CCNA Automation Questions

Cisco NSO (Network Services Orchestrator) is the correct tool because it provides multi-domain, multi-vendor orchestration with native support for both NX-OS and ACI through its Network Element Drivers (NEDs). NSO uses a model-driven approach with YANG data models and NETCONF/RESTCONF protocols to manage configuration consistency across distributed data centers, enabling service-level abstraction and closed-loop automation that other tools lack.

C is correct because Ansible is an agentless automation tool that uses SSH to push declarative configurations to Nexus 9000 switches. It supports idempotent playbooks, meaning the same playbook can be run multiple times without changing the state if the desired configuration is already in place, and its YAML-based playbooks integrate seamlessly with version control systems like Git.

The 'XML namespace mismatch' error occurs when the namespace URI declared in the XML payload does not match the namespace defined in the YANG module. NETCONF uses the namespace to identify the correct YANG model for parsing the configuration data. If the namespace in the XML does not exactly match the one in the Cisco NX-OS openconfig YANG model, the switch rejects the operation with this specific error.

NX-API REST supports JSON and XML and uses HTTPS for secure communication.

The MIT follows a hierarchy: Tenant > Application Profile (AP) > Endpoint Group (EPG).

The cisco.nxos collection includes modules like nxos_vlan, nxos_interface, nxos_bgp, and nxos_config. Playbooks are written in YAML. Ansible uses SSH (or NX-API) to connect, not a dedicated agent. 'nxos_facts' is a module for gathering facts.

Correct matches: APIC is the central policy controller; Spine switches connect leaves; Leaf switches connect endpoints. Common confusions include mistaking APIC as a forwarding switch and associating EPG with spine switches.

Git is the industry standard for version control, enabling history, branching, and collaboration.

The MIT includes objects like tenants, application profiles (AP), EPGs, and bridge domains (BD). VRF is also part of MIT. 'fvTenant', 'fvAp', 'fvAEPg', 'fvBD' are object classes. 'l3extOut' is for L3 out, not part of the core MIT hierarchy for tenant networking.

The cisco.nxos collection includes the nxos_vlan module specifically for managing VLANs on NX-OS devices.

Password recovery involves boot interruption, register change, boot, password reset, and save.

Git is a distributed version control system widely used for managing infrastructure as code, including network configurations. Ansible is for automation, Jenkins for CI/CD pipelines, and Docker for containers.

The APIC REST API supports certificate-based authentication (option B) and local AAA user authentication with a username and password (option C). Certificate-based authentication uses X.509 certificates for secure, non-interactive API access, while local AAA authentication relies on credentials stored directly on the APIC. Both methods are explicitly documented as valid for REST API calls.

IaC involves managing and provisioning network infrastructure through machine-readable definition files, rather than manual processes. Storing configurations in version control (like Git) and using automated tools is key.

NETCONF uses XML for data encoding and provides operations like get, edit-config, etc., based on YANG models.

acitoolkit uses a Session object; after making changes, the session's push_to_apic method must be called to commit.

RESTCONF (RFC 8040) is a REST-based protocol using HTTP methods and supports XML/JSON.

The Cobra SDK provides an object-oriented Python interface for ACI automation, wrapping the APIC REST API.

The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

The NX-API on Nexus switches requires a JSON payload wrapped in an 'ins_api' object that includes fields such as 'version', 'type', 'chunk', 'sid', and 'input'. Omitting this wrapper or any required field results in HTTP 400 'Invalid request payload'. Option A correctly points out that the payload lacks the required 'ins_api' wrapper.

The Python requests library allows you to pass a self-signed certificate file via the `verify` parameter, which adds that certificate to the trusted store for that session. This satisfies the security policy by maintaining HTTPS encryption and certificate verification without disabling SSL checks or requiring a CA-signed certificate. The team can export the APIC's self-signed certificate (e.g., from the APIC GUI or CLI) and use it in their scripts as `requests.get(url, verify='/path/to/cert.pem')`.

The nxos_bgp module is designed to manage BGP configuration on NX-OS devices.

The Python SDK for UCS Manager is version-specific; upgrading UCS Manager from 4.0 to 4.2 introduces API changes that can deprecate or remove methods like `set_vnic_order`. Updating the SDK to a version compatible with UCS Manager 4.2 ensures the Python scripts use the correct API calls, and modifying the scripts to align with any new method signatures or attributes resolves the AttributeError.

An Ansible playbook consists of hosts (target devices), tasks (what to do), and modules (the actual operations). Variables can be used but are not mandatory components.

OpenConfig defines standard YANG models for various network functions, including interfaces.

Terraform can use RESTCONF/NETCONF providers, but Ansible with cisco.nxos collection also supports YANG; however, Terraform is declarative and fits CI/CD pipelines well.

The 'replace' option in the cisco.nxos.nxos_config module allows you to provide a configuration file that defines the desired state, and the module will only apply changes if the current configuration does not match, ensuring idempotency. This is a best practice for network automation with Ansible on Nexus switches.

Guest shell provides a Linux environment; EEM can trigger Python applets on events.

NX-API (REST API) uses HTTP or HTTPS as its transport protocol, allowing RESTful operations (GET, POST, PUT, DELETE) over standard web ports. This is in contrast to NETCONF, which uses SSH as its transport (RFC 6241). Therefore, option B is correct.

The Cisco NX-API allows batching multiple CLI commands into a single HTTP request, which reduces the number of round trips and improves automation efficiency. This is a key advantage over traditional SSH-based scripting, where each command typically requires a separate connection or session.

terraform-provider-aci is the correct provider for ACI automation. The resource for an application profile in ACI is 'aci_application_profile' which is part of the provider. 'aci_tenant' is for tenants, 'aci_epg' for EPGs, and 'aci_bridge_domain' for bridge domains.

The 'check_mode' (or '--check') flag in Ansible allows dry-run to verify idempotency.

The JSON error indicates that the NX-API request was rejected because the command is not permitted through the NX-API interface. NX-API enforces a strict allowlist of commands; any command not explicitly allowed (e.g., certain show commands or configuration commands that could destabilize the switch) will return this error. This is a security and stability feature of the NX-API RESTful interface.

Cisco NX-API returns structured data formats like JSON or XML, which are inherently machine-readable and consistent regardless of CLI display changes or software version updates. This eliminates the fragility of traditional CLI scraping with regular expressions, where output formatting changes (e.g., column widths, spacing, or label text) can break parsing logic. Structured data ensures reliable, predictable automation workflows.

A sensor path defines the specific YANG data model paths or operational data that the device will stream to the collector. In model-driven telemetry on Cisco NX-OS, the sensor path is the fundamental component that tells the device exactly which data to monitor and stream, such as 'Cisco-NX-OS-device:System/clock-items' or interface statistics paths.

An Ansible playbook with the nxos_config backup option is the best solution because it provides idempotent, version-controlled backups of running-configurations across 200 Nexus switches. The nxos_config module automatically creates a timestamped backup file on the Ansible control node, ensuring both reliability through automated, consistent execution and a built-in version history via the backup files. This approach scales efficiently without requiring manual intervention or fragile scripting.

The root cause of the deployment failure is overlapping IP subnets in the template definition. Manually correcting the overlapping subnets in the template and re-running the deployment script directly resolves the validation error without introducing unnecessary complexity or risk. This approach ensures the template is valid before deployment, maintaining consistency across all leaf switches.

Terraform with the terraform-provider-aci allows declarative management of ACI objects.

gNMI (gRPC Network Management Interface) and gRPC are both correct because they are the primary protocols used for streaming telemetry on Nexus 9000 switches. gNMI defines a standard model-driven telemetry subscription mechanism over gRPC, while gRPC provides the underlying high-performance transport for streaming telemetry data to collectors.

The terraform-provider-aci is the official Terraform provider for Cisco ACI. terraform-provider-nxos is for Nexus switches. The other options are not valid.

Guest shell provides a Linux environment on Nexus where Python scripts can run directly.

The `nxos_config` module is the primary Ansible module for managing NX-OS device configurations, allowing you to apply, replace, or merge configuration snippets directly onto Nexus switches. It is part of the `cisco.nxos` collection and is specifically designed for NX-OS, unlike `ios_config` which targets Cisco IOS/IOS-XE devices.

The nxos_vlan module is specifically designed to manage VLANs on Cisco NX-OS devices.

The error 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting' occurs because the `connection: network_cli` parameter is being passed inside the task block of the playbook. The `cisco.nxos.nxos_config` module does not accept a `connection` parameter at the task level; connection settings must be defined at the play or inventory level. This is a common syntax error when using Ansible network modules.

The nxos_config module is a generic module for applying arbitrary configuration commands, but it does not validate or handle the specific semantics of MTU configuration. The nxos_mtu module is purpose-built to manage MTU settings on Nexus interfaces, ensuring correct syntax and idempotent behavior. Therefore, using nxos_mtu is the appropriate approach for this task.

The SSL_ERROR_BAD_CERT_DOMAIN error indicates that the certificate presented by the Nexus 9000 switch does not match the hostname used in the REST API client's request. When NX-API uses HTTPS, the client validates the server's certificate against the requested domain; a mismatch triggers this error. This is a common TLS/SSL certificate validation issue, not a problem with HTTP conflicts, missing keys, or corrupted files.

APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

HTTP 400 indicates a bad request, which in the context of NX-API typically means the JSON or XML payload sent to the switch does not conform to the expected schema. Common issues include missing required fields (e.g., 'ins_api' version, 'type', 'chunk', 'sid', 'input', 'outputformat'), incorrect JSON syntax, or invalid values for parameters like 'version' or 'type'. The requests library successfully delivered the HTTP request, but the NX-API rejected it due to malformed content.