350-401 Automation Practice Question
A network automation team needs to securely retrieve the running configuration from 200 Cisco IOS XE routers daily using a Python script. The script must authenticate with individual user credentials, use a structured data format, and avoid screen-scraping. Which approach best meets these requirements?
⚠ Common exam trap
The trap here is assuming that any SSH-based method (such as Paramiko running show commands) counts as structured automation, when only model-driven APIs like NETCONF return schema-validated data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the ncclient Python library to send NETCONF <get-config> RPCs over SSH, requesting the <running> datastore with a YANG-modeled filter.
NETCONF over SSH with ncclient delivers secure, credential-based access and returns configuration data as structured XML governed by YANG models. This eliminates the fragility of parsing CLI text and avoids screen-scraping. The other approaches either return unstructured output, cannot retrieve full configurations reliably, or rely on UI scraping, so they do not meet the stated automation requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SNMPv3 GET requests with the OID for the running configuration MIB object to retrieve the full configuration.
Why it's wrong here
SNMP is designed for monitoring and retrieving specific operational variables, not full device configurations. Cisco IOS XE does not expose the entire running configuration through a single SNMP OID. SNMPv3 adds authentication and encryption, but the approach cannot reliably return the complete configuration in a structured, schema-validated way.
- ✗
Use the requests library to send HTTP GET requests to the device's web UI login page, then scrape the configuration page HTML.
Why it's wrong here
Scraping HTML from a web UI is a form of screen-scraping and is explicitly excluded. It is fragile because UI markup changes across IOS XE versions, lacks structured data, and does not provide a stable, schema-driven API. This approach also complicates authentication and session handling compared to a purpose-built network API.
- ✓
Use the ncclient Python library to send NETCONF <get-config> RPCs over SSH, requesting the <running> datastore with a YANG-modeled filter.
Why this is correct
NETCONF over SSH provides secure, authenticated access with structured XML payloads defined by YANG models. The <get-config> RPC retrieves the running configuration in a machine-readable format, eliminating screen-scraping. ncclient is a standard Python library for NETCONF, and individual credentials are supported. This directly satisfies all stated requirements.
- ✗
Use the paramiko library to open an SSH session and execute the 'show running-config' command, then parse the raw text output.
Why it's wrong here
Paramiko provides SSH transport but returns unstructured CLI text. Parsing raw 'show running-config' output is brittle, requires regex, and lacks schema validation. It does not use a structured data format natively. The scenario explicitly requires avoiding screen-scraping, so this approach fails the structured-data and maintainability requirements.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Cisco DNA Center Automation
Cisco DNA Center Automation is a centralized software platform that simplifies network management by automatically configuring, monitoring, and troubleshooting Cisco devices using policy-driven intent and software tools.
Key term
NETCONF Protocol
NETCONF is a network management protocol that uses a structured data format to configure, retrieve, and modify network devices in a standard, programmatic way.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.