CCNA Automation Questions

The <lock> operation is used to lock a datastore, preventing other sessions from modifying it. The <target> element specifies which datastore to lock, in this case <running/>. This ensures exclusive access for the session. The lock must be released with <unlock> after changes are made. This is the correct operation to prevent concurrent modifications.

Implementing multiprocessing or multithreading allows the Python script to open SSH sessions to multiple routers simultaneously, dividing the 500-device workload across parallel workers. This dramatically reduces total wall-clock time, because network latency and device response delays overlap rather than accumulate. Using a ThreadPoolExecutor or multiprocessing pool with appropriate concurrency limits (e.g., 20-50 workers) can bring total runtime well under the timeout while preserving Netmiko's robust CLI interactions.

RESTCONF on Cisco IOS XE requires authentication for all requests. HTTP 401 Unauthorized explicitly means the request lacks valid credentials. Providing a username and password via HTTP Basic Authentication (e.g., requests.get(url, auth=('admin', 'password'))) supplies the necessary authentication, allowing the request to succeed if the credentials are correct and the user has sufficient privileges.

In Cisco DNA Center, before a template can be applied to a device, the device must be provisioned to a site. Provisioning involves assigning the device to a site and configuring management IP, credentials, and other parameters. The Intent API has a provisioning endpoint that must be called after device assignment. Without provisioning, template application fails with an error indicating the device is not provisioned. This is the missing step.

The :rollback-on-error capability ensures that if any operation within a <commit> fails, the server automatically rolls back the entire transaction to the previous state. This provides automatic error recovery and guarantees atomicity. Without it, a partial commit could leave the device in an inconsistent state. This capability is crucial for the team's requirement to roll back on error.

For a YANG model to be accessible via NETCONF, it must be advertised in the device's NETCONF capabilities. Even if the model file exists, if it is not enabled or supported by the NETCONF server, requests will fail. The engineer should check the <hello> message for the model's namespace and revision. This is the most likely cause of the error.

An HTTP 400 Bad Request in vManage often indicates that the request body fails validation against the expected schema. Even if JSON syntax is correct, semantic errors like invalid IP addresses, missing required fields, or incorrect data types cause the API to reject the payload. Correcting the field values to match the template schema resolves the issue.

The vManage REST API requires authentication using a session token. The client must first POST credentials to /j_security_check to obtain a JSESSIONID cookie, which is then included in subsequent requests. Without this token, the server returns 401 Unauthorized. The script must authenticate before accessing /dataservice/device. This is the most likely cause of the error.

The network_cli connection plugin is designed for network devices and supports SSH key-based authentication. By copying the public key to the switches, Ansible can authenticate using the private key without passwords. This meets the requirement of no password prompts and no plaintext passwords. The network_cli plugin handles the SSH session and CLI interaction.

Using a YANG model validator ensures the configuration adheres to the device's data model, catching syntax and semantic errors early. This validation can be automated in the CI pipeline, preventing invalid configurations from being deployed. It aligns with infrastructure-as-code best practices.

Agentless tools interact with devices using existing interfaces like RESTCONF, NETCONF, or SSH CLI. They may parse CLI output or use structured APIs to apply changes. This approach avoids installing software on devices. This statement is correct and highlights how agentless tools operate.

NSO provides a reconcile action that compares the actual device configuration with the intended configuration from the service model and re-applies any missing or altered settings. This action can be triggered manually or scheduled. By enabling reconcile, the engineer ensures that drift is corrected according to the service model. This is the correct feature for enforcing configuration compliance in NSO.

The 'save_when' parameter in the ios_config module controls when the running configuration is saved to the startup configuration. Setting it to 'always' ensures that after any configuration change, the running config is saved. This directly addresses the issue of changes not persisting after reboot. It is the correct parameter to use.

The Cisco SD-WAN vManage REST API does not support basic authentication for most endpoints. Instead, clients must authenticate by sending a POST request to /j_security_check with username and password, which returns a JSESSIONID cookie. Subsequent requests must include this cookie. Using basic authentication results in a 401 error even with valid credentials.

RESTCONF requires authentication, and a 401 Unauthorized indicates missing or invalid credentials. Cisco IOS XE supports Basic authentication over HTTPS, so the engineer must include a valid username and password in the request headers. This directly addresses the authentication failure without altering device configuration.

The Chef client is the enforcement agent that runs directly on each managed device, including network infrastructure such as IOS XE, NX-OS, or IOS XR when Cisco devices are integrated with Chef. It performs the convergence loop by querying the Chef server for the node's run list, evaluating the current state using Ohai, and then executing resources to bring the device to the desired configuration. This on-device agent is precisely the component that applies the automated configuration, making it the correct answer.

This snippet uses the correct RESTCONF URL for the hostname, sets the Accept header to 'application/yang-data+json', provides basic authentication credentials, and disables SSL verification. The JSON response for this leaf is a dictionary with the key 'Cisco-IOS-XE-native:hostname'. This correctly retrieves the hostname.

Ansible is a declarative, agentless automation tool that uses YAML playbooks and connects to devices over SSH. It does not require an agent on the managed device, making it ideal for network automation. The scenario describes exactly these characteristics.

RESTCONF supports the PATCH method to apply partial modifications to a resource. When using PATCH with a JSON payload, only the specified fields are altered, leaving other existing configuration intact. This is ideal for changing a single interface description without overwriting the entire interface configuration. The payload must be structured according to the YANG model, targeting the specific leaf to be modified.

The <edit-config> operation is used to modify the configuration in a target datastore. It supports operations like merge, replace, create, and delete. The engineer would use this to apply changes to interface configurations. It is the core operation for making configuration changes via NETCONF and is required to fulfill the modification requirement.

Running ssh-add on the control node is the correct solution because it loads the passphrase-protected private key into the running SSH agent, where its decrypted form is retained for the duration of the agent session. Once the key is in the agent, Ansible's SSH connections can use it transparently without prompting for the passphrase, since the agent responds to authentication requests. This directly addresses the root cause: the key must be pre-authenticated to the SSH agent before Ansible attempts to connect, and ssh-add is the standard way to do that in an automated, non-interactive workflow.

NETCONF <edit-config> on Cisco IOS XE modifies the running configuration. To persist changes across a reload, the running configuration must be copied to the startup configuration. This can be done with a <copy-config> RPC targeting the 'startup' datastore or by using the 'copy running-config startup-config' command. Without this step, the configuration is lost on reload, which matches the scenario.

DNA Center's intent-based declarative model lets engineers define the desired end state, and the controller computes and applies device configuration to reach it. This contrasts with imperative per-device CLI configuration, and is a defining characteristic of DNA Center automation.

YANG leaves carry built-in types and restriction statements like range, length, pattern, and mandatory. When a NETCONF or RESTCONF write arrives, the device validates the value against these constraints, producing errors such as 'invalid-value' if violated. This enforcement is central to why model-driven interfaces are more reliable than CLI screen-scraping, and it directly reflects how YANG behaves on IOS XE.

A 401 Unauthorized response indicates that the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires authentication, typically via HTTP Basic Authentication or token-based methods. If the Python script did not include the 'auth' parameter with a valid username and password, or if the credentials are incorrect, the device will return 401. The engineer must configure the script to send proper authentication headers.

The Cisco DNA Center Intent API requires the authentication token to be included in the HTTP header with the key 'X-Auth-Token'. Without this header, the API returns 401 Unauthorized even if the token is valid. The engineer must add the header 'X-Auth-Token: <token>' to the GET request to authenticate successfully.

Ansible does not use an environment variable named ANSIBLE_BACKUP_DIR to set the backup directory. Instead, the ios_config module provides the backup_options parameter, which includes a dir_path sub-option to specify where backups are stored. Without this, backups may be saved to a default location or not at all, depending on the Ansible version.

RESTCONF requires the Content-Type header to be set to 'application/yang-data+json' when sending JSON payloads. If the header is missing or set to 'application/json', the server may reject the request with a 400 Bad Request. The engineer must include the correct media type to ensure the server parses the payload correctly.

In newer revisions of the ietf-interfaces YANG module (RFC 8343), the 'interfaces-state' container was removed and replaced by the 'interfaces' container containing both configuration and state data, with state nodes marked as 'config false'. If the device implements the newer model, a filter targeting 'interfaces-state' will return no data. The engineer should query the 'interfaces' container instead.

RESTCONF uses POST to create a new resource in a data tree. Sending a JSON body to the VLAN list URI creates the specified VLAN. The device responds with 201 Created and a Location header. This is the correct method when the target resource does not yet exist and you are adding a new list entry.

The cookbook likely contains a resource that declares the desired set of SNMP community strings and uses Chef's convergence model to delete any string not in that set. If 'public' was the only community configured on the router, removing it leaves zero valid SNMP communities, causing management stations to lose all SNMP access. This is a classic configuration-drift accident where a declarative resource accidentally omits an existing credential.

RESTCONF requires the client to specify the desired media type via the Accept header. Without it, the server may return 406 Not Acceptable. Setting Accept: application/yang-data+json tells the server to return data in JSON format, which is the standard for RESTCONF. This directly resolves the 406 error by indicating the client's supported response format.

NETCONF uses SSH as its transport protocol, and the standard port for SSH is TCP 22. This provides a secure, encrypted channel for NETCONF messages. The engineer should connect to port 22 to establish the NETCONF session, which supports both configuration and state data retrieval via RPCs.

RESTCONF requires the client to specify the desired media type for the response. The 406 Not Acceptable error occurs when the Accept header is missing or does not match a media type the server can produce. Adding Accept: application/yang-data+json tells the server to return the data in JSON format, which IOS XE supports, resolving the error.

The Requests library is a popular Python HTTP library that simplifies sending HTTP requests. It is commonly used with RESTCONF to interact with Cisco devices because it handles HTTP methods like GET, POST, PUT, PATCH, and DELETE, and supports authentication and JSON/XML payloads. It is an excellent choice for beginners.

xmltodict is a Python library that converts XML into a dictionary, making it easy to work with XML data in Python. It preserves attributes and nested structures, and is commonly used with NETCONF responses. It directly addresses the need to transform XML into a dictionary for manipulation.

When OSPF cost changes are deployed simultaneously across multiple routers without a convergence interval, each router temporarily holds a different version of the link-state database (LSDB). This inconsistency causes the Shortest Path First (SPF) calculations on different routers to produce divergent, potentially looping paths until LSAs are fully flooded and SPF re-runs on all nodes. The correct practice is to stage changes incrementally, allowing each LSA to propagate and the SPF recalculation to complete before the next cost modification is applied.

YANG is a data modeling language used to define the hierarchical structure of configuration and state data in a device. It describes nodes, types, and constraints, allowing controllers and applications to understand the data that NETCONF retrieves and modifies. This is the core purpose of YANG, separate from transport or encoding details, and it is correct because YANG models the data, not the protocol messages.

YANG is a data modeling language used to model configuration and state data manipulated by NETCONF, RESTCONF, and other protocols. It is human-readable, hierarchical, and defines the structure, syntax, and semantics of data. YANG models are used by Cisco IOS XE and other vendors to expose their APIs. The engineer should choose YANG because it is specifically designed for this purpose and is the standard for model-driven programmability.

GET is the correct HTTP method for retrieving data from a RESTCONF resource. Basic Authentication over HTTPS encodes the username and password in the Authorization header, and the TLS encryption of HTTPS protects the credentials in transit. This satisfies the requirement for encrypted communication and authentication, making it the appropriate choice for this scenario.

The ietf-yang-library YANG module defines a data model for listing YANG modules supported by a device. By using the <get> operation with a subtree filter targeting 'ietf-yang-library:modules-state', the engineer can retrieve the list of all available YANG modules. This is the standard method for discovering YANG models via NETCONF.

This sequence correctly locks the candidate datastore, edits it with the desired configuration, validates the candidate, commits the changes to running, and then unlocks the candidate. This follows the NETCONF confirmed-commit workflow and is the standard approach when using the candidate datastore with ncclient. It ensures atomicity and prevents conflicts.

In NETCONF, the 'merge' operation combines the configuration data in the RPC with the existing configuration. For a leaf node like the IP address, which is a single instance, the new value overwrites the existing value. The interface will end up with only the new IP address 10.1.1.2/24. This is because the merge operation updates the leaf with the provided value, effectively replacing the old one.

The Cisco Catalyst Center Intent API requires the authentication token to be passed in the HTTP header 'X-Auth-Token'. If the token is included in the body or as a query parameter, the API will reject the request with 401 Unauthorized. The engineer must set the header correctly. This is a common mistake when first using the API.

The confirmed-commit capability enables a commit operation that must be confirmed within a specified timeout; if confirmation does not occur, the device automatically reverts to the previous configuration. This provides the automatic rollback behavior the engineer needs. Without this capability, a failed or unconfirmed commit would leave the device in the new configuration state, so verifying its advertisement is essential for atomic, safe changes.

A YANG interface module carries a description leaf holding free-text administrative annotation for the interface. It is a standard configurable attribute alongside administrative state and addressing, making it one of the three expected interface attributes.