350-401 Automation Practice Question
A network automation team is using Cisco NSO (Network Services Orchestrator) to manage a multi-vendor network. They have created a service model in YANG and deployed it. A network engineer notices that when a device configuration is changed manually outside of NSO, NSO does not automatically correct it. Which NSO feature should be configured to ensure that NSO re-applies the intended configuration when a device drifts from the service model?
⚠ Common exam trap
Test-takers frequently confuse sync-from with reconcile; sync-from pulls device config into NSO, while reconcile pushes the intended config to the device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'reconcile' action on the device or service in NSO.
To correct configuration drift in Cisco NSO, the reconcile action is used. It compares the device's actual configuration with the intended configuration defined by the service model and re-applies any discrepancies. This ensures that the device remains compliant with the service intent. Other options either do not address drift correction or would worsen the situation by syncing the wrong state. Reconcile is the standard mechanism for enforcing compliance in NSO.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a periodic 'sync-from' operation to pull the device configuration into NSO.
Why it's wrong here
A 'sync-from' operation reads the device configuration and updates NSO's copy, but it does not push the intended configuration back to the device. This would actually make NSO aware of the drift but not correct it; in fact, it could overwrite the intended state with the drifted state. The engineer needs to push the intended configuration, not pull the actual one.
- ✗
Configure NSO to use the 'commit dry-run' option when deploying services.
Why it's wrong here
The 'commit dry-run' option in NSO simulates a commit and shows the changes that would be applied without actually modifying the device. It is useful for validation and previewing, but it does not enforce configuration or correct drift. It is a planning tool, not a compliance mechanism. Therefore, it does not solve the problem of manual changes causing drift.
- ✗
Configure the device to use NETCONF Call Home to notify NSO of changes.
Why it's wrong here
NETCONF Call Home allows a device to initiate a connection to NSO, which can be useful for NAT traversal or dynamic IP scenarios. However, it does not automatically trigger NSO to reconcile configuration drift. Call Home is about connectivity, not compliance. The engineer needs a feature that actively monitors and enforces the desired state, which Call Home alone does not provide.
- ✓
Enable the 'reconcile' action on the device or service in NSO.
Why this is correct
NSO provides a reconcile action that compares the actual device configuration with the intended configuration from the service model and re-applies any missing or altered settings. This action can be triggered manually or scheduled. By enabling reconcile, the engineer ensures that drift is corrected according to the service model. This is the correct feature for enforcing configuration compliance in NSO.
Go deeper
Related to this question
Learn chapter
Spine-Leaf and Software-Defined Network Architectures
Key term
Cisco DNA Center Automation
Cisco DNA Center Automation is a centralized software platform that simplifies network management by automatically configuring, monitoring, and troubleshooting Cisco devices using policy-driven intent and software tools.
Key term
NETCONF Protocol
NETCONF is a network management protocol that uses a structured data format to configure, retrieve, and modify network devices in a standard, programmatic way.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.