CCNA Network Programmability Foundation Questions

NETCONF exposes distinct datastores; the running datastore holds the active configuration currently in effect on the device. Targeting it applies changes immediately without a separate commit step, unlike candidate, which requires explicit commit to take effect.

Cisco REST APIs expose their management endpoints over TLS, so specifying the https scheme ensures credentials and payloads travel encrypted rather than in cleartext. This satisfies the stem's secure-communication requirement by preventing plaintext HTTP exposure.

ERAS exposes ISE's internal data model through standards-based REST endpoints, letting automation scripts create, read, update and delete objects such as endpoints, identity groups and network devices. This satisfies the stem's requirement for programmatic CRUD access to ISE resources rather than GUI-only administration.

DELETE is a valid REST HTTP method used to remove an existing network configuration resource identified by its URI. This satisfies the stem's requirement for methods managing configurations, alongside GET, POST, PUT and PATCH, each mapping to a distinct CRUD operation.

A leaf holds exactly one value of a defined type and cannot contain child nodes, unlike containers or lists which organise hierarchy. This matches the stem's description of a single-value node, making it the accurate statement about leaf behaviour in YANG.

The requests library raises a Timeout exception when a connection or read operation exceeds the configured timeout without a response. This distinguishes it from ConnectionError, which covers network-level failures rather than a server simply responding too slowly.

Cisco DNA Center returns an X-Auth-Token header after successful authentication, and subsequent API calls must include this token to satisfy the session-persistence requirement. It is passed as a request header rather than a cookie, so scripts must capture and resend it on every call.

Python's json module raises JSONDecodeError when the parser encounters malformed syntax, such as a missing closing brace, because the token stream ends before the object is terminated. This is the specific exception type the stem describes.

JSON's compact key-value structure eliminates XML's verbose closing tags, cutting payload size and the parsing overhead modern Cisco security APIs incur. This directly satisfies the stem's bandwidth and latency constraint, since smaller responses transmit faster and require less CPU to deserialise than equivalent XML documents.

Collection Variables persist at collection scope, so a script can capture a value from one response and reference it in later requests via {{variable}} syntax, satisfying the requirement to chain requests dynamically within the same Postman collection.

A 403 response means the request was authenticated but the identity is not authorised, so the API user account lacks the roles or privileges required for that operation. Credentials are valid; RBAC permissions on Cisco ISE are the constraint being violated.

JSON encodes structured data as text using objects and arrays, and parsers exist for virtually every language, satisfying the language-independence requirement. Unlike XML it imposes no schema or verbosity, keeping payloads compact for API transport between heterogeneous systems.

REST APIs enforce a defined schema and validate input before changes are applied, so malformed or mistyped commands are rejected rather than pushed to devices. This structured validation replaces error-prone manual CLI entry, satisfying the reduced configuration errors benefit.

The 201 status code is returned by the server after a request successfully creates a new resource, typically following POST or PUT. This confirms the resource now exists, satisfying the stem's question about what 201 Created signifies in an HTTP response.

The FMC REST API provides a token generation endpoint at /api/fmc_platform/v1/auth/generatetoken. A POST with valid credentials returns headers including X-auth-access-token and X-auth-refresh-token. The access token must be included in subsequent requests to authenticate. This is the standard method for session-based authentication with FMC.

SSLError arises during TLS verification when the server's certificate cannot be validated against trusted certificate authorities, typically because it is self-signed, expired, or hostname-mismatched. The requests library rejects the handshake rather than transmitting data insecurely.

NETCONF encodes configuration and state data in XML, giving a hierarchical, schema-defined structure that YANG models validate. This satisfies the stem's requirement for a common benefit by enabling programmatic parsing, filtering and atomic edits, unlike unstructured CLI screen-scraping, so automation tools can reliably read and modify specific configuration nodes.

A 401 Unauthorized response indicates the request lacked valid credentials, so the missing or expired authentication token is the cause. The ASA REST API requires a valid token in the request header, satisfying the stem's scenario of an unauthenticated Postman call.

The Postman Console records the raw HTTP request and response, including headers and bodies, for every call made during a session. This satisfies the audit requirement to verify that all requests are logged with full wire-level detail.

The `manager.connect()` method establishes the SSH transport that NETCONF requires, opening a session to the device on port 830. This satisfies the stem's constraint of using `ncclient`, whose Manager class depends on this SSH-based session before any RPCs, such as `<get-config>`, can be issued.

Wrapping the API call in try-except lets the script catch requests.exceptions.RequestException, the base class covering connection, timeout and HTTP errors. This satisfies the requirement to handle failures gracefully instead of crashing when a Cisco platform is unreachable or returns an error.

After exchanging credentials, Cisco security APIs typically return a bearer token that must be included in the Authorization header of subsequent requests. This token maintains the authenticated session without resending credentials, satisfying the requirement to sustain a session after initial authentication.

PATCH transmits only the changed leaf nodes, so the device merges them into the existing configuration. PUT replaces the entire target resource, meaning any omitted fields revert to defaults or are removed. PATCH therefore satisfies the stem's requirement for partial updates without disturbing untouched settings.

YANG's tree-structured schema natively represents nested configuration and state data, letting modules model device hierarchies such as interfaces containing addresses. This directly satisfies the hierarchical data modelling requirement, unlike flat SNMP MIB tables. Its container, list and leaf constructs enforce that structure, enabling NETCONF and RESTCONF to address nodes by path.

The requests library's auth parameter accepts a tuple and automatically constructs a Basic authentication header from it using base64 encoding. This places the credentials in the Authorization header rather than the URL, which is exactly what the engineer needs to keep them out of query strings and server logs.

The requests Response object exposes the numeric HTTP status as r.status_code, so a script can test r.status_code == 200 after a GET to the FMC /api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies endpoint. This is the canonical, vendor-neutral way to inspect the outcome of the call before attempting to parse the returned JSON body.

The 4xx class of HTTP status codes indicates that the client made an error, such as a malformed request or requesting a nonexistent resource. A 404 specifically means the server could not find the requested resource. In this scenario, the script should catch the 404 and handle it gracefully, perhaps by logging and adjusting the request.

Content-Type declares the media type of the request body, so RESTCONF knows whether the payload is JSON or XML and parses it accordingly. Accept instead describes the desired response format, so Content-Type is the header satisfying the requirement to tell the server the format being sent.

Environments store variables separately from collections, letting the same collection run against different targets by swapping the active environment. This satisfies the scenario's need to organise variables by context, since collection-level variables remain fixed while environment variables change per deployment without editing the collection itself.

REST APIs apply policies programmatically from a single definition, eliminating per-device CLI drift. This directly satisfies the stem's consistency constraint: every endpoint receives identical configuration, so enforcement is repeatable and auditable across the fleet rather than depending on manual, error-prone command entry.

The `Accept: application/json` header performs content negotiation, telling the FMC's REST API which media type the client expects. This satisfies the stem's requirement for a JSON response, since the server inspects `Accept` and serialises its payload accordingly. Without it, FMC may default to XML, breaking JSON parsing in the `requests` script.

json.loads() converts the JSON text into native Python dictionaries and lists, after which chained square-bracket indexing navigates each nested level by key. This is the standard library's idiomatic parsing route and handles arbitrary depth without extra dependencies or schema definitions.

The base NETCONF namespace, urn:ietf:params:xml:ns:netconf:base:1.0, must wrap the <edit-config> element so the device parses the operation itself as a protocol message rather than as configuration data. Without it, the RPC is unrecognised, satisfying the stem's requirement that the device correctly interpret the payload.

Passing `verify=False` to `requests` disables TLS certificate validation entirely, so the self-signed certificate is accepted without checking against a trusted CA bundle. This directly satisfies the testing scenario, where the certificate chain cannot be validated. Note that this suppresses verification for that call only, and urllib3 warnings appear unless explicitly silenced.

json.loads() deserialises a JSON-formatted string into the equivalent Python object, such as a dict or list. This satisfies the stem's requirement, converting text received from an API response into native structures that Python code can index and manipulate.

The HTTP method defines the operation the API performs on the target resource, mapping to create, read, update or delete semantics. Without it, the server cannot determine the intended action, so it forms one of the three essential components alongside the URI and headers.

429 indicates the client exceeded the API rate limit. Exponential backoff with jitter spreads retries so the client does not hammer the endpoint, and honoring Retry-After respects the server's explicit guidance. This reduces 429s while still allowing the script to catch up promptly once the limit window resets.

GET is defined as a safe, idempotent method: repeated identical requests return the same representation without altering device state. POST, PUT, PATCH and DELETE can all modify configuration, so GET uniquely satisfies the stem's constraint of retrieving information without changing the FTD configuration.

This snippet uses the verify parameter pointing to the CA bundle, which tells requests to validate the server certificate against the provided trusted CAs. It also supplies HTTP Basic authentication, which the ISE ERS API supports. The URL is correct for listing network devices. This combination ensures secure TLS verification and successful authentication, meeting the scenario's requirement.

A leaf is a fundamental YANG node that holds a single scalar value, such as an interface name or MTU, and cannot contain child nodes. It is a valid component of a YANG model definition, satisfying the question's requirement.

NETCONF's <edit-config> operation loads configuration data into a specified target datastore, typically the running datastore, altering the device's active configuration. This distinguishes it from <get-config>, which only retrieves data, satisfying the requirement to change device state.

A leaf-list defines a node holding multiple instances of the same data type, unlike a leaf. This satisfies the stem's requirement by describing the multi-value collection behaviour that distinguishes leaf-list from single-value leaf nodes in YANG models.

A leaf-list defines multiple instances of a single leaf, each holding the same data type, which satisfies the stem's requirement for an array of identically typed values. Unlike a leaf, it permits repetition; unlike a container with list entries, its members are simple values without keys or child nodes.

The must statement attaches a validation expression to a data node, and the server rejects any configuration or state that evaluates false. This enforces the operational constraint the stem describes, unlike type or mandatory, which govern structure rather than runtime validity.

A for loop iterates directly over the list of IP addresses returned by the API call, binding each element to a variable without manual index management. This satisfies the scenario's requirement to process every address sequentially, and is the idiomatic Python construct for traversing an iterable of unknown length.

A 201 status code confirms the request succeeded and a new resource was created on the server, typically returned after a POST. It satisfies the stem's constraint of signalling both success and creation, unlike 200 OK, which indicates success without implying a new resource.

The `json` library parses JSON text into native Python dictionaries and lists, so nested values are reached by key indexing such as `data['endpoint']['macAddress']`. This directly satisfies the stem's requirement to extract a field nested inside an object, without extra dependencies or schema definitions.

`response.json()` deserialises the body into a Python dictionary, so `['items']` retrieves the list, `[0]` indexes its first element, and `['name']` reads that object's field. This directly satisfies the stem's requirement to access the first object's name within the parsed JSON structure.

GET is the HTTP method defined for safe, idempotent retrieval of a resource representation without altering server state. This satisfies the stem's requirement for retrieving information, unlike POST, PUT, PATCH or DELETE, which create or modify resources.

Cisco API responses commonly expose rate-limit state through headers such as X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, letting clients read remaining quota and reset timing. This satisfies the stem's requirement for a true statement about rate limiting.

The Accept header performs content negotiation, telling the server which media types the client can handle, such as application/json or application/xml. This directly satisfies the stem's requirement to identify the header's significance: it declares the expected response format rather than the request payload's format, which Content-Type governs.

grouping defines a reusable set of data nodes that can be referenced via uses throughout the model, so shared structures are defined once. This satisfies the stem's requirement to reduce duplication across various parts of the YANG module.

Token generation is a state-changing action, so FMC requires POST rather than GET. The generatetoken endpoint under fmc_platform/v1 accepts Basic credentials and returns the auth token plus refresh token in response headers, which the script then reuses for subsequent API calls.

The candidate store holds uncommitted configuration changes separately from the running datastore, so a `<discard-changes>` operation reverts it to the running configuration without affecting live traffic. This satisfies the stem's requirement that proposed changes can be abandoned when found incorrect, before any commit makes them active.

Config nodes are writable and intended for device configuration, whereas state nodes are read-only and report operational status such as counters or interface up/down. This read-only, operational nature is the defining axis separating state from config in YANG models.

PATCH sends only the changed fields as a partial update, leaving unspecified attributes untouched, whereas PUT supplies a full representation that overwrites the entire resource. This distinction satisfies the scenario contrasting partial modification with complete replacement.

The requests library abstracts raw socket handling and urllib plumbing behind a simple API, so scripts issue GET, POST, PUT and DELETE calls with automatic session, header and JSON handling. That directly satisfies the stem's requirement for the standard HTTP client in automation scripting.

Content negotiation is driven by the Accept header, which tells FMC the client's preferred response media type. Setting Accept: application/json makes the server return JSON rather than XML, satisfying the stem's requirement that the server understands the JSON preference.

NETCONF sessions begin with the client and server exchanging <hello> messages, which advertise supported capabilities and the base protocol version. This handshake must complete before any <rpc> operations, so <hello> is the message type that establishes the session and exchanges capability information.

The raise_for_status() method of the requests library's Response object raises an HTTPError exception if the HTTP status code indicates an error (4xx or 5xx). This allows the script to catch these exceptions and handle them appropriately, such as logging the error or retrying the request. It is a best practice for robust error handling in API interactions.

The Cisco FMC REST API uses a custom header named X-auth-access-token to carry the authentication token obtained from the initial authentication request. After a successful POST to /api/fmc_platform/v1/auth/generatetoken, the response includes this token, which must be included in all subsequent requests. Using this header is the standard method for token-based authentication with FMC.

The <edit-config> operation with default-operation='merge' merges the specified configuration with the existing configuration. This is the default behavior if default-operation is not specified. It ensures that only the provided nodes are modified, leaving other interfaces untouched. This is the correct approach for adding or modifying specific configuration without affecting other parts.

A grouping statement holds a reusable set of nodes that other modules reference through a uses statement after importing the module. It exists solely to group reusable definitions, unlike container, list or leaf, which define data tree instances.

A 429 signals the client exceeded its allotted request quota. Exponential backoff retries after progressively longer, randomised delays, letting the quota window reset and preventing repeated throttling. Immediate retries or ignoring the error would worsen throttling, so backoff satisfies the stem's requirement for an appropriate programmatic response.

The --format flag controls how pyang renders the parsed YANG module, selecting an output plugin such as tree, yang, or jstree. It satisfies the scripting need to produce machine-readable or human-readable model output rather than validating or fetching schemas.

JSON defines number as a primitive value type, covering integers and floating-point values with optional exponents and signs. This satisfies the stem's requirement for a common JSON data type, alongside string, boolean, null, object and array. Numbers require no quoting, unlike string values.

The requests library's json parameter accepts a Python dictionary and serialises it to JSON automatically, setting the Content-Type header accordingly. This removes the need to call json.dumps() manually, satisfying the stem's claim about automatic serialisation of dictionaries.

This filter uses the subtree filtering mechanism with the correct namespace for the ietf-interfaces module. It selects the interfaces container and filters for the interface with name GigabitEthernet1. The structure matches the YANG model, ensuring only the desired interface configuration is returned. This is the standard way to filter NETCONF responses.

JSON's lightweight, text-based structure parses directly into native objects, making it the de facto payload format for REST APIs. Cisco security platforms such as SecureX and Firepower Management Center expose JSON over HTTPS for programmatic device interaction, satisfying the stem's requirement for the standard REST data format.

Using standard HTTP methods (GET, POST, PUT, DELETE) for CRUD operations satisfies REST's uniform-interface constraint, which Cisco security product APIs such as Firepower and Umbrella enforce. This stateless, resource-oriented approach ensures predictable, interoperable calls across endpoints, unlike RPC-style designs that embed actions in the URL.

Path parameters are embedded directly within the URL path, for example /devices/{id}, so they identify the specific resource being addressed. Query parameters instead filter or modify the request after the path. This satisfies the stem's requirement for passing resource-identifying information in the URL itself.

The Headers tab accepts arbitrary key–value pairs sent with every request, so an API key header such as `x-api-key: <value>` is transmitted exactly as the API expects. This satisfies the stem's requirement that the key travel in the request header, unlike query parameters or the body.