View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q341. An Ansible playbook needs to execute a configuration task only when a previous command returns output containing the string ESTABLISHED. Which approach is most appropriate?

1. Register the command result and evaluate it with a when condition
   2. Create a new inventory for each result
   3. Use run_once on every task
   4. Replace the playbook with manual CLI configuration

Correct Answer: 1. Register the command result and evaluate it with a when condition

Explanation: Ansible can save a task’s result in a variable with register, allowing later tasks to evaluate fields such as command output, return status, or structured data. A when condition can then determine whether the next configuration action should execute. This is useful when automation depends on observed network state rather than running blindly. The condition should be written carefully so missing or unexpected output fails safely. run_once controls execution frequency rather than conditional behavior. Combining registered results with conditions enables adaptive network automation while keeping execution logic explicit and repeatable.

Q342. A Terraform resource depends on a calculated value that is not known until another resource has been created. How does Terraform normally handle this during planning?

1. It always fails the configuration immediately
   2. It deletes both resources
   3. It can represent the dependent value as unknown until it becomes available during apply
   4. It converts the value into a Git variable

Correct Answer: 3. It can represent the dependent value as unknown until it becomes available during apply

Explanation: Terraform can build a dependency graph even when some resource attributes are not known until apply time. During planning, such values may be represented as unknown while Terraform still determines the ordering implied by resource references. Once the prerequisite resource is created, the actual value becomes available for dependent resources. Engineers should review plans carefully because unknown values can make certain downstream details less visible before execution. Explicit depends_on is usually unnecessary when a normal expression reference already establishes the relationship. This behavior supports declarative Infrastructure as Code while handling runtime-generated resource attributes.

Q343. A NETCONF client needs to discard uncommitted modifications in the candidate datastore and restore it to the current committed configuration. Which operation is most appropriate when supported?

1. <delete-config>
   2. <get-config>
   3. <lock>
   4. <discard-changes>

Correct Answer: 4. <discard-changes>

Explanation: The NETCONF <discard-changes> operation removes uncommitted modifications from the candidate datastore and restores the candidate to the current committed configuration. This is valuable when validation fails or an automation transaction must be abandoned before commit. It is different from <delete-config>, which deletes a configuration datastore where permitted, and <lock>, which prevents competing modifications. Transaction-oriented features such as candidate configuration, validation, commit, locking, and discarding changes make NETCONF well suited to controlled network automation where several related configuration edits should be treated as a coordinated operation.

Q344. A Python application must call the same function for every device but also needs both the device position and the device object while iterating. Which built-in function is most appropriate?

1. sorted()
   2. enumerate()
   3. zip() only
   4. repr()

Correct Answer: 2. enumerate()

Explanation: Python’s enumerate() iterates over a collection while returning both an index and the corresponding item. This is useful when an automation workflow needs a sequence number for progress reporting, batching, logs, or result correlation while still operating on the actual device object. It is clearer and less error-prone than manually maintaining and incrementing an index variable. zip() combines multiple iterables, while sorted() reorders elements and repr() generates a representation of an object. Choosing suitable built-ins keeps automation code concise and easier to review.

Q345. An API requires clients to send an Idempotency-Key header when creating change requests. What is the primary reason for this design?

1. Encrypt the request body
   2. Select the response media type
   3. Replace API authentication
   4. Prevent repeated delivery of the same logical request from creating duplicate operations

Correct Answer: 4. Prevent repeated delivery of the same logical request from creating duplicate operations

Explanation: An idempotency key lets a server recognize that multiple requests represent the same intended operation. If a client loses the first response and retries, the server can return the original result instead of creating a second change request or duplicate resource. This is especially useful for POST-style operations that are not naturally idempotent. The key should be unique to the logical transaction and stored long enough to cover reasonable retry windows. It does not provide encryption or authentication and does not define content negotiation. Idempotency controls improve reliability when network failures make delivery outcomes uncertain.

Q346. A Git repository contains an automation file that was accidentally modified. The engineer wants to see exactly which unstaged lines differ from the version currently in the index. Which command is most appropriate?

1. git diff
   2. git tag
   3. git init
   4. git clone

Correct Answer: 1. git diff

Explanation: git diff displays differences between working-tree content and the staging area by default, making it useful for reviewing unstaged modifications before committing or discarding them. Other forms of the command can compare commits, branches, or staged changes. This is particularly valuable for Infrastructure as Code because a small textual modification can have a large production impact. Engineers should review diffs before committing and again during code review. Git tags mark commits, git init creates repositories, and git clone copies an existing repository rather than showing local file differences.

Q347. A GitLab CI job generates a Terraform plan that must be reviewed by a later manual deployment job. What should the pipeline do with the plan file?

1. Delete it immediately after creation
   2. Preserve it as a controlled artifact for the later job
   3. Email it as plain text to every employee
   4. Recreate a different plan after approval without review

Correct Answer: 2. Preserve it as a controlled artifact for the later job

Explanation: If the deployment decision is based on a reviewed Terraform plan, the pipeline should preserve that exact plan as a controlled artifact and make it available to the authorized apply stage. Recreating the plan later can introduce changes if source code, variables, provider data, or infrastructure state changed after review. Artifact access should be restricted because plans can contain sensitive infrastructure information. A strong workflow connects source revision, validation evidence, reviewed plan, approval, and execution. This improves traceability and reduces the gap between what an engineer reviewed and what the pipeline eventually applies.

Q348. A CML test workflow repeatedly fails because a virtual router has not finished booting when automation attempts the first API or CLI connection. Which improvement is best?

1. Increase every device timeout to one hour regardless of state
   2. Remove all readiness checks
   3. Poll for defined device readiness conditions before starting the test
   4. Assume that launching the node means the network OS is ready

Correct Answer: 3. Poll for defined device readiness conditions before starting the test

Explanation: Starting a virtual node and having its network operating system ready for automation are separate events. The pipeline should wait for a meaningful readiness condition, such as successful management connectivity, an expected API response, or another deterministic indicator, before beginning tests. Polling should use bounded timeouts so broken nodes do not block the pipeline indefinitely. Fixed long sleeps can work but waste time and remain unreliable across varying startup conditions. Readiness-based synchronization makes CML integration tests faster and more predictable and reduces intermittent failures caused purely by timing.

Q349. A model-driven telemetry system receives interface statistics from many platforms, but interface names use different conventions such as Gi0/1 and GigabitEthernet0/1. Which processing step helps downstream correlation?

1. Normalize identifiers into a consistent canonical representation
   2. Remove all interface names
   3. Store every name as an unrelated random identifier
   4. Convert all statistics into screenshots

Correct Answer: 1. Normalize identifiers into a consistent canonical representation

Explanation: Analytics systems frequently need to correlate data from several platforms, collectors, or APIs that use different naming conventions for the same type of object. Normalizing interface identifiers into a canonical form makes searching, comparison, alerting, and cross-source correlation more reliable. The pipeline should preserve the original source value when useful for troubleshooting while also creating a normalized representation. Normalization can apply to hostnames, interface names, timestamps, units, addresses, and other metadata. Without it, logically equivalent objects may appear unrelated to downstream automation even when the underlying measurements are correct.

Q350. A webhook receiver must prevent an attacker from capturing a legitimate signed request and replaying it hours later. Which additional control best addresses this risk?

1. Remove webhook authentication
   2. Use only the request URL as proof of authenticity
   3. Permit every previously valid signature forever
   4. Validate a timestamp or nonce and reject requests outside an allowed replay window

Correct Answer: 4. Validate a timestamp or nonce and reject requests outside an allowed replay window

Explanation: A cryptographic signature verifies integrity and sender authenticity, but a previously valid signed request can sometimes be replayed if the receiver has no freshness check. Including a signed timestamp or nonce allows the server to reject duplicate or excessively old requests. The receiver can enforce a short acceptance window and store recently used identifiers where necessary. HTTPS should still protect transport, and the payload should be schema validated before triggering actions. Replay defense is particularly important when webhooks initiate automation because repeating a previously authorized event could otherwise cause duplicate infrastructure operations.

Q351. A pyATS test must verify that a route is present but should ignore fields such as route age that naturally change over time. What validation approach is best?

1. Compare only the meaningful fields required by the test
   2. Require every parsed field to remain byte-for-byte identical
   3. Disable route validation
   4. Convert output to a screenshot and compare images

Correct Answer: 2. Compare only the meaningful fields required by the test

Explanation: Operational state often includes volatile fields such as timers, counters, timestamps, and ages. A test should validate the fields that represent the intended network requirement while ignoring values that naturally change and are irrelevant to success. For route validation, this might include prefix, next hop, protocol, or selected path rather than route age. Overly strict comparisons create false failures and reduce confidence in automated testing. pyATS structured data makes selective comparison easier because tests can reference meaningful fields directly instead of relying on fragile full-text equality.

Q352. An automation service uses a long-lived API credential shared by several independent applications. What design improvement most strengthens accountability?

1. Share the same credential with additional applications
   2. Remove authentication from the API
   3. Give each application a distinct workload identity and credential
   4. Print the shared credential in troubleshooting logs

Correct Answer: 3. Give each application a distinct workload identity and credential

Explanation: Separate workload identities allow permissions, audit logs, rotation, and revocation to be managed independently for each application. If one credential is compromised, administrators can revoke that identity without disrupting every automation service. Logs also clearly identify which workload performed an operation instead of attributing all activity to one shared account. Each identity should receive only the privileges required for its function. Shared credentials reduce accountability and increase blast radius. Distinct machine identities are therefore a stronger foundation for secure network automation, especially when several pipelines, services, and agents access the same controllers.

Q353. A Dockerized automation component writes configuration files that must persist after the container is recreated. Which storage option is most appropriate?

1. Container memory only
   2. A persistent Docker volume or equivalent durable storage
   3. The container’s disposable writable layer only
   4. A temporary /tmp directory inside the container

Correct Answer: 4. A persistent Docker volume or equivalent durable storage

Explanation: Data that must survive container replacement should be stored outside the container’s ephemeral writable layer. A Docker volume or another durable external storage mechanism preserves files independently of a particular container instance. Temporary directories and container-local writable layers can disappear when the container is deleted or recreated. The storage location should still have appropriate access controls, backup, and encryption if the configuration is sensitive. Container design should explicitly distinguish persistent state from temporary data so lifecycle operations do not unintentionally destroy information required by the automation service.

Q354. A TLS certificate is valid for another six months, but the issuing intermediate CA has been replaced and clients no longer trust the old chain. What must the service administrator evaluate?

1. Updating the certificate chain or reissuing the service certificate through the currently trusted CA path
   2. Changing the Git branch name
   3. Disabling hostname verification
   4. Converting HTTPS into plaintext HTTP

Correct Answer: 2. Updating the certificate chain or reissuing the service certificate through the currently trusted CA path

Explanation: Certificate validity depends on more than the leaf certificate’s expiration date. Clients must be able to build a valid chain to a trusted root using acceptable intermediate certificates. If the old intermediate is no longer trusted or the PKI hierarchy changed, administrators may need to update the served chain or reissue the leaf certificate under the current trusted path. Disabling certificate verification or HTTPS weakens security and is not an appropriate operational fix. PKI lifecycle management must account for CA rotation, chain changes, revocation, expiration, and client trust-store behavior.

Q355. An organization evaluates an AI automation assistant that occasionally fails to identify real network faults and incorrectly declares the network healthy. Which metric directly measures this type of error?

1. False-negative rate
   2. GPU utilization
   3. Average response length
   4. Number of Git commits

Correct Answer: 1. False-negative rate

Explanation: A false negative occurs when a real condition exists but the system fails to detect or report it. For a network troubleshooting assistant, declaring a genuinely faulty network healthy is a false-negative outcome. This metric can be especially important when missed failures have greater consequences than unnecessary investigations. AI evaluations should measure several dimensions, including false positives, false negatives, overall technical accuracy, unsafe recommendations, latency, and tool-selection behavior. The correct threshold depends on the intended use and level of autonomy. AI quality must be measured using representative labeled scenarios rather than subjective confidence.

Q356. A retrieval-augmented AI system performs semantic search well but often retrieves chunks containing the right keywords from the wrong customer environment. Which additional retrieval control is most appropriate?

1. Increase temperature
   2. Remove customer metadata
   3. Apply tenant or environment metadata filtering before or during retrieval
   4. Mix all customers’ data into one unrestricted context

Correct Answer: 3. Apply tenant or environment metadata filtering before or during retrieval

Explanation: Semantic similarity alone is not sufficient when a shared retrieval system contains data from multiple customers, sites, environments, or security domains. Metadata filters can restrict candidate documents to the authorized tenant or target environment before semantic ranking. This improves both security and relevance by preventing highly similar but inappropriate documents from entering the model context. The retrieval layer should enforce authenticated access rather than relying on the LLM to ignore unauthorized material later. Metadata filtering, provenance, freshness, and semantic ranking work together to produce trustworthy grounded context.

Q357. An MCP server exposes a network-change tool. Why should each tool invocation carry the authenticated caller identity into backend audit logs?

1. To reduce the model context window
   2. To provide accountability for who initiated the action
   3. To eliminate TLS
   4. To let users bypass authorization

Correct Answer: 2. To provide accountability for who initiated the action

Explanation: When an AI agent acts on behalf of a user or service, backend audit logs should preserve the originating identity rather than recording every operation only as a generic MCP service account. This enables incident investigation, compliance review, authorization decisions, and user-level accountability. The implementation can use delegated identity, signed context, or another trusted mechanism while ensuring the agent cannot forge identity information. Auditing should also capture the requested operation, parameters, result, timestamps, approval information, and target resources. Strong attribution is especially important when AI-assisted workflows can modify production infrastructure.

Q358. An AI network agent’s tool returns a large routing table that exceeds the model’s practical context capacity. What should the tool layer do?

1. Return every route regardless of size
   2. Remove all route information
   3. Increase model randomness
   4. Filter, paginate, or summarize the tool result according to the user’s actual query

Correct Answer: 4. Filter, paginate, or summarize the tool result according to the user’s actual query

Explanation: Tool output should be designed for efficient consumption. Returning an entire large routing table wastes context and can hide the small amount of information relevant to the user’s question. The tool can support filters for prefix, protocol, VRF, or device, or return paginated or summarized results. Deterministic filtering is preferable when exact data selection is possible. The system should preserve access controls and allow operators to retrieve additional evidence when needed. Managing tool-result size improves AI reliability, latency, and cost while reducing irrelevant information in the model’s context.

Q359. An AI agent proposes disabling an interface, but deterministic validation shows that the interface belongs to the only path to a remote site. What should happen?

1. Disable the interface because the AI selected it
   2. Ignore the topology data
   3. Block the action because the deterministic dependency check identifies unacceptable impact
   4. Remove the validation rule

Correct Answer: 3. Block the action because the deterministic dependency check identifies unacceptable impact

Explanation: Infrastructure safety decisions should be enforced by deterministic controls capable of evaluating known dependencies and policy. If the target interface is the only path to a remote site, shutting it would cause an outage regardless of the AI’s reasoning. The system should reject the operation or require a redesigned change that preserves connectivity. The agent can use the validation result to revise its recommendation. This illustrates why AI-generated intent and deterministic execution controls should remain separate: the model can assist with diagnosis and planning, while authoritative topology and policy determine whether an action is permitted.

Q360. A company wants to improve an AI network agent over time while ensuring production performance does not silently degrade after model, prompt, or retrieval changes. Which practice is best?

1. Maintain a versioned regression-evaluation suite and run it before promoting changes
   2. Deploy every change immediately and evaluate only after incidents
   3. Remove historical evaluation results
   4. Judge quality solely by whether answers sound confident

Correct Answer: 1. Maintain a versioned regression-evaluation suite and run it before promoting changes

Explanation: AI systems can regress when models, prompts, retrieval indexes, tool descriptions, or surrounding application logic change. A versioned evaluation suite containing representative network tasks with known expected outcomes allows teams to detect these regressions before production promotion. Results can be compared across releases for technical accuracy, unsafe actions, false positives, false negatives, tool selection, and latency. The suite should be supplemented by controlled production monitoring because offline tests cannot cover every condition. Treating AI behavior as something that requires regression testing brings software-engineering discipline to model-powered network automation.