CCNA Infra Automation Questions

Requiring a pull request with at least one approval before merging to the main branch enforces peer review and validation of configuration changes. This ensures that only code that has been reviewed for correctness, syntax, and adherence to standards is merged, preventing erroneous or malicious configurations from reaching production via the CI/CD pipeline.

The Cisco Catalyst Center Terraform provider allows network automation engineers to define and manage network infrastructure resources in a declarative state file. Terraform uses a desired-state approach where the configuration file describes the intended end state of resources, and the provider communicates with Catalyst Center's REST API to enforce that state, enabling idempotent and version-controlled infrastructure management.

Credentials supplied through environment variables let the same script run locally and in CI without modification, and they never land in the repository. The script authenticates against the DNA Center token service and reuses the resulting token for the API calls it needs, satisfying both the secrecy and unattended-execution constraints.

PyATS is a test automation framework designed for network engineers, providing built-in test libraries (e.g., `pyats.aetest`) that enable writing reusable, modular test scripts. Unlike a simple ping script, pyATS supports structured test cases, data-driven testing, and integration with Cisco devices via libraries like `Genie`, allowing for comprehensive validation beyond basic reachability.

Storing configuration backups in a version-controlled repository before each change ensures that a known-good 'previous' snapshot is always available for rollback, even if the Git revert commit only reverts the playbook code and not the device configuration. In CI/CD for network automation, the pipeline must have access to the exact prior state to restore it; version-controlled backups provide an immutable, auditable history that can be checked out by commit hash. This directly prevents the failure described, where the rollback playbook cannot find the previous configuration snapshot.

Linting is the stage that validates syntax and style for code or configuration files. In a CI/CD pipeline for network automation, the linting stage uses tools like `ansible-lint` to check Ansible playbooks for syntax errors, best practices, and idempotency issues before any testing or deployment occurs.

The `ios_config` module is correct because it is specifically designed to manage Cisco IOS device configurations by sending configuration commands via SSH or Telnet, using the CLI to apply changes to the running or startup configuration. This module is part of Ansible's `cisco.ios` collection and directly supports the IOS operating system, making it the standard choice for automating configuration tasks on Cisco IOS devices.

Ansible uses a push-based architecture where the control node must be a Linux or macOS system with Python installed to execute playbooks. Python is required because Ansible itself is written in Python and relies on it for modules, SSH connections, and Jinja2 templating. No additional database, license, or dedicated management server is needed for basic network automation against Cisco IOS devices.

OSPF configuration requires enabling the OSPF process, setting a router ID, and advertising networks in specific areas.

SCP (Secure Copy Protocol) is the most appropriate choice because it provides encrypted, authenticated file transfers over SSH, ensuring the confidentiality and integrity of Cisco IOS configuration backups. It is natively supported on Cisco IOS devices and allows secure push operations to a central server without requiring additional software.

When an API returns 429, the client must back off according to the server's Retry-After header rather than retrying aggressively or trying to evade the limit. Immediate retries, transport downgrades, and token rotation do not address the throttling and can worsen it. Respecting Retry-After is the standard, reliable way to recover from rate limiting against the Cisco DNA Center Intent API.

SSH (Secure Shell) is the correct protocol because it provides encrypted, authenticated remote access to Cisco IOS-XE devices, which is essential for secure automation. Ansible uses SSH to connect to network devices and execute configuration commands idempotently by comparing the desired state (defined in playbooks) against the current device state, ensuring only necessary changes are applied without duplication or disruption.

The scenario requires a NETCONF client, a YAML parser, and externalized credentials. ncclient provides the NETCONF over SSH capability, PyYAML reads the inventory, and environment variables keep secrets out of the code. Together these choices meet both the protocol and the reusability requirements without embedding sensitive data.

Cisco DNA Center's token-based authentication flow returns a token from the /auth/token endpoint, and that token must be presented in the X-Auth-Token header for all subsequent API requests. Other common authentication headers like Authorization: Bearer or custom cookie schemes are not recognized by DNA Center. Using the correct header ensures the script can reuse the token until it expires, avoiding repeated authentication calls.

The team's centralized source of truth in Git (YAML files) should be the authoritative reference for network definitions. By comparing these definitions against both the actual Nexus switch configurations and AWS VPC subnets, the team can identify and correct any drift or mismatch. This aligns with Infrastructure as Code (IaC) best practices, ensuring that all environments are synchronized from a single, version-controlled source before making any changes.

Ansible satisfies the agentless, SSH-based, YAML-driven requirements in one tool. Its ios_config and related modules push configuration changes to Cisco IOS XE devices without installing anything on them, and playbooks express the desired banner state declaratively. Competing configuration management tools rely on agents that cannot run on the routers themselves.

RESTCONF maps YANG models to HTTP resources. To read configuration or state data, use GET with a URL rooted at /restconf/data/, followed by the module name and a colon, then the data node path. The ietf-interfaces module defines the interfaces container, so the correct URL is GET https://device/restconf/data/ietf-interfaces:interfaces.

In YANG, a 'leaf' node defines a single, scalar value of a specific data type. When the leaf is named 'bandwidth' with type 'uint32', it represents a single integer value, typically interpreted as kilobits per second (kbps) in the context of network device configuration (e.g., interface bandwidth). This aligns with the standard YANG data modeling approach where a leaf cannot hold multiple values or complex structures.

Ansible's idempotent modules, such as `ios_vlan` for Cisco IOS devices, are designed to check the current state of the device before making changes. If the VLAN already exists, the module will report 'ok' and not attempt to create it again, preventing the error and ensuring the playbook completes successfully. This aligns with Ansible's best practice of writing idempotent playbooks that produce the same result regardless of how many times they are run.

HTTP 429 (Too Many Requests) indicates the client has sent too many requests in a given amount of time, triggering rate limiting on the server. In network automation, devices like routers or switches enforce rate limits to prevent resource exhaustion, often based on RFC 6585. This is common when automation scripts exceed API call thresholds, requiring retry logic with exponential backoff.

After authenticating to the DNA Center Intent API, clients receive a token that must be sent in the X-Auth-Token header on every subsequent request. Basic credentials, cookies, and content type headers serve different purposes and do not carry the issued token. Reusing the token reduces credential exposure and matches how the controller expects stateless API calls to be authorized.

The candidate capability is required because the script edits a candidate datastore and then commits the change to running. NETCONF capabilities are advertised in the server's <hello> message; a client must check for the candidate capability before using <edit-config> with a candidate target and <commit>. Rollback-on-error, validate, and writable-running serve different purposes and do not enable the candidate datastore workflow.

YANG (RFC 6020/7950) allows you to define data constraints such as ranges, mandatory elements, and type restrictions directly in the model. When you attempt to apply configuration via NETCONF or RESTCONF, the server validates the data against these constraints before committing, preventing invalid changes from being applied.

LLDP (IEEE 802.1AB) and CDP (Cisco Discovery Protocol) are Layer 2 protocols that allow network devices to advertise their identity, capabilities, and directly connected neighbors. In automation environments, these protocols enable dynamic discovery of the network topology without manual intervention, making them essential for automated inventory and mapping.

Ansible is the best-suited tool because it provides a dedicated module (cisco.aci.aci_rest) that directly interacts with the APIC REST API, allowing declarative automation of VLAN and other ACI configurations. Unlike generic scripting, Ansible abstracts the HTTP requests and handles idempotency, authentication, and error handling natively for the ACI fabric.

NETCONF (Network Configuration Protocol) uses SSH as its default transport protocol, as specified in RFC 6242. SSH provides the required secure, authenticated, and encrypted channel for NETCONF sessions, ensuring confidentiality and integrity of configuration data exchanged between the client and server.

Secure automation requires protecting credentials and managing tokens efficiently. Storing secrets outside the code prevents leaks, and reusing a valid token until expiration avoids unnecessary authentication calls. The other options either weaken security or add avoidable overhead that can trigger rate limits.

Using environment variables keeps credentials out of source code and allows them to be managed securely by the deployment environment. This is a widely accepted practice for handling secrets in automation scripts. It avoids the risks of hardcoding or storing secrets in version control, and it supports different credentials per environment.

The URL capability (urn:ietf:params:netconf:capability:url:1.0) is a standard NETCONF capability that allows a client to specify a URL as the source or target of operations like <copy-config> or <edit-config>. Option D is correct because urn:ietf:params:netconf:base:1.0 is the mandatory base capability that every NETCONF session must advertise, as defined in RFC 6241, indicating support for the core NETCONF protocol operations.

Meraki enforces per-organization call limits and communicates throttling with the 429 Too Many Requests status. The application should catch that status, honor any Retry-After header, and back off before retrying. Authentication and permission errors use different codes, and server outages use 503, so only 429 correctly identifies rate limiting.

The ios_config module is designed for Cisco IOS devices and requires a persistent network connection to send configuration commands. The network_cli connection method establishes an SSH session that remains open for the duration of the playbook task, allowing the module to send multiple CLI commands and handle prompts. This is the recommended connection method for ios_config because it supports privilege escalation and command responses needed for configuration changes.

The 'mask' leaf is defined with the type 'inet:ipv4-prefix-length', which represents a decimal integer from 0 to 32 indicating the number of leading 1 bits in the subnet mask (e.g., 24 for /24). This is the correct data type for a prefix length in YANG models, not an IPv4 address or a generic string.

Ansible Vault is the recommended security practice for encrypting sensitive data like SSH credentials. It allows you to store encrypted variables and files within your playbooks or inventory, protecting secrets at rest while enabling decryption at runtime via a password or key file. This avoids exposing credentials in plain text, which is critical for centralized automation servers that may be accessed by multiple users or integrated into CI/CD pipelines.

Unit tests should isolate the code under test from external systems. Patching the HTTP call with unittest.mock replaces the real request with a mock response containing sample JSON, so the parsing logic is exercised deterministically without any network traffic. Proxies, live sandboxes, and retry tuning all leave real calls in place.

YANG is a data modeling language that defines the structure and constraints of configuration and state data, and it is designed to be used with NETCONF (RFC 6241) and RESTCONF (RFC 8040) as the transport protocols. This makes option A correct because YANG models are encoded in XML or JSON and exchanged via these protocols.

The candidate datastore capability is the only one that introduces a separate staging area plus a commit operation, enabling atomic configuration changes. Writable-running, rollback-on-error, and validate are separate capabilities that do not create a candidate store. When a NETCONF client must edit offline and commit transactionally, the hello message must include the candidate capability URI before the client can target candidate in edit-config.

The cisco.ios.ios_config module is correct because it allows you to push raw CLI configuration lines to Cisco IOS devices, including SNMP-related commands like 'snmp-server community' or 'snmp-server host'. The cisco.ios.ios_snmp_server module is correct because it is a dedicated Ansible module that provides structured, idempotent management of SNMP server settings (e.g., communities, hosts, traps) without requiring raw CLI lines.

The error response includes a field 'missingParameters' with the value 'ipAddress', which explicitly indicates that the request body did not include the required 'ipAddress' field. Cisco DNA Center's API for device creation requires this field to identify the device on the network. Without it, the API cannot proceed with adding the device, resulting in a 400 Bad Request.

Canary deployment is the correct practice because it gradually introduces the configuration change to a small subset of devices or traffic before full rollout. This allows monitoring for adverse effects and automatic rollback if issues arise, minimizing the risk of production disruption. In a CI/CD pipeline for network changes, this approach aligns with incremental validation and risk mitigation.

NETCONF on Cisco IOS XE is exposed as an SSH subsystem on TCP port 830. The ncclient library negotiates the SSH transport and then exchanges XML capabilities and RPCs. Using SSH on the NETCONF port is the documented combination, so the script must target TCP 830 rather than the standard CLI port or a TLS-based alternative.

An Ansible playbook with the ios_config module's backup option is the most scalable approach because it uses a push-based automation model that can manage all 50 routers from a single control node, leveraging SSH for secure transport and idempotent configuration management without requiring any agent on the routers.

The 'ietf-interfaces' YANG model defines the '/interfaces-state' container specifically for operational state data (e.g., status, counters), as per RFC 7223. The XPATH '/interfaces-state/interface' retrieves the list of all interfaces with their operational status, which is exactly what the developer needs. The 'ncclient' library can filter using this XPATH to get read-only operational data from a NETCONF-enabled Cisco IOS-XE device.

NETCONF separates staging from activation through the candidate datastore and the commit operation. Loading the candidate with edit-config, validating it, and then committing ensures the configuration is syntactically and semantically correct before it becomes active, and the commit is atomic. This is the standard approach for safe, transactional configuration changes on devices that support the candidate capability.

Using the 'state' parameter in Ansible modules (e.g., 'state: present' or 'state: absent') explicitly declares the desired end state of a resource. This allows the module to compare the current state against the desired state and only make changes if necessary, ensuring that running the playbook multiple times produces the same result without unintended side effects.

Meraki paginates large collections and advertises the subsequent page through the HTTP Link response header with rel="next". A client that inspects headers and follows that URL iterates the entire collection robustly, which is the documented pattern for traversing large result sets. Approaches that assume a single oversized page, misuse POST, or repurpose rate-limit headers all fail to advance through the data.

HTTP status code 200 indicates a successful GET request where the server has processed the request and is returning the requested data in the response body. In the context of the Cisco DNA Center REST API, a 200 response to a GET /network-device call means the list of network devices was successfully retrieved and is included in the response payload.

Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It provides high-level methods for sending commands, handling prompts, and managing device interactions, making it the most appropriate choice for automating configuration tasks across multiple devices.

Interface GigabitEthernet0/1 is in the 'administratively down' state, as indicated by the 'down' status in the 'Status' column and the 'down' in the 'Protocol' column. This means the interface has been manually disabled with the 'shutdown' command, preventing it from sending or receiving any IP traffic. In contrast, interfaces that are 'up/up' can forward traffic, while 'up/down' indicates a Layer 1 issue but still allows Layer 2 control plane traffic.

Token-based controller APIs require the client to obtain a token at login, present it on subsequent protected calls, and refresh it when it expires. Storing and attaching the token in a request header satisfies the session requirement, and detecting an authentication failure to re-login keeps unattended scripts working. Replaying credentials, hard-coding tokens, and disabling TLS verification are insecure or nonfunctional alternatives.

The error-tag 'in-use' combined with the error-app-tag 'data-exists' in NETCONF indicates that the configuration operation (e.g., <edit-config> with operation 'create') attempted to add a configuration element that already exists in the running datastore. NETCONF uses these standardized error tags per RFC 6241 to signal that the requested operation cannot be completed because the target data node is already present, preventing duplicate configuration entries.

The Cisco Meraki Dashboard API requires authentication via a custom HTTP header named `X-Cisco-Meraki-API-Key`, where the value is your API key. This is the only supported method for authenticating requests to the Meraki API, as documented in the official API reference. Option D correctly specifies this header, making it the required authentication method for creating an HTTP webhook for network alerts.

Idempotency ensures that applying the same configuration multiple times results in the same final state, preventing unintended changes. In network automation, tools like Ansible or Terraform use idempotent modules (e.g., `ios_config`) to verify the current device state before applying changes, avoiding configuration drift or repeated command failures.

Secure authentication in Ansible is achieved by encrypting secrets with Ansible Vault and letting the playbook load them at runtime, while per-device values are supplied through inventory host_vars and group_vars. Together these satisfy both requirements: credentials stay protected, and the playbook can reference the variables it expects for each switch.

The 'provider' parameter in the ios_config module is a dictionary that encapsulates the connection details required to access the network device, such as hostname, username, password, port, and transport protocol (e.g., SSH). This allows the module to establish a session with the Cisco IOS XE device before applying configuration changes. Without the provider, the module would not know how to reach or authenticate to the target device.

Ansible is the correct tool because it is an agentless automation platform that uses SSH to push configuration changes, such as VLAN deployment, to network devices. It allows engineers to define the desired state of VLANs in YAML playbooks and apply them consistently across multiple switches without manual intervention.

NETCONF is the correct answer because it is a network management protocol specifically designed to operate with YANG data models, using XML or JSON encoding to transport configuration and state data. YANG defines the structure of the data, and NETCONF provides the operations (get, edit-config, etc.) to manipulate that data in a model-driven, programmatic way. This makes NETCONF the standard tool for model-driven programmability in modern network automation.

RESTCONF (RFC 8040) is a REST-like protocol that uses HTTP methods to access structured data defined by YANG models. It natively supports both XML and JSON as data serialization formats, allowing clients to choose the format via the Accept header or URL suffix (e.g., .xml or .json). This makes XML and JSON the correct answer because they are the only formats explicitly defined in the RESTCONF specification for encoding configuration and operational data.

Ansible's defining architecture is agentless and push-based: the control node runs playbooks and opens SSH sessions to managed devices to execute modules. Puppet and Chef rely on agents that pull configuration, and SaltStack's signature design uses minion agents, so only Ansible matches the described model.

JSON supports basic data types: string (e.g., "hello"), number (e.g., 42), boolean (true/false), null, array, and object. Common confusions include misidentifying boolean values as strings or strings as numbers.

Syslog is inherently push-based, so configuring the device to send events to a collector is the most direct way to detect an interface-down event. The collector can then invoke the Slack API webhook, creating an event-driven pipeline. Polling approaches add latency and may miss transient events.

A candidate datastore combined with validate and commit gives the developer a staged, model-checked, transactional change workflow. Invalid edits are caught before they reach the running configuration, and a failed validation simply discards the candidate, preserving service. This matches the requirement for pre-commit validation and the ability to abandon bad configurations.

The Chef Server is the central hub that stores configuration policies (cookbooks, roles, environments, data bags) and distributes them to nodes via a REST API. When a Chef Client runs on a node, it authenticates with the Chef Server and downloads the relevant policy to converge the node to the desired state. This makes the Chef Server the authoritative source of configuration policy in a Chef architecture.

Creating a device through the DNA Center Intent API requires a JSON body, so Content-Type must be application/json, and the call must be authenticated with the token in the X-Auth-Token header. Compression headers and browser-style cookies or Basic credentials do not satisfy these two mandatory requirements.

The correct approach uses exception handling to catch the HTTP error from the failed request, then performs a token refresh via the DNA Center authentication API and retries the original request. This pattern is essential for robust API clients that must handle token expiration. The other options either loop without refreshing credentials, use static tokens, or abort without recovery, none of which solve the authentication failure scenario.

JSON (JavaScript Object Notation) is the most commonly used data format in REST API requests and responses for modern network automation because it is lightweight, language-agnostic, and natively supported by most programming languages and network devices. REST APIs typically use JSON over HTTP due to its ease of parsing, compact structure, and alignment with web development practices, making it the de facto standard for exchanging structured data in automation workflows like those with Cisco NSO, Ansible, or Python scripts.

Ansible is an agentless automation tool that connects to managed nodes over SSH or other protocols, and it uses declarative YAML playbooks to define desired state. These two characteristics distinguish it from agent-based tools like Puppet or Chef, which require agents and use their own domain-specific languages. The team's need for agentless and declarative automation is met by these features.

Git is a distributed version control system that tracks changes in source code and configuration files, making it the ideal tool for version controlling network configurations. Unlike configuration management tools, Git provides commit history, branching, and rollback capabilities specifically designed for version control.

The git remote -v command enumerates each configured remote and prints its fetch and push URLs, which directly confirms which repository the local clone is linked to. Other commands inspect working tree state, commit history, or local diffs, none of which expose remote configuration. Verifying remotes before pushing avoids accidentally sending commits to an unintended upstream repository.