View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q201. An Ansible playbook contains sensitive API credentials that must remain encrypted while stored in the automation repository. Which Ansible feature is designed for this purpose?

1. Dynamic inventory
   2. Check mode
   3. Ansible Vault
   4. Fact gathering

Correct Answer: 3. Ansible Vault

Explanation: Ansible Vault is designed to encrypt sensitive data used by Ansible, including passwords, API tokens, and other secrets that might otherwise appear in plaintext variable files. The encrypted content can remain in version control while authorized automation processes decrypt it at execution time using an approved credential mechanism. Vault does not eliminate the need to control access to repositories, pipeline environments, or decryption passwords. Dynamic inventory discovers hosts, check mode previews supported changes, and fact gathering collects host information. Secret protection is particularly important because network automation repositories can affect large numbers of infrastructure devices.

Q202. A Terraform configuration needs to generate zero or more nested configuration blocks dynamically from a collection. Which Terraform construct is most appropriate?

1. Dynamic block
   2. Output block
   3. Backend block
   4. Provider lock file

Correct Answer: 1. Dynamic block

Explanation: Terraform dynamic blocks can generate repeated nested blocks from collections when the number or contents of those blocks vary according to input data. This is useful when a provider resource contains nested structures such as rules, interfaces, or policy entries that cannot be represented simply as ordinary scalar attributes. Dynamic blocks should be used carefully because excessive abstraction can make configurations difficult to read. Output blocks expose resulting values, while backend configuration defines how Terraform state is stored. Infrastructure as Code should remain understandable even when reusable constructs reduce repetitive configuration.

Q203. A RESTCONF GET request returns far more YANG-modeled data than an automation application requires. What should the engineer investigate to reduce unnecessary response data?

1. Increasing the device logging level
   2. Using HTTP DELETE first
   3. Converting the request to Telnet
   4. Supported RESTCONF query parameters that limit returned content or fields

Correct Answer: 4. Supported RESTCONF query parameters that limit returned content or fields

Explanation: RESTCONF supports query mechanisms that can constrain returned data depending on the resource and implementation. Reducing the requested data can improve response time, lower bandwidth use, and simplify downstream parsing. An automation client should retrieve only what it needs rather than repeatedly downloading large configuration or operational trees. The exact query parameters and support should be verified against RFC 8040 and platform documentation. DELETE modifies resources and is inappropriate for reducing a GET response. Efficient model-driven automation combines precise resource paths, appropriate query parameters, correct media types, and validation of returned YANG-modeled data.

Q204. A Python automation script needs command-line arguments for the target site, dry-run mode, and configuration file. Which standard-library module is best suited to defining and validating these options?

1. random
   2. argparse
   3. decimal
   4. statistics

Correct Answer: 2. argparse

Explanation: Python’s argparse module provides a structured way to define command-line arguments, options, types, defaults, required values, and help messages. This is useful for network automation utilities that need predictable operator input, such as a site identifier, configuration path, or dry-run flag. It provides clearer validation and usage information than manually reading raw sys.argv positions. Input received through command-line arguments must still be validated against business and security requirements before it affects infrastructure. Well-designed interfaces make automation safer by reducing ambiguous operator input and making execution behavior easier to understand.

Q205. A REST API returns a Location header after successfully creating a new network object. What does this header commonly provide?

1. The URI of the newly created resource
   2. The API user’s password
   3. The controller’s private key
   4. A Git repository path

Correct Answer: 3. The URI of the newly created resource

Explanation: After creating a resource, an HTTP API can return a Location header identifying the URI of that newly created object. An automation client can use the URI to retrieve the object’s details, monitor its state, or perform subsequent operations without guessing its identifier. The exact behavior depends on the API specification, and clients should interpret it together with the returned status code and response body. Headers should never expose passwords or private keys. Understanding standard HTTP semantics helps automation applications integrate more reliably with network controllers and management platforms.

Q206. An API access token contains scopes for read:devices and write:devices. A reporting application only retrieves inventory. Which token design follows least privilege?

1. Grant every available API scope
   2. Issue a token containing only read:devices
   3. Use the controller administrator account instead
   4. Disable API authorization

Correct Answer: 2. Issue a token containing only read:devices

Explanation: Least privilege means giving an application only the permissions required for its function. A reporting application that reads device inventory does not need write privileges, so its token should contain only the necessary read scope. If the credential is compromised, the attacker then has fewer capabilities. Broad administrator credentials create an unnecessarily large blast radius. Scope design should be combined with token expiration, secure storage, rotation, logging, and strong authentication to the authorization system. Persistent API automation is safer when each workload has a dedicated identity with narrowly defined permissions.

Q207. A team wants to mark a specific repository commit as the exact network automation release deployed to production. Which Git feature best supports this?

1. git clean
   2. git stash
   3. .gitignore
   4. A Git tag

Correct Answer: 4. A Git tag

Explanation: Git tags provide human-readable references to particular commits and are commonly used to identify releases or important deployment points. A tag such as v2.3.0 can identify the exact source revision associated with a production network automation release. Annotated and signed tags can provide additional metadata or authenticity depending on workflow requirements. Tags do not replace immutable build artifacts or deployment logs, but they strengthen traceability between source code and releases. git stash temporarily saves local modifications, while git clean removes untracked files and .gitignore controls which paths Git normally tracks.

Q208. A developer wants to find which commit first introduced a failing validation behavior in a long Git history. Which Git capability is designed to efficiently narrow down the offending commit?

1. git bisect
   2. git init
   3. git clone
   4. git status

Correct Answer: 1. git bisect

Explanation: git bisect performs a binary search through commit history. The engineer identifies a known good commit and a known bad commit, then Git checks intermediate revisions while the engineer or an automated test marks each as good or bad. This can locate the commit that introduced a regression much faster than testing every revision sequentially. It is especially effective when validation can be automated. Although AUTOCOR emphasizes core version-control operations used in Infrastructure as Code, understanding systematic troubleshooting of repository history is valuable for diagnosing regressions in automation scripts and configuration logic.

Q209. A GitLab pipeline builds a deployable network automation package. The organization wants production to use exactly the artifact that passed validation, not a freshly rebuilt copy. What approach best supports this?

1. Rebuild manually on the production server
   2. Promote the same validated immutable artifact to the deployment stage
   3. Copy random files from a developer workstation
   4. Ignore build identifiers

Correct Answer: 2. Promote the same validated immutable artifact to the deployment stage

Explanation: A strong CI/CD workflow builds an artifact once, validates that exact artifact, and promotes the same immutable output through later stages. Rebuilding separately for production can introduce dependency, environment, or source differences after testing has already completed. Artifact promotion improves reproducibility and creates a clearer audit trail connecting source code, test results, and production deployment. Hashes, version identifiers, or signatures can further strengthen integrity. Cisco’s current AUTOCOR training emphasizes CI/CD pipelines that integrate building, testing, validation, and deployment for network automation solutions.

Q210. A CI pipeline must ensure two production deployment jobs cannot modify the same network environment simultaneously. Which design is most appropriate?

1. Run as many production jobs concurrently as possible
   2. Disable pipeline state tracking
   3. Use a deployment lock or serialized resource control
   4. Remove prevalidation

Correct Answer: 4. Use a deployment lock or serialized resource control

Explanation: Concurrent production deployments against the same infrastructure can race with one another and create unpredictable state. A deployment lock, resource group, or equivalent serialization mechanism ensures only one workflow modifies the target environment at a time. This is especially important when pipelines perform read-modify-write operations or when network devices cannot safely process overlapping changes. The exact implementation depends on the CI/CD platform. Locking does not eliminate the need for prevalidation, version control, or post-validation. Instead, it protects the deployment phase from concurrency hazards that automated pipelines can otherwise create at scale.

Q211. A model-driven telemetry deployment must collect CPU utilization every 30 seconds regardless of whether the value changes. Which update method best matches the requirement?

1. Periodic sample-based updates
   2. On-change updates only
   3. One-time file export
   4. Git webhook notifications

Correct Answer: 3. Periodic sample-based updates

Explanation: Sample-based telemetry sends data at defined intervals, making it suitable when operators need a regular time series even if the value remains unchanged. CPU utilization is often analyzed as a continuous trend, so consistent periodic samples can support dashboards, capacity planning, and anomaly detection. On-change updates may be more efficient for state values that change infrequently but may not provide the desired time-series granularity for continuously varying metrics. The sampling interval should balance operational visibility against device, network, collector, and storage load.

Q212. A telemetry collector receives data successfully, but timestamps from several devices differ significantly from each other. Why is this a serious operational issue?

1. Telemetry cannot contain numeric values
   2. Event sequencing and cross-device correlation can become unreliable
   3. YANG models stop functioning
   4. Git repositories become corrupted

Correct Answer: 1. Event sequencing and cross-device correlation can become unreliable

Explanation: Accurate timestamps are essential when telemetry and logs from multiple devices are analyzed together. If clocks differ significantly, operators may misinterpret which event occurred first, fail to correlate cause and effect, or draw incorrect conclusions during troubleshooting. Network devices and automation infrastructure should therefore use reliable time synchronization. Collectors may normalize timestamps, but they cannot always reconstruct the true event order when source clocks are badly wrong. Observability depends not only on collecting data but also on ensuring metadata such as timestamps and identities is reliable enough to support meaningful analysis.

Q213. A pyATS test case needs initialization logic that should run before its individual test sections. Which testing concept is most appropriate?

1. A common setup section
   2. A Docker bind mount
   3. Terraform import
   4. A RESTCONF DELETE request

Correct Answer: 4. A common setup section

Explanation: Structured test frameworks typically separate preparation, test execution, and cleanup. In pyATS AEtest, common setup can prepare the environment, connect to devices, validate prerequisites, or initialize data needed by later test cases. This avoids repeating setup code in every individual test. Cleanup sections can then release resources or disconnect sessions when testing finishes. Separating setup and validation logic makes automated tests easier to maintain and understand. Cisco’s current AUTOCOR training includes building pyATS validation tools and integrating them into CI/CD workflows.

Q214. A Python application must execute an external program with user-supplied arguments. Which implementation is safest?

1. Build a single shell command string by concatenating raw user input
   2. Pass validated arguments as a list without invoking a shell when possible
   3. Run all external commands as root
   4. Disable input validation

Correct Answer: 2. Pass validated arguments as a list without invoking a shell when possible

Explanation: Passing validated arguments directly to a subprocess without invoking a shell reduces the chance that special shell characters are interpreted as additional commands. Raw string concatenation can create command-injection vulnerabilities if external data reaches the command line. The application should allowlist expected values, restrict privileges, and avoid shell execution entirely when a native library or API can perform the operation. Running as root only increases the potential impact of an exploit. AUTOCOR explicitly includes secure coding practices such as input validation and credential protection for network automation solutions.

Q215. A Docker Compose environment contains a database password directly inside the Compose file committed to Git. What is the best improvement?

1. Print the password during startup
   2. Rename the password variable
   3. Move the secret to an approved runtime secret mechanism and keep it out of version control
   4. Publish the repository so all users can access it

Correct Answer: 1. Move the secret to an approved runtime secret mechanism and keep it out of version control

Explanation: Credentials should not be committed directly into Docker Compose files or other version-controlled configuration. An approved secrets-management mechanism can provide the value at runtime and support access control, auditing, and rotation. Depending on the environment, this might involve orchestrator secrets, a dedicated secret manager, protected pipeline variables, or another secure injection mechanism. Merely renaming the variable does not protect its value. Cisco’s AUTOCOR training includes both Docker Compose environments and secure coding practices, so automation engineers should understand that containerization does not remove the need for proper secret management.

Q216. A TLS certificate uses a 2048-bit RSA public key. Which component must remain secret?

1. The public certificate
   2. The CA name
   3. The certificate serial number
   4. The corresponding private key

Correct Answer: 3. The corresponding private key

Explanation: The public certificate is intended to be distributed to clients and contains public identity and key information. The corresponding private key must remain confidential because possession of it can allow an attacker to impersonate the service or perform unauthorized cryptographic operations. Private keys should be protected through filesystem permissions, secret-management systems, HSMs, or other controls appropriate to the environment. Certificate serial numbers and CA names are not secrets. AUTOCOR’s operational objectives include generating, signing, and installing certificates for secure automation services, making private-key protection a fundamental PKI responsibility.

Q217. A local LLM answers network questions accurately but takes 30 seconds per response, which is too slow for the intended operator workflow. Which AI characteristic should the team evaluate?

1. Response latency and resource requirements
   2. Git conflict frequency
   3. VLAN numbering only
   4. Certificate serial length

Correct Answer: 1. Response latency and resource requirements

Explanation: AI solution quality includes more than factual accuracy. An operational assistant must also meet acceptable latency and compute requirements for its intended workflow. Local models can provide greater data control but may require substantial CPU, GPU, memory, or optimization to deliver responsive interactions. The team can compare models, quantization levels, hardware, context sizes, or architecture choices while continuing to measure accuracy. A model that is correct but too slow may still be unsuitable for a time-sensitive operations environment. AI automation design therefore needs both technical correctness and practical performance evaluation.

Q218. An AI agent uses retrieval to answer network questions. A user should only be allowed to retrieve documents they already have permission to access. Where should this restriction be enforced?

1. Only in the final natural-language response
   2. At the retrieval and data-access layer before restricted content is supplied to the model
   3. By asking the model politely not to reveal information
   4. By giving the model access to every document first

Correct Answer: 4. At the retrieval and data-access layer before restricted content is supplied to the model

Explanation: Authorization should be applied before sensitive data enters the model’s context. The retrieval system should identify the user or workload, evaluate permissions, and return only documents that identity is allowed to access. Prompt instructions are not a sufficient security boundary because a model may reveal information already present in its context. Enforcing access at the data layer reduces the risk of cross-user information leakage. This principle is especially important for network documentation, device inventories, and security configurations, where retrieved content may expose sensitive architecture even when the AI agent itself performs only read operations.

Q219. An AI network agent calls a diagnostic tool, but the backend never responds. What should the agent platform enforce?

1. Infinite waiting
   2. Automatic administrator escalation
   3. A bounded tool-call timeout with clear error handling
   4. Reboot every network device

Correct Answer: 2. A bounded tool-call timeout with clear error handling

Explanation: AI agents should not wait indefinitely for external tools because an unavailable API or network device could block the entire conversational workflow. The platform should define tool-call timeouts and return a controlled error when the limit is exceeded. Depending on the tool and operation, bounded retries with backoff may also be appropriate. The agent should then explain that current data could not be obtained rather than inventing a result. Timeouts are part of making AI automation dependable because LLM reasoning may rely on external deterministic systems whose failures must be handled explicitly.

Q220. An AI agent generates a network change that passes syntax validation but modifies more devices than the user’s request intended. Which safeguard best reduces this risk before execution?

1. Give the model broader administrator permissions
   2. Disable change previews
   3. Execute first and inspect impact later
   4. Generate and validate an explicit change plan showing exact targets and actions before approval

Correct Answer: 3. Generate and validate an explicit change plan showing exact targets and actions before approval

Explanation: A syntax-valid configuration can still have the wrong scope. Before execution, the automation system should produce a deterministic plan showing which devices, interfaces, policies, or resources will be changed and exactly what operations are proposed. The plan can be compared against the original request, authoritative inventory, policy constraints, and approval thresholds. High-impact changes can then require explicit human confirmation. This approach separates AI-generated intent interpretation from actual execution and makes unintended scope expansion easier to detect before it affects production infrastructure.