Ansible Automation practice questions

Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)

Trap 1: YAML files in Python cannot contain comments, so all inventory data…

Incorrect because YAML supports comments using the '#' character, and Python's PyYAML library can parse files that include comments (though comments are not preserved when dumping).

Trap 2: JSON is always more human-readable than YAML for complex inventory…

Incorrect because YAML is often considered more human-readable due to its use of indentation and less verbose syntax; JSON can be harder to read for deeply nested structures.

A
A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.
Correct because this is a common pattern: use PyYAML to load a YAML inventory file, iterate over devices, and use Netmiko or NAPALM to collect facts.
B
The json module in Python can be used to serialize a dictionary containing device inventory data into a JSON string for storage or transmission.
Correct because Python's built-in json module provides json.dumps() to convert Python objects (like dicts) into JSON strings, which is useful for saving inventory data or sending it to other systems.
C
CSV files can be parsed using Python's csv module to import device inventory data, such as hostname, IP, and credentials, into a script.
Correct because the csv module allows reading and writing CSV files, which are commonly used for inventory lists in network automation.
D
YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.
Why wrong: Incorrect because YAML supports comments using the '#' character, and Python's PyYAML library can parse files that include comments (though comments are not preserved when dumping).
E
JSON is always more human-readable than YAML for complex inventory structures.
Why wrong: Incorrect because YAML is often considered more human-readable due to its use of indentation and less verbose syntax; JSON can be harder to read for deeply nested structures.

Question 2mediummulti select

Which two statements about Python data structures used in network automation are true? (Choose two.)

Trap 1: Tuples are commonly used to store device credentials because they…

Incorrect because tuples are immutable; they cannot be modified after creation, making them unsuitable for dynamic credential storage.

Trap 2: Sets are ordered and allow indexing to retrieve specific elements.

Incorrect because sets are unordered and do not support indexing; they are used for unique elements and set operations.

Trap 3: Strings are mutable and ideal for storing multiple device…

Incorrect because strings are immutable in Python and are not designed to hold multiple separate values; they are single sequences of characters.

A
Tuples are commonly used to store device credentials because they can be modified easily.
Why wrong: Incorrect because tuples are immutable; they cannot be modified after creation, making them unsuitable for dynamic credential storage.
B
Dictionaries are used to store key-value pairs such as device IP, username, and password.
Correct because dictionaries map keys to values, which is perfect for storing device parameters like IP, username, and password.
C
Sets are ordered and allow indexing to retrieve specific elements.
Why wrong: Incorrect because sets are unordered and do not support indexing; they are used for unique elements and set operations.
D
Lists are ordered and can be used to store multiple device names for iteration.
Correct because lists maintain order and allow iteration, making them suitable for storing a list of device names or IPs.
E
Strings are mutable and ideal for storing multiple device configurations.
Why wrong: Incorrect because strings are immutable in Python and are not designed to hold multiple separate values; they are single sequences of characters.

Study the full SD-Access breakdown →

Question 3mediumdrag order

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 4mediumdrag order

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 5mediummultiple choice

An engineer uses the following Ansible playbook to configure an interface on a Cisco IOS-XE device using the cisco.ios.ios_interfaces module:

```yaml --- - name: Configure interface hosts: cisco-routers gather_facts: no tasks: - name: Set interface description cisco.ios.ios_interfaces: config: - name: GigabitEthernet0/1 description: "Uplink to Core"

enabled: true

state: replaced ```

What is the result of running this playbook?

Trap 1: The interface will have the description set and all other…

The 'replaced' state replaces the entire interface configuration, not just the provided parameters.

Trap 2: The playbook will fail because 'enabled' is not a valid parameter…

'enabled' is a valid parameter in the cisco.ios.ios_interfaces module.

Trap 3: The playbook will fail because 'state: replaced' requires a…

'replaced' is a valid state that replaces the configuration with the provided one.

A
The interface will have the description set and all other parameters remain unchanged.
Why wrong: The 'replaced' state replaces the entire interface configuration, not just the provided parameters.
B
The playbook will fail because 'enabled' is not a valid parameter for ios_interfaces.
Why wrong: 'enabled' is a valid parameter in the cisco.ios.ios_interfaces module.
C
The interface will be configured with only the description and enabled state, removing any other existing configuration.
The 'replaced' state replaces the whole interface configuration with the provided values.
D
The playbook will fail because 'state: replaced' requires a 'before' and 'after' state.
Why wrong: 'replaced' is a valid state that replaces the configuration with the provided one.

Question 6easymultiple choice

An Ansible playbook uses the cisco.ios.ios_telemetry module to configure a telemetry subscription:

```yaml --- - name: Configure telemetry subscription hosts: ios_xe gather_facts: no tasks: - name: Create telemetry subscription cisco.ios.ios_telemetry: state: present subscription_id: 300 receiver: ip: 10.1.1.100 port: 50051 protocol: grpc-tcp source_ip: 10.1.1.1 encoding: kvgpb filter: xpath: /interfaces/interface/state/counters update_policy: period: 10000 ```

What is the purpose of the 'state: present' parameter?

Trap 1: It checks if the subscription is currently active.

state: present does not check activity; it ensures configuration exists.

Trap 2: It removes the subscription if it exists.

That would be state: absent.

Trap 3: It displays the current subscription configuration.

state: present modifies configuration, not displays it.

A
It ensures the subscription is present in the running configuration.
state: present creates or updates the subscription to match the desired state.
B
It checks if the subscription is currently active.
Why wrong: state: present does not check activity; it ensures configuration exists.
C
It removes the subscription if it exists.
Why wrong: That would be state: absent.
D
It displays the current subscription configuration.
Why wrong: state: present modifies configuration, not displays it.

Question 7mediumdrag order

Drag and drop the steps of Ansible playbook execution flow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 8hardmatching

Drag and drop each Ansible variable precedence level on the left to its matching scope on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Highest precedence, passed via --extra-vars on command line

Lowest precedence, defined in defaults/main.yml of a role

Variables specific to a single host, defined in host_vars/

Variables applied to all hosts in a group, defined in group_vars/

Variables defined in the vars: section of a play

Question 9mediummatching

Drag and drop each Ansible component on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines the list of managed hosts and groups

YAML file containing ordered tasks to execute

Structured directory for reusable variables, tasks, and handlers

Executable code that performs a specific configuration or operational task

Special task triggered only when notified by another task

Question 10mediummulti select

Which two statements about Ansible modules and idempotency are true? (Choose two.)

Trap 1: The 'command' module is idempotent by default because it always…

Incorrect because the 'command' module is not idempotent; it executes the command every time without checking if the desired state already exists.

Trap 2: All Ansible modules are inherently idempotent regardless of how…

Incorrect because not all modules are idempotent; for example, 'command' and 'shell' modules execute every time unless the user adds a 'creates' or 'when' condition.

Trap 3: Idempotency only applies to network modules, not to Linux system…

Incorrect because idempotency is a general design principle for all Ansible modules, including both network and system modules.

A
Idempotency means that running a playbook multiple times will always result in the same final state on the managed node.
Correct because idempotency ensures that repeated application of the same configuration does not change the system beyond the desired state.
B
The 'command' module is idempotent by default because it always runs the given command.
Why wrong: Incorrect because the 'command' module is not idempotent; it executes the command every time without checking if the desired state already exists.
C
The 'copy' module is idempotent because it checks the checksum of the destination file before copying.
Correct because the 'copy' module compares the source and destination file checksums and only copies if they differ, making it idempotent.
D
All Ansible modules are inherently idempotent regardless of how they are implemented.
Why wrong: Incorrect because not all modules are idempotent; for example, 'command' and 'shell' modules execute every time unless the user adds a 'creates' or 'when' condition.
E
Idempotency only applies to network modules, not to Linux system modules.
Why wrong: Incorrect because idempotency is a general design principle for all Ansible modules, including both network and system modules.

Question 11mediummatching

Drag and drop each Ansible connection type on the left to its matching protocol on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

SSH-based CLI connection to network devices

SSH-based NETCONF session for XML configuration

HTTP/HTTPS-based API connection (e.g., NX-API, RESTCONF)

Runs modules on the Ansible control node without SSH to target

Pure Python SSH implementation (fallback when native SSH is unavailable)

Question 12hardmatching

Drag and drop each Ansible variable precedence level on the left to its matching scope on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Variables passed via --extra-vars, highest precedence

Default variables inside a role, lowest precedence

Variables defined in host_vars/ directory for a specific host

Variables defined in group_vars/ directory for a group

Variables defined in the vars: section of a play

Question 13mediummatching

Study the full SD-Access breakdown →

Drag and drop each Cisco DNA Center workflow on the left to its matching component on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Creates network profiles, site hierarchy, and IP address pools

Defines SGTs, scalable groups, and access contracts

Deploys configurations and fabric settings to network devices

Monitors network health, client experience, and application performance

Automates device onboarding, software image management, and compliance checks

Question 14mediummulti select

Which two statements about Cisco DNA Center integration with Cisco SD-Access are true? (Choose two.)

Trap 1: Cisco DNA Center automatically configures OSPF as the control plane…

Incorrect because SD-Access uses LISP as the control plane protocol; OSPF is used for underlay routing but not as the fabric control plane.

Trap 2: Cisco DNA Center requires a separate WAN controller to manage…

Incorrect because DNA Center directly manages border nodes as part of the fabric; no separate WAN controller is needed.

Trap 3: Cisco DNA Center configures SD-Access edge nodes as the core…

Incorrect because edge nodes are access-layer switches that connect endpoints, not core routers; core routers are part of the underlay.

A
Cisco DNA Center is used to design and provision the SD-Access fabric, including defining virtual networks and host pools.
Correct because DNA Center provides the GUI and API to create fabric domains, IP pools, and virtual networks (VRFs).
B
Cisco DNA Center automatically configures OSPF as the control plane protocol for SD-Access.
Why wrong: Incorrect because SD-Access uses LISP as the control plane protocol; OSPF is used for underlay routing but not as the fabric control plane.
C
Cisco DNA Center can enforce group-based policies using Scalable Group Tags (SGTs) in the SD-Access fabric.
Correct because DNA Center integrates with Cisco ISE to define and apply SGT-based policies across the fabric.
D
Cisco DNA Center requires a separate WAN controller to manage SD-Access border nodes.
Why wrong: Incorrect because DNA Center directly manages border nodes as part of the fabric; no separate WAN controller is needed.
E
Cisco DNA Center configures SD-Access edge nodes as the core routers of the network.
Why wrong: Incorrect because edge nodes are access-layer switches that connect endpoints, not core routers; core routers are part of the underlay.

Question 15mediummulti select

Which two statements about Cisco DNA Center automation workflows are true? (Choose two.)

Trap 1: Cisco DNA Center requires an external APIC-EM controller to manage…

Incorrect because APIC-EM is the predecessor to DNA Center; DNA Center has its own integrated discovery and inventory management.

Trap 2: Cisco DNA Center automation is limited to GUI-based workflows and…

Incorrect because DNA Center provides a comprehensive REST API for automation, integration, and custom workflows.

Trap 3: Cisco DNA Center uses Cisco ISE as the primary source for device…

Incorrect because ISE is used for policy and identity services, not for device discovery; DNA Center uses SNMP, CLI, and NETCONF for discovery.

A
Cisco DNA Center supports Plug and Play (PnP) for zero-touch deployment of new switches and routers.
Correct because PnP is a built-in feature of DNA Center that automates the initial provisioning of network devices without manual intervention.
B
Cisco DNA Center can push configuration templates to devices using CLI commands or REST API calls.
Correct because DNA Center supports both CLI-based template deployment and REST API integration for programmatic configuration changes.
C
Cisco DNA Center requires an external APIC-EM controller to manage device discovery and inventory.
Why wrong: Incorrect because APIC-EM is the predecessor to DNA Center; DNA Center has its own integrated discovery and inventory management.
D
Cisco DNA Center automation is limited to GUI-based workflows and does not support any programmatic interfaces.
Why wrong: Incorrect because DNA Center provides a comprehensive REST API for automation, integration, and custom workflows.
E
Cisco DNA Center uses Cisco ISE as the primary source for device discovery and network topology mapping.
Why wrong: Incorrect because ISE is used for policy and identity services, not for device discovery; DNA Center uses SNMP, CLI, and NETCONF for discovery.

Question 16mediummultiple choice

An Ansible playbook uses the cisco.dnac.site module to create a new building site. The playbook is:

- name: Create building site cisco.dnac.site: host: "{{ dnac_host }}"

username: "{{ dnac_username }}"

password: "{{ dnac_password }}" validate_certs: no state: present site: name: Building-B type: building parentName: Area-1 address: "123 Main St" latitude: 37.7749 longitude: -122.4194 register: result

What is the purpose of the 'parentName' parameter?

Trap 1: It defines the DNS domain name for the building.

This is not related to DNS.

Trap 2: It sets the name of the network profile associated with the…

Network profiles are separate from site hierarchy.

Trap 3: It is used to specify the building's primary IP address.

The building itself does not have an IP address.

A
It specifies the name of the building's parent in the hierarchy, such as an area or global site.
Correct. The parentName defines where in the site hierarchy the building is placed.
B
It defines the DNS domain name for the building.
Why wrong: This is not related to DNS.
C
It sets the name of the network profile associated with the building.
Why wrong: Network profiles are separate from site hierarchy.
D
It is used to specify the building's primary IP address.
Why wrong: The building itself does not have an IP address.

Question 17easymulti select

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Trap 1: DNA Center primarily uses SNMP to manage devices.

It uses NETCONF, RESTCONF, and other protocols.

Trap 2: DNA Center only supports greenfield deployments.

It supports both brownfield and greenfield.

Trap 3: DNA Center uses an imperative model for network configuration.

It uses a declarative model.

A
DNA Center primarily uses SNMP to manage devices.
Why wrong: It uses NETCONF, RESTCONF, and other protocols.
B
DNA Center only supports greenfield deployments.
Why wrong: It supports both brownfield and greenfield.
C
DNA Center uses a declarative model for network configuration.
DNA Center is declarative.
D
DNA Center provides a single dashboard for network management.
DNA Center is a centralized management platform.
E
DNA Center uses an imperative model for network configuration.
Why wrong: It uses a declarative model.

Question 18hardmultiple choice

An engineer creates an Ansible playbook to configure model-driven telemetry on a Cisco IOS-XE device:

```yaml --- - name: Configure MDT subscription hosts: ios_xe gather_facts: no tasks: - name: Configure telemetry receiver cisco.ios.ios_config: lines: - telemetry ietf subscription 101 - receiver ip address 10.10.10.10 port 57500 protocol grpc-tcp - encoding encode-kvgpb - filter xpath /interfaces/interface/state/counters - update-policy periodic 5000 ```

What is the problem with this playbook?

Trap 1: The 'encoding encode-kvgpb' should be 'encoding encode-json'.

KVGPB (Key-Value Google Protocol Buffers) is a valid encoding for MDT.

Trap 2: The 'update-policy periodic 5000' should be 'update-policy periodic…

The period is in milliseconds, so 5000 is correct.

Trap 3: The 'filter xpath' path is invalid for IOS-XE.

The XPath /interfaces/interface/state/counters is valid for OpenConfig.

A
The playbook is missing the 'source-address' command under the receiver.
The receiver must include a source-address to specify the IP address from which telemetry data is sent.
B
The 'encoding encode-kvgpb' should be 'encoding encode-json'.
Why wrong: KVGPB (Key-Value Google Protocol Buffers) is a valid encoding for MDT.
C
The 'update-policy periodic 5000' should be 'update-policy periodic 5000 milliseconds'.
Why wrong: The period is in milliseconds, so 5000 is correct.
D
The 'filter xpath' path is invalid for IOS-XE.
Why wrong: The XPath /interfaces/interface/state/counters is valid for OpenConfig.

Question 19mediummultiple choice

An Ansible playbook uses the cisco.ios.ios_l3_interfaces module to configure an IPv4 address on GigabitEthernet0/1:

```yaml --- - name: Configure IPv4 address hosts: cisco-routers gather_facts: no tasks: - name: Set IP address cisco.ios.ios_l3_interfaces: config: - name: GigabitEthernet0/1 ipv4: - address: 10.1.1.1/24 state: merged ```

What is the effect of the 'state: merged' parameter?

Trap 1: It replaces the entire L3 configuration on the interface with only…

That is the behavior of 'replaced', not 'merged'.

Trap 2: It deletes the IP address if it exists.

That would be 'absent' state.

Trap 3: It only checks the configuration without making changes.

That would be 'gathered' or 'rendered'.

A
It replaces the entire L3 configuration on the interface with only the provided address.
Why wrong: That is the behavior of 'replaced', not 'merged'.
B
It adds the IP address to the interface, merging with any existing configuration.
'merged' adds the configuration to the existing one without removing other settings.
C
It deletes the IP address if it exists.
Why wrong: That would be 'absent' state.
D
It only checks the configuration without making changes.
Why wrong: That would be 'gathered' or 'rendered'.

Question 20mediumdrag order