350-401 Automation Practice Question
A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?
⚠ Common exam trap
Cisco often tests the distinction between the Chef client (the agent that enforces state) and the Chef server (the repository), leading candidates to mistakenly select the server as the component that manages device state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Chef client
In a Chef-managed brownfield environment with Cisco IOS XE devices, the Chef client is the agent that runs on each device (or on a proxy like a guest shell) and applies the desired state defined in cookbooks. It is responsible for converging the device's configuration to match the policy, making it the correct component for state management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ohai
Why it's wrong here
Ohai is a system inventory and data collection service embedded within the Chef architecture. When the Chef client converges a node, Ohai first runs to gather platform, hostname, network interface, memory, and other system attributes, which are then exposed to recipes as node attributes. It does not apply any configuration, execute resources, or enforce policy; it is simply the fact-gathering layer that feeds information to the Chef client. Thus, while it is part of the process, it is not the component responsible for automating network device configuration.
- ✓
Chef client
Why this is correct
The Chef client is the enforcement agent that runs directly on each managed device, including network infrastructure such as IOS XE, NX-OS, or IOS XR when Cisco devices are integrated with Chef. It performs the convergence loop by querying the Chef server for the node's run list, evaluating the current state using Ohai, and then executing resources to bring the device to the desired configuration. This on-device agent is precisely the component that applies the automated configuration, making it the correct answer.
- ✗
Chef workstation
Why it's wrong here
The Chef workstation is a separate development environment used by network engineers or automation engineers to author, modify, and test cookbooks, recipes, and policies. These artifacts are uploaded from the workstation to the Chef server for distribution, but the workstation itself never runs on managed devices and does not participate in enforcing configuration. It is a tool for creating automation content, not the agent that executes it on network devices, so it cannot be the answer.
- ✗
Chef server
Why it's wrong here
The Chef server functions as the central repository and control plane for the Chef architecture, storing cookbooks, node metadata, policies, and search indexes. It exposes an API that Chef clients use to retrieve their run lists and cookbooks, and it tracks node check-ins and compliance status. However, the server never resides on or directly configures network devices; it only serves the configuration data to the Chef client that runs on each device. Therefore, it is infrastructure that supports automation rather than the component that performs the device configuration.
Go deeper
Related to this question
Learn chapter
EIGRP: Basics and Advanced Configuration
Key term
REST API for Network Devices
A REST API for network devices is a set of rules that allows software applications to communicate with routers, switches, and firewalls using standard web methods like GET, POST, PUT, and DELETE over HTTP or HTTPS.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.