350-401 · topic practice
Practise ENCOR 350-401 Python For Network Automation practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
Python For Network Automation questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Simplifies SSH connections to network devices
Provides a unified API for configuration and state retrieval
Enables parallel task execution across inventory
Supports asynchronous network device communication
Offers raw SSH protocol implementation
Trap 1: 30 seconds
Incorrect. 30 seconds is the default for NBMA networks.
Trap 2: 5 seconds
A 5-second hello interval is the default for OSPF on NBMA (Non-Broadcast Multi-Access) networks, not for Ethernet. On an Ethernet broadcast multi-access link, the default hello interval is 10 seconds. This option is tempting because 5 seconds is the default for OSPF point-to-point and NBMA interfaces, so it is correct for those specific network types, but the stem explicitly specifies an Ethernet link.
Trap 3: 40 seconds
Incorrect. 40 seconds is the default dead interval for Ethernet.
10 seconds
Correct. The default hello interval for Ethernet is 10 seconds.
30 seconds
Why wrong: Incorrect. 30 seconds is the default for NBMA networks.
5 seconds
Why wrong: A 5-second hello interval is the default for OSPF on NBMA (Non-Broadcast Multi-Access) networks, not for Ethernet. On an Ethernet broadcast multi-access link, the default hello interval is 10 seconds. This option is tempting because 5 seconds is the default for OSPF point-to-point and NBMA interfaces, so it is correct for those specific network types, but the stem explicitly specifies an Ethernet link.
40 seconds
Why wrong: Incorrect. 40 seconds is the default dead interval for Ethernet.
Trap 1: YAML files in Python cannot contain comments, so all inventory data…
Incorrect because YAML supports comments using the '#' character, and Python's PyYAML library can parse files that include comments (though comments are not preserved when dumping).
Trap 2: JSON is always more human-readable than YAML for complex inventory…
Incorrect because YAML is often considered more human-readable due to its use of indentation and less verbose syntax; JSON can be harder to read for deeply nested structures.
A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.
Correct because this is a common pattern: use PyYAML to load a YAML inventory file, iterate over devices, and use Netmiko or NAPALM to collect facts.
The json module in Python can be used to serialize a dictionary containing device inventory data into a JSON string for storage or transmission.
Correct because Python's built-in json module provides json.dumps() to convert Python objects (like dicts) into JSON strings, which is useful for saving inventory data or sending it to other systems.
CSV files can be parsed using Python's csv module to import device inventory data, such as hostname, IP, and credentials, into a script.
Correct because the csv module allows reading and writing CSV files, which are commonly used for inventory lists in network automation.
YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.
Why wrong: Incorrect because YAML supports comments using the '#' character, and Python's PyYAML library can parse files that include comments (though comments are not preserved when dumping).
JSON is always more human-readable than YAML for complex inventory structures.
Why wrong: Incorrect because YAML is often considered more human-readable due to its use of indentation and less verbose syntax; JSON can be harder to read for deeply nested structures.
Trap 1: Tuples are commonly used to store device credentials because they…
Incorrect because tuples are immutable; they cannot be modified after creation, making them unsuitable for dynamic credential storage.
Trap 2: Sets are ordered and allow indexing to retrieve specific elements.
Incorrect because sets are unordered and do not support indexing; they are used for unique elements and set operations.
Trap 3: Strings are mutable and ideal for storing multiple device…
Incorrect because strings are immutable in Python and are not designed to hold multiple separate values; they are single sequences of characters.
Tuples are commonly used to store device credentials because they can be modified easily.
Why wrong: Incorrect because tuples are immutable; they cannot be modified after creation, making them unsuitable for dynamic credential storage.
Dictionaries are used to store key-value pairs such as device IP, username, and password.
Correct because dictionaries map keys to values, which is perfect for storing device parameters like IP, username, and password.
Sets are ordered and allow indexing to retrieve specific elements.
Why wrong: Incorrect because sets are unordered and do not support indexing; they are used for unique elements and set operations.
Lists are ordered and can be used to store multiple device names for iteration.
Correct because lists maintain order and allow iteration, making them suitable for storing a list of device names or IPs.
Strings are mutable and ideal for storing multiple device configurations.
Why wrong: Incorrect because strings are immutable in Python and are not designed to hold multiple separate values; they are single sequences of characters.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: The vEdge routers have not been rebooted after the policy change.
Incorrect because policy changes take effect immediately without reboot.
Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…
Incorrect because OMP graceful restart affects route convergence, not policy application.
Trap 3: The BFD sessions between vEdge and vSmart are flapping.
Incorrect because BFD is for data plane failure detection, not for policy distribution.
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.
A network engineer runs the following command on Switch SW1:
SW1# show vlan id 10 VLAN ID: 10 VLAN Name: Sales VLAN Type: Ethernet VLAN State: active
MTU: 1500
Remote SPAN VLAN: No
Primary VLAN ID: 10
Private VLAN Type: Primary
Associated Secondary VLAN IDs: 100, 200
Based on this output, what can be concluded?
Trap 1: VLAN 10 is a community VLAN.
It is a primary VLAN, not community.
Trap 2: VLAN 10 is an isolated VLAN.
It is a primary VLAN.
Trap 3: VLAN 10 is a normal data VLAN with no private VLAN features.
The output clearly indicates private VLAN configuration.
VLAN 10 is a community VLAN.
Why wrong: It is a primary VLAN, not community.
VLAN 10 is an isolated VLAN.
Why wrong: It is a primary VLAN.
VLAN 10 is a primary private VLAN.
The output shows 'Private VLAN Type: Primary' and associated secondary VLANs.
VLAN 10 is a normal data VLAN with no private VLAN features.
Why wrong: The output clearly indicates private VLAN configuration.
A network engineer runs the following command on Switch SW1:
SW1# show etherchannel summary
Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator
M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port
Number of channel-groups in use: 1 Number of aggregators: 1
Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D)
Based on this output, what can be concluded?
Trap 1: The EtherChannel is using PAgP.
The protocol is shown as LACP.
Trap 2: Port Gi0/3 is bundled in the channel.
Gi0/3 has flag D (down), not P (bundled).
Trap 3: The port-channel is a Layer 3 interface.
The flag 'S' indicates Layer 2.
The EtherChannel is using PAgP.
Why wrong: The protocol is shown as LACP.
Port Gi0/3 is bundled in the channel.
Why wrong: Gi0/3 has flag D (down), not P (bundled).
The port-channel is a Layer 3 interface.
Why wrong: The flag 'S' indicates Layer 2.
The EtherChannel has two active member links.
Gi0/1 and Gi0/2 are marked P (bundled), so two links are active.
Trap 1: Type 1 hypervisors require a host OS for device drivers, while Type…
Type 1 hypervisors have their own drivers; Type 2 rely on the host OS.
Trap 2: Type 2 hypervisors are always more secure than Type 1 because of…
The additional OS layer increases attack surface, reducing security.
Trap 3: Type 1 hypervisors cannot support hardware passthrough, but Type 2…
Both types can support hardware passthrough; Type 1 typically does it more efficiently.
Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.
This is the fundamental architectural difference.
Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.
Why wrong: Type 1 hypervisors have their own drivers; Type 2 rely on the host OS.
Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.
Why wrong: The additional OS layer increases attack surface, reducing security.
Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.
Why wrong: Both types can support hardware passthrough; Type 1 typically does it more efficiently.
Trap 1: The VM's VF is using the same MAC address as the host management…
Incorrect because SR-IOV assigns unique MAC addresses to VFs.
Trap 2: The ESXi host requires a dedicated physical NIC for management when…
Incorrect because SR-IOV can coexist with management on the same NIC if properly configured.
Trap 3: The VM's VF is consuming all available bandwidth on the NIC.
Incorrect because bandwidth consumption would not cause the management network to become unreachable.
The physical NIC's PF is also used for the host management network, and SR-IOV configuration disrupted it.
Correct because SR-IOV can interfere with the PF if the management network is on the same port.
The VM's VF is using the same MAC address as the host management interface.
Why wrong: Incorrect because SR-IOV assigns unique MAC addresses to VFs.
The ESXi host requires a dedicated physical NIC for management when using SR-IOV.
Why wrong: Incorrect because SR-IOV can coexist with management on the same NIC if properly configured.
The VM's VF is consuming all available bandwidth on the NIC.
Why wrong: Incorrect because bandwidth consumption would not cause the management network to become unreachable.
Trap 1: Place the firewall interface in both VRFs using the ip vrf…
Incorrect because a single interface can only belong to one VRF.
Trap 2: Create a VLAN trunk between the switch and firewall, and assign the…
Incorrect because a VLAN cannot be in two VRFs simultaneously.
Trap 3: Use policy-based routing (PBR) in VRF DEV to forward traffic to the…
Incorrect because PBR does not solve the VRF isolation; the firewall is in a different VRF, so the switch cannot directly forward to it without route leaking.
Configure a static route in VRF DEV pointing to the firewall's IP address in VRF PROD, and use the route-map to leak the route.
Correct because route leaking allows one VRF to use a next-hop in another VRF. A static route with the appropriate VRF and route-map can achieve this.
Place the firewall interface in both VRFs using the ip vrf forwarding command on the same interface.
Why wrong: Incorrect because a single interface can only belong to one VRF.
Create a VLAN trunk between the switch and firewall, and assign the same VLAN to both VRFs.
Why wrong: Incorrect because a VLAN cannot be in two VRFs simultaneously.
Use policy-based routing (PBR) in VRF DEV to forward traffic to the firewall's MAC address.
Why wrong: Incorrect because PBR does not solve the VRF isolation; the firewall is in a different VRF, so the switch cannot directly forward to it without route leaking.
Trap 1: The engineer used 'ip default-network' which is not supported in…
Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
Trap 2: The internal routers have a route to the default network with a…
Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
Trap 3: The engineer needs to configure 'eigrp stub' on the router to allow…
Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.
The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.
Why wrong: Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
Correct. The static default route must be correctly configured with a next-hop IP address. If the static route is missing or uses an interface instead of a next-hop, it may not be valid, and the redistribution will not propagate the route to internal routers, despite appearing in the topology table with a metric.
The internal routers have a route to the default network with a better metric from another source.
Why wrong: Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.
Why wrong: Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.
Trap 1: gNMI telemetry subscriptions can only use YANG paths from…
Incorrect because gNMI can use any YANG model path—native, OpenConfig, or IETF—as long as the device supports it.
Trap 2: gNMI relies on NETCONF for session establishment and data encoding.
Incorrect because gNMI is independent of NETCONF; it uses gRPC (HTTP/2) for transport and Protocol Buffers for encoding, not NETCONF's XML-based encoding.
gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.
Correct because gRPC is built on HTTP/2 for multiplexed, low-latency communication and uses Protocol Buffers for serialization and service definition.
gNMI (gRPC Network Management Interface) is a gRPC-based protocol that can be used for both telemetry and configuration operations.
Correct because gNMI defines RPCs for Subscribe (telemetry), Get, Set, and Capabilities, making it suitable for both monitoring and configuration.
gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.
Why wrong: Incorrect because gNMI can use any YANG model path—native, OpenConfig, or IETF—as long as the device supports it.
gNMI relies on NETCONF for session establishment and data encoding.
Why wrong: Incorrect because gNMI is independent of NETCONF; it uses gRPC (HTTP/2) for transport and Protocol Buffers for encoding, not NETCONF's XML-based encoding.
gNMI supports both periodic and on-change telemetry subscriptions.
Correct because gNMI's Subscribe RPC allows specifying a subscription mode of SAMPLE (periodic) or ON_CHANGE.
A network engineer issues the following command on Router R2:
R2# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up Internet Address 192.168.1.2/24, Area 0 Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 2.2.2.2, Interface address 192.168.1.2 Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:03 Index 1/1/1, flood queue length 0 Next 0x0(0)/0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 2, Adjacent neighbor count is 2
Adjacent with neighbor 1.1.1.1 (Backup Designated Router) Adjacent with neighbor 3.3.3.3
Based on this output, what can be concluded?
Trap 1: R2 is the Backup Designated Router on this segment.
The state is DR, not BDR.
Trap 2: The OSPF cost to reach the network 192.168.1.0/24 is 20.
The cost on this interface is 10, not 20.
Trap 3: R2 will send hello packets every 40 seconds.
The hello interval is 10 seconds, not 40.
R2 has a full OSPF adjacency with all neighbors on this segment.
The adjacent neighbor count is 2, equal to the neighbor count, meaning all neighbors are fully adjacent.
R2 is the Backup Designated Router on this segment.
Why wrong: The state is DR, not BDR.
The OSPF cost to reach the network 192.168.1.0/24 is 20.
Why wrong: The cost on this interface is 10, not 20.
R2 will send hello packets every 40 seconds.
Why wrong: The hello interval is 10 seconds, not 40.
Drag a concept onto its matching description — or click a concept then click the description.
Generates the Network LSA and maintains full adjacencies with all routers on the segment
Monitors the DR and assumes the DR role if the DR fails
Forms full adjacencies only with the DR and BDR
Connects multiple areas and advertises inter-area routes
Redistributes external routes into OSPF
A network engineer runs the following command on Router R1:
R1# show ip access-lists
Extended IP access list 120
10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
30 deny tcp any any eq 22 (2 matches)
40 permit ip any any (10 matches)Based on this output, what can be concluded?
Trap 1: SSH access from 10.0.0.0/8 is denied.
Entry 10 permits SSH from 10.0.0.0/8.
Trap 2: All SSH traffic is permitted.
Entry 30 denies SSH from sources not in the permitted ranges.
Trap 3: The ACL has an implicit deny at the end.
Entry 40 permits all IP traffic, so there is no implicit deny for non-SSH traffic.
SSH access from 192.168.1.0/24 would be denied.
Entry 30 denies SSH from any source not matching entries 10 or 20, so 192.168.1.0/24 would be denied.
SSH access from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits SSH from 10.0.0.0/8.
All SSH traffic is permitted.
Why wrong: Entry 30 denies SSH from sources not in the permitted ranges.
The ACL has an implicit deny at the end.
Why wrong: Entry 40 permits all IP traffic, so there is no implicit deny for non-SSH traffic.
Drag a concept onto its matching description — or click a concept then click the description.
Virtualized network function software (e.g., virtual router)
Physical and virtual resources (compute, storage, networking)
Orchestration and lifecycle management framework
Manages NFVI resources (e.g., OpenStack)
Manages lifecycle of individual VNFs
Trap 1: The supplicant is the device that provides authentication services,…
Incorrect; the supplicant is the client requesting access, not the authentication server.
Trap 2: 802.1X is only supported on wireless networks and cannot be used on…
Incorrect; 802.1X is widely used on both wired and wireless networks.
The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.
Correct; EAPoL is the encapsulation used for 802.1X on wired LANs.
The authenticator is typically a network switch or wireless access point.
Correct; the authenticator enforces access control and relays EAP messages.
The supplicant is the device that provides authentication services, such as a RADIUS server.
Why wrong: Incorrect; the supplicant is the client requesting access, not the authentication server.
The authentication server is usually a RADIUS server that validates credentials.
Correct; RADIUS is the standard protocol for 802.1X authentication servers.
802.1X is only supported on wireless networks and cannot be used on wired switches.
Why wrong: Incorrect; 802.1X is widely used on both wired and wireless networks.
Trap 1: Increase the MTU on the link between the PE routers.
MTU issues would cause packet drops, not route absence.
Trap 2: Reconfigure LDP on the PE routers to establish a targeted session.
LDP is not directly related to VRF route import.
Trap 3: Check the MPLS label stack on the local PE to ensure labels are…
Label issues would affect all destinations, not just one.
Increase the MTU on the link between the PE routers.
Why wrong: MTU issues would cause packet drops, not route absence.
Reconfigure LDP on the PE routers to establish a targeted session.
Why wrong: LDP is not directly related to VRF route import.
Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.
Why wrong: Label issues would affect all destinations, not just one.
Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.
Correct: Mismatched route targets cause routes to not be imported into the VRF.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Python For Network Automation sessions
Every question in these sessions is drawn from the Python For Network Automation domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Practise 350-401 questions linked to Architecture.
Practise 350-401 questions linked to Virtualization.
Practise 350-401 questions linked to Infrastructure.
Practise 350-401 questions linked to Network Assurance.
Practise 350-401 questions linked to Security.
Practise 350-401 questions linked to Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
Python For Network Automation only
Mixed 350-401 sessionA free account saves results across sessions and highlights which topics need work.
Sign up free