View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q241. An Ansible playbook targets 100 routers, but a task that queries a central asset-management API should execute only once for the entire play. Which Ansible keyword is most appropriate?

1. serial: 1
   2. delegate_to: localhost only
   3. run_once: true
   4. gather_facts: false

Correct Answer: 3. run_once: true

Explanation: run_once: true instructs Ansible to execute a task only once rather than once for every host in the play. This is appropriate for operations such as querying a central inventory system, creating one change ticket, or retrieving shared data. The resulting information can then be distributed or referenced by later tasks as required. delegate_to changes where a task executes but does not by itself prevent the task from executing once per inventory host. serial controls batch size, while gather_facts controls automatic fact collection. Using run_once avoids redundant API requests and unnecessary processing.

Q242. A Terraform team renames a resource block in its configuration but wants Terraform to recognize that the existing infrastructure object has moved to the new resource address instead of destroying and recreating it. Which feature best supports this?

1. An output block
   2. terraform fmt
   3. A provider alias
   4. A moved block

Correct Answer: 4. A moved block

Explanation: A Terraform moved block records that an existing resource or module address has been renamed or reorganized in configuration. Terraform can then associate the existing state with the new address instead of interpreting the refactor as a request to destroy the old object and create a new one. This is useful when cleaning up Infrastructure as Code structure without changing the actual infrastructure. Engineers should still inspect the resulting plan before applying it. Output blocks expose values, provider aliases select provider configurations, and terraform fmt only reformats Terraform source files.

Q243. A REST API response returns HTTP 201 Created after an automation client successfully creates a network object. What does this status code indicate?

1. A new resource was successfully created
   2. Authentication is required
   3. The server is temporarily unavailable
   4. The requested resource was not modified

Correct Answer: 1. A new resource was successfully created

Explanation: HTTP 201 Created indicates that the request succeeded and resulted in the creation of a new resource. The server may also provide a Location header identifying the URI of the new object and may include a representation of the created resource in the response body. Automation code should interpret this as a successful creation event rather than treating all success responses as HTTP 200. HTTP 401 relates to authentication, while 503 indicates temporary service unavailability. Correctly interpreting HTTP response codes is important when building reliable automation that consumes controller and network-management APIs.

Q244. A Python automation application must process independent API calls concurrently because each call spends most of its time waiting on network I/O. Which Python approach should the engineer evaluate?

1. Replacing all functions with global variables
   2. Converting the API responses to images
   3. Asynchronous I/O using asyncio and compatible clients
   4. Executing all requests strictly one at a time

Correct Answer: 3. Asynchronous I/O using asyncio and compatible clients

Explanation: Asynchronous I/O can improve throughput for workloads dominated by waiting on network responses. Python’s asyncio framework allows one execution thread to make progress on other tasks while an API request is waiting for I/O, provided compatible asynchronous libraries are used. This can be useful when querying many network endpoints or controllers. Concurrency should still be bounded to respect device capacity and API rate limits. Async programming also introduces complexity in exception handling, cancellation, and result aggregation, so it should be chosen when workload scale and latency justify it rather than applied indiscriminately.

Q245. A Git repository contains a large feature branch. An engineer wants to inspect an older branch in a second directory without repeatedly switching the branch in the current working tree. Which Git feature is most useful?

1. git clean
   2. .gitignore
   3. git reset –hard
   4. git worktree

Correct Answer: 4. git worktree

Explanation: git worktree allows multiple working directories to be associated with the same repository, with each worktree checked out at a different branch or commit. This is useful when an engineer needs to compare automation code across releases, troubleshoot an older branch, or perform parallel work without repeatedly stashing and switching the primary working directory. Each worktree still shares the underlying repository history. git clean removes untracked files, .gitignore defines files that should normally remain untracked, and git reset –hard modifies the current working tree and can discard local changes.

Q246. A GitLab pipeline needs to provide a database token to one deployment job, but the token should not be exposed to pipelines from unprotected feature branches. Which approach is best?

1. Commit the token in the repository
   2. Use a protected CI/CD variable restricted to protected branches or environments
   3. Put the token in a public artifact
   4. Add the token to every pipeline log

Correct Answer: 2. Use a protected CI/CD variable restricted to protected branches or environments

Explanation: Protected CI/CD variables can limit sensitive values to trusted branches, tags, or deployment environments. This reduces the chance that unreviewed feature-branch code can print, exfiltrate, or misuse production credentials. The secret should also be masked where supported and preferably integrated with an external secrets-management system for stronger lifecycle controls. Committing tokens to Git can expose them permanently in repository history, while artifacts and logs may have broad visibility. CI/CD security should ensure that pipeline code, credentials, environment protections, and deployment permissions all reflect least-privilege principles.

Q247. A team wants to verify that a network automation pipeline can tolerate a simulated router failure during testing. Which use of Cisco Modeling Labs best supports this requirement?

1. Introduce controlled node or link failures in the test topology and validate expected recovery behavior
   2. Test only a perfectly healthy topology
   3. Replace CML with a static diagram
   4. Disable all validation when a node fails

Correct Answer: 1. Introduce controlled node or link failures in the test topology and validate expected recovery behavior

Explanation: Cisco Modeling Labs enables engineers to create controlled network scenarios, including node outages or link failures, without affecting production users. Automation can then validate whether routing convergence, redundancy, alerting, and remediation behave as expected. This is valuable because testing only successful deployments does not reveal how automation responds to degraded conditions. A CI workflow can create the topology, inject a defined fault, execute pyATS or other tests, collect evidence, and clean up afterward. Failure testing strengthens confidence that automation handles both normal operations and realistic fault conditions safely.

Q248. A network automation application retrieves device inventory from an API and must reject responses that do not match the expected structure before using them. Which technique best supports this?

1. Trust every response automatically
   2. Convert the response to plain text only
   3. Validate the response against an expected schema
   4. Disable exception handling

Correct Answer: 3. Validate the response against an expected schema

Explanation: Schema validation verifies that incoming data contains the expected fields, data types, allowed values, and structural relationships before automation relies on it. This can detect malformed API responses, unexpected version changes, or corrupted data early in the workflow. Python libraries and formal JSON Schema definitions can be used to implement this pattern. Validation is particularly important when API output will drive device configuration because one unexpected field can otherwise propagate incorrect changes at scale. Schema validation does not replace authentication or business-level checks, but it provides a strong structural safeguard between external APIs and infrastructure automation.

Q249. A model-driven telemetry collector must distinguish telemetry streams from multiple routers that publish the same YANG paths. Which metadata is especially important?

1. The source device identity
   2. The engineer’s Git username
   3. The Docker image tag only
   4. The Terraform workspace name only

Correct Answer: 1. The source device identity

Explanation: When many devices publish identical telemetry paths, the collector must know which device generated each update. Source identity enables dashboards, alerts, analytics, and troubleshooting systems to associate a measurement with the correct router, switch, or controller. Timestamps and sensor paths are also important, but identical paths without reliable source identity would make data ambiguous. Collector architectures should therefore preserve device identity throughout ingestion, normalization, storage, and downstream processing. Metadata design is essential to telemetry quality because data without trustworthy context can produce misleading operational conclusions even when the underlying metric values are correct.

Q250. A network automation application receives hundreds of telemetry events per second but should generate only one alert when the same interface repeatedly flaps during a short window. Which mechanism best reduces alert storms?

1. Disable monitoring permanently
   2. Event aggregation or suppression within a defined time window
   3. Create a separate alert for every telemetry sample
   4. Remove timestamps from all events

Correct Answer: 2. Event aggregation or suppression within a defined time window

Explanation: Event aggregation groups related events into a smaller number of actionable alerts. If an interface rapidly transitions between states, generating an independent incident for every transition can overwhelm operators and incident systems. A defined suppression or correlation window can summarize repeated events while still retaining the underlying telemetry for analysis. The design should avoid hiding meaningful persistent failures, so thresholds and windows must match operational requirements. Effective automation should reduce noise without losing evidence. Alert quality is important because excessive low-value notifications can cause operators to overlook genuinely critical network conditions.

Q251. A pyATS test successfully connects to a device but fails when parsing the output of a command because the device software version changed the CLI format. What is the best response?

1. Assume the test passed
   2. Delete all validation
   3. Verify parser support for the platform and software version and update the validation appropriately
   4. Convert the output to an image

Correct Answer: 3. Verify parser support for the platform and software version and update the validation appropriately

Explanation: Structured parsers depend on supported platform and software output formats. A device upgrade can introduce CLI differences that an older parser does not understand. The engineer should confirm parser compatibility, update relevant libraries, or use an alternate supported data source such as a model-driven API when appropriate. Treating the parse failure as a successful test would hide uncertainty about the network state. Validation tooling itself must therefore be versioned and tested alongside infrastructure changes. Reliable automation includes maintaining parsers and test dependencies as network operating systems evolve.

Q252. An automation service calls several external APIs. Operators need to trace one user request across all of those downstream calls. Which observability practice best supports this?

1. Remove request identifiers
   2. Use unrelated log formats for every service
   3. Log only application startup messages
   4. Propagate a consistent correlation or trace identifier across the workflow

Correct Answer: 4. Propagate a consistent correlation or trace identifier across the workflow

Explanation: A correlation or trace identifier allows logs and events from multiple components to be associated with one end-to-end workflow. When an automation request triggers calls to inventory, controllers, validation systems, and incident platforms, the same identifier can be included throughout those interactions. Operators can then reconstruct the sequence without relying only on timestamps or manual guesswork. The identifier should not contain sensitive information and should be generated in a way that avoids collisions. Distributed automation becomes significantly easier to troubleshoot when every component preserves consistent tracing context.

Q253. An automation service is configured for mutual TLS. What additional authentication occurs compared with ordinary server-authenticated TLS?

1. The client also presents a certificate that the server validates
   2. Encryption is disabled after the handshake
   3. The server no longer presents a certificate
   4. Both systems share the server’s private key

Correct Answer: 1. The client also presents a certificate that the server validates

Explanation: In mutual TLS, both sides authenticate using certificates. The server presents its certificate to the client as in conventional HTTPS, and the client also presents a certificate that the server validates against trusted certificate authorities and policy. This provides strong workload or machine identity without sharing passwords. Each endpoint retains its own private key; private keys are never exchanged during normal TLS authentication. Certificate issuance, rotation, revocation, and authorization mapping still need to be managed carefully. mTLS can be useful when automation services communicate across trusted machine-to-machine interfaces requiring strong identity assurance.

Q254. A development team changes the system prompt used by an AI network agent. What practice best supports controlled comparison and rollback if the new prompt performs poorly?

1. Replace the old prompt permanently with no record
   2. Version-control prompt templates and associate evaluations with each version
   3. Store prompts only in individual engineers’ clipboard history
   4. Disable AI testing

Correct Answer: 4. Version-control prompt templates and associate evaluations with each version

Explanation: Prompt templates are part of the behavior of an AI application and should be treated as managed configuration or code. Version control provides history, review, comparison, and rollback, while a repeatable evaluation suite allows the team to measure whether a new prompt improves or degrades technical performance. Deployment records can then identify which prompt version was active during a particular result. Without this discipline, AI behavior can change without traceability. Prompt versioning is particularly useful when network automation agents use complex system instructions, retrieval policies, and tool-selection guidance.

Q255. An AI retrieval system stores document embeddings in a vector database. The user is authorized to view only documents for Site A. Which design best enforces this restriction?

1. Retrieve every document and ask the LLM not to mention Site B
   2. Remove all user identity information
   3. Apply authorization metadata filters during retrieval before documents reach the model
   4. Depend only on prompt wording

Correct Answer: 3. Apply authorization metadata filters during retrieval before documents reach the model

Explanation: Access control should be enforced at retrieval time so unauthorized content is never supplied to the language model. Metadata associated with each indexed document can identify site, owner, classification, tenant, or other authorization attributes. The retrieval system then filters candidates according to the authenticated user’s permissions before semantic ranking or context assembly. Asking the model to hide unauthorized information is insufficient once that information is already in its context. This principle is especially important for network design documents, configurations, security policies, and customer-specific infrastructure information stored in shared retrieval systems.

Q256. An MCP server offers a tool that can retrieve interface counters. What should happen if the AI agent supplies a device identifier that does not exist in the approved inventory?

1. The server should invent the closest device name
   2. The server should reject the request through deterministic validation
   3. The server should query every device automatically
   4. The server should disable authentication

Correct Answer: 2. The server should reject the request through deterministic validation

Explanation: MCP tool arguments should be validated independently of the model. If a requested device does not exist in the approved inventory, the server should return a controlled error rather than guessing or broadening the query. This prevents hallucinated identifiers from producing unexpected infrastructure access and makes the agent’s failure explicit. The validation layer can also check authorization, parameter type, resource limits, and allowed operations. Language models are probabilistic, so deterministic server-side controls are essential whenever AI-generated tool calls interact with real network systems.

Q257. A conversational AI network agent gives a highly confident answer that conflicts with current telemetry. What should the application prioritize?

1. The model’s confidence wording
   2. The current validated operational evidence
   3. The longest generated explanation
   4. The oldest cached answer

Correct Answer: 2. The current validated operational evidence

Explanation: Natural-language confidence is not evidence of technical correctness. If current validated telemetry contradicts the model’s statement, the application should prioritize the authoritative operational data. The agent can revise its explanation using that evidence or acknowledge uncertainty if sources remain inconsistent. AI systems should be designed so factual network state comes from trusted tools, telemetry, controllers, and sources of truth rather than from model intuition. This is central to safe AI-assisted operations because persuasive language can otherwise cause engineers to over-trust incorrect recommendations or diagnoses.

Q258. An AI automation platform proposes a configuration change affecting 200 devices, while the user requested a change for only one site. Which safeguard should detect the mismatch before execution?

1. A scope-validation check comparing requested intent with exact target inventory
   2. A higher model temperature
   3. Removal of the change preview
   4. Unlimited administrator privileges

Correct Answer: 4. A scope-validation check comparing requested intent with exact target inventory

Explanation: Automation should explicitly compare the user’s requested scope with the generated execution plan. If the user requested one site but the plan targets 200 devices across several sites, the workflow should fail validation or require correction before any change is applied. Target lists should be derived from authoritative inventory and displayed clearly during review. This deterministic check limits the impact of hallucinated filters, ambiguous prompts, or programming errors. High-impact infrastructure actions should never rely solely on a language model’s interpretation of scope without an independent verification layer.

Q259. A network AI assistant is used to summarize a large set of incident logs. What is the best way to reduce the risk that critical rare events disappear during summarization?

1. Discard raw logs after the first summary
   2. Use only the model’s summary for all investigations
   3. Preserve raw evidence and combine summarization with deterministic filtering for critical indicators
   4. Remove timestamps before summarizing

Correct Answer: 1. Preserve raw evidence and combine summarization with deterministic filtering for critical indicators

Explanation: Summarization is lossy by nature and can omit events the model considers less important. Critical security or operational indicators should therefore be detected using deterministic rules, searches, or analytics in addition to AI summarization. Raw logs should remain available for investigation, audit, and reprocessing. The AI can help reduce information overload and explain patterns, but it should not become the sole record of what occurred. Preserving evidence and using explicit detection logic reduces the chance that a rare but important event disappears from the operator’s view.

Q260. A network automation team wants an AI agent to suggest remediations but never perform them automatically. Which architecture best satisfies this requirement?

1. Give the model unrestricted write tools but instruct it not to use them
   2. Expose read-only diagnostic tools and return remediation recommendations for human execution
   3. Disable audit logging
   4. Allow configuration changes whenever confidence exceeds 50%

Correct Answer: 3. Expose read-only diagnostic tools and return remediation recommendations for human execution

Explanation: If the agent’s role is advisory, the safest architecture is to provide only the read capabilities necessary for diagnosis and prevent it from having write access at all. The model can gather current state, analyze evidence, and produce recommended remediation steps that an engineer reviews and executes through approved processes. This creates a stronger boundary than relying on prompt instructions to prevent use of available destructive tools. Tool permissions should reflect the intended autonomy level of the agent, while authentication, authorization, logging, and data-access controls remain enforced independently.