View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q161. A Python network automation function opens a file containing generated configurations. The engineer wants the file to be closed automatically even if an exception occurs. Which Python technique is most appropriate?

1. Keep the file open until the script exits
   2. Use a with context manager
   3. Open the file repeatedly inside an infinite loop
   4. Store the file descriptor in a global variable

Correct Answer: 2. Use a with context manager

Explanation: A Python with statement uses a context manager to manage resources such as files safely. When execution leaves the with block, Python closes the file automatically, including when an exception occurs inside the block. This reduces resource leaks and makes code easier to understand than manually opening and closing files across multiple execution paths. Similar context-management patterns can be useful for other resources that require setup and cleanup. Reliable network automation code should manage files, sessions, and other resources predictably because failed cleanup can create locked files, resource exhaustion, or inconsistent workflow behavior.

Q162. A Terraform resource should be replaced before the existing instance is destroyed because removing the old instance first would interrupt a critical service. Which lifecycle setting is most appropriate?

1. prevent_destroy = false
   2. ignore_changes
   3. depends_on
   4. create_before_destroy = true

Correct Answer: 4. create_before_destroy = true

Explanation: The create_before_destroy lifecycle setting instructs Terraform to attempt creation of the replacement resource before removing the existing resource when replacement is required. This can reduce downtime for resources that can coexist temporarily. Engineers must still confirm that the underlying platform allows both instances to exist simultaneously and that identifiers, capacity, or addressing do not conflict. ignore_changes tells Terraform to disregard selected attribute differences, while depends_on expresses dependency ordering. Lifecycle behavior should be designed carefully because infrastructure changes can have availability consequences beyond the Terraform configuration itself.

Q163. An engineer uses NETCONF to modify configuration on a device that supports a candidate datastore. What is a key advantage of using the candidate datastore?

1. Changes can be prepared and validated before they are committed to the active configuration
   2. It permanently disables configuration validation
   3. It eliminates the need for authentication
   4. It converts NETCONF messages into unstructured CLI text

Correct Answer: 1. Changes can be prepared and validated before they are committed to the active configuration

Explanation: A NETCONF candidate datastore allows configuration changes to be staged separately from the active running configuration. Automation can edit the candidate configuration, perform validation where supported, and then commit the prepared changes as a controlled operation. This can reduce the risk of leaving a device in a partially modified state when several related changes must be applied together. The exact datastore capabilities depend on the network platform. NETCONF still requires appropriate authentication and structured operations. The candidate model supports transactional configuration workflows that can be safer than applying a long series of unrelated CLI commands individually.

Q164. An API client must process 10,000 device objects returned in multiple pages. Each response contains a next URL until the final page. What should the client do?

1. Process only the first page
   2. Guess URLs for later pages manually
   3. Follow each returned next URL until no continuation URL remains
   4. Increase the timeout and assume all objects are on page one

Correct Answer: 3. Follow each returned next URL until no continuation URL remains

Explanation: This API is using link-based pagination. The client should process the current page and follow the server-provided continuation URL until the response indicates there are no additional pages. Using the API’s supplied link avoids assumptions about how pagination is implemented and helps ensure all objects are retrieved. The automation should also handle errors and avoid processing the same page repeatedly if malformed continuation data appears. Pagination is important in network automation because inventory, event, and configuration APIs can return datasets far larger than a single response should reasonably contain.

Q165. A Terraform team repeatedly computes the same complex expression from several input variables inside one module. Which Terraform construct can improve readability by assigning that computed value a reusable name?

1. Local value
   2. State lock
   3. Provider alias
   4. Backend block

Correct Answer: 1. Local value

Explanation: Terraform local values allow expressions to be assigned meaningful names and reused elsewhere within a module. This can make configurations easier to read when the same derived value, naming convention, prefix, tag set, or address calculation is needed multiple times. Locals are not user-supplied inputs and do not expose results externally in the same way outputs do. A backend controls state storage, while provider aliases configure multiple provider instances. Using locals appropriately reduces duplicated expressions and makes Infrastructure as Code easier to review and maintain without introducing unnecessary repetition.

Q166. A Git branch has several local commits that should be replayed on top of the latest main branch to produce a linear history. Which Git operation is most appropriate?

1. git clean
   2. git init
   3. git tag
   4. git rebase main

Correct Answer: 4. git rebase main

Explanation: Rebasing replays the current branch’s commits on top of another base commit, such as the latest main branch. This can create a cleaner linear history by avoiding an additional merge commit. Because rebase rewrites commit identifiers, teams should be cautious when rebasing commits that have already been shared with other collaborators. Conflicts may also need to be resolved during the operation. Although core AUTOCOR Git objectives emphasize several specific version-control operations, understanding branch-history management helps engineers maintain clean Infrastructure as Code repositories and integrate network automation changes predictably.

Q167. A GitLab deployment job should run only when changes are merged into the protected main branch, not for every feature-branch commit. Which pipeline capability should be used?

1. Remove all branch information from the pipeline
   2. Configure job rules or conditions based on the branch
   3. Run production deployment from every commit
   4. Disable source control integration

Correct Answer: 2. Configure job rules or conditions based on the branch

Explanation: GitLab pipeline rules can control whether a job is included based on conditions such as branch name, pipeline source, changed files, or variables. A production deployment can therefore be restricted to the protected main branch while tests and validation still run on feature branches. This reduces the chance of unreviewed development changes reaching production. Branch protection, approvals, and required validation can provide additional safeguards. CI/CD automation should encode deployment policy explicitly rather than relying on engineers to remember which jobs are safe to run manually.

Q168. A CI pipeline launches a CML topology for testing, but a failed test prevents the normal cleanup stage from running. What design improvement best prevents abandoned lab environments from accumulating?

1. Never destroy test topologies
   2. Run cleanup only after successful deployments
   3. Configure cleanup to execute even when earlier jobs fail
   4. Require users to remove every lab manually

Correct Answer: 3. Configure cleanup to execute even when earlier jobs fail

Explanation: Temporary test environments should have reliable cleanup logic that runs whether validation succeeds or fails. CI/CD platforms commonly provide ways to define cleanup jobs or execution conditions that allow teardown after failed stages. Without this protection, failed pipelines can leave CML labs running and eventually consume CPU, memory, licensing capacity, or address resources. The pipeline should preserve relevant logs and test results before destruction, but infrastructure intended to be ephemeral should not depend on a completely successful pipeline for cleanup. This pattern improves repeatability and operational hygiene.

Q169. A model-driven telemetry deployment sends data to a message bus before several analytics applications consume it. What is a major architectural benefit of the message bus?

1. It removes the need for device telemetry subscriptions
   2. It converts all telemetry into CLI commands
   3. It prevents every collector failure
   4. It decouples telemetry producers from multiple downstream consumers

Correct Answer: 4. It decouples telemetry producers from multiple downstream consumers

Explanation: A message bus can separate telemetry ingestion from downstream processing. Devices or collectors publish data into the messaging layer, while monitoring, analytics, alerting, or storage systems consume the information independently. This makes it easier to add consumers without requiring every device to send separate streams to every application. The architecture can also absorb bursts and provide buffering depending on the technology used. It does not eliminate the need for subscriptions, sizing, retention planning, or fault tolerance. Decoupling components is especially useful when telemetry platforms must support several operational use cases simultaneously.

Q170. A network automation application receives a webhook event containing a unique event identifier. Why should it record identifiers that have already been processed?

1. To support deduplication and avoid performing the same action twice
   2. To disable webhook authentication
   3. To make events larger
   4. To replace all application logs

Correct Answer: 2. To support deduplication and avoid performing the same action twice

Explanation: Webhook delivery can be retried when the sender does not receive an acknowledgment or experiences a transient network problem. As a result, the same logical event may arrive more than once. Recording a unique event identifier allows the receiver to determine whether an event has already been processed and avoid duplicate changes. This is especially important when the action is not naturally idempotent. Authentication, signatures, and schema validation should still protect the webhook. Deduplication improves reliability by ensuring transport-level retries do not unintentionally produce repeated infrastructure operations.

Q171. A network automation service logs events in JSON with fields for timestamp, device, operation, result, and correlation ID. What is the main advantage of this structured logging approach?

1. It makes machine parsing, filtering, and correlation easier
   2. It guarantees the application will never fail
   3. It removes the need for log storage
   4. It automatically fixes configuration errors

Correct Answer: 1. It makes machine parsing, filtering, and correlation easier

Explanation: Structured logs represent attributes as predictable fields instead of embedding all context in arbitrary free-form messages. Log collectors and SIEM platforms can therefore index fields, search by device or job ID, build dashboards, and correlate related events across distributed automation components. Correlation identifiers are especially useful when one workflow interacts with several APIs or devices. Structured logging does not eliminate failures, but it improves the ability to diagnose them. Sensitive information should still be redacted so the operational benefits of rich logging do not create credential exposure.

Q172. A network automation API certificate has been compromised before its normal expiration date. Which PKI mechanism can clients use to determine that the certificate should no longer be trusted?

1. Git commit signing
   2. Terraform state locking
   3. Certificate revocation information such as CRL or OCSP
   4. Docker image tagging

Correct Answer: 3. Certificate revocation information such as CRL or OCSP

Explanation: Certificate revocation mechanisms allow a certificate authority to indicate that a certificate should no longer be trusted even though its validity period has not expired. A Certificate Revocation List contains revoked certificate information, while the Online Certificate Status Protocol can provide status information more dynamically. Client behavior depends on platform and configuration, but revocation checking is part of a complete PKI lifecycle. If a private key is compromised, administrators should revoke and replace the affected certificate promptly. Expiration alone is insufficient because the compromised certificate could otherwise remain valid for months.

Q173. An automation system receives a device hostname from an external API. The hostname will later be included in a shell command. Which approach is safest?

1. Concatenate the raw hostname directly into the command
   2. Validate against an allowlisted format and avoid shell execution when a safer API is available
   3. Trust the value because another application supplied it
   4. Disable command logging and execute it as root

Correct Answer: 2. Validate against an allowlisted format and avoid shell execution when a safer API is available

Explanation: Data from another application should still be treated as untrusted. The automation should validate the hostname against expected syntax and, where possible, avoid constructing shell commands from external text altogether. Safer libraries or APIs that separate arguments from command syntax reduce injection risk. If shell execution is genuinely required, the script should use strict allowlists and appropriate argument-handling mechanisms. Running as root increases the impact of any injection flaw. Secure automation design assumes data can become malicious or malformed regardless of which upstream system supplied it.

Q174. A network team uses a local LLM for automation assistance. Which metric is most useful when evaluating whether the model consistently generates correct configuration recommendations for a defined test set?

1. Number of CPU fans in the server
   2. Size of the terminal window
   3. Average prompt length only
   4. Accuracy against a validated set of expected answers or outcomes

Correct Answer: 1. Accuracy against a validated set of expected answers or outcomes

Explanation: A controlled evaluation dataset with known correct outcomes allows the team to measure how often the model produces technically correct recommendations. Accuracy alone may not capture every operational concern, so teams can also examine unsafe outputs, consistency, latency, and false positive or false negative behavior depending on the use case. However, comparing results against authoritative expected answers provides direct evidence of technical quality. Subjective impressions from a few prompts are insufficient for production decisions. AI-assisted network automation should be evaluated systematically before being trusted for consequential workflows.

Q175. An AI assistant needs access to internal network documentation when answering questions but should not require that all documentation be embedded permanently in the model. Which approach best supports this requirement?

1. Remove access to documentation entirely
   2. Fine-tune the model after every document edit
   3. Retrieve relevant current documents at query time and provide them as grounded context
   4. Ask the model to guess from general training data

Correct Answer: 4. Retrieve relevant current documents at query time and provide them as grounded context

Explanation: Retrieval-augmented workflows can search approved documentation when a question is asked and provide relevant passages to the language model as context. This allows the system to use current organizational information without retraining the model every time documentation changes. Access controls should be enforced during retrieval so users do not gain information they are not permitted to view. Retrieved content should also be treated as potentially untrusted input because documents can contain malicious instructions. Grounding the response in approved current sources generally improves factual relevance compared with relying only on pretrained model knowledge.

Q176. A FastMCP tool accepts a device_name parameter. Why is defining a clear tool schema useful to an AI agent?

1. It eliminates all need for authorization
   2. It tells the model what arguments the tool expects and their intended structure
   3. It gives the agent unrestricted shell access
   4. It guarantees every generated argument is safe

Correct Answer: 3. It tells the model what arguments the tool expects and their intended structure

Explanation: A clear MCP tool schema describes the function, its parameters, expected types, and often useful descriptions. This helps the model select an appropriate tool and construct a correctly structured call. Schema definition improves interoperability between the AI client and the MCP server, but it is not a security boundary by itself. The server must still validate every argument and enforce authentication and authorization. A correctly shaped request can still be malicious or inappropriate. Tool schemas support reliable AI integration, while deterministic server-side controls provide the necessary operational protection.

Q177. An AI agent is asked to troubleshoot a routing problem. Its available tools include show_routes, show_interfaces, and erase_startup_config. Which design change best follows least privilege?

1. Remove the destructive configuration tool from the troubleshooting agent’s available tool set
   2. Keep every tool and rely only on prompt instructions
   3. Remove authentication from all tools
   4. Allow arbitrary commands instead of named tools

Correct Answer: 1. Remove the destructive configuration tool from the troubleshooting agent’s available tool set

Explanation: Least privilege means an agent should receive only the capabilities necessary for its assigned task. A troubleshooting assistant requires read-oriented diagnostic functions but does not need a destructive startup-configuration operation. Removing that capability creates a stronger control than merely instructing the model not to use it. If prompt injection or model error occurs, an unavailable tool cannot be selected. Tool authorization, input validation, audit logging, and identity controls should still be enforced. AI systems should be designed so that accidental reasoning failures have a limited operational blast radius.

Q178. A generative AI system produces two different configurations from the same prompt on separate runs. Which property of LLM behavior does this demonstrate?

1. Terraform state corruption
   2. Probabilistic output variability
   3. Git branch protection
   4. Deterministic compilation

Correct Answer: 2. Probabilistic output variability

Explanation: Large language models generate tokens probabilistically, so identical or nearly identical prompts can produce different responses depending on model configuration, sampling parameters, and internal generation behavior. This means AI-generated automation should not be assumed to be deterministic. Teams should validate generated code and configuration every time it is used, especially for infrastructure changes. Lower-temperature or constrained generation can reduce variability but does not transform an LLM into a deterministic policy engine. Critical network decisions should therefore rely on explicit validation, policy checks, and authoritative state rather than raw model output alone.

Q179. A conversational network agent proposes an interface shutdown. Which architecture provides the strongest audit trail for determining later why the action occurred?

1. Store only the final device configuration
   2. Disable model and tool logging
   3. Keep only the user’s username
   4. Record the user request, relevant retrieved context, model decision, approval, tool call, and resulting network outcome

Correct Answer: 4. Record the user request, relevant retrieved context, model decision, approval, tool call, and resulting network outcome

Explanation: End-to-end auditability requires more than the final device state. Logging the original request, retrieved operational evidence, model output, human approval where applicable, exact tool invocation, timestamps, identity information, and post-change result allows investigators to reconstruct why an action happened. Sensitive information should be protected or redacted appropriately. This type of traceability is particularly important for AI-assisted automation because the reasoning layer may be probabilistic. Detailed audit records support troubleshooting, governance, incident investigation, and accountability when automated systems are allowed to influence production infrastructure.

Q180. An organization is considering whether an AI network agent should autonomously reboot production routers when it detects a fault. What is the most appropriate design principle?

1. Make every AI recommendation execute automatically
   2. Remove post-action validation
   3. Match autonomy to risk, using deterministic checks and human approval for high-impact actions
   4. Give the model unrestricted administrator credentials

Correct Answer: 3. Match autonomy to risk, using deterministic checks and human approval for high-impact actions

Explanation: AI autonomy should be proportional to the potential operational impact of an action. Low-risk read operations may be safely automated, while rebooting a production router can disrupt many users and should normally require strong validation, policy controls, and potentially explicit human approval. The automation should confirm the device, fault condition, dependencies, redundancy, and maintenance context before acting. Post-action validation should verify recovery. An AI model can contribute analysis, but high-impact decisions should remain bounded by deterministic controls that continue to function even if the model is mistaken or manipulated.