350-401 Automation Practice Question
A network automation team is evaluating configuration management tools. They need a tool that uses a declarative, agentless architecture and communicates over SSH to push configuration to Cisco IOS XE devices. Which tool best fits these requirements?
⚠ Common exam trap
The trap here is conflating agentless operation with tools that can optionally run without agents but typically rely on agent-based architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ansible with the ios_config module
Ansible is designed as an agentless automation tool that connects over SSH and uses declarative YAML playbooks. The ios_config module is purpose-built for Cisco IOS configuration management. This combination meets all stated requirements: declarative, agentless, and SSH-based. Other tools either require agents or add architectural complexity that makes them less suitable for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Puppet with the Cisco IOS module
Why it's wrong here
Puppet typically requires an agent (Puppet agent) on managed nodes, although it can run agentless via SSH in some cases. However, its primary model is agent-based, and the Cisco IOS module is less mature than alternatives. It does not natively use SSH as its primary transport for network devices without additional configuration, making it a poorer fit for the stated agentless SSH requirement.
- ✓
Ansible with the ios_config module
Why this is correct
Ansible is agentless, uses SSH as its transport, and employs declarative playbooks. The ios_config module specifically manages configuration on Cisco IOS devices. It requires no software installed on the managed device, aligning perfectly with the requirement. This combination is widely used for network automation and directly satisfies the scenario's constraints.
- ✗
SaltStack with the napalm proxy minion
Why it's wrong here
SaltStack can manage network devices via proxy minions using NAPALM, but it requires a Salt master and proxy minion processes, introducing a non-agentless architecture. Although it can use SSH through NAPALM, the setup is more complex and not purely agentless in the same sense as Ansible. It does not best fit the simple agentless SSH requirement.
- ✗
Chef Infra with the Cisco IOS cookbook
Why it's wrong here
Chef Infra uses a client-server or standalone agent model, requiring a Chef client on managed nodes. Even with the Cisco IOS cookbook, it relies on an agent-based architecture, not agentless SSH. While it can manage network devices through proxy nodes, that adds complexity and does not meet the straightforward agentless SSH requirement described.
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
Cisco DNA Center Automation
Cisco DNA Center Automation is a centralized software platform that simplifies network management by automatically configuring, monitoring, and troubleshooting Cisco devices using policy-driven intent and software tools.
Key term
YAML for Network Config
YAML for Network Config is a human-readable data serialization language used to define, automate, and manage network device configurations in a structured text format.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.