350-401 Automation Practice Question
An organization uses Chef to manage network device configurations. A cookbook that configures SNMP community strings is applied to a group of routers. After the run, one router loses SNMP access. The cookbook uses the following resource: snmp_community 'public' do action :remove end. What is the most likely cause of the issue?
⚠ Common exam trap
A common mix-up: candidates assume the issue is a syntax error or a misapplied community string, but Cisco tests the understanding that Chef resources execute exactly as written, and removing the only SNMP community string will break SNMP access regardless of other factors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cookbook removed the only configured SNMP community string
The `snmp_community 'public' do action :remove end` resource explicitly removes the SNMP community string named 'public'. If 'public' was the only SNMP community string configured on the router, its removal would leave the router with no valid SNMP community, causing all SNMP access to be lost. Chef applies the resource as defined; the issue is not a syntax error or misapplication of a different string, but the direct consequence of removing the sole community.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The router's Chef client encountered a syntax error and stopped mid-execution
Why it's wrong here
A syntax error in a Chef cookbook prevents the client from even completing the compile phase, which happens before any resource is converged. Consequently, the Chef client would abort the entire run without applying any changes, so the SNMP community could not be partially removed. The failure would also generate a visible exception in the chef-client output, not a silent loss of management access.
- ✗
The cookbook accidentally applied a 'private' community string instead of 'public'
Why it's wrong here
If the cookbook had inadvertently set the community string to 'private', the resource would typically call :create with a new community name, leaving the existing 'public' string intact unless a separate :delete action targeted it. The observed symptom is that 'public' is missing, not that a different string exists, so this option cannot explain the outage. Even if 'private' were applied, SNMP would still function with that community string, whereas the problem states no access is available.
- ✓
The cookbook removed the only configured SNMP community string
Why this is correct
The cookbook likely contains a resource that declares the desired set of SNMP community strings and uses Chef's convergence model to delete any string not in that set. If 'public' was the only community configured on the router, removing it leaves zero valid SNMP communities, causing management stations to lose all SNMP access. This is a classic configuration-drift accident where a declarative resource accidentally omits an existing credential.
- ✗
The cookbook is not idempotent and reapplied the change multiple times
Why it's wrong here
Idempotency ensures that running a resource multiple times converges to the same declared state; it does not cause progressive deletion of configuration. A non-idempotent cookbook might add duplicate communities or repeat actions, but it would not specifically remove the only community unless the resource's desired state explicitly omitted it. Thus, the removal is a result of the intended (or mistakenly declared) state, not a side effect of repeated application.
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.