CCNA Automation Questions

RESTCONF on Cisco IOS XE requires HTTP authentication. A 401 Unauthorized indicates missing or invalid credentials. Creating a local user with sufficient privilege and including the credentials in the Authorization header (Basic Auth) allows the request to be authenticated. This is the standard method for RESTCONF access when no AAA server is configured.

Ansible is an agentless automation tool that uses YAML-based playbooks to define tasks. It connects to network devices via SSH or other protocols without requiring any software installation on the managed devices. This matches the engineer's requirements: simple, agentless, and YAML-based configuration management for Cisco IOS XE switches.

Ansible is an agentless automation tool that uses YAML-based playbooks to define tasks. It connects to managed devices over SSH or NETCONF, so no agent software needs to be installed on the Cisco IOS devices. This makes it ideal for simple, push-based configuration management. Ansible modules like 'ios_config' allow network engineers to automate configuration changes across multiple devices efficiently.

<get-config> is the NETCONF operation used to retrieve configuration data. It requires a <source> element specifying the configuration datastore (e.g., <running>) and can include a <filter> to limit the data returned. This is the correct way to retrieve a subset of the running configuration, such as interface configuration.

A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. Even with a valid session, the user's role must include permission to access the /dataservice/device endpoint. The engineer should check the user's role and group permissions in vManage to ensure they have read access to device inventory.

The ios_facts module is specifically designed to collect facts from Cisco IOS devices, including IOS XE. It gathers information such as hostname, version, interfaces, and hardware details. Using this module, the administrator can retrieve operational data and display it using the debug or other output mechanisms. It is the correct choice for fact gathering on Cisco IOS XE platforms.

The absence of the 'candidate' capability in the NETCONF capabilities list means the device does not support the candidate datastore. NETCONF operations like edit-config with candidate target or commit will fail. The engineer must use the running datastore directly or enable candidate support if available.

vManage is the centralized management plane in Cisco SD-WAN. It hosts the templates and orchestrates configuration pushes to WAN edge devices via the vBond and vSmart controllers. When a template is attached to a device, vManage generates the configuration and sends it to the device. This makes vManage the correct component for automating branch deployment.

If the Catalyst Center appliance's IP address is changed after an upgrade, the management network's routing and ARP entries are disrupted. Devices that are configured to send telemetry or accept management commands to/from the old IP address will no longer be reachable, because their ARP caches, DHCP reservations, or static routes still reference the previous address. Additionally, any access control lists on the devices that permit management traffic from the appliance's old IP will silently drop the new source address. This directly explains why all devices become unreachable after the upgrade, even though the appliance itself is up.

Ansible is agentless, uses SSH as its transport, and employs declarative playbooks. The ios_config module specifically manages configuration on Cisco IOS devices. It requires no software installed on the managed device, aligning perfectly with the requirement. This combination is widely used for network automation and directly satisfies the scenario's constraints.

Cisco DNA Center's Intent API uses the base path '/dna/intent/api/v1/'. The endpoint '/network-device' returns a list of all network devices. A GET request is used to retrieve data. This is the correct method and URL for fetching device inventory. Authentication is required via a token, but the method and path are correct.

:rollback-on-error is a NETCONF capability that ensures if any part of a configuration transaction fails, the entire transaction is rolled back to the previous state. This directly supports the requirement for atomicity and automatic rollback. It works in conjunction with the candidate datastore. Therefore, verifying this capability is necessary to guarantee that errors do not leave the device in a partially configured state.

An 'invalid-value' error-tag means the server rejected a data value in the payload, usually because it violates the YANG leaf's type, length, or pattern constraints, or because the leaf is placed under the wrong namespace. Aligning the JSON structure and value with the model definition resolves the rejection. The URI and HTTP method are already correct in the scenario, so the payload content is the remaining cause.

A 401 Unauthorized response indicates the server did not receive valid authentication credentials. RESTCONF over HTTPS typically uses HTTP Basic Authentication, which requires a properly formatted Authorization header containing base64-encoded username and password. If the script omits this header or encodes it incorrectly, the device rejects the request with 401 even though the credentials themselves are valid.

VLAN configuration syntax is not identical across all Cisco IOS versions: older IOS releases traditionally used 'vlan database' mode, while modern IOS-XE and many IOS 15.x train support interface configuration mode with 'vlan <vlan-id>'. If the playbook uses commands like 'vlan <id>' inside interface config or relies on VTP-related syntax that the specific IOS version does not recognize, the switch will return a '% Invalid input' error at the CLI. This failure would occur only on switches running that divergent IOS version, while other switches with compatible syntax execute successfully.

If a configuration line includes a value that the device changes automatically (e.g., 'description Configured on 2025-01-01' or an ACL sequence number), the module will see a difference each time and reapply the line. This results in a 'changed' status even when the intent is already met. The engineer should avoid such dynamic values or use templates that account for them.

If the device is configured to use the candidate datastore, changes made via <edit-config> are not active until a <commit> RPC is issued. The RPC would be accepted without error, but the running configuration remains unchanged. This is a common oversight when using NETCONF with candidate datastores. Issuing a <commit> applies the changes.

Cisco DNA Center enforces role-based access control (RBAC). Even with a valid token, if the user account lacks the required permissions for the Intent API, the request will be denied with 403 Forbidden. The team must ensure the user has a role that includes access to the network device inventory, such as SUPER-ADMIN-ROLE or a custom role with appropriate privileges.

RESTCONF uses the GET method to retrieve data. The URI path /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 correctly targets a specific interface using the YANG model ietf-interfaces. This is the standard way to read configuration data via RESTCONF. The other methods and URIs are either incorrect HTTP verbs or malformed paths.

When a NETCONF session is established over SSH, both the client and server exchange <hello> messages. The server's <hello> contains a <capabilities> element listing all supported YANG models and protocol features. This is the standard mechanism for capability discovery, and the client must parse this message to learn which models are available.

Automation eliminates manual mistakes.

vManage is the management plane that stores device configurations and policies. During zero-touch provisioning, the vEdge router obtains its configuration from vManage after being directed by vBond. vManage is essential for pushing the initial configuration and managing the device thereafter.

RESTCONF GET returns structured JSON or XML over HTTPS, and Python's requests library can call it directly from a script. Saving the responses into a repository gives the team version-controlled, structured backups. This matches the imperative, script-driven preference and avoids CLI parsing, making it the most aligned approach for programmatic configuration retrieval at scale.

The <get-config> RPC requires a <source> element to specify which datastore to retrieve configuration from. The running datastore is commonly used. Without it, the NETCONF server cannot determine which configuration to return, resulting in an error. Adding <source><running/></source> resolves the issue.

RESTCONF indeed uses HTTP methods and supports JSON and XML.

NETCONF supports filtering of <get-config> and <get> responses using the <filter> element. The filter can be a subtree filter (matching XML structure) or an XPath filter (using XPath expressions). By specifying a filter, the engineer can limit the response to only the desired configuration, such as interfaces. This is a standard NETCONF capability and is essential for efficient data retrieval.

Ansible Vault allows encrypting sensitive data such as passwords. The encrypted file can be decrypted at runtime with a vault password, which can be provided via a file or prompt. This keeps passwords out of plaintext in the playbook and enables secure, non-interactive automation. This is the recommended method for securing credentials in Ansible.

The /dataservice/device endpoint in vManage REST API returns a list of all devices managed by vManage, including their system IP, hostname, and status. This is the correct endpoint for retrieving device inventory. It supports filtering and pagination. The engineer can use this to identify devices for further automation tasks.

Cisco DNA Center returns HTTP 202 Accepted for asynchronous operations, including site creation. The response includes a task ID, and the site is not fully created until that task reaches a success state. The device assignment fails because the site does not yet exist. The team must poll the task endpoint until completion before proceeding.

Cisco-specific YANG models typically have a namespace URI containing 'cisco.com' and are designed to expose Cisco IOS XE-specific features and operational data. They complement standard models by providing access to proprietary functionality. For example, Cisco-IOS-XE-native is a common model for native configuration. This statement accurately describes their naming and purpose.

Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It handles device-specific prompts, paging, and other nuances, allowing engineers to send configuration commands and retrieve output easily. It supports Cisco IOS XE and many other vendors. For a beginner needing a high-level interface without dealing with low-level details, Netmiko is ideal. It abstracts the complexities of SSH and device interaction.

RESTCONF is a REST-based protocol that uses HTTP methods (GET, POST, PUT, PATCH, DELETE) and supports JSON encoding. It is enabled on IOS XE with the 'restconf' command and uses the HTTPS server. This matches the requirement to retrieve interface status programmatically with JSON and HTTP.

This error from Netmiko/Paramiko means the SSHTransport object is not in an active state when invoke_shell() is called. On Cisco devices, this commonly occurs when the device is still booting and the SSH server has not fully initialized—for example, RSA keys are still being generated—so the server accepts TCP but aborts the SSH protocol handshake, leaving the client transport inactive.

Ansible is an agentless automation tool that uses SSH to connect to managed devices. It uses YAML-based playbooks, which match the engineer's preference. For Cisco IOS XE, Ansible provides modules like ios_config and ios_command that run over SSH. This makes Ansible the ideal choice for simple, agentless configuration management with YAML playbooks.

The :candidate capability indicates support for a candidate configuration datastore, which allows changes to be staged and validated before being committed to the running configuration. Without this capability, the router cannot accept edits to a candidate datastore, resulting in the error. Enabling :candidate enables the desired workflow of testing configurations before applying them.

The <get-config> operation is designed to retrieve configuration data from a specified datastore, such as <running/>. It returns the configuration in XML format. This is the correct NETCONF operation for reading configuration, as it does not include state data. The engineer can then parse the XML to extract the running configuration.

Ansible is an agentless automation tool that uses SSH or NETCONF to connect to devices, requiring no agent installation on managed nodes. It uses declarative playbooks written in YAML. This aligns perfectly with the requirement for an agentless, declarative tool run from a central server. Ansible is widely used for Cisco network automation.

Cisco DNA Center's Intent API uses token-based authentication. After authenticating via /dna/system/api/v1/auth/token, the script must include the returned token in the X-Auth-Token header for subsequent requests. Without this header, the server returns 403 Forbidden even if credentials are correct. The script likely omitted this step, causing the authorization failure.

In DNA Center, CLI templates are created and then associated with a site, and devices that are not assigned to a site cannot be targeted by the provisioning workflow that applies those templates. Template configuration via the 'Provision' workflow only operates on devices that belong to a selected site in the network hierarchy. Thus the correct fix is to assign the switch to a site, after which the templates and compliance checks become applicable.

The 'unknown-element' error occurs when the filter references a data node that is not defined in any YANG model supported by the device or when the namespace is incorrect. The engineer must confirm that the device supports the ietf-interfaces or Cisco-specific interface YANG model and that the filter uses the exact namespace and node names from that model.

The vManage REST API uses session-based authentication where the client posts credentials to /j_security_check and receives a JSESSIONID cookie. This cookie must be included in subsequent API requests. This is the standard method for programmatic access to vManage, allowing scripts to authenticate and perform operations.

Ansible is declarative, agentless, and connects to managed nodes over SSH without installing any agent software. Its network modules, including ios_config and ios_ospf, target Cisco IOS and IOS XE devices and push configuration from playbooks. This matches the requirement for consistency across many routers, no on-device agent, and SSH-based transport exactly as described.

The Catalyst Center Intent API uses token-based authentication. The engineer must first authenticate by sending a POST request to the /dna/system/api/v1/auth/token endpoint with Basic Authentication (username and password). The response contains a token that must be included in subsequent API calls as an X-Auth-Token header. This is the standard method for API access.

The error explicitly states that the candidate datastore is not supported. Many Cisco IOS XE devices support only the running datastore for NETCONF edits, not the candidate datastore. The candidate datastore allows staging changes before committing, but if it is unsupported, the <edit-config> must target the running datastore. The script should be modified to use the running datastore instead of candidate, and the <commit> operation is unnecessary because changes take effect immediately.

Ansible is an agentless automation tool that uses YAML for playbooks. It connects to devices over SSH or NETCONF and does not require installing agents on managed nodes. It has modules like ios_config for Cisco IOS XE. This matches the administrator's requirements for simplicity and no agent installation.

Cisco DNA Center often processes site creation asynchronously. A 202 Accepted response indicates the request was accepted but not yet completed. The API typically returns a task ID in the response body. The engineer must poll the task status until it succeeds before the site is available. Sending a GET immediately can result in 404 because the site does not exist yet.

HTTP 401 Unauthorized specifically indicates that the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires authentication, typically via HTTP Basic Authentication or token-based methods. Without proper credentials, the device rejects the request. The engineer must include an Authorization header with valid credentials to succeed.

NETCONF over SSH provides secure, authenticated access with structured XML payloads defined by YANG models. The <get-config> RPC retrieves the running configuration in a machine-readable format, eliminating screen-scraping. ncclient is a standard Python library for NETCONF, and individual credentials are supported. This directly satisfies all stated requirements.

Cisco DNA Center's Intent API requires a POST request to the /dna/system/api/v1/auth/token endpoint, using Basic authentication with the username and password. The response contains a token that must be included in subsequent requests in the X-Auth-Token header. This is the standard authentication flow for the Intent API.

The 202 Accepted response includes a task ID for asynchronous operations. The engineer should poll the task endpoint using that ID to check the status. Once the task status is 'SUCCESS', the site creation is complete. This is the standard pattern for DNA Center Intent API operations that are long-running.

This is the correct RESTCONF URI to retrieve the hostname from the Cisco IOS XE native YANG model. The GET method is used to read data. The URI path follows the YANG model structure, starting with the module name and then the data node. This will return the hostname if configured.

RESTCONF is a RESTful protocol that maps CRUD operations to HTTP methods. GET retrieves data, POST creates, PUT replaces, PATCH modifies, and DELETE removes. This aligns with the RESTCONF RFC and is how IOS XE exposes YANG-modeled configuration and state. The team can rely on these standard methods for automation, making this statement accurate and essential for designing tooling.

NETCONF uses TCP port 830, which is separate from the standard SSH port 22. If NETCONF is not enabled on the Cisco IOS XE device via the 'netconf-yang' command, the device will not listen on port 830, and the connection attempt will fail with a socket error. The engineer's ability to SSH on port 22 does not guarantee NETCONF is active. Enabling 'netconf-yang' is required to start the NETCONF SSH server.

Ansible is agentless, connecting over SSH, and uses YAML playbooks. The cisco.ios collection provides modules like ios_vlan and ios_config to manage IOS XE devices. No software needs to be installed on the switches beyond SSH and proper credentials. This matches all requirements: declarative, agentless, YAML-based, and SSH connectivity.

Rollback to a known good state is the critical safety net in a CI/CD pipeline because it directly addresses the recovery-time objective after a failed deployment. The automation framework should preserve the last-known-good configuration (e.g., a snapshot, a config replace file, or a rollback token) and be able to reapply it automatically or on-demand when health checks fail. This minimizes mean time to recovery and is the only option that actively restores service rather than merely preventing or mitigating the impact of a failure.

RESTCONF is a RESTful protocol that also uses YANG models. It maps YANG data to HTTP methods (GET, POST, PUT, PATCH, DELETE) and uses JSON or XML. Cisco IOS XE supports RESTCONF over HTTPS. It is ideal for web-based automation and integrates well with modern tooling. It is a valid protocol for model-driven configuration.

RESTCONF is not enabled by default on IOS XE. The 'restconf' global command starts the RESTCONF agent, and it depends on the HTTPS server being active via 'ip http secure-server'. Without these, the device will not accept RESTCONF requests, resulting in connection failures or 401 errors. This step is mandatory before any RESTCONF API call can succeed.

Ansible is agentless, connecting to devices over SSH, and uses YAML-formatted playbooks to define automation tasks. It includes modules such as ios_config and ios_command that specifically target Cisco IOS XE devices. This matches all stated requirements: no agent, YAML syntax, and SSH communication, making it the correct choice for this scenario.

RESTCONF is the IETF model-driven interface that maps YANG models onto HTTP methods and runs over HTTPS on TCP port 443. Setting the Accept header to application/yang-data+json tells the device to return JSON-encoded structured data rather than XML. This directly satisfies the requirement for a programmatic, model-driven interface over HTTPS without CLI screen-scraping.

The candidate capability allows the script to edit the candidate datastore, validate changes, and commit them atomically. Without it, direct edits to the running datastore may not support rollback or validation, violating the atomicity requirement. Checking for this capability ensures the device supports the candidate configuration workflow.

RESTCONF is designed to use HTTP methods (GET, POST, PUT, PATCH, DELETE) and supports both XML and JSON encoding. It is built on the same YANG models as NETCONF but provides a RESTful interface that is easier to work with, especially for those familiar with JSON and HTTP. This matches the engineer's preferences.

Ansible's block/rescue structure allows error handling. The configuration task can be placed in a block, and if it fails, the rescue section can execute a rollback task, such as using 'cli_command' to run 'configure replace' with a previously saved configuration file. This provides automatic rollback without manual intervention, directly addressing the requirement.

A 401 Unauthorized error indicates that the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires authentication, typically via HTTP Basic Authentication. The engineer must include the username and password in the request headers. This is the standard method to authenticate RESTCONF requests. Without credentials, the device rejects the request, resulting in a 401 error.

Running a pre-task that inspects ansible_net_version and then uses conditional logic to select either the native ios_bgp module or an alternative module (e.g., ios_config) ensures that the playbook aligns with the device's supported API and syntax. This avoids silent failures caused by module versions that do not recognize the running IOS release, and it is the recommended pattern for maintaining idempotent, OS-aware automation across a heterogeneous fleet.

This header tells the RESTCONF server that the client expects the response body in JSON format according to the YANG data model. Cisco IOS XE RESTCONF uses the media type 'application/yang-data+json' for JSON-encoded YANG data. Without it, the server may return XML or an error. This is the correct header to include.

A 401 Unauthorized error indicates authentication failure. The most likely cause is that the username or password is wrong, or the user account lacks the necessary permissions to access the RESTCONF API. The engineer should verify the credentials and ensure the user has appropriate privilege level (e.g., privilege 15).

YANG supports augmentation, allowing vendors to extend standard models with proprietary data. Cisco IOS XE uses augmentations to add features not covered by IETF or OpenConfig models. This is essential for managing Cisco-specific functionality. The statement is true and highlights the flexibility of YANG for vendor customization.

A 401 Unauthorized response means the request lacks valid authentication credentials. RESTCONF uses HTTP authentication, typically basic auth. The engineer must include an Authorization header with the base64-encoded username:password. Even if the credentials are correct, they must be sent in the request. The script likely omitted the auth parameter, causing the server to reject the request. Adding basic authentication resolves the issue.

YANG modules are versioned with revision dates. A module revision may change between IOS XE releases, and using an outdated or mismatched revision can cause errors. By checking the revision date from the yang-library, the engineer can ensure the script uses the correct model version for the device's software, preventing schema mismatches.

NETCONF returns data in XML format. To extract specific values, the script must parse the XML. Libraries such as xml.etree.ElementTree or lxml allow navigation of the XML tree. This step is necessary to process the response and retrieve the statistics values for further use.

RESTCONF requires the Content-Type header to be application/yang-data+json when sending a JSON payload. Without it, the device cannot determine the payload format and returns 415. Adding this header tells the server the body is YANG data encoded in JSON, allowing it to parse and apply the configuration.

The subtree filtering capability allows the client to specify a filter that selects only the desired subtrees of the configuration data. By using a subtree filter, the engineer can request only the interface description and IP address, reducing the response size and processing. This is the standard way to filter NETCONF responses.

Ansible's check mode (--check) allows the playbook to run without applying changes, reporting what would be modified. This supports peer review and drift detection. The ios_config module can compare the running configuration against the desired lines and indicate differences. This aligns with infrastructure as code principles by enabling safe validation before actual deployment, making it the correct choice.

RESTCONF requires the payload to conform to the YANG model. If the JSON structure does not match the expected hierarchy, such as missing the 'ietf-interfaces:interface' container or incorrect nesting, the device will reject it with HTTP 400. This is the most likely cause. The engineer must ensure the payload follows the YANG model exactly.