View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q181. An Ansible playbook contains several related configuration tasks that should trigger recovery actions if one of them fails. Which Ansible structure is most appropriate?

1. vars_files
   2. serial
   3. register
   4. A block with a rescue section

Correct Answer: 4. A block with a rescue section

Explanation: Ansible blocks allow several tasks to be grouped together and can include rescue tasks that execute when a task in the main block fails. This is useful for network automation workflows that need defined recovery actions, such as restoring a previous configuration, gathering troubleshooting information, or notifying operators. An optional always section can run regardless of success or failure. register captures task results, serial controls how many hosts are processed at once, and vars_files imports variables. Structured failure handling makes large-scale network changes more predictable and reduces the impact of partial automation failures.

Q182. A Terraform configuration needs to create exactly five similar lab resources whose identities are naturally represented by numeric indexes. Which meta-argument is appropriate?

1. count
   2. depends_on
   3. lifecycle
   4. backend

Correct Answer: 1. count

Explanation: Terraform’s count meta-argument creates multiple instances of a resource based on an integer value. With count = 5, Terraform produces five instances that can be referenced using numeric indexes such as resource.example[0]. This works well when resources are essentially interchangeable and numeric indexing is acceptable. for_each may be preferable when instances have meaningful stable keys. depends_on controls dependencies, lifecycle modifies resource lifecycle behavior, and a backend defines state storage. Selecting between count and for_each carefully can make Infrastructure as Code easier to maintain as the environment changes.

Q183. A RESTCONF client sends JSON-formatted YANG data when modifying device configuration. Which HTTP header is especially important for identifying the format of the request body?

1. User-Agent
   2. Location
   3. Content-Type
   4. Server

Correct Answer: 3. Content-Type

Explanation: The Content-Type header identifies the media type of the request body so the RESTCONF server knows how to interpret the supplied data. When sending YANG-modeled JSON, the client should use the media type required by RESTCONF and the target implementation. The Accept header can separately indicate which response representation the client wants to receive. User-Agent identifies the client software, while Location and Server are used for different HTTP purposes. Correct headers are important because a structurally valid payload can still be rejected if its media type is missing or inappropriate.

Q184. A network API accepts a long-running software-image operation and immediately returns HTTP 202 Accepted with a status URL. What should the automation client do next?

1. Assume the operation completed successfully
   2. Monitor the returned status resource until the asynchronous operation reaches a final state
   3. Resubmit the operation continuously
   4. Treat HTTP 202 as an authentication failure

Correct Answer: 2. Monitor the returned status resource until the asynchronous operation reaches a final state

Explanation: HTTP 202 indicates that the server accepted the request for processing but has not necessarily completed it. APIs that perform long-running operations commonly provide a task, job, or status URL that the client can query until the operation succeeds or fails. Robust automation should implement appropriate polling intervals, timeouts, error handling, and maximum waiting periods. Treating acceptance as completion can cause later automation steps to run prematurely. Repeatedly resubmitting the same operation may create duplicates. Understanding asynchronous API workflows is important when network controllers perform tasks that cannot complete within a single request-response exchange.

Q185. A Python automation program needs to apply the same logging wrapper to several functions without duplicating the logging code inside each function. Which Python feature is well suited to this requirement?

1. Decorator
   2. Floating-point conversion
   3. List slicing only
   4. Binary encoding

Correct Answer: 1. Decorator

Explanation: A Python decorator can wrap a function with reusable behavior without duplicating that behavior throughout the application’s business logic. A logging decorator could record function entry, execution time, sanitized arguments, errors, or completion status for multiple automation functions. This can improve consistency and maintainability when cross-cutting functionality must be applied broadly. Decorators should still be designed carefully so they do not hide exceptions or expose sensitive information. They are particularly useful in mature automation applications where logging, retry logic, metrics, authorization checks, or validation need to be implemented consistently around many functions.

Q186. An engineer has uncommitted Git changes but must temporarily switch branches to investigate another issue. The changes should not be committed yet. Which Git command is most appropriate?

1. git revert
   2. git reset –hard
   3. git init
   4. git stash

Correct Answer: 4. git stash

Explanation: git stash temporarily saves working-tree changes so the engineer can obtain a clean working directory and switch to another task or branch. The saved changes can later be restored using commands such as git stash apply or git stash pop. This is useful for short-lived context switching when the current work is not ready for a formal commit. git reset –hard could destroy local work, git revert reverses an existing commit, and git init creates a repository. Engineers should still use commits for durable history rather than relying on stashes as long-term storage.

Q187. A GitLab CI pipeline downloads the same Python dependencies during every job and pipeline run. Which mechanism can improve performance by reusing dependency data when appropriate?

1. Git conflict markers
   2. Production Terraform state
   3. CI cache
   4. A CML topology snapshot only

Correct Answer: 3. CI cache

Explanation: CI caching can preserve reusable dependency data between jobs or pipeline executions, reducing repeated downloads and improving pipeline speed. Package-manager directories are common cache candidates. A cache differs from an artifact: artifacts usually represent job outputs that later stages need, while caches are primarily intended to accelerate repeated work. Cache keys should be designed so incompatible dependency versions do not incorrectly share data. Network automation pipelines still need reproducible dependency definitions rather than relying solely on cached files. Proper caching can shorten feedback cycles without weakening build, validation, deployment, or post-validation requirements.

Q188. A production network automation deployment should not proceed until an authorized engineer approves the validated change. Which CI/CD control best implements this requirement?

1. Delete the validation results
   2. Configure a manual approval or protected deployment gate
   3. Allow every feature branch to deploy automatically
   4. Disable access controls on the runner

Correct Answer: 2. Configure a manual approval or protected deployment gate

Explanation: A manual or protected deployment gate inserts an explicit authorization step between automated validation and production execution. The pipeline can still build the automation, run tests, validate the network, and produce a deployment plan automatically, but production modification waits for an authorized approver. This is useful for high-impact network changes and regulated environments. The approval should complement rather than replace automated prevalidation and post-validation. Cisco’s current AUTOCOR blueprint emphasizes end-to-end CI/CD network automation stages, making controlled promotion into production an important architectural consideration.

Q189. A Python program must start a predefined Cisco Modeling Labs topology automatically as part of an integration-test workflow. Which approach is most suitable?

1. Use CML’s programmable API from the automation code
   2. Require an operator to click every node manually
   3. Replace CML with a text editor
   4. Send configuration through Syslog

Correct Answer: 4. Use CML’s programmable API from the automation code

Explanation: Cisco Modeling Labs exposes programmable capabilities that allow automation to create, start, stop, inspect, and manage lab environments. A Python workflow can use these interfaces to prepare a repeatable test topology before applying candidate network automation. Tests can then run against the simulated infrastructure, and cleanup logic can remove the environment afterward. This approach fits CI/CD much better than requiring manual interaction for every test execution. Cisco’s current AUTOCOR training specifically includes building Python scripts to launch CML test topologies and integrating those topologies into automated pipelines.

Q190. A telemetry architecture requires the collector to initiate a connection toward each network device to establish subscriptions. Which general subscription model does this describe?

1. Device-initiated telemetry only
   2. Collector-initiated subscription
   3. Offline packet capture
   4. Git-triggered telemetry

Correct Answer: 3. Collector-initiated subscription

Explanation: In a collector-initiated telemetry design, the management or telemetry system establishes the session toward the network device and requests the desired telemetry subscriptions. This differs from designs where devices are preconfigured to initiate streaming sessions toward collectors. The exact terminology and protocol behavior depend on the telemetry implementation being used, but understanding who establishes the session affects firewall rules, authentication, scaling, and failure recovery. The architecture should also define sensor paths, update intervals, encoding, transport security, and data storage. Cisco’s AUTOCOR Operations domain includes model-driven telemetry architecture and its data-consumption considerations.

Q191. A centralized Syslog server receives events from routers, automation servers, and security devices. Which Syslog concept identifies the subsystem or source category that generated a message?

1. Facility
   2. Git tag
   3. Terraform variable
   4. Docker volume

Correct Answer: 1. Facility

Explanation: Syslog facilities provide a categorical indication of the subsystem or type of system that generated a message. They can be combined with severity levels to support filtering, routing, storage, and alerting policies on centralized Syslog systems. Severity represents the importance of the event, whereas facility helps classify its source category. In modern structured logging designs, additional application fields may provide even richer context. Cisco’s AUTOCOR Operations domain includes implementing logging strategies using files, Syslog, and webhooks, so understanding how centralized logging classifies and routes operational events is useful for automation troubleshooting.

Q192. A pyATS automation test needs connection details for multiple devices, including hostnames, addresses, credentials references, and platform information. Where is this information commonly defined?

1. Only inside every individual test function
   2. In a pyATS testbed definition, commonly represented in YAML
   3. In a Docker image tag
   4. In a Git merge message

Correct Answer: 2. In a pyATS testbed definition, commonly represented in YAML

Explanation: A pyATS testbed file describes devices and how automation can connect to them. It can include logical names, platform information, connection protocols, addresses, topology relationships, and credential references. Keeping this information in a structured testbed definition separates environment details from test logic and makes test code more reusable across labs and production environments. Credentials should still be handled securely rather than exposed unnecessarily in plain text. Cisco’s AUTOCOR course includes configuration validation with pyATS and integration of pyATS testing into automation pipelines.

Q193. A TLS server sends its leaf certificate but omits the required intermediate CA certificate. Clients trust the root CA but still fail to validate the server. What should be corrected?

1. The Git repository branch
   2. The RESTCONF URI
   3. The server’s certificate-chain presentation
   4. The Docker network name

Correct Answer: 3. The server’s certificate-chain presentation

Explanation: TLS clients must be able to build a valid trust chain from the server’s leaf certificate to a trusted root. If the leaf was issued by an intermediate CA, the server normally needs to provide the relevant intermediate certificate so the client can construct that chain. The root itself usually does not need to be sent because clients already maintain trusted root stores. An incomplete chain can therefore cause validation failures even when the leaf certificate itself is otherwise valid. AUTOCOR includes obtaining and deploying trusted CA-signed TLS certificates as an Operations skill.

Q194. A Python automation service receives an IP address from user input. It should accept only valid IPv4 or IPv6 addresses before querying infrastructure. Which approach is strongest?

1. Trust any string containing a period
   2. Use a proper IP-address parsing and validation library
   3. Pass the raw input directly into shell commands
   4. Remove all input-length limits

Correct Answer: 1. Use a proper IP-address parsing and validation library

Explanation: Structured values should be validated with parsers that understand their actual syntax rather than with weak string checks. Python’s standard library, for example, provides IP-address handling that can determine whether input is a valid IPv4 or IPv6 address. This reduces malformed input and helps downstream code operate on normalized values. If the address later influences commands or API calls, authorization and additional policy checks may also be needed. Cisco’s current AUTOCOR Operations objectives include secure coding practices such as input validation, authentication, secret management, and output sanitization.

Q195. A local LLM used for network automation begins producing poorer results after the organization changes its prompting template. What is the best way to determine whether the new template caused a regression?

1. Ask one engineer whether the answers look better
   2. Replace the model immediately without testing
   3. Increase randomness as much as possible
   4. Run a repeatable benchmark of validated network tasks before and after the prompt change

Correct Answer: 4. Run a repeatable benchmark of validated network tasks before and after the prompt change

Explanation: AI automation should be evaluated using a repeatable set of representative tasks with known expected outcomes. Running the same benchmark before and after a prompt, model, retrieval, or tooling change provides evidence of whether quality improved or regressed. Metrics can include technical accuracy, unsafe recommendations, tool-selection correctness, latency, and consistency. Subjective impressions from a few examples can miss important failure modes. Cisco’s updated AUTOCOR content explicitly includes evaluating the accuracy of AI recommendations, so controlled evaluation is more appropriate than assuming a prompt change is beneficial.

Q196. A network team runs an LLM locally with Ollama. What is one primary architectural benefit of this design compared with sending every prompt to a public external AI service?

1. The model is guaranteed never to hallucinate
   2. Network data can remain within the organization’s controlled environment
   3. Authorization is no longer necessary
   4. Generated automation no longer requires testing

Correct Answer: 2. Network data can remain within the organization’s controlled environment

Explanation: Running an approved model locally can give an organization greater control over where prompts, configurations, and retrieved network information are processed. This can help with privacy, intellectual-property, and data-governance requirements. Local execution does not make the model automatically correct or secure; organizations still need access controls, monitoring, validation, patching, tool restrictions, and safe handling of sensitive information. Cisco’s AUTOCOR course includes setting up a local LLM with Ollama and using Python with local models for network automation, reflecting the exam’s emphasis on practical AI integration.

Q197. An MCP server provides static network design standards that an AI client may read as contextual information without executing an operation. Which MCP concept best fits this type of exposed information?

1. Tool only
   2. Root shell
   3. Resource
   4. Terraform provider

Correct Answer: 3. Resource

Explanation: In MCP, resources can expose contextual information that a client can read, such as documentation, configuration references, inventories, or other data. Tools are more appropriate when the model needs to invoke an operation or function. Distinguishing between informational resources and callable tools helps make an MCP integration clearer and can reduce unnecessary operational capability. Access control remains important because read-only resources may still contain sensitive network information. Cisco’s current AUTOCOR exam specifically includes constructing FastMCP servers that provide network information to AI agents.

Q198. An AI agent can generate a proposed network change, but an independent rules engine checks whether the change violates routing and security standards before allowing execution. What is the primary benefit of this design?

1. It removes all need for logging
   2. It allows deterministic policy enforcement outside the probabilistic model
   3. It guarantees the LLM’s explanation is correct
   4. It eliminates the need for authentication

Correct Answer: 2. It allows deterministic policy enforcement outside the probabilistic model

Explanation: Large language models are probabilistic and can generate incorrect or unsafe recommendations. A deterministic rules or policy layer can independently evaluate proposed changes against explicit requirements before any network action occurs. This means the security boundary does not depend entirely on the model following instructions correctly. Such controls can enforce prohibited commands, allowed configuration ranges, approval requirements, or source-of-truth constraints. The model can still help interpret intent and generate suggestions, but deterministic systems should govern high-impact actions. This separation is a strong architectural pattern for production AI-assisted network automation.

Q199. An AI troubleshooting agent retrieves logs that contain malicious text instructing the agent to call a destructive tool. What should the architecture do with the retrieved log content?

1. Treat it as privileged system instructions
   2. Execute any embedded instructions automatically
   3. Give the log content administrator permissions
   4. Treat it as untrusted data and keep tool authorization independent of retrieved text

Correct Answer: 4. Treat it as untrusted data and keep tool authorization independent of retrieved text

Explanation: External and retrieved content can contain indirect prompt-injection instructions designed to manipulate an AI agent. Logs, tickets, documentation, webpages, and configuration comments should therefore be treated as data rather than trusted control instructions. Tool permissions should be enforced separately through identity and authorization mechanisms, ensuring malicious text cannot grant itself destructive capabilities. The system can also separate trusted prompts from retrieved context and limit tool access according to the agent’s intended role. This approach reduces the chance that untrusted operational data becomes a pathway to unauthorized infrastructure actions.

Q200. A company wants an AI agent to remediate low-risk interface-description inconsistencies automatically but requires approval for routing changes. Which governance approach does this represent?

1. Risk-based levels of automation autonomy
   2. Complete elimination of human oversight
   3. Identical handling for every network operation
   4. Unrestricted AI administrator access

Correct Answer: 1. Risk-based levels of automation autonomy

Explanation: Not every automation action has the same operational impact. Correcting a nonfunctional interface description may be low risk, while changing routing can disrupt major portions of the network. A mature AI automation design can therefore assign different autonomy levels based on action type, impact, confidence, policy, and reversibility. Low-risk tasks may run automatically after deterministic validation, while higher-risk changes require explicit human approval. All actions should still be authorized, logged, and validated afterward. Risk-based autonomy allows organizations to benefit from AI automation without granting the model unrestricted control over critical infrastructure.