CCNA Infrastructure and Automation Questions

NETCONF uses a client-server model where the server (the Cisco IOS XE device) must have the NETCONF server explicitly enabled. If the SSH transport succeeds but capabilities are not exchanged, it indicates the NETCONF subsystem is not active on the device. The `netconf-yang` feature must be enabled via `netconf-yang` in global configuration mode to start the NETCONF server and allow capability exchange.

After authenticating to Cisco DNA Center, the returned token must be included in the X-Auth-Token header on all subsequent API requests. A missing or incorrectly named header causes a 401 Unauthorized response. The other options are less likely: token expiration would not occur immediately, the endpoint accepts GET, and Basic authentication is not used once a token is obtained.

RESTCONF typically uses Basic authentication over HTTPS (RFC 7235) because it is a lightweight, stateless mechanism that sends a base64-encoded username:password pair in the Authorization header. In the Cisco DevNet sandbox CSR1000v environment, this is the standard method for authenticating RESTCONF requests, as the sandbox provides a username and password for access.

The XPath expression `[Name='1/0/1']` is a predicate filter that selects a specific list instance from the `GigabitEthernet` YANG list. In YANG model-driven telemetry, list keys are used to identify individual entries, and the predicate syntax `[key='value']` pinpoints exactly one instance within the list.

Version control (e.g., Git) is a fundamental CI/CD best practice: it tracks changes, enables rollbacks, and supports collaboration on automation scripts and playbooks. Without version control, you lose auditability and the ability to reliably reproduce network states, which violates the principle of infrastructure as code.

The Cisco SD-WAN Manager (vManage) API authenticates clients by accepting a username and password at /j_security_check and returning a JSESSIONID cookie. That cookie must be included in the headers of subsequent API calls. This session-based approach is specific to SD-WAN and differs from token or key-based authentication used by other Cisco platforms.

HTTP 429 indicates the client exceeded the API rate limit. The requests library integrates urllib3's Retry mechanism, which can be configured with backoff_factor and status_forcelist to automatically retry on 429 with exponential delays. Mounting the adapter on a session applies this behavior to all requests, providing a clean, standard solution.

NETCONF defines <get-config> specifically for reading configuration from a named datastore, and <running/> identifies the active configuration. The broader <get> returns state data too, while <edit-config> and <copy-config> modify data. Therefore <get-config> with a running source is the correct, standards-based request for retrieving the running configuration.

The JSON response from the Cisco DNA Center device inventory API returns a list of devices under the 'response' key, and each device is a dictionary. The serial number for the first device is accessed by indexing into the list with [0] and then retrieving the 'serialNumber' key from that dictionary.

The 400 Bad Request error indicates that the server cannot process the request due to a client-side issue, such as invalid data in the payload. Since the mandatory fields (hostname, MAC address, VN name) are provided, the most likely cause is that the virtual network (VN) name does not match any existing VN in the fabric. DNA Center validates the VN name against its fabric configuration; if the VN is not defined, the API rejects the request with a 400 error.

HTTP 401 means the authentication credential was not accepted, and the most common cause in DNA Center automation is a token that expired between acquisition and use. Re-authenticating to get a fresh token and resending the request with the updated X-Auth-Token header resolves the failure at its source and completes the site creation.

Ansible generates a retry file by default when a playbook fails on some hosts. Using `--limit @<retry-file>` re-runs the playbook only against the failed hosts, avoiding unnecessary execution on the 95 successful switches. This is the most efficient method because it targets only the problematic devices without manual intervention or full re-runs.

Ansible is the correct answer because it is an infrastructure-as-code tool that uses a declarative YAML-based language (playbooks) to define desired system states. It automates configuration management across multiple devices agentlessly, using SSH or WinRM to push configurations, making it ideal for multi-device environments.

The ios_vlan module is purpose-built for idempotent VLAN management on Cisco IOS-XE devices. It ensures that a VLAN with the specified VLAN ID, name, and state (active/suspend) is present or absent without affecting other VLANs, making it the correct choice for automating VLAN deployment idempotently.

Role-Based Access Control (RBAC) on the CI/CD tool directly restricts which users or groups can trigger pipeline jobs that modify production network devices. This ensures that only authorized network engineers have the permissions to execute changes, aligning with the principle of least privilege in deployment pipelines.

Git-based change control with review and auditability is achieved through short-lived feature branches, pull requests with required approvals, automated CI validation, and merges to a protected main branch that triggers deployment. Direct pushes, personal-fork deployments, and tagging alone all skip the review gate and produce no approval record, so they cannot satisfy the validation and audit-trail requirements.

DNA Center issues a time-limited token from its authentication endpoint, and every subsequent REST call must present that token in the X-Auth-Token request header. Standard OAuth schemes, invented vendor headers, and cookie-based sessions are not honored by the controller, so only the documented X-Auth-Token header will authenticate the script successfully.

Event-driven reaction requires a push mechanism. NETCONF event notifications let a client subscribe to a stream and receive XML events from the device as state changes occur, eliminating polling latency and unstructured parsing. SNMP polling, RESTCONF GETs, and scheduled CLI commands are all pull-based and return either delayed or unstructured data, so none deliver the required asynchronous, structured event stream.

RFC 6241 defines the <edit-config> operation with the 'merge', 'replace', 'create', 'delete', and 'remove' operations. These allow granular modification of configuration data, with 'merge' being the default behavior if no operation attribute is specified.

The 'no shutdown' command is required to administratively enable an interface on Cisco IOS devices. Without it, the interface remains in an administratively down state regardless of IP configuration. Ansible automation scripts must include this command in the task or playbook to bring the interface up.

The Meraki Dashboard API requires the API key to be sent in the X-Cisco-Meraki-API-Key request header. This is a custom header defined by Meraki, and it must be present on every API call. Other authentication schemes such as Bearer tokens, X-Auth-Token, or Basic authentication are not supported for Meraki API keys, so requests using them will be rejected with an authentication error.

The 401 HTTP response code indicates an authentication failure. Since the username and password are confirmed correct and the server is reachable, the most likely cause is that the script obtained a token earlier but is now using an expired token without refreshing it. Cisco DNA Center tokens have a configurable timeout (default 1 hour), and the script must re-authenticate or refresh the token before it expires.

Model-driven telemetry uses a push model that sends data only when there is a change or at a configured interval, which significantly reduces the device CPU overhead compared to frequent SNMP polling, where the device must process and respond to each individual GET request from the NMS. This efficiency gain is a primary advantage of telemetry over traditional polling.

YANG requires a `list` statement to define a collection of entries with multiple leafs, and a `key` statement to uniquely identify each list entry. The `list interface` with `key name` allows multiple interfaces, each having both a `name` (string) and `speed` (enumeration), matching the requirement exactly.

NETCONF supports two standard filter types: subtree and xpath. The subtree filter is the most widely implemented and allows selective retrieval of configuration data by specifying an XML fragment. For retrieving only interface configuration, a subtree filter containing the <interfaces> node is the correct approach.

The `requests.post()` function is specifically designed to send HTTP POST requests, and passing the `json=data` parameter automatically serializes the Python dictionary to JSON and sets the `Content-Type` header to `application/json`. This is the standard way to create a resource via Cisco DNA Center's REST API endpoints that expect JSON payloads.

Ansible is agentless and push-based, using YAML playbooks executed in sequence, while Puppet traditionally uses agents and a declarative DSL with dependency-driven ordering. Those two architectural and authoring differences are accurate. The remaining statements invert the architectures, misstate module languages and transports, or wrongly claim both tools need a persistent agent on the network device.

The ios_config module is the correct choice because it is specifically built for idempotent configuration management on Cisco IOS devices. It checks the running configuration and only applies missing lines, ensuring the device reaches the desired state without redundant changes. The other modules either execute commands, manage specific resources like VLANs, or gather facts, none of which fulfill the requirement to apply arbitrary configuration lines idempotently.

Reading the running configuration over NETCONF requires a read operation against the running datastore. The ncclient get_config method is designed for exactly this purpose, accepting a source datastore and optional subtree or XPath filter. The other methods either modify state, apply staged changes, or send unvalidated raw RPCs.

Ansible inventory files define the hosts and groups that Ansible manages. They can be written in YAML format, which is a human-readable data serialization language that Ansible supports alongside the traditional INI format. This flexibility allows users to choose the format that best suits their automation needs, with YAML being particularly useful for complex inventories due to its support for structured data.

NETCONF uses the edit-config operation to modify device configuration programmatically. Since the automation script detected that the interface is disabled (enabled state is false), sending an edit-config request with <enabled>true</enabled> for that interface directly remediates the issue by setting the operational state to enabled, aligning with the expected state without manual intervention.

Netmiko is built on top of Paramiko but adds a higher-level abstraction layer that automatically handles device-specific prompt detection, command output parsing, and SSH session management. This simplifies the backup process across heterogeneous devices by eliminating the need to manually write code for each device's unique prompt patterns and command responses.

Cisco DNA Center authenticates API clients by exchanging HTTP Basic credentials for a time-limited token. The client posts to /dna/system/api/v1/auth/token, and the controller returns a JSON object whose 'Token' field is then used in the X-Auth-Token header. This is the only supported pattern among the choices, so the script must follow it to create sites successfully.

`git rebase` rewrites the commit history of the feature branch to appear as if it was branched from the latest commit on the main branch, resulting in a linear, clean project history. This avoids the merge commits that `git merge` creates, making the commit log easier to follow and debug. The primary advantage is not speed or conflict resolution, but a streamlined, non-branching history.

The Meraki Dashboard API authenticates requests with the API key placed in the X-Cisco-Meraki-API-Key header. To enumerate accessible organizations, the client sends a GET to /api/v1/organizations. Query-string keys, HTTP Basic auth, and OAuth bearer tokens are not the documented mechanism for this endpoint, so only the header-based approach with the correct path succeeds.

Ansible uses SSH as its default transport protocol to connect to Cisco IOS devices because SSH provides encrypted, secure remote access and is the standard for network device management in modern environments. Ansible's native architecture relies on SSH for agentless communication, executing modules and playbooks over this secure channel without requiring additional software on the target devices.

Cisco DNA Center uses an intent-based networking model where the administrator defines the desired state (e.g., 'provision a switchport for access VLAN 10') and the controller automatically translates that intent into the necessary device configurations (CLI or NETCONF/YANG). This abstraction reduces manual errors and enforces consistency across the campus network without requiring per-device CLI scripting.

The Meraki Dashboard API uses a simple API key for authentication, not OAuth2 or JWT. The key must be included in the `X-Cisco-Meraki-API-Key` header of every request. This is the only supported method for authenticating with the Meraki API, as documented by Cisco Meraki.

To retrieve devices by hostname pattern via the DNA Center Intent API, the developer must first authenticate to obtain a token, then issue a GET request to the network-device endpoint and filter the results. Authentication is always required, and the GET method is used for read operations. The other options involve incorrect HTTP methods, unnecessary device configuration, or actions that do not contribute to the retrieval task.

The POST HTTP method is used to create a new resource on the server, and the Cisco DNA Center API endpoint `/dna/intent/api/v1/site` is designed to accept a POST request with a JSON payload containing site, building, and floor details. This follows RESTful conventions where POST is the standard method for resource creation, and the API documentation specifies this exact endpoint for adding a new site hierarchy.

When using NETCONF with the candidate datastore on Cisco NX-OS, changes are staged in the candidate configuration and do not affect the running configuration until a commit operation is explicitly sent. The commit operation copies the candidate configuration to the running datastore, making the changes take effect immediately. Without this step, the candidate changes remain unapplied.

The exhibit shows a telemetry subscription with a 'period' of 500, which in Cisco model-driven telemetry (MDT) is expressed in milliseconds. Therefore, the frequency is every 500 milliseconds, making option B correct.

The 'type enumeration' statement in YANG defines a leaf that can only take one of the explicitly listed enum values. By specifying 'enum full;', 'enum half;', and 'enum auto;', the developer restricts the 'duplex' leaf to exactly those three predefined strings, which matches the requirement.

Unit tests for API-calling code should isolate the function from the network and assert on the request it constructs. Mocking the HTTP client provides deterministic responses, while checking the method, URL, and authentication header verifies the contract with the Meraki Dashboard API. Together these keep the suite fast, repeatable, and meaningful in CI.

NETCONF advertises supported capabilities during hello exchange. The candidate datastore capability creates a staging area separate from running, letting an engineer apply edits, inspect them, and then commit or discard. Writable-running applies changes immediately, rollback-on-error only handles failed transactions, and notification streams events, so none of those provide the preview-then-commit workflow.

Idempotency ensures that applying the same configuration multiple times always results in the same desired state, regardless of the current state of the device. This is the most critical practice for IaC because it prevents configuration drift and guarantees that the environment state matches the code-defined configuration. Without idempotency, repeated runs of the automation tool could introduce unintended changes or fail to correct deviations.

The Meraki API uses RESTful conventions where retrieving a list of resources is done with a GET request. The endpoint GET /organizations/{organizationId}/networks returns all networks belonging to a specific organization, as documented in the Meraki API reference. This matches the standard pattern for listing child resources under a parent resource.

Idempotency in network automation means that executing an operation multiple times results in the same network state as executing it once. For example, using a REST API PUT request to set a VLAN configuration will leave the device in the same state whether the request is sent once or repeatedly, because PUT is inherently idempotent. This prevents unintended side effects like duplicate VLANs or interface misconfigurations when a script is retried due to network failures or timeouts.

RESTCONF is the correct choice because it is a stateless protocol that uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE) to manipulate YANG-defined data stores on a Cisco IOS-XE device. Unlike NETCONF, which is stateful and session-oriented, RESTCONF operates over HTTP without maintaining session state, making it ideal for lightweight, RESTful automation.

Network automation with Ansible requires the network_cli connection plugin and a correct ansible_network_os value so the right terminal and module behavior is selected. Using the local connection, switching to the NETCONF port, or applying Linux privilege escalation semantics all misrepresent how IOS XE devices are managed. Confirming the connection type and platform identifier addresses the most common causes of successful login but failed configuration.