View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q301. An Ansible project contains common interface-configuration tasks, templates, defaults, and handlers that must be reused across several playbooks. Which Ansible construct is best suited to packaging this reusable content?

1. Inventory alias
   2. Role
   3. Registered variable
   4. Ad hoc command

Correct Answer: 2. Role

Explanation: Ansible roles provide a structured way to package reusable automation content such as tasks, handlers, templates, files, defaults, and variables. A role can be included by multiple playbooks, making common network automation easier to maintain and test. For example, an interface-management role can standardize descriptions, addressing, and validation logic across several site deployment playbooks. Registered variables store task results and do not package reusable automation. Inventory aliases identify hosts, while ad hoc commands are intended for individual operations rather than maintainable automation structure. Roles improve modularity and reduce duplicated configuration logic.

Q302. A Terraform team wants developers to maintain separate logical state instances for development and testing while using the same Terraform configuration. Which Terraform feature can provide this separation?

1. Output variables
   2. Provider aliases only
   3. Lifecycle ignore rules
   4. Workspaces

Correct Answer: 4. Workspaces

Explanation: Terraform workspaces allow multiple state instances to be associated with the same configuration. They can be useful for separating similar environments such as development and testing when the overall configuration structure is shared. Each workspace maintains its own state, so resources created in one workspace are tracked separately from another. Workspaces are not always the best choice for strongly isolated production environments, where separate configurations or backends may provide clearer boundaries. Provider aliases select alternate provider configurations, outputs expose values, and lifecycle rules affect resource behavior rather than creating separate state instances.

Q303. A YANG model defines a leaf-list containing multiple DNS server addresses. How is this data most naturally represented in JSON?

1. As an array of scalar values
   2. As one comma-separated string only
   3. As an HTTP cookie
   4. As a Git tag

Correct Answer: 1. As an array of scalar values

Explanation: A YANG leaf-list represents multiple values of the same leaf type. In JSON encoding, it is naturally represented as an array containing scalar values such as strings, integers, or addresses according to the YANG type. This differs from a YANG list, whose entries often become arrays of structured objects. Preserving the modeled type is important because RESTCONF and other model-driven automation rely on predictable structure and semantics. Converting the values into one arbitrary comma-separated string would discard the modeled collection structure and could cause validation or interoperability problems.

Q304. A Python network automation program repeatedly opens and closes API sessions in several functions. The team wants one custom object to automatically allocate and release a session when used with a with statement. What should the object implement?

1. Only a global variable
   2. A list comprehension
   3. Context manager behavior
   4. A recursive function with no termination condition

Correct Answer: 3. Context manager behavior

Explanation: Python context managers define setup and cleanup behavior associated with a with block. A custom API-session class can establish a connection or allocate resources on entry and then reliably close the session when execution leaves the block, including during exceptions. Context managers are commonly implemented with __enter__ and __exit__, or by using utilities from contextlib. This centralizes resource management and reduces the chance that sessions remain open after errors. Reusable cleanup behavior is valuable in automation applications that communicate with many controllers and devices over long-running workflows.

Q305. A REST API supports both Accept and Content-Type headers. Which statement correctly describes their roles?

1. Both headers identify only authentication methods
   2. Accept specifies the desired response format, while Content-Type identifies the request body format
   3. Accept is used only for rate limiting
   4. Content-Type identifies the Git branch being deployed

Correct Answer: 2. Accept specifies the desired response format, while Content-Type identifies the request body format

Explanation: The Content-Type header tells the server how to interpret the data contained in the request body, while the Accept header tells the server which response media types the client can consume. In RESTCONF and other structured APIs, using the correct media types is essential because JSON and XML representations may have specific registered formats. A request can be syntactically correct but still fail if headers do not match the expected content. These headers do not provide authentication or rate limiting and have no relationship to source-control branches.

Q306. A Git engineer accidentally deletes a local branch and later realizes an important commit was not pushed anywhere. Which Git feature may help locate the commit if Git’s local reference history still contains it?

1. git reflog
   2. .gitignore
   3. git clean
   4. git init

Correct Answer: 1. git reflog

Explanation: Git’s reflog records updates to local references such as branch tips and HEAD. Even after a branch is deleted or reset, the reflog may still contain the commit identifier needed to recover work, provided the relevant objects have not yet been garbage collected. An engineer can inspect reflog entries, locate the previous commit, and create a new branch or tag referencing it. .gitignore controls untracked files, git clean removes them, and git init creates a repository. Reflog is therefore a valuable recovery tool for local history mistakes.

Q307. A GitLab pipeline has independent lint, unit-test, and schema-validation jobs. The integration test should begin as soon as all three required jobs complete rather than waiting for unrelated jobs in the same stage. Which GitLab feature best supports this dependency graph?

1. .gitignore
   2. Git stash
   3. Manual router login
   4. Explicit job dependencies using needs

Correct Answer: 4. Explicit job dependencies using needs

Explanation: GitLab’s needs keyword allows jobs to declare explicit dependencies and can create a directed acyclic graph for pipeline execution. A downstream integration job can begin when its actual prerequisites finish instead of waiting for every job in an earlier stage. This can reduce pipeline duration while preserving required validation order. The dependency relationship should still ensure failed prerequisite jobs prevent unsafe downstream work. Source-control ignore rules and stashes do not control pipeline scheduling. Efficient CI/CD design combines correct safety gates with parallelism where jobs are genuinely independent.

Q308. A Cisco Modeling Labs test includes two redundant WAN links. The automation team wants to prove traffic moves to the backup link when the primary fails. What is the most meaningful validation?

1. Check only that the CML nodes booted successfully
   2. Confirm the topology file exists
   3. Disable the primary link and verify routing and reachability converge through the backup path
   4. Check the Git repository size

Correct Answer: 3. Disable the primary link and verify routing and reachability converge through the backup path

Explanation: High-availability testing should verify the operational outcome, not simply whether devices are running. In CML, the team can deliberately fail the primary path and then use routing checks, reachability tests, or pyATS validation to confirm the expected backup route becomes active. The workflow can also measure convergence behavior and restore the link afterward. This type of fault injection provides stronger evidence than checking topology startup alone. Simulated failure testing helps identify automation, routing, or validation defects before equivalent conditions occur in production.

Q309. A telemetry platform receives values from devices using different units, such as bandwidth in bits per second from one source and kilobits per second from another. What should happen before cross-device analytics are performed?

1. Normalize the measurements to consistent units
   2. Combine the raw values without conversion
   3. Delete unit metadata
   4. Convert all values into text strings

Correct Answer: 1. Normalize the measurements to consistent units

Explanation: Analytics are meaningful only when equivalent metrics use compatible units. Combining bits per second and kilobits per second without normalization produces incorrect comparisons, thresholds, and aggregate calculations. A telemetry processing pipeline should preserve unit metadata and convert measurements to a standard representation before analysis. Similar normalization may be needed for timestamps, interface identifiers, or platform-specific labels. Structured telemetry simplifies machine processing, but data-quality controls remain essential. Poor normalization can produce misleading alerts even when every raw measurement was collected accurately from its original source.

Q310. An automation service sends important events to a remote Syslog server over TCP. What advantage does TCP generally provide compared with UDP for this use case?

1. It guarantees that the application logic is correct
   2. It provides connection-oriented delivery with retransmission behavior
   3. It eliminates the need for log retention
   4. It automatically encrypts all Syslog traffic

Correct Answer: 4. It provides connection-oriented delivery with retransmission behavior

Explanation: TCP provides connection-oriented transport with acknowledgments and retransmission mechanisms, making it more reliable than best-effort UDP when network loss occurs. However, TCP itself does not encrypt Syslog; TLS is needed when confidentiality and authenticated transport are required. Reliable transport also does not guarantee that the remote logging application successfully stored or processed every event, so system-level monitoring remains necessary. Logging architecture should consider reliability, security, backpressure, retention, and failure handling rather than selecting a protocol based only on simplicity.

Q311. A pyATS test suite validates BGP neighbors, but some routers intentionally have two peers while others have four. How should expected values be supplied?

1. Hard-code the same peer count for every router
   2. Store device-specific expectations in structured test data or the source of truth
   3. Ignore neighbor count entirely
   4. Fail every device with more than two peers

Correct Answer: 2. Store device-specific expectations in structured test data or the source of truth

Explanation: Validation should compare actual state against the intended state for each device rather than assuming every router has identical requirements. Device-specific expectations can come from a test-data file, inventory system, or authoritative source of truth. The test logic remains reusable while input data describes how many peers each device should have. This separation improves maintainability and avoids duplicating test code. Hard-coding one value for all routers would produce false failures or false successes when network roles differ. Good automation combines reusable validation logic with authoritative per-device expectations.

Q312. A Python automation service needs to retry a failed API request up to three times with delays of 1, 2, and 4 seconds. Which retry strategy does this represent?

1. Constant polling
   2. Infinite retry
   3. Exponential backoff
   4. Random device selection

Correct Answer: 3. Exponential backoff

Explanation: Exponential backoff increases the wait between consecutive retries, commonly by multiplying the previous delay. A sequence such as 1, 2, and 4 seconds is a basic example. This strategy reduces pressure on an overloaded or temporarily unavailable service compared with immediate repeated requests. Production implementations often add jitter to avoid many clients retrying simultaneously. Retries should be bounded and applied only to conditions that are reasonably transient. Authentication failures, invalid input, or permanent authorization errors generally require corrective action rather than automatic repeated attempts.

Q313. A Docker image for a network automation application is built using several stages. What is a major benefit of a multi-stage build?

1. The final image can exclude build tools and unnecessary intermediate files
   2. Containers no longer require an operating-system runtime
   3. Every container automatically gains root privileges
   4. Git history is embedded automatically

Correct Answer: 4. The final image can exclude build tools and unnecessary intermediate files

Explanation: Multi-stage Docker builds allow compilation or dependency-building tools to exist in an earlier stage while only the required runtime artifacts are copied into the final image. This can substantially reduce image size and attack surface. A smaller runtime image is easier to distribute and may contain fewer packages requiring vulnerability management. Multi-stage builds do not eliminate the need for a runtime environment or secure configuration, and they should not be used to add unnecessary privileges. Container security also depends on trusted base images, scanning, secrets handling, and runtime permissions.

Q314. An automation service has separate readiness and liveness checks. What is the primary purpose of a readiness check?

1. Determine whether the service should currently receive traffic or work
   2. Prove the source code contains no vulnerabilities
   3. Replace application monitoring entirely
   4. Determine the Git commit author

Correct Answer: 1. Determine whether the service should currently receive traffic or work

Explanation: A readiness check indicates whether an application is prepared to accept requests or perform work. A service can be alive but not ready, for example while it is still loading configuration or waiting for a required backend dependency. Load balancers or orchestrators can use readiness status to avoid sending traffic prematurely. Liveness checks answer a different question: whether the process appears healthy enough to continue running or may require restart. Separating these concepts can prevent unnecessary restarts and reduce failed requests during application initialization or temporary dependency conditions.

Q315. A local LLM can answer network questions accurately, but a much smaller model achieves nearly identical results while using less GPU memory. Which operational advantage does the smaller model provide?

1. It removes all need for testing
   2. It guarantees zero hallucinations
   3. Reduced compute and memory requirements
   4. Unlimited context size

Correct Answer: 3. Reduced compute and memory requirements

Explanation: Smaller models generally require less memory and compute capacity, which can lower hardware costs and improve inference speed or deployment flexibility. If evaluation shows that a smaller model provides comparable technical accuracy for the target network tasks, it may be more practical for local automation use. Model selection should be based on measured quality, latency, resource consumption, context needs, and security constraints rather than assuming larger is always better. Smaller models can still hallucinate and require the same validation, authorization, retrieval, and tool-safety controls as larger language models.

Q316. A retrieval system initially finds 50 semantically similar network-document chunks. The application wants a more precise final set of five chunks before passing context to the LLM. Which technique is useful?

1. Remove all retrieval scoring
   2. Apply a reranking step to prioritize the most relevant results
   3. Send all documents regardless of relevance
   4. Randomly choose five chunks

Correct Answer: 2. Apply a reranking step to prioritize the most relevant results

Explanation: Retrieval systems often use an initial semantic search for broad recall and then apply reranking to improve precision. A reranker evaluates the query and candidate chunks more closely and orders them so the most relevant evidence is supplied to the model. This can reduce context-window waste and improve grounded answer quality. Reranking does not replace freshness checks, provenance, authorization filtering, or prompt-injection defenses. The retrieval pipeline should first ensure the user is authorized to access the content, then select current authoritative material and rank it appropriately for the question.

Q317. An MCP server returns detailed error messages containing internal controller URLs and authentication metadata. What should be improved?

1. Return even more internal secrets for debugging
   2. Make every error public
   3. Remove all error reporting
   4. Sanitize tool errors while preserving useful non-sensitive diagnostic information

Correct Answer: 4. Sanitize tool errors while preserving useful non-sensitive diagnostic information

Explanation: Error responses should provide enough information for the AI agent and operators to understand what failed without leaking credentials, internal tokens, private URLs, or other sensitive implementation details. The MCP server can log richer diagnostics to a protected backend while returning a sanitized error to the caller. Completely hiding errors makes troubleshooting difficult, whereas exposing secrets expands the impact of failures. AI-integrated tooling should follow the same secure coding principles as other APIs: validate input, enforce authorization, limit output, sanitize errors, and maintain controlled audit logs.

Q318. An AI network agent has confidence scores from a classifier that predicts whether a proposed change is low risk. What should the system do before using those scores as an approval threshold?

1. Validate and calibrate the scores against representative labeled outcomes
   2. Assume a score of 0.9 always means exactly 90% real-world safety
   3. Remove all deterministic controls
   4. Let the model redefine the threshold during execution

Correct Answer: 2. Validate and calibrate the scores against representative labeled outcomes

Explanation: Model confidence values do not automatically correspond to real-world probabilities. Before using them to control network-change autonomy, the organization should evaluate how predicted confidence aligns with actual outcomes on representative data. Calibration testing can reveal whether high-confidence predictions are genuinely more reliable and where thresholds should be placed. Even a well-calibrated score should not replace deterministic authorization, scope checks, policy constraints, and validation for high-impact actions. AI metrics must be interpreted empirically rather than assumed to have an intuitive probability meaning.

Q319. A network AI assistant receives current device state from a trusted tool and a conflicting statement from an old troubleshooting document. Which evidence should be prioritized for a question about the device’s current status?

1. The current validated device state
   2. The older document because it contains more text
   3. Whichever source appears first in the context
   4. The model’s pretrained memory

Correct Answer: 1. The current validated device state

Explanation: Questions about current operational status should rely primarily on fresh authoritative evidence. A troubleshooting document may explain general behavior, but it cannot override direct validated device state when determining whether an interface, route, or neighbor is currently active. Retrieval systems should preserve metadata such as source type, timestamp, and authority so the AI can distinguish live evidence from background documentation. When data conflicts, the assistant should explain the discrepancy rather than blend incompatible facts. Grounding network answers in current trusted state reduces hallucination and improves operator confidence.

Q320. An AI agent can create a proposed Terraform plan, but production policy requires that only a separate deployment service may execute terraform apply. What security principle does this architecture demonstrate?

1. Shared unrestricted administrator access
   2. Disabling change control
   3. Separation of duties between planning and execution
   4. Removing auditability

Correct Answer: 3. Separation of duties between planning and execution

Explanation: Separating plan generation from execution prevents one component from controlling the entire change lifecycle. The AI agent can interpret intent and prepare a proposed Terraform change, while an independently authorized deployment service validates and applies approved plans. This reduces the impact of model errors or compromised conversational sessions and provides clearer governance boundaries. The execution service can enforce policy, target scope, credentials, approval, and locking without relying on the LLM. Separation of duties is particularly valuable for high-impact Infrastructure as Code workflows where a single command can change many production resources.