endpoint, and a non-200 response with an authentication failure triggers this exception.
Exam trap
Cisco often tests the distinction between authentication failures (wrong credentials) and authorization failures (no API access), so candidates mistakenly choose 'user does not have API access' when the error message clearly points to the login phase.
How to eliminate wrong answers
Option A is wrong because an incorrect APIC URL would typically result in a connection timeout or HTTP 404 error, not an 'AuthenticationError' — the SDK would fail to reach the APIC before authentication is attempted. Option B is wrong because if the user lacks API access, the APIC would still authenticate the user (returning a token) but then deny subsequent API operations with a 403 Forbidden error; the 'AuthenticationError' occurs at login, not during API calls. Option D is wrong because missing imports would cause a Python ImportError or NameError at script startup, not an 'AuthenticationError' at runtime — the SDK would not even execute the login call.
A Python script using the pyATS framework to parse 'show interface' output on a Nexus 9000 switch fails with a parsing error, even though the CLI command runs successfully. What is the most likely missing component?
pyATS uses Genie parsers that are version-specific; missing parser leads to parse error.
Why this answer
The pyATS framework relies on Genie parsers to convert raw CLI output into structured data. If the Genie parser for the specific NX-OS version is missing or not imported, the script cannot parse the 'show interface' output, resulting in a parsing error even though the CLI command itself runs successfully. This is the most likely missing component because pyATS/Genie parsers are version-specific and must be installed for the exact platform and OS version.
Exam trap
Cisco often tests the distinction between command execution success and parsing success, trapping candidates who assume a working CLI command guarantees pyATS/Genie parsing will work without the correct version-specific parser installed.
How to eliminate wrong answers
Option A is wrong because authentication methods (e.g., SSH credentials, API tokens) are used for device connection, not for parsing CLI output; a parsing error occurs after successful connection and command execution. Option C is wrong because using the wrong device type (e.g., iosxe instead of nxos) would cause a different error—either a connection failure or a mismatch in command syntax—not a parsing error on a command that runs successfully. Option D is wrong because NETCONF is not required for pyATS/Genie parsing; pyATS can parse CLI output over SSH or Telnet without any NETCONF configuration.
An administrator wants to use the APIC REST API to create a new Tenant in ACI. Which object in the Management Information Tree (MIT) should be the target of the POST request?
fvTenant is the correct object class for a tenant.
Why this answer
The Tenant object is at the top of the MIT hierarchy under root. The API endpoint for tenants is typically /api/mo/uni/tn-[name].json. EPG, BD, and AP are child objects.
A network engineer wants to automate the deployment of VLANs across 50 Nexus switches in a data center. Which approach provides the most consistent and repeatable results with minimal manual effort?
Declarative and idempotent, ensures consistent configuration.
Why this answer
Ansible playbook with the nxos_vlan module is the correct choice because it provides idempotent, declarative automation that ensures consistent VLAN configuration across all 50 Nexus switches with minimal manual effort. Ansible handles SSH connectivity and state management natively, eliminating the need for custom scripting and reducing the risk of human error.
Exam trap
Cisco often tests the distinction between ad-hoc scripting (like netmiko or Bash) and declarative automation tools (like Ansible) that provide idempotency and state management, leading candidates to choose a technically functional but less robust scripting approach.
How to eliminate wrong answers
Option A is wrong because a Python script using netmiko, while programmatic, requires custom error handling, idempotency logic, and manual loop management for 50 switches, making it less consistent and more effort than Ansible's built-in modules. Option B is wrong because manual CLI on each switch is error-prone, time-consuming, and does not scale to 50 switches, offering no repeatability or automation. Option C is wrong because a Bash script with SSH relies on fragile expect-like constructs or raw SSH commands, lacks idempotency, and requires extensive custom logic to handle device differences and failures, leading to inconsistent results.
Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?
JSON returns numbers as strings in this context; a type mismatch causes failure.
Why this answer
The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.
Exam trap
Cisco often tests the nuance that NX-API returns all values as strings, tricking candidates who assume numeric fields are returned as integers and overlook the need for type conversion in validation logic.
How to eliminate wrong answers
Option B is wrong because the JSON output shown is well-formed (valid key-value pairs, proper brackets), so parsing would succeed. Option C is wrong because the output includes 'adminState: up', indicating the interface is administratively up, not down. Option D is wrong because the output clearly contains the 'switchportMode' field with value 'access', so the field is not missing.
Which TWO statements about Cisco NX-API are correct? (Choose two.)
NX-API is a RESTful API over HTTP/HTTPS.
Why this answer
Cisco NX-API is a programmatic interface that uses HTTP/HTTPS as the transport protocol, allowing RESTful API calls to configure and monitor Nexus switches. It supports both XML and JSON output formats, enabling flexible data parsing in automation scripts. This makes options C and E correct.
Exam trap
Cisco often tests the misconception that NX-API uses SSH (like NETCONF) or is limited to specific hardware, when in fact it uses HTTP/HTTPS and is widely supported across Nexus platforms.
A DevOps team wants to apply Infrastructure as Code principles to manage their data center network. Which tool is best suited for declaratively managing ACI configurations using Terraform?
Correct: Terraform's ACI provider enables declarative management.
Why this answer
Terraform uses the terraform-provider-aci to declaratively manage ACI objects like tenants, APs, EPGs, etc.
An engineer is writing an Ansible playbook to configure BGP on a Nexus 9000 switch. Which module from the cisco.nxos collection should be used to manage BGP configuration?
nxos_bgp manages BGP configuration on NX-OS.
Why this answer
The cisco.nxos.nxos_bgp module is specifically designed for BGP configuration on NX-OS devices. nxos_vlan manages VLANs, nxos_interface manages interfaces, and nxos_config applies raw CLI commands.
Which protocol is recommended for streaming model-driven telemetry from NX-OS to a collector?
gRPC with protobuf is the recommended transport for MDT.
Why this answer
gRPC (Google Remote Procedure Call) is the recommended protocol for streaming model-driven telemetry from NX-OS to a collector because it provides efficient, bidirectional streaming over HTTP/2, supports structured data encoding (e.g., Protobuf or JSON), and is natively supported in NX-OS for high-frequency, push-based telemetry. Unlike polling-based protocols, gRPC enables the device to continuously stream operational data to the collector with low latency and minimal overhead.
Exam trap
Cisco often tests the misconception that HTTP or SNMP can handle streaming telemetry, but the trap is that SNMP is pull-based and HTTP lacks the persistent, bidirectional streaming capabilities of gRPC, which is the only option that natively supports the push-based, subscription-driven model required for NX-OS telemetry.
How to eliminate wrong answers
Option A (FTP) is wrong because FTP is a file transfer protocol designed for bulk file uploads/downloads, not for real-time streaming of telemetry data, and it lacks the bidirectional streaming and structured data capabilities required for model-driven telemetry. Option B (SNMP) is wrong because SNMP is a traditional polling-based protocol that uses a pull model (manager requests data from agents), which is inefficient for high-frequency telemetry and does not support the push-based, subscription-driven streaming model that NX-OS telemetry requires. Option C (HTTP) is wrong because while HTTP can be used for telemetry (e.g., via RESTCONF), it is not optimized for streaming; gRPC, which uses HTTP/2 as a transport, provides persistent connections, multiplexing, and server push, making it the superior choice for streaming telemetry in NX-OS.
An engineer wants to automate the creation of VLANs on a Nexus 9000 switch using Python scripts. Which on-box solution allows running Python scripts directly on the switch without an external server?
Guest shell is a Linux container on Nexus for running Python scripts.
Why this answer
Guest shell provides a secure Linux environment on Nexus switches to run Python scripts and tools.
A NETCONF session to an NX-OS switch fails with 'Connection refused'. What is the most likely cause?
Without 'feature netconf', the NETCONF server does not start.
Why this answer
NETCONF uses SSH port 830 by default, but the 'Connection refused' error specifically indicates that the TCP connection was actively rejected by the switch, not that it timed out or was unreachable. This occurs when the NETCONF subsystem is not available because the 'netconf' feature has not been enabled on the NX-OS device, which is required to start the NETCONF server process.
Exam trap
Cisco often tests the distinction between 'Connection refused' (service not running) and 'Connection timed out' (host unreachable or firewall blocking), leading candidates to incorrectly select 'wrong port' or 'unreachable' when the real issue is that the NETCONF feature is not enabled.
How to eliminate wrong answers
Option A is wrong because 'All of the above' cannot be correct since only one option is the most likely cause. Option B is wrong because while the default NETCONF SSH port is 830, a wrong port would result in a timeout or 'Connection timed out', not an active 'Connection refused' — the switch would not reject the connection on a different port unless that port is closed. Option C is wrong because if the switch were unreachable, the error would be 'No route to host' or 'Connection timed out', not 'Connection refused', which requires the switch to be reachable and actively rejecting the connection.
An engineer wants to automate VLAN configuration on a Cisco Nexus 9000 switch using a Python script running in the guest shell. Which library should the engineer use to send NX-OS commands via the NX-API?
Correct. cisco_nxapi is the Python library for NX-API.
Why this answer
The cisco_nxapi library is specifically designed for Python scripts to interact with Nexus switches via NX-API. The OnEX library is not a standard library; guest shell leverages Python on-box, but the library for NX-API calls is cisco_nxapi.
A team is using Cisco DCNM for fabric management. They need to integrate with an external CI/CD pipeline. Which API should they use to trigger a network configuration change?
Centralized northbound API, ideal for CI/CD.
Why this answer
The DCNM REST API is the correct choice because it provides a programmatic, northbound interface specifically designed for integrating Cisco DCNM with external CI/CD pipelines. This API allows you to trigger network configuration changes at the fabric level, abstracting the complexity of individual switches and ensuring consistency across the entire fabric, which is essential for automated, version-controlled deployments.
Exam trap
Cisco often tests the distinction between device-level APIs (like NX-API) and fabric-level management APIs (like DCNM REST API), leading candidates to choose NX-API because they assume it is the most direct way to configure switches, but they miss that the question specifically requires integration with a CI/CD pipeline for fabric management, which demands a centralized, orchestrated approach.
How to eliminate wrong answers
Option A is wrong because SNMP SET is a legacy, device-level protocol that is not designed for fabric-wide orchestration or CI/CD integration; it is slow, lacks transactional guarantees, and does not support the declarative model needed for automated pipelines. Option C is wrong because NX-API on each switch operates at the individual device level, requiring the pipeline to manage each switch separately, which defeats the purpose of fabric-level management and introduces risk of configuration drift. Option D is wrong because CLI via SSH is a manual, non-scalable method that cannot be reliably integrated into an automated CI/CD pipeline; it lacks idempotency, audit trails, and the ability to roll back changes atomically.
An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?
nxapi is the official Python library for NX-OS NX-API.
Why this answer
The `nxapi` library is specifically designed for automating configuration backups and other management tasks on Cisco NX-OS switches. It provides a Pythonic interface to the NX-API, which uses HTTP/HTTPS-based REST or XML/JSON-RPC calls to execute CLI commands and retrieve structured output, making it the correct choice for this purpose.
Exam trap
Cisco often tests the distinction between generic libraries (like `requests` or `paramiko`) and platform-specific libraries (like `nxapi`), trapping candidates who overlook that `nxapi` provides built-in NX-OS command formatting and authentication, whereas `requests` would require manual construction of NX-API payloads.
How to eliminate wrong answers
Option A is wrong because the `requests` library is a generic HTTP client library for Python; it can be used to send HTTP requests to NX-API but lacks the NX-OS-specific abstractions, authentication handling, and command formatting that `nxapi` provides. Option B is wrong because `paramiko` is an SSHv2 implementation for Python; while it can be used to automate CLI commands over SSH, it is not purpose-built for NX-OS and requires manual handling of SSH sessions, command parsing, and error handling. Option C is wrong because `cli` is not a standard Python library; it is a module within Cisco's NX-OS Python environment (e.g., `from cli import cli`) that runs CLI commands locally on the switch, but it is not a library for external automation of configuration backups.
In ACI, the management information tree (MIT) organizes managed objects hierarchically. Which object is the parent of an Application Profile (AP)?
Tenant is the top-level container; AP is under tenant.
Why this answer
In the MIT, a Tenant contains Application Profiles.
When using Cisco NSO (Network Services Orchestrator) to automate service creation across a data center network, what is a key consideration regarding device compatibility?
NSO requires a compatible NED for each device model and OS version to translate service models.
Why this answer
B is correct because Cisco NSO uses Network Element Drivers (NEDs) to translate service models into device-specific CLI, SNMP, or NETCONF commands. Each NED is tied to a specific device OS version (e.g., IOS-XE 16.12, NX-OS 9.3), so mismatched NEDs cause configuration failures or incomplete deployments. Without a compatible NED, NSO cannot communicate with or configure the device.
Exam trap
The trap here is that candidates assume NSO relies exclusively on NETCONF or YANG for all devices, overlooking the critical role of OS-version-specific NEDs in enabling multi-protocol, multi-vendor automation.
How to eliminate wrong answers
Option A is wrong because NSO does not require NETCONF for all devices; it supports multiple southbound protocols including CLI, SNMP, and RESTCONF, with NEDs abstracting the protocol details. Option C is wrong because YANG models are not hand-coded by the team for each device; NSO uses pre-built NEDs that contain YANG models, and custom YANG models are only needed for service design, not device compatibility. Option D is wrong because NSO is vendor-agnostic and supports multi-vendor environments through NEDs for devices from Cisco, Juniper, Arista, and others.
Which protocol is used by NETCONF for transport?
NETCONF uses SSH for secure transport.
Why this answer
NETCONF (RFC 6241) uses SSH as its transport protocol.
Which three components are part of the ACI Management Information Tree (MIT)? (Choose three.)
Tenant is a top-level object in MIT.
Why this answer
MIT includes objects like tenants, application profiles, EPGs, and bridge domains.
Ready to test yourself?
Try a timed practice session using only Automation questions.