Ansible Automation practice questions

A network engineer is automating the deployment of VLAN configurations on a set of Cisco IOS-XE switches using Ansible. The playbook uses the ios_vlans module and runs successfully on the first switch, but fails on the second switch with an error indicating that the module is not found. Both switches are running the same IOS-XE version and have the same management access configured. What is the most likely cause of this issue?

Trap 1: The second switch does not have the ios_vlans module installed…

Ansible modules run on the control node, not on the managed devices; the switch does not need the module installed.

Trap 2: The second switch has a different SSH key that is not accepted by…

SSH key issues would cause connection failures, not a 'module not found' error.

Trap 3: The playbook uses a fully qualified collection name (FQCN)…

An incorrect FQCN would cause a similar error, but the first switch succeeded, indicating the FQCN is correct.

A
The second switch does not have the ios_vlans module installed locally.
Why wrong: Ansible modules run on the control node, not on the managed devices; the switch does not need the module installed.
B
The cisco.ios collection is not installed on the Ansible control node.
The ios_vlans module is part of the cisco.ios collection; without it, the playbook fails on any device.
C
The second switch has a different SSH key that is not accepted by the Ansible control node.
Why wrong: SSH key issues would cause connection failures, not a 'module not found' error.
D
The playbook uses a fully qualified collection name (FQCN) incorrectly.
Why wrong: An incorrect FQCN would cause a similar error, but the first switch succeeded, indicating the FQCN is correct.

Review the full OSPF breakdown →

Question 2hardmultiple choice

An engineer is writing an Ansible playbook to configure OSPF on a fleet of Cisco Nexus 9000 switches. The playbook uses the nxos_ospf module. When executed, the playbook reports 'changed' for every switch, even on subsequent runs when no configuration changes are made. The engineer wants to achieve idempotent behavior. What is the most likely cause of the non-idempotent results?

Trap 1: The Ansible control node is using an outdated version of the…

While module versions matter, the nxos_ospf module has supported idempotency for many releases; this is less likely than a configuration mismatch.

Trap 2: The switches have different NX-OS versions, causing the module to…

Version differences could cause issues, but the scenario states all switches report 'changed', suggesting a consistent cause, not version variability.

Trap 3: The engineer forgot to use the '--check' flag to verify idempotency.

The --check flag only simulates changes; it does not affect whether the module is idempotent.

A
The Ansible control node is using an outdated version of the nxos_ospf module that does not support idempotency.
Why wrong: While module versions matter, the nxos_ospf module has supported idempotency for many releases; this is less likely than a configuration mismatch.
B
The playbook does not specify all OSPF parameters, such as 'router-id', causing the module to detect a difference with the running configuration.
If the playbook omits parameters that the module manages (e.g., router-id defaults to a loopback IP), the module sees a change and marks it as 'changed'.
C
The switches have different NX-OS versions, causing the module to behave inconsistently.
Why wrong: Version differences could cause issues, but the scenario states all switches report 'changed', suggesting a consistent cause, not version variability.
D
The engineer forgot to use the '--check' flag to verify idempotency.
Why wrong: The --check flag only simulates changes; it does not affect whether the module is idempotent.

Question 3mediummultiple choice

A network team uses Ansible Tower to manage configuration backups of 500 Cisco IOS routers. They have a playbook that uses the ios_config module with the 'backup: yes' option. Recently, backups started failing for a subset of routers, with errors like 'backup destination path does not exist'. The playbook uses a variable 'backup_dir' set in the Tower job template. What is the most likely cause of these failures?

Trap 1: The routers have insufficient storage space to save the backup…

Backups are saved on the Ansible control node, not on the routers; router storage is irrelevant.

Trap 2: The ios_config module requires the 'backup_options' sub-option to…

The 'backup: yes' parameter is still valid and creates a backup in the default or specified directory; the error points to a path issue, not a deprecated parameter.

Trap 3: The routers are not reachable via SSH during the backup window.

Unreachable routers would produce connection errors, not 'backup destination path does not exist'.

A
The routers have insufficient storage space to save the backup locally.
Why wrong: Backups are saved on the Ansible control node, not on the routers; router storage is irrelevant.
B
The 'backup_dir' variable is not defined for those specific routers in their host_vars or group_vars, causing the playbook to use an undefined path.
If the variable is overridden or missing for certain hosts, the backup path may be invalid, leading to the error.
C
The ios_config module requires the 'backup_options' sub-option to specify the directory, and the playbook is using the deprecated 'backup' parameter.
Why wrong: The 'backup: yes' parameter is still valid and creates a backup in the default or specified directory; the error points to a path issue, not a deprecated parameter.
D
The routers are not reachable via SSH during the backup window.
Why wrong: Unreachable routers would produce connection errors, not 'backup destination path does not exist'.

Question 4easymultiple choice

An engineer is automating the configuration of SNMPv3 on a large number of Cisco IOS-XE devices using Ansible. The playbook uses the ios_snmp_server module. The engineer wants to ensure that the SNMP configuration is applied only if the device is running a specific IOS version that supports SNMPv3. Which Ansible feature should the engineer use to conditionally execute the task?

Trap 1: Use the 'tags' feature to selectively run the SNMP task only on…

Tags control which tasks run, but they are not dynamic based on device facts; they are set at playbook design time.

Trap 2: Use the 'register' directive to capture the output and then use…

Register captures output, and failed_when marks a task as failed; neither is designed for conditional execution based on facts.

Trap 3: Use the 'block' and 'rescue' structure to handle version mismatches.

Block/rescue is for error handling, not for conditional execution based on facts.

A
Use the 'tags' feature to selectively run the SNMP task only on certain devices.
Why wrong: Tags control which tasks run, but they are not dynamic based on device facts; they are set at playbook design time.
B
Use the 'register' directive to capture the output and then use 'failed_when' to skip the task.
Why wrong: Register captures output, and failed_when marks a task as failed; neither is designed for conditional execution based on facts.
C
Use the 'when' clause with a condition on the 'ansible_net_version' fact.
The 'when' clause allows dynamic conditional execution based on gathered facts like the IOS version.
D
Use the 'block' and 'rescue' structure to handle version mismatches.
Why wrong: Block/rescue is for error handling, not for conditional execution based on facts.

Study the full ACL explanation →

Question 5hardmultiple choice

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Trap 1: The routers have a different IOS version that interprets 'outbound'…

IOS does not interpret 'outbound'; the module itself validates the parameter, and an invalid value would likely cause an error, not a silent misinterpretation.

Trap 2: The engineer forgot to include the 'state: present' parameter, so…

If the module did not apply the ACL, the interface would have no ACL, not an inbound one.

Trap 3: The ACL itself is defined with the wrong direction in the playbook.

The ACL definition is separate from the binding; the binding direction is what determines inbound/outbound.

A
The routers have a different IOS version that interprets 'outbound' as 'in'.
Why wrong: IOS does not interpret 'outbound'; the module itself validates the parameter, and an invalid value would likely cause an error, not a silent misinterpretation.
B
The playbook uses 'direction: outbound' but the module expects 'direction: out'.
The ios_acl_interfaces module expects 'in' or 'out'; 'outbound' is not a valid value, causing the module to either ignore the parameter or default to 'in'.
C
The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.
Why wrong: If the module did not apply the ACL, the interface would have no ACL, not an inbound one.
D
The ACL itself is defined with the wrong direction in the playbook.
Why wrong: The ACL definition is separate from the binding; the binding direction is what determines inbound/outbound.

Question 6mediummultiple choice

An organization uses Ansible to manage network device configurations. They have a playbook that uses the ios_command module to execute 'show ip route' on multiple routers and then uses the 'debug' module to print the output. Recently, the playbook started failing with 'Timeout (12s) waiting for privilege escalation prompt'. The routers are reachable and SSH credentials are correct. What is the most likely cause?

Trap 1: The routers are configured with a different enable secret that does…

A mismatched password would cause an authentication failure, not a timeout waiting for a prompt.

Trap 2: The SSH key exchange is taking longer than the default 12-second…

SSH key exchange would cause a connection timeout, not a privilege escalation timeout.

Trap 3: The ios_command module requires a different privilege level to…

The 'show ip route' command typically requires privilege level 1 or 15; the issue is with the escalation process itself, not the command.

A
The routers are configured with a different enable secret that does not match the one in the Ansible vault.
Why wrong: A mismatched password would cause an authentication failure, not a timeout waiting for a prompt.
B
The 'ansible_connection' is set to 'network_cli' but the 'ansible_become_method' is not set to 'enable'.
For network_cli connections, the become method must be 'enable'; otherwise, Ansible waits indefinitely for the privilege prompt.
C
The SSH key exchange is taking longer than the default 12-second timeout.
Why wrong: SSH key exchange would cause a connection timeout, not a privilege escalation timeout.
D
The ios_command module requires a different privilege level to execute 'show ip route'.
Why wrong: The 'show ip route' command typically requires privilege level 1 or 15; the issue is with the escalation process itself, not the command.

Question 7hardmultiple choice

A network engineer is using Ansible to automate the deployment of a new VLAN on a Cisco Nexus switch. The playbook uses the nxos_vlan module. The engineer wants to ensure that if the VLAN already exists, the playbook does not make any changes (idempotent). However, the playbook always reports 'changed' even when the VLAN exists with the same configuration. What is a likely reason?

Trap 1: The playbook uses the 'vlan_id' parameter but not the 'name'…

If the name is not specified, the module does not compare it; the issue is more likely with the VLAN state.

Trap 2: The nxos_vlan module is not idempotent by design and always reports…

The nxos_vlan module is designed to be idempotent; this behavior indicates a configuration mismatch.

Trap 3: The engineer is using the '--diff' flag, which forces the module to…

The --diff flag shows changes but does not cause false 'changed' status.

A
The playbook uses the 'vlan_id' parameter but not the 'name' parameter, causing the module to ignore the name mismatch.
Why wrong: If the name is not specified, the module does not compare it; the issue is more likely with the VLAN state.
B
The playbook does not include the 'vlan_state' parameter, and the existing VLAN is in 'suspend' state, while the module defaults to 'active'.
If the module defaults to 'active' but the VLAN is 'suspend', the module sees a difference and reports 'changed'.
C
The nxos_vlan module is not idempotent by design and always reports changes.
Why wrong: The nxos_vlan module is designed to be idempotent; this behavior indicates a configuration mismatch.
D
The engineer is using the '--diff' flag, which forces the module to report changes.
Why wrong: The --diff flag shows changes but does not cause false 'changed' status.

Question 8mediummultiple choice

A company uses Ansible to manage the configuration of 1000 Cisco IOS routers. They have a playbook that uses the ios_config module with the 'src' parameter pointing to a Jinja2 template. The playbook runs successfully for months, but after a recent IOS upgrade on a subset of routers, the playbook fails with 'ERROR! Syntax error while loading YAML script'. The template has not been changed. What is the most likely cause?

Trap 1: The Jinja2 template now contains syntax errors because the IOS…

The error message specifically says YAML script error, not a Jinja2 template error.

Trap 2: The ios_config module is incompatible with the new IOS version.

Module incompatibility would cause a different error, such as 'module not found' or 'unable to parse response'.

Trap 3: The playbook file was corrupted during the IOS upgrade process.

The IOS upgrade is performed on the routers, not on the Ansible control node; the playbook file is unaffected.

A
The IOS upgrade changed the output of a 'show' command that is used to set a fact, and that fact now contains characters that break YAML syntax.
If a fact contains newlines or special characters, it can cause YAML parsing errors when the playbook tries to process it.
B
The Jinja2 template now contains syntax errors because the IOS upgrade changed the configuration requirements.
Why wrong: The error message specifically says YAML script error, not a Jinja2 template error.
C
The ios_config module is incompatible with the new IOS version.
Why wrong: Module incompatibility would cause a different error, such as 'module not found' or 'unable to parse response'.
D
The playbook file was corrupted during the IOS upgrade process.
Why wrong: The IOS upgrade is performed on the routers, not on the Ansible control node; the playbook file is unaffected.

Question 9easymultiple choice

An engineer is using Ansible to automate the configuration of NTP on a group of Cisco IOS-XE switches. The playbook uses the ios_ntp module. The engineer wants to ensure that the NTP configuration is applied only to switches that are in the 'core' group, not the 'access' group. The inventory file defines these groups. Which Ansible feature should the engineer use to restrict the playbook to the 'core' group?

Trap 1: Use the 'when' clause to check if the switch is in the 'core' group…

While this would work, it is less efficient than directly targeting the group in the 'hosts' field.

Trap 2: Use the 'limit' option when running the ansible-playbook command to…

The 'limit' option is a runtime parameter, not a design-time feature; the question asks for a feature to use in the playbook itself.

Trap 3: Define a variable in the 'core' group and use 'vars_prompt' to ask…

vars_prompt is for interactive input, not for restricting execution to a group.

A
Use the 'when' clause to check if the switch is in the 'core' group using the 'group_names' variable.
Why wrong: While this would work, it is less efficient than directly targeting the group in the 'hosts' field.
B
Set the 'hosts' field in the play to 'core' instead of 'all'.
By setting 'hosts: core', the play will only run on switches that are members of the 'core' group.
C
Use the 'limit' option when running the ansible-playbook command to specify the 'core' group.
Why wrong: The 'limit' option is a runtime parameter, not a design-time feature; the question asks for a feature to use in the playbook itself.
D
Define a variable in the 'core' group and use 'vars_prompt' to ask the engineer which group to run on.
Why wrong: vars_prompt is for interactive input, not for restricting execution to a group.

Question 10mediummultiple choice

A network engineer writes the following Ansible playbook to configure an interface on a Cisco IOS-XE device:

--- - hosts: routers gather_facts: no tasks: - name: Configure interface cisco.ios.ios_config: lines: - ip address 192.168.1.1 255.255.255.0 parents: interface GigabitEthernet0/1

What is the issue with this playbook?

Trap 1: The playbook will work correctly because the module automatically…

The module does not auto-detect; the connection type must be explicitly set.

Trap 2: The playbook will fail because 'cisco.ios.ios_config' is not a…

The module name is valid; the issue is the missing connection parameter.

Trap 3: The playbook will work but only if the device is running IOS-XE…

The IOS version does not affect the need for the connection parameter.

A
The playbook will fail because the 'cisco.ios.ios_config' module requires the 'connection: network_cli' parameter in the play or inventory.
Without setting connection to network_cli, Ansible defaults to 'smart' which may not work for network devices.
B
The playbook will work correctly because the module automatically detects the device type.
Why wrong: The module does not auto-detect; the connection type must be explicitly set.
C
The playbook will fail because 'cisco.ios.ios_config' is not a valid module name.
Why wrong: The module name is valid; the issue is the missing connection parameter.
D
The playbook will work but only if the device is running IOS-XE 16.9 or later.
Why wrong: The IOS version does not affect the need for the connection parameter.

Question 11mediummultiple choice

A Python script using Netmiko is written to send a command to a Cisco router:

from netmiko import ConnectHandler

device = { 'device_type': 'cisco_ios', 'ip': '192.168.1.1', 'username': 'admin', 'password': 'cisco', 'secret': 'enable'

connection = ConnectHandler(**device) connection.enable() output = connection.send_command('show ip interface brief')

print(output)

connection.disconnect()

What is the potential issue with this script?

Trap 1: The script will fail because 'device_type' should be…

The device_type 'cisco_ios' is correct for SSH; the issue is not the device type.

Trap 2: The script will work correctly without any issues.

Missing exception handling can cause crashes; it is not robust.

Trap 3: The script will fail because 'secret' is misspelled; it should be…

The correct parameter name is 'secret' for the enable password.

A
The script will fail because 'device_type' should be 'cisco_ios_telnet' for telnet connections.
Why wrong: The device_type 'cisco_ios' is correct for SSH; the issue is not the device type.
B
The script will work correctly without any issues.
Why wrong: Missing exception handling can cause crashes; it is not robust.
C
The script will fail because 'secret' is misspelled; it should be 'enable_secret'.
Why wrong: The correct parameter name is 'secret' for the enable password.
D
The script lacks exception handling for authentication or connection failures, which can cause the script to crash.
Netmiko can raise exceptions like AuthenticationException or NetmikoTimeoutException; these should be caught.

Question 12easymultiple choice

A REST API call is made to Cisco DNA Center to get the list of network devices:

GET /dna/intent/api/v1/network-device Headers: X-Auth-Token: <token>

The response is:

{
  "response": [
    {
      "id": "123456",
      "managementIpAddress": "10.10.10.1",
      "platformId": "C9300-24P",
      "role": "ACCESS"
    }
  ],
  "version": "1.0"
}

What does this response indicate?

Trap 1: The response indicates an error because the 'version' field is…

Version is present and has a value; it is not an error.

Trap 2: The response contains multiple devices, but only one is shown due…

There is no indication of pagination; only one device is returned.

Trap 3: The response requires authentication because the token is missing.

The token is present in the header; the response is valid.

A
The response contains a single device with management IP 10.10.10.1 and role ACCESS.
The JSON array has one element with the given fields.
B
The response indicates an error because the 'version' field is missing a value.
Why wrong: Version is present and has a value; it is not an error.
C
The response contains multiple devices, but only one is shown due to pagination.
Why wrong: There is no indication of pagination; only one device is returned.
D
The response requires authentication because the token is missing.
Why wrong: The token is present in the header; the response is valid.

Question 13hardmultiple choice

An Ansible playbook uses the cisco.nxos.nxos_config module to configure a Nexus switch:

--- - hosts: nxos_switches gather_facts: no connection: network_cli tasks: - name: Configure VLAN cisco.nxos.nxos_config: lines: - vlan 100 - name Test_VLAN parents: vlan 100

What will be the result of this playbook?

Trap 1: The playbook will successfully create VLAN 100 and set its name to…

The 'parents' parameter should be empty or omitted for global commands like VLAN creation.

Trap 2: The playbook will fail because 'cisco.nxos.nxos_config' does not…

The module supports any configuration lines; the issue is the 'parents' parameter.

Trap 3: The playbook will work but only if the Nexus switch runs NX-OS 7.0…

The NX-OS version is not relevant to this syntax issue.

A
The playbook will successfully create VLAN 100 and set its name to Test_VLAN.
Why wrong: The 'parents' parameter should be empty or omitted for global commands like VLAN creation.
B
The playbook will fail because the 'parents' parameter cannot be the same as the lines.
Using 'parents: vlan 100' when the lines also start with 'vlan 100' creates a conflict; the module may not apply the configuration correctly.
C
The playbook will fail because 'cisco.nxos.nxos_config' does not support VLAN configuration.
Why wrong: The module supports any configuration lines; the issue is the 'parents' parameter.
D
The playbook will work but only if the Nexus switch runs NX-OS 7.0 or later.
Why wrong: The NX-OS version is not relevant to this syntax issue.

Question 14mediummultiple choice

A Python script uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device:

from napalm import get_network_driver

driver = get_network_driver('ios') device = driver('192.168.1.1', 'admin', 'cisco') device.open() arp_table = device.get_arp_table()

print(arp_table)

device.close()

What is the issue with this script?

Trap 1: The script will work correctly because 'ios' is the correct driver…

IOS-XE requires a different driver.

Trap 2: The script will fail because the 'get_arp_table()' method requires…

The method does not require arguments; it returns a list of dictionaries.

Trap 3: The script will work but only if the device is running IOS-XE 16.12…

The driver name is the issue, not the version.

A
The script will fail because the driver name 'ios' is incorrect; it should be 'iosxe' for IOS-XE devices.
NAPALM uses 'iosxe' for IOS-XE; 'ios' is for classic IOS.
B
The script will work correctly because 'ios' is the correct driver for all Cisco IOS devices.
Why wrong: IOS-XE requires a different driver.
C
The script will fail because the 'get_arp_table()' method requires an argument.
Why wrong: The method does not require arguments; it returns a list of dictionaries.
D
The script will work but only if the device is running IOS-XE 16.12 or later.
Why wrong: The driver name is the issue, not the version.

Question 15mediummultiple choice

A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics:

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 Accept: application/yang-data+json

Response:

"ietf-interfaces:interface": [

{
      "name": "GigabitEthernet1",
      "type": "iana-if-type:ethernetCsmacd",
      "enabled": true,

"ietf-ip:ipv4": {

"address": [
          {
            "ip": "192.168.1.1",
            "netmask": "255.255.255.0"
          }
        ]
      }
    }
  ]
}

What does the response indicate about the interface?

Trap 1: The interface is disabled because the 'enabled' field is missing.

The 'enabled' field is present and set to true.

Trap 2: The response indicates an error because the interface type is…

The type 'ethernetCsmacd' is correct for Ethernet interfaces.

Trap 3: The response shows that the interface has no IP address configured.

The IPv4 address is present.

A
The interface GigabitEthernet1 is enabled and has an IPv4 address of 192.168.1.1/24.
The 'enabled' field is true, and the IPv4 address with netmask indicates /24.
B
The interface is disabled because the 'enabled' field is missing.
Why wrong: The 'enabled' field is present and set to true.
C
The response indicates an error because the interface type is incorrect.
Why wrong: The type 'ethernetCsmacd' is correct for Ethernet interfaces.
D
The response shows that the interface has no IP address configured.
Why wrong: The IPv4 address is present.

Question 16mediummultiple choice

An Ansible playbook uses the uri module to make a REST API call to Cisco DNA Center:

--- - hosts: localhost gather_facts: no tasks: - name: Get devices uri: url: "https://dna-center/api/v1/network-device" method: GET headers: X-Auth-Token: "{{ token }}" return_content: yes register: result

- debug: var: result.json

What is missing from this playbook?

Trap 1: The playbook will work if the token is defined in the inventory…

Even if defined, the token must be dynamically obtained; hardcoding is not secure.

Trap 2: The playbook should use the 'cisco.dnac' collection instead of the…

The uri module can be used but authentication is still required.

Trap 3: The playbook is missing the 'validate_certs: no' parameter to…

While SSL validation may be an issue, the primary missing piece is authentication.

A
The playbook is missing a task to authenticate and obtain the X-Auth-Token before making the API call.
DNA Center requires a token obtained via POST /dna/system/api/v1/auth/token.
B
The playbook will work if the token is defined in the inventory file.
Why wrong: Even if defined, the token must be dynamically obtained; hardcoding is not secure.
C
The playbook should use the 'cisco.dnac' collection instead of the uri module.
Why wrong: The uri module can be used but authentication is still required.
D
The playbook is missing the 'validate_certs: no' parameter to ignore SSL errors.
Why wrong: While SSL validation may be an issue, the primary missing piece is authentication.

Question 17hardmultiple choice

A telemetry subscription is configured on a Cisco IOS-XE device using gRPC dial-out:

telemetry ietf subscription 101 encoding encode-kvgpb filter xpath /interfaces/interface/statistics stream yang-push update-policy periodic 500 receiver ip address 10.10.10.10 50001 protocol grpc-tcp

What does this configuration do?

Trap 1: It sends interface statistics every 500 milliseconds to the…

The update-policy is periodic 500, which is in seconds, not milliseconds.

Trap 2: It sends configuration changes for interfaces to the receiver using…

The filter is for statistics, not configuration; it is a push model.

Trap 3: It sends interface statistics only when there is a change, using a…

The update-policy is periodic, not on-change.

A
It sends interface statistics every 500 milliseconds to the receiver using gRPC.
Why wrong: The update-policy is periodic 500, which is in seconds, not milliseconds.
B
It sends interface statistics every 500 seconds to the receiver at 10.10.10.10 port 50001 using gRPC.
The periodic value is in seconds; the receiver is correctly specified.
C
It sends configuration changes for interfaces to the receiver using gRPC.
Why wrong: The filter is for statistics, not configuration; it is a push model.
D
It sends interface statistics only when there is a change, using a push model.
Why wrong: The update-policy is periodic, not on-change.

Question 18mediummultiple choice

A Python script uses the requests library to interact with Cisco DNA Center's REST API:

import requests

url = "https://dna-center/api/v1/network-device" headers = {

"X-Auth-Token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

response = requests.get(url, headers=headers, verify=False)

print(response.json())

What is a security concern with this script?

Trap 1: The script uses a hardcoded token, which is a security risk.

While hardcoding tokens is not best practice, the question asks about the script as shown; the token is present.

Trap 2: The script does not handle HTTP errors, which could expose…

While error handling is important, the SSL issue is a more direct security concern.

Trap 3: The script uses an incorrect URL; the path should be…

The URL path is valid; the security concern is about SSL verification.

A
The script uses a hardcoded token, which is a security risk.
Why wrong: While hardcoding tokens is not best practice, the question asks about the script as shown; the token is present.
B
The script disables SSL certificate verification, making it vulnerable to man-in-the-middle attacks.
verify=False should only be used in test environments; in production, proper certificates should be used.
C
The script does not handle HTTP errors, which could expose sensitive information.
Why wrong: While error handling is important, the SSL issue is a more direct security concern.
D
The script uses an incorrect URL; the path should be /dna/intent/api/v1/network-device.
Why wrong: The URL path is valid; the security concern is about SSL verification.

Question 19mediummultiple choice

Given the following Ansible playbook snippet: --- - name: Configure interface hosts: routers gather_facts: no tasks: - name: Set IP address ios_config: lines: - ip address 192.168.1.1 255.255.255.0 - no shutdown parents: interface GigabitEthernet0/1 What is the effect of this playbook?

Trap 1: It configures the IP address globally, not under the interface.

Incorrect. The 'parents' parameter places the lines under the interface configuration mode.

Trap 2: It only configures the IP address; no shutdown is ignored because…

Incorrect. 'no shutdown' is a valid interface command in IOS.

Trap 3: It fails because 'parents' cannot be used with 'lines' in…

Incorrect. 'parents' is specifically used to specify the parent configuration block for the lines.

A
It configures IP address 192.168.1.1/24 on interface GigabitEthernet0/1 and enables it.
Correct. The lines are applied under the specified interface, setting the IP and no shutdown.
B
It configures the IP address globally, not under the interface.
Why wrong: Incorrect. The 'parents' parameter places the lines under the interface configuration mode.
C
It only configures the IP address; no shutdown is ignored because it is not a valid command.
Why wrong: Incorrect. 'no shutdown' is a valid interface command in IOS.
D
It fails because 'parents' cannot be used with 'lines' in ios_config.
Why wrong: Incorrect. 'parents' is specifically used to specify the parent configuration block for the lines.

Question 20mediummultiple choice

Given the following Ansible playbook snippet: --- - name: Configure VLAN hosts: switches gather_facts: no tasks: - name: Create VLAN 100 ios_vlan: vlan_id: 100 name: Engineering state: present Which statement is true about this playbook?

Trap 1: It only checks if VLAN 100 exists and reports its status.

Incorrect. 'state: present' will create the VLAN if missing, not just check.

Trap 2: It deletes VLAN 100 if it exists.

Incorrect. 'state: present' ensures existence, not deletion. 'state: absent' would delete.

Trap 3: It fails because 'name' is not a valid parameter for ios_vlan.

Incorrect. 'name' is a valid parameter to set the VLAN name.

A
It creates VLAN 100 with name Engineering if it does not exist.
Correct. The module idempotently creates the VLAN with the specified name.
B
It only checks if VLAN 100 exists and reports its status.
Why wrong: Incorrect. 'state: present' will create the VLAN if missing, not just check.
C
It deletes VLAN 100 if it exists.
Why wrong: Incorrect. 'state: present' ensures existence, not deletion. 'state: absent' would delete.
D
It fails because 'name' is not a valid parameter for ios_vlan.
Why wrong: Incorrect. 'name' is a valid parameter to set the VLAN name.