Automation practice questions

A network engineer wants to automate the deployment of a new VLAN across all Cisco Nexus switches in a data center using Python scripts. Which tool is most appropriate for this task?

Trap 1: SSH CLI commands via Paramiko

While possible, it's less efficient than NX-API for automation.

Trap 2: Ansible playbook

Ansible is a separate automation tool, not a Python script tool.

Trap 3: SNMP SET commands

SNMP is not designed for configuration deployment.

A
Cisco NX-API with Python requests
NX-API provides RESTful API for direct configuration via Python.
B
SSH CLI commands via Paramiko
Why wrong: While possible, it's less efficient than NX-API for automation.
C
Ansible playbook
Why wrong: Ansible is a separate automation tool, not a Python script tool.
D
SNMP SET commands
Why wrong: SNMP is not designed for configuration deployment.

Question 2mediummultiple choice

A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?

Trap 1: API rate limiting has been exceeded

Rate limiting returns 429 Too Many Requests.

Trap 2: Network connectivity issue between the script and the switch

Connectivity issues would result in timeouts or connection refused errors.

Trap 3: The user account does not have admin privileges

Insufficient privileges would return 403 Forbidden.

A
API rate limiting has been exceeded
Why wrong: Rate limiting returns 429 Too Many Requests.
B
Network connectivity issue between the script and the switch
Why wrong: Connectivity issues would result in timeouts or connection refused errors.
C
The user account does not have admin privileges
Why wrong: Insufficient privileges would return 403 Forbidden.
D
Invalid or expired authentication token
401 Unauthorized indicates authentication failure.

Question 3hardmultiple choice

An engineer is designing an automation solution for a large data center with multiple Cisco UCS Manager domains. Which approach best ensures idempotent configuration operations?

Trap 1: Writing imperative Python scripts that execute CLI commands

Imperative scripts may not be idempotent unless carefully designed.

Trap 2: Directly calling UCS Manager XML API using POST requests

Without state tracking, operations may not be idempotent.

Trap 3: Using SNMP to set configuration parameters

SNMP is not idempotent and not suitable for configuration.

A
Writing imperative Python scripts that execute CLI commands
Why wrong: Imperative scripts may not be idempotent unless carefully designed.
B
Using a declarative automation tool like Ansible with idempotent modules
Declarative tools ensure the desired state is achieved regardless of current state.
C
Directly calling UCS Manager XML API using POST requests
Why wrong: Without state tracking, operations may not be idempotent.
D
Using SNMP to set configuration parameters
Why wrong: SNMP is not idempotent and not suitable for configuration.

Read the full Ansible explanation →

Question 4mediummultiple choice

A DevOps team uses Ansible to automate the configuration of Cisco Nexus switches. After running a playbook, some switches have the correct configuration but others do not. The playbook uses the 'nxos_config' module. Which action should be taken to ensure consistent configuration?

Trap 1: Set 'ignore_errors' to true in the playbook

Ignoring errors can lead to incomplete configurations.

Trap 2: Use 'serial' directive to run the playbook on one switch at a time

Serial execution does not guarantee consistency.

Trap 3: Enable check mode to verify changes before applying

Check mode only simulates, does not apply changes.

A
Set 'ignore_errors' to true in the playbook
Why wrong: Ignoring errors can lead to incomplete configurations.
B
Use the 'backup' option to save the running config before changes
Backup provides a restore point for rollback.
C
Use 'serial' directive to run the playbook on one switch at a time
Why wrong: Serial execution does not guarantee consistency.
D
Enable check mode to verify changes before applying
Why wrong: Check mode only simulates, does not apply changes.

Question 5hardmultiple choice

A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?

Trap 1: Configuration Database (CDB) snapshots

CDB stores configurations but does not detect out-of-band changes.

Trap 2: Service model templates

Service models define services, not detection of out-of-band changes.

Trap 3: Rollback and recovery mechanism

Rollback is used after changes are made.

A
Configuration Database (CDB) snapshots
Why wrong: CDB stores configurations but does not detect out-of-band changes.
B
Fast-map synchronization
Fast-map syncs device configurations with NSO and detects drift.
C
Service model templates
Why wrong: Service models define services, not detection of out-of-band changes.
D
Rollback and recovery mechanism
Why wrong: Rollback is used after changes are made.

Question 6mediummulti select

Which TWO statements about Cisco NX-API are correct? (Choose two.)

Trap 1: NX-API uses SSH for transport.

NX-API uses HTTP/HTTPS, not SSH.

Trap 2: NX-API only supports GET requests.

NX-API supports POST, GET, PUT, DELETE.

Trap 3: NX-API is only available on Nexus 3000 series switches.

NX-API is available on Nexus 9000, 7000, 3000 series.

A
NX-API uses SSH for transport.
Why wrong: NX-API uses HTTP/HTTPS, not SSH.
B
NX-API only supports GET requests.
Why wrong: NX-API supports POST, GET, PUT, DELETE.
C
NX-API uses HTTP/HTTPS as the transport protocol.
NX-API is a RESTful API over HTTP/HTTPS.
D
NX-API is only available on Nexus 3000 series switches.
Why wrong: NX-API is available on Nexus 9000, 7000, 3000 series.
E
NX-API can output data in XML and JSON formats.
NX-API supports both XML and JSON.

Question 7hardmulti select

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Trap 1: The API uses SNMP for configuration changes.

The API uses XML over HTTP/HTTPS, not SNMP.

Trap 2: The UCS Manager XML API uses RESTful JSON format.

It uses XML, not JSON.

A
Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.
Idempotency is achieved by targeting specific objects.
B
The XML API is based on a management information model (MIT) similar to ACI.
UCS Manager uses a MIT similar to ACI.
C
The API uses XML for both request and response payloads.
It is an XML-based API.
D
The API uses SNMP for configuration changes.
Why wrong: The API uses XML over HTTP/HTTPS, not SNMP.
E
The UCS Manager XML API uses RESTful JSON format.
Why wrong: It uses XML, not JSON.

Question 8mediummultiple choice

Refer to the exhibit. An automation script is used to configure a new VLAN 40 on Eth1/2 trunk. The script sends the following NX-API command: 'switchport trunk allowed vlan add 40'. After execution, the engineer runs 'show running-config interface eth1/2' and sees that the trunk allowed VLAN list shows '10,20,30,40'. However, the automation script logs indicate success for adding VLAN 40, but the running config does not show the change. What is the most likely issue?

Exhibit

Refer to the exhibit.

interface Eth1/1
  description Server-Connection
  switchport mode access
  switchport access vlan 100
  spanning-tree port type edge
  no shutdown

interface Eth1/2
  description Trunk-to-Core
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  spanning-tree port type network
  no shutdown

Trap 1: The command syntax is incorrect; 'add' is not a valid keyword.

The 'add' keyword is valid for adding VLANs to the allowed list.

Trap 2: The script actually removed the existing VLANs and replaced them…

The running config shows the list includes all VLANs, so it was not replaced.

Trap 3: The NX-API command was sent to the wrong interface.

The command targeted Eth1/2, and the running config shows that interface.

A
The command syntax is incorrect; 'add' is not a valid keyword.
Why wrong: The 'add' keyword is valid for adding VLANs to the allowed list.
B
The engineer is viewing a different switch or the configuration was reverted by another process.
The running config shows the change, so the issue is likely that the engineer is looking at the wrong device or the config was changed after.
C
The script actually removed the existing VLANs and replaced them with only VLAN 40.
Why wrong: The running config shows the list includes all VLANs, so it was not replaced.
D
The NX-API command was sent to the wrong interface.
Why wrong: The command targeted Eth1/2, and the running config shows that interface.

Question 9hardmultiple choice

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Exhibit

Refer to the exhibit.

{
  "totalCount": "1",
  "imdata": [
    {
      "l1PhysIf": {
        "attributes": {
          "id": "Eth1/1",
          "adminSt": "up",
          "descr": "To-Server",
          "mtu": "1500",
          "switchportMode": "access",
          "accessVlan": "100"
        }
      }
    }
  ]
}

Trap 1: The JSON output is malformed and cannot be parsed.

The JSON is valid.

Trap 2: The interface is administratively down.

The output shows 'adminSt': 'up'.

Trap 3: The JSON output is missing the 'switchportMode' field.

The output includes 'switchportMode'.

A
The script uses strict type checking, and the values are returned as strings instead of integers.
JSON returns numbers as strings in this context; a type mismatch causes failure.
B
The JSON output is malformed and cannot be parsed.
Why wrong: The JSON is valid.
C
The interface is administratively down.
Why wrong: The output shows 'adminSt': 'up'.
D
The JSON output is missing the 'switchportMode' field.
Why wrong: The output includes 'switchportMode'.

Question 10hardmultiple choice

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Trap 1: Change the authentication method in the script from password-based…

The error is not related to the authentication method; it's a TLS issue.

Trap 2: Regenerate the API key for the service account and update the…

The credentials are correct, so the API key is not the issue.

Trap 3: Disable TLS 1.3 on the APIC by setting the 'ssl-protocols'…

While this would work, it reduces security and is not the recommended approach.

A
Change the authentication method in the script from password-based to certificate-based authentication.
Why wrong: The error is not related to the authentication method; it's a TLS issue.
B
Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.
Upgrading the library ensures TLS 1.3 compatibility, preserving security.
C
Regenerate the API key for the service account and update the script with the new key.
Why wrong: The credentials are correct, so the API key is not the issue.
D
Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.
Why wrong: While this would work, it reduces security and is not the recommended approach.

Question 11mediumdrag order

Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediumdrag order

Arrange the steps to recover a lost admin password on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediummatching

Match each Cisco ACI component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Central controller for policy management

Leaf-to-leaf connectivity and fabric backplane

Top-of-rack switch connecting servers to fabric

Endpoint group for policy application

Bridge domain for Layer 2 forwarding context

Question 14mediummatching

Match each Cisco data center high availability feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

First-hop redundancy for default gateway

Multi-chassis link aggregation with loop prevention

Transparent interconnection of lots of links (TRILL-based)

Non-Stop Forwarding during supervisor switchover

Stateful Switchover for control plane redundancy

Question 15easymultiple choice

An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?

Trap 1: requests

Requests is a generic HTTP library, not specifically for NX-OS automation.

Trap 2: paramiko

Paramiko is for SSH, not optimized for NX-OS NX-API.

Trap 3: cli

'cli' is not a Python library; it's a command-line interface.

A
requests
Why wrong: Requests is a generic HTTP library, not specifically for NX-OS automation.
B
paramiko
Why wrong: Paramiko is for SSH, not optimized for NX-OS NX-API.
C
cli
Why wrong: 'cli' is not a Python library; it's a command-line interface.
D
nxapi
nxapi is the official Python library for NX-OS NX-API.

Question 16mediummultiple choice

A Python script using NX-API returns HTTP 401. What is the most likely cause?

Trap 1: Wrong NX-API version in URL

Wrong version gives a different HTTP error (e.g., 404).

Trap 2: Firewall blocking port 443

Firewall block results in connection timeout, not HTTP 401.

Trap 3: Invalid credentials

Invalid credentials cause 401, but more specifically, missing or wrong username/password.

A
Wrong NX-API version in URL
Why wrong: Wrong version gives a different HTTP error (e.g., 404).
B
Firewall blocking port 443
Why wrong: Firewall block results in connection timeout, not HTTP 401.
C
NX-API not enabled on the switch
If NX-API is not enabled, the HTTP endpoint may return 401 (or 404) – but typically 401 due to lack of authentication context. In practice, enabling NX-API is required for authentication to work.
D
Invalid credentials
Why wrong: Invalid credentials cause 401, but more specifically, missing or wrong username/password.

Question 17hardmultiple choice

In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?

Trap 1: Use the REST API with POST method for each creation

POST without idempotency checks can create duplicate objects.

Trap 2: Write CLI scripts using expect or pexpect

CLI scripts lack idempotency and are error-prone.

Trap 3: Use Python SDK with a check-and-create loop

This is less reliable than using Ansible's built-in idempotency.

A
Use the REST API with POST method for each creation
Why wrong: POST without idempotency checks can create duplicate objects.
B
Use Ansible with state: present in the cisco.aci collections
Ansible modules are idempotent and widely used in ACI automation.
C
Write CLI scripts using expect or pexpect
Why wrong: CLI scripts lack idempotency and are error-prone.
D
Use Python SDK with a check-and-create loop
Why wrong: This is less reliable than using Ansible's built-in idempotency.

Read the full network assurance explanation →

Question 18easymultiple choice

Which protocol is recommended for streaming model-driven telemetry from NX-OS to a collector?

Trap 1: FTP

FTP is for file transfer, not streaming.

Trap 2: SNMP

SNMP is traditional but not model-driven telemetry.

Trap 3: HTTP

HTTP is not a streaming protocol.

A
FTP
Why wrong: FTP is for file transfer, not streaming.
B
SNMP
Why wrong: SNMP is traditional but not model-driven telemetry.
C
HTTP
Why wrong: HTTP is not a streaming protocol.
D
gRPC
gRPC with protobuf is the recommended transport for MDT.

Question 19mediummultiple choice

Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?

Trap 1: The 'host_key_checking' setting

This is for SSH key verification, not privilege.

Trap 2: The 'ansible_user' variable

ansible_user is for login, not privilege escalation.

Trap 3: The inventory file syntax

Inventory syntax errors cause different failures.

A
The 'host_key_checking' setting
Why wrong: This is for SSH key verification, not privilege.
B
The 'ansible_become_password' or 'enable' password in the playbook
This is required for privilege escalation on NX-OS.
C
The 'ansible_user' variable
Why wrong: ansible_user is for login, not privilege escalation.
D
The inventory file syntax
Why wrong: Inventory syntax errors cause different failures.

Question 20hardmultiple choice

An engineer is writing a Python script to automate ACI fabric discovery using the APIC SDK. The script needs to wait until the fabric formation is complete before proceeding. Which approach is most reliable?

Trap 1: Implement asynchronous callbacks using the SDK

The APIC SDK does not provide async callback support.

Trap 2: Use the configExportP object to monitor discovery

configExportP is for configuration export, not fabric discovery.

Trap 3: Use time.sleep() for a fixed duration

Fixed sleep is not adaptive and may be too short or long.

A
Implement asynchronous callbacks using the SDK
Why wrong: The APIC SDK does not provide async callback support.
B
Periodically poll the fabric membership state via REST API
Polling is reliable and adaptive to actual state changes.
C
Use the configExportP object to monitor discovery
Why wrong: configExportP is for configuration export, not fabric discovery.
D
Use time.sleep() for a fixed duration
Why wrong: Fixed sleep is not adaptive and may be too short or long.