350-401 Automation Practice Question
A network automation engineer is writing a Python script to retrieve interface statistics from a Cisco IOS XE device using NETCONF. The script uses the 'ncclient' library and connects to the device on port 830. However, the connection fails with a 'Could not open socket' error. The engineer confirms that the device is reachable via ping and SSH on port 22. What is the most likely reason for the failure?
⚠ Common exam trap
The trap here is assuming that if SSH on port 22 works, NETCONF should also work; however, NETCONF requires a separate service on port 830 that must be explicitly enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NETCONF is not enabled on the device.
The 'Could not open socket' error when connecting to port 830 typically means the NETCONF service is not enabled on the device. NETCONF uses a separate SSH server on port 830, which is activated by the 'netconf-yang' command. The engineer's successful SSH on port 22 only confirms the standard SSH server is running, not NETCONF. Therefore, enabling NETCONF is the required fix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NETCONF is not enabled on the device.
Why this is correct
NETCONF uses TCP port 830, which is separate from the standard SSH port 22. If NETCONF is not enabled on the Cisco IOS XE device via the 'netconf-yang' command, the device will not listen on port 830, and the connection attempt will fail with a socket error. The engineer's ability to SSH on port 22 does not guarantee NETCONF is active. Enabling 'netconf-yang' is required to start the NETCONF SSH server.
- ✗
The 'ncclient' library requires Python 2, but the script is using Python 3.
Why it's wrong here
'ncclient' is compatible with both Python 2 and Python 3 in recent versions. The error 'Could not open socket' indicates a network-level issue, such as a refused connection or timeout, rather than a Python version incompatibility. If there were a library issue, the error would likely be different, such as an ImportError or a protocol error. Thus, Python version is not the cause.
- ✗
The firewall is blocking outbound connections on port 830.
Why it's wrong here
While a firewall could block port 830, the scenario does not mention any firewall restrictions, and the engineer can reach the device via ping and SSH on port 22. A firewall blocking port 830 is possible but less likely than the device simply not having NETCONF enabled. The most direct cause is that the NETCONF service is not listening on port 830, which is a common oversight when enabling NETCONF.
- ✗
The device's SSH server is configured to use a non-standard port.
Why it's wrong here
The engineer confirmed that SSH on port 22 is working, which suggests the standard SSH server is on port 22. NETCONF, however, uses a separate SSH server on port 830. The error is specific to connecting to port 830, so the standard SSH port configuration is irrelevant. If the device's SSH server were on a non-standard port, the engineer's SSH test on port 22 would have failed, but it succeeded.
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
NETCONF Protocol
NETCONF is a network management protocol that uses a structured data format to configure, retrieve, and modify network devices in a standard, programmatic way.
Key term
Cisco DNA Center Automation
Cisco DNA Center Automation is a centralized software platform that simplifies network management by automatically configuring, monitoring, and troubleshooting Cisco devices using policy-driven intent and software tools.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.