Automation practice questions

Refer to the exhibit. An engineer is trying to automate configuration using NX-API on a Nexus 9000 switch. They have enabled 'feature nxapi' but when they attempt to send a POST request to the NX-API endpoint, they receive '400 Bad Request' with 'Invalid message format'. What is the most likely missing configuration?

Exhibit

show running-config | include feature\nfeature nxapi\nfeature bash\nfeature interface-vlan\nfeature lacp\nfeature vpc

Trap 1: The switch does not have the 'nxapi' feature enabled.

The exhibit shows 'feature nxapi' is already enabled.

Trap 2: The engineer is using the wrong URL path; should be /ins instead of…

While using the wrong path could cause a 404, a 400 indicates malformed request, not wrong path.

Trap 3: The authentication method is set to 'none' but should be 'basic'.

Authentication method affects responses differently; a 400 usually is about syntax, not auth.

A
The switch does not have the 'nxapi' feature enabled.
Why wrong: The exhibit shows 'feature nxapi' is already enabled.
B
The NX-API HTTP/HTTPS server is not configured with a port (e.g., 'nxapi http port 80').
Enabling the feature alone does not start the server; a port must be configured.
C
The engineer is using the wrong URL path; should be /ins instead of /api.
Why wrong: While using the wrong path could cause a 404, a 400 indicates malformed request, not wrong path.
D
The authentication method is set to 'none' but should be 'basic'.
Why wrong: Authentication method affects responses differently; a 400 usually is about syntax, not auth.

Read the full REST/YANG explanation →

Question 2hardmultiple choice

A DevOps team uses Infrastructure as Code (IaC) for data center network automation. They want to adopt a vendor-neutral YANG data model for configuration management. Which YANG model set should they use?

Trap 1: Cisco native YANG models

Cisco native YANG models are proprietary to Cisco and not vendor-neutral, so they do not meet the requirement of vendor-neutrality.

Trap 2: IETF YANG models

IETF YANG models are vendor-neutral but often more generic; OpenConfig is more tailored for operational use and data center automation.

Trap 3: NX-OS-specific YANG models

NX-OS-specific YANG models are vendor-specific to Cisco NX-OS and not vendor-neutral.

A
OpenConfig YANG models
OpenConfig YANG models are vendor-neutral and supported by multiple vendors, making them suitable for multi-vendor environments.
B
Cisco native YANG models
Why wrong: Cisco native YANG models are proprietary to Cisco and not vendor-neutral, so they do not meet the requirement of vendor-neutrality.
C
IETF YANG models
Why wrong: IETF YANG models are vendor-neutral but often more generic; OpenConfig is more tailored for operational use and data center automation.
D
NX-OS-specific YANG models
Why wrong: NX-OS-specific YANG models are vendor-specific to Cisco NX-OS and not vendor-neutral.

Question 3hardmultiple choice

A data center engineer is using Ansible to automate NX-OS configuration. They want to ensure that the running configuration is updated and saved to the startup configuration after applying changes to VLANs. Which Ansible module attribute should be used in the nxos_vlan module?

Trap 1: backup: yes

The 'backup' parameter backs up the running config to a file, it does not save to startup.

Trap 2: startup_config: yes

There is no 'startup_config' parameter in nxos_vlan.

Trap 3: running_config: yes

There is no 'running_config' parameter in nxos_vlan.

A
save: yes
The 'save' parameter does not exist in the nxos_vlan module. To save config, use the nxos_config module.
B
backup: yes
Why wrong: The 'backup' parameter backs up the running config to a file, it does not save to startup.
C
startup_config: yes
Why wrong: There is no 'startup_config' parameter in nxos_vlan.
D
running_config: yes
Why wrong: There is no 'running_config' parameter in nxos_vlan.

Question 4easymultiple choice

A network engineer wants to automate the deployment of a new VLAN across all Cisco Nexus switches in a data center using Python scripts. Which tool is most appropriate for this task?

Trap 1: SSH CLI commands via Paramiko

While possible, it's less efficient than NX-API for automation.

Trap 2: Ansible playbook

Ansible is a separate automation tool, not a Python script tool.

Trap 3: SNMP SET commands

SNMP is not designed for configuration deployment.

A
Cisco NX-API with Python requests
NX-API provides RESTful API for direct configuration via Python.
B
SSH CLI commands via Paramiko
Why wrong: While possible, it's less efficient than NX-API for automation.
C
Ansible playbook
Why wrong: Ansible is a separate automation tool, not a Python script tool.
D
SNMP SET commands
Why wrong: SNMP is not designed for configuration deployment.

Question 5mediummultiple choice

A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?

Trap 1: API rate limiting has been exceeded

Rate limiting returns 429 Too Many Requests.

Trap 2: Network connectivity issue between the script and the switch

Connectivity issues would result in timeouts or connection refused errors.

Trap 3: The user account does not have admin privileges

Insufficient privileges would return 403 Forbidden.

A
API rate limiting has been exceeded
Why wrong: Rate limiting returns 429 Too Many Requests.
B
Network connectivity issue between the script and the switch
Why wrong: Connectivity issues would result in timeouts or connection refused errors.
C
The user account does not have admin privileges
Why wrong: Insufficient privileges would return 403 Forbidden.
D
Invalid or expired authentication token
401 Unauthorized indicates authentication failure.

Question 6hardmultiple choice

An engineer is designing an automation solution for a large data center with multiple Cisco UCS Manager domains. Which approach best ensures idempotent configuration operations?

Trap 1: Writing imperative Python scripts that execute CLI commands

Imperative scripts may not be idempotent unless carefully designed.

Trap 2: Directly calling UCS Manager XML API using POST requests

Without state tracking, operations may not be idempotent.

Trap 3: Using SNMP to set configuration parameters

SNMP is not idempotent and not suitable for configuration.

A
Writing imperative Python scripts that execute CLI commands
Why wrong: Imperative scripts may not be idempotent unless carefully designed.
B
Using a declarative automation tool like Ansible with idempotent modules
Declarative tools ensure the desired state is achieved regardless of current state.
C
Directly calling UCS Manager XML API using POST requests
Why wrong: Without state tracking, operations may not be idempotent.
D
Using SNMP to set configuration parameters
Why wrong: SNMP is not idempotent and not suitable for configuration.

Read the full Ansible explanation →

Question 7mediummultiple choice

A DevOps team uses Ansible to automate the configuration of Cisco Nexus switches. After running a playbook, some switches have the correct configuration but others do not. The playbook uses the 'nxos_config' module. Which action should be taken to ensure consistent configuration?

Trap 1: Set 'ignore_errors' to true in the playbook

Ignoring errors can lead to incomplete configurations.

Trap 2: Use 'serial' directive to run the playbook on one switch at a time

Serial execution does not guarantee consistency.

Trap 3: Enable check mode to verify changes before applying

Check mode only simulates, does not apply changes.

A
Set 'ignore_errors' to true in the playbook
Why wrong: Ignoring errors can lead to incomplete configurations.
B
Use the 'backup' option to save the running config before changes
Backup provides a restore point for rollback.
C
Use 'serial' directive to run the playbook on one switch at a time
Why wrong: Serial execution does not guarantee consistency.
D
Enable check mode to verify changes before applying
Why wrong: Check mode only simulates, does not apply changes.

Question 8hardmultiple choice

A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?

Trap 1: Configuration Database (CDB) snapshots

CDB stores configurations but does not detect out-of-band changes.

Trap 2: Service model templates

Service models define services, not detection of out-of-band changes.

Trap 3: Rollback and recovery mechanism

Rollback is used after changes are made.

A
Configuration Database (CDB) snapshots
Why wrong: CDB stores configurations but does not detect out-of-band changes.
B
Fast-map synchronization
Fast-map syncs device configurations with NSO and detects drift.
C
Service model templates
Why wrong: Service models define services, not detection of out-of-band changes.
D
Rollback and recovery mechanism
Why wrong: Rollback is used after changes are made.

Question 9mediummulti select

Which TWO statements about Cisco NX-API are correct? (Choose two.)

Trap 1: NX-API uses SSH for transport.

NX-API uses HTTP/HTTPS, not SSH.

Trap 2: NX-API only supports GET requests.

NX-API supports POST, GET, PUT, DELETE.

Trap 3: NX-API is only available on Nexus 3000 series switches.

NX-API is available on Nexus 9000, 7000, 3000 series.

A
NX-API uses SSH for transport.
Why wrong: NX-API uses HTTP/HTTPS, not SSH.
B
NX-API only supports GET requests.
Why wrong: NX-API supports POST, GET, PUT, DELETE.
C
NX-API uses HTTP/HTTPS as the transport protocol.
NX-API is a RESTful API over HTTP/HTTPS.
D
NX-API is only available on Nexus 3000 series switches.
Why wrong: NX-API is available on Nexus 9000, 7000, 3000 series.
E
NX-API can output data in XML and JSON formats.
NX-API supports both XML and JSON.

Question 10hardmulti select

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Trap 1: The API uses SNMP for configuration changes.

The API uses XML over HTTP/HTTPS, not SNMP.

Trap 2: The UCS Manager XML API uses RESTful JSON format.

It uses XML, not JSON.

A
Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.
Idempotency is achieved by targeting specific objects.
B
The XML API is based on a management information model (MIT) similar to ACI.
UCS Manager uses a MIT similar to ACI.
C
The API uses XML for both request and response payloads.
It is an XML-based API.
D
The API uses SNMP for configuration changes.
Why wrong: The API uses XML over HTTP/HTTPS, not SNMP.
E
The UCS Manager XML API uses RESTful JSON format.
Why wrong: It uses XML, not JSON.

Question 11mediummultiple choice

Refer to the exhibit. An automation script is used to configure a new VLAN 40 on Eth1/2 trunk. The script sends the following NX-API command: 'switchport trunk allowed vlan add 40'. After execution, the engineer runs 'show running-config interface eth1/2' and sees that the trunk allowed VLAN list shows '10,20,30'. The automation script logs indicate success for adding VLAN 40, but the running config does not show the change. What is the most likely issue?

Exhibit

Refer to the exhibit.

interface Eth1/1
  description Server-Connection
  switchport mode access
  switchport access vlan 100
  spanning-tree port type edge
  no shutdown

interface Eth1/2
  description Trunk-to-Core
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  spanning-tree port type network
  no shutdown

Trap 1: The command syntax is incorrect; 'add' is not a valid keyword.

The 'add' keyword is valid in NX-OS for adding VLANs to a trunk allowed list; syntax is not the issue.

Trap 2: The script actually removed the existing VLANs and replaced them…

The 'add' keyword appends VLANs to the existing allowed list; it does not remove or replace current VLANs.

Trap 3: The NX-API command was sent to the wrong interface.

While sending the command to the wrong interface is possible, the script would still have applied the change to the specified interface. However, the logs indicate success, and the engineer is checking the specific interface Eth1/2; if the interface is correct, a mismatch between expected and actual result points to a device-level discrepancy rather than an interface misconfiguration.

A
The command syntax is incorrect; 'add' is not a valid keyword.
Why wrong: The 'add' keyword is valid in NX-OS for adding VLANs to a trunk allowed list; syntax is not the issue.
B
The engineer is viewing a different switch or the configuration was reverted by another process.
If the script succeeded but the running config on the inspected device lacks the change, the most likely cause is that the engineer is viewing a different switch or the configuration was reverted after the script completed.
C
The script actually removed the existing VLANs and replaced them with only VLAN 40.
Why wrong: The 'add' keyword appends VLANs to the existing allowed list; it does not remove or replace current VLANs.
D
The NX-API command was sent to the wrong interface.
Why wrong: While sending the command to the wrong interface is possible, the script would still have applied the change to the specified interface. However, the logs indicate success, and the engineer is checking the specific interface Eth1/2; if the interface is correct, a mismatch between expected and actual result points to a device-level discrepancy rather than an interface misconfiguration.

Question 12hardmultiple choice

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Exhibit

Refer to the exhibit.

{
  "totalCount": "1",
  "imdata": [
    {
      "l1PhysIf": {
        "attributes": {
          "id": "Eth1/1",
          "adminSt": "up",
          "descr": "To-Server",
          "mtu": "1500",
          "switchportMode": "access",
          "accessVlan": "100"
        }
      }
    }
  ]
}

Trap 1: The JSON output is malformed and cannot be parsed.

The JSON is valid.

Trap 2: The interface is administratively down.

The output shows 'adminSt': 'up'.

Trap 3: The JSON output is missing the 'switchportMode' field.

The output includes 'switchportMode'.

A
The script uses strict type checking, and the values are returned as strings instead of integers.
JSON returns numbers as strings in this context; a type mismatch causes failure.
B
The JSON output is malformed and cannot be parsed.
Why wrong: The JSON is valid.
C
The interface is administratively down.
Why wrong: The output shows 'adminSt': 'up'.
D
The JSON output is missing the 'switchportMode' field.
Why wrong: The output includes 'switchportMode'.

Study the full Python automation breakdown →

Question 13hardmultiple choice

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Trap 1: Change the authentication method in the script from password-based…

The error is not related to the authentication method; it's a TLS issue.

Trap 2: Regenerate the API key for the service account and update the…

The credentials are correct, so the API key is not the issue.

Trap 3: Disable TLS 1.3 on the APIC by setting the 'ssl-protocols'…

While this would work, it reduces security and is not the recommended approach.

A
Change the authentication method in the script from password-based to certificate-based authentication.
Why wrong: The error is not related to the authentication method; it's a TLS issue.
B
Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.
Upgrading the library ensures TLS 1.3 compatibility, preserving security.
C
Regenerate the API key for the service account and update the script with the new key.
Why wrong: The credentials are correct, so the API key is not the issue.
D
Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.
Why wrong: While this would work, it reduces security and is not the recommended approach.

Question 14mediumdrag order

Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Step 1: Assign physical interfaces to the port-channel using the…

This is incorrect because you cannot assign physical interfaces to a port-channel that has not been created yet; the port-channel interface must exist first.

Trap 2: Step 1: Configure the port-channel interface

This is incorrect because you cannot configure a port-channel interface before creating it; configuration requires the interface to exist.

Trap 3: Step 1: Verify the port-channel status

This is incorrect because verification should be the final step after configuration; performing it first would show no port-channel exists.

A
Step 1: Create the port-channel interface. Step 2: Configure the port-channel interface (e.g., switchport mode). Step 3: Assign physical interfaces to the port-channel using the channel-group command. Step 4: Verify the port-channel status.
This is the correct order because you must first create the logical port-channel interface, then configure its properties, then add member interfaces, and finally verify the configuration.
B
Step 1: Assign physical interfaces to the port-channel using the channel-group command. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Verify the port-channel status.
Why wrong: This is incorrect because you cannot assign physical interfaces to a port-channel that has not been created yet; the port-channel interface must exist first.
C
Step 1: Configure the port-channel interface. Step 2: Create the port-channel interface. Step 3: Assign physical interfaces to the port-channel. Step 4: Verify the port-channel status.
Why wrong: This is incorrect because you cannot configure a port-channel interface before creating it; configuration requires the interface to exist.
D
Step 1: Verify the port-channel status. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Assign physical interfaces to the port-channel.
Why wrong: This is incorrect because verification should be the final step after configuration; performing it first would show no port-channel exists.

Question 15mediumdrag order

Arrange the steps to recover a lost admin password on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Interrupt boot, then boot the switch, then change boot register,…

This is incorrect because changing the boot register after the switch has booted is not possible; the boot register must be modified at the loader prompt before booting to bypass the startup config.

Trap 2: Change boot register, then boot the switch, then interrupt boot,…

This is incorrect because you cannot interrupt the boot after the switch has already booted; the interruption must occur during the boot process, and the boot register change must happen at the loader prompt before booting.

Trap 3: Interrupt boot, then change boot register, then set new password,…

This is incorrect because you cannot set the admin password before the operating system has fully booted; the password reset requires the switch to be in a running state with configuration access.

A
Interrupt boot, then change boot register to bypass startup config, then boot the switch, then set new admin password, then save configuration and reload
This order correctly follows the Cisco Nexus password recovery procedure: interrupt the boot process at the loader prompt, modify the boot register to skip loading the startup configuration, boot the system, reset the admin password, and finally save the new configuration and reload.
B
Interrupt boot, then boot the switch, then change boot register, then set new password, then save configuration
Why wrong: This is incorrect because changing the boot register after the switch has booted is not possible; the boot register must be modified at the loader prompt before booting to bypass the startup config.
C
Change boot register, then boot the switch, then interrupt boot, then set new password, then save configuration
Why wrong: This is incorrect because you cannot interrupt the boot after the switch has already booted; the interruption must occur during the boot process, and the boot register change must happen at the loader prompt before booting.
D
Interrupt boot, then change boot register, then set new password, then boot the switch, then save configuration
Why wrong: This is incorrect because you cannot set the admin password before the operating system has fully booted; the password reset requires the switch to be in a running state with configuration access.

Question 16mediummatching

Match each Cisco ACI component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Central controller for policy management

Leaf-to-leaf connectivity and fabric backplane

Top-of-rack switch connecting servers to fabric

Endpoint group for policy application

Bridge domain for Layer 2 forwarding context

Trap 1: APIC: Physical switch that forwards traffic

Incorrect — APIC is a controller, not a forwarding switch; forwarding is done by leaf/spine.

Trap 2: Spine: Endpoint group (EPG) concept

Incorrect — EPG is a logical grouping of endpoints, not a function of spine switches.

A
APIC: Centralized controller for policy and fabric management
APIC is the main controller for policy management and fabric configuration in ACI.
B
Spine: Core switch connecting all leaf switches
Spine switches form the backbone of the ACI fabric, connecting all leaf switches.
C
Leaf: Access switch connecting to endpoints
Leaf switches are ToR switches that connect to servers and other endpoints.
D
APIC: Physical switch that forwards traffic
Why wrong: Incorrect — APIC is a controller, not a forwarding switch; forwarding is done by leaf/spine.
E
Spine: Endpoint group (EPG) concept
Why wrong: Incorrect — EPG is a logical grouping of endpoints, not a function of spine switches.

Question 17mediummatching

Match each Cisco data center high availability feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

First-hop redundancy for default gateway

Multi-chassis link aggregation with loop prevention

Transparent interconnection of lots of links (TRILL-based)

Non-Stop Forwarding during supervisor switchover

Stateful Switchover for control plane redundancy

Trap 1: HSRP: Open standard protocol that provides first-hop redundancy…

HSRP is Cisco proprietary, not an open standard. This definition describes VRRP.

Trap 2: SSO: Feature that continues packet forwarding during a supervisor…

SSO synchronizes control plane state; forwarding continuity is provided by NSF.

A
HSRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.
Why wrong: HSRP is Cisco proprietary, not an open standard. This definition describes VRRP.
B
VRRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.
VRRP is an open standard (RFC 5798) for first-hop redundancy using a virtual IP.
C
GLBP: Cisco protocol that provides load balancing across multiple gateways using a single virtual IP.
GLBP allows up to four active gateways to share traffic loads using a single virtual IP.
D
SSO: Feature that continues packet forwarding during a supervisor switchover.
Why wrong: SSO synchronizes control plane state; forwarding continuity is provided by NSF.
E
NSF: Feature that continues packet forwarding during a supervisor switchover.
NSF allows a router to forward packets during a switchover by relying on peer routers.
F
VPC: Technology that bundles links from two switches to appear as a single logical link.
VPC enables link aggregation across two chassis for redundancy and load balancing.

Study the full Python automation breakdown →

Question 18easymultiple choice

An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?

Trap 1: requests

Requests is a generic HTTP library, not specifically for NX-OS automation.

Trap 2: paramiko

Paramiko is for SSH, not optimized for NX-OS NX-API.

Trap 3: cli

'cli' is not a Python library; it's a command-line interface.

A
requests
Why wrong: Requests is a generic HTTP library, not specifically for NX-OS automation.
B
paramiko
Why wrong: Paramiko is for SSH, not optimized for NX-OS NX-API.
C
cli
Why wrong: 'cli' is not a Python library; it's a command-line interface.
D
nxapi
nxapi is the official Python library for NX-OS NX-API.

Study the full Python automation breakdown →

Question 19mediummultiple choice

A Python script using NX-API returns HTTP 401. What is the most likely cause?

Trap 1: Wrong NX-API version in URL

Wrong version gives a different HTTP error (e.g., 404).

Trap 2: Firewall blocking port 443

Firewall block results in connection timeout, not HTTP 401.

Trap 3: NX-API not enabled on the switch

If NX-API is not enabled, the HTTP endpoint may return 401 (or 404) – but typically 401 due to lack of authentication context. In practice, enabling NX-API is required for authentication to work.

A
Wrong NX-API version in URL
Why wrong: Wrong version gives a different HTTP error (e.g., 404).
B
Firewall blocking port 443
Why wrong: Firewall block results in connection timeout, not HTTP 401.
C
NX-API not enabled on the switch
Why wrong: If NX-API is not enabled, the HTTP endpoint may return 401 (or 404) – but typically 401 due to lack of authentication context. In practice, enabling NX-API is required for authentication to work.
D
Invalid credentials
Invalid credentials cause 401, but more specifically, missing or wrong username/password.

Question 20hardmultiple choice

In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?

Trap 1: Use the REST API with POST method for each creation

POST without idempotency checks can create duplicate objects.

Trap 2: Write CLI scripts using expect or pexpect

CLI scripts lack idempotency and are error-prone.

Trap 3: Use Python SDK with a check-and-create loop

This is less reliable than using Ansible's built-in idempotency.

A
Use the REST API with POST method for each creation
Why wrong: POST without idempotency checks can create duplicate objects.
B
Use Ansible with state: present in the cisco.aci collections
Ansible modules are idempotent and widely used in ACI automation.
C
Write CLI scripts using expect or pexpect
Why wrong: CLI scripts lack idempotency and are error-prone.
D
Use Python SDK with a check-and-create loop
Why wrong: This is less reliable than using Ansible's built-in idempotency.