View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q361. An Ansible playbook must generate router configurations from a text file containing placeholders, loops, and conditional sections. Which mechanism is most appropriate?

1. Static inventory
   2. Jinja2 template
   3. Ansible Vault only
   4. Git tag

Correct Answer: 2. Jinja2 template

Explanation: Ansible commonly uses Jinja2 templates to generate configuration files dynamically from variables and structured data. Templates can contain placeholders, loops, filters, and conditional logic, making them useful for building interface, routing, ACL, or system configurations from reusable definitions. A single template can therefore serve many devices while variables provide device-specific values. Ansible Vault protects sensitive values but does not provide configuration rendering by itself. Static inventory identifies managed hosts, while Git tags identify repository revisions. Template-driven configuration reduces duplicated text and helps standardize generated network configurations across large environments.

Q362. A Terraform variable called vlan_id must accept only values from 1 through 4094. Which Terraform capability should be used to reject invalid values before deployment?

1. Output sensitivity
   2. State locking
   3. Provider aliasing
   4. Variable validation condition

Correct Answer: 4. Variable validation condition

Explanation: Terraform variables can include validation rules that evaluate supplied values and return a descriptive error when the input violates defined requirements. A vlan_id variable can therefore enforce an acceptable numeric range before resources are planned or applied. Early validation prevents bad input from flowing further into Infrastructure as Code and reduces the chance of producing invalid network configuration. Provider aliases configure different provider instances, state locking protects concurrent state operations, and sensitive output handling controls display of secret values. Input validation is especially useful when reusable modules are consumed by many teams or environments.

Q363. A RESTCONF client requires only two leaves from a large YANG-modeled resource and the server supports field selection. Which approach minimizes unnecessary returned data?

1. Use the supported fields query to request only the required modeled elements
   2. Download the complete datastore every time
   3. Send HTTP DELETE before the query
   4. Convert the resource into CLI text

Correct Answer: 1. Use the supported fields query to request only the required modeled elements

Explanation: When a RESTCONF implementation supports field selection, the client can request only the modeled elements needed by the workflow. This reduces response size, bandwidth, parsing overhead, and device processing compared with retrieving a large subtree unnecessarily. The client should still target the narrowest practical URI and verify the platform’s RESTCONF capabilities. Model-driven automation works best when applications use YANG structure precisely rather than repeatedly downloading complete configuration trees. HTTP DELETE changes configuration and should never be used simply to optimize data retrieval. Efficient data selection becomes increasingly important as automation scales across many devices.

Q364. A Python automation script has separate lists containing device names and management IP addresses in corresponding order. Which built-in function can iterate over matching pairs from both lists?

1. enumerate
   2. sorted
   3. zip
   4. repr

Correct Answer: 3. zip

Explanation: Python’s zip() function combines elements from multiple iterables according to their positions. If one list contains device names and another contains corresponding management addresses, zip(names, addresses) allows the script to iterate through each matching pair cleanly. This is more readable than manually maintaining indexes. Engineers should verify that input collections have the expected lengths because normal zip() stops when the shortest iterable is exhausted. enumerate() supplies indexes, sorted() orders values, and repr() returns a representation of an object. Appropriate built-ins help keep network automation code concise and maintainable.

Q365. A backend network automation service must obtain an access token directly from an authorization server without involving a human user. Which OAuth workflow is most appropriate for this machine-to-machine use case?

1. Authorization code flow requiring interactive user consent
   2. Client credentials grant
   3. Password sharing between all applications
   4. Anonymous API access

Correct Answer: 2. Client credentials grant

Explanation: The OAuth client credentials grant is designed for machine-to-machine scenarios where an application authenticates as itself rather than acting on behalf of an interactive user. The client presents its own credential to the authorization server and receives an access token carrying appropriate scopes. This works well for backend automation services, provided the client secret or private credential is protected securely. The token should receive only least-privilege permissions and should be rotated or reacquired according to policy. Authorization code flow is more appropriate when user authorization is required. Anonymous access removes an important security boundary.

Q366. An engineer wants to inspect the exact files and commit message introduced by a specific Git commit without changing the current branch. Which Git command is most appropriate?

1. git show <commit>
   2. git reset –hard
   3. git clean -fd
   4. git init

Correct Answer: 1. git show <commit>

Explanation: git show displays information about a specific Git object, and when used with a commit it normally shows commit metadata together with the patch introduced by that commit. This makes it useful for reviewing exactly what changed in a network automation repository without modifying the current branch or working tree. git reset –hard alters branch and working-tree state and can discard work. git clean removes untracked files, while git init initializes a repository. Being able to inspect individual changes is important when auditing Infrastructure as Code and diagnosing which modification affected production behavior.

Q367. A GitLab CI/CD variable contains a token. The token must be available to a job but should be obscured if it accidentally appears in job output. Which variable protection should the team enable where supported?

1. Convert it into a repository tag
   2. Put it into README.md
   3. Commit it as Base64 text
   4. Mask the CI/CD variable

Correct Answer: 4. Mask the CI/CD variable

Explanation: Masked CI/CD variables are designed to reduce accidental exposure of sensitive values in pipeline logs by replacing recognized occurrences with protected output. Masking should be combined with protected-variable restrictions when the secret must also be limited to trusted branches or environments. It is not a substitute for an external secret-management system or proper credential rotation. Encoding a credential with Base64 does not protect it because encoding is easily reversible. Committing a token into Git is particularly dangerous because it can remain recoverable from repository history even after deletion from the current version.

Q368. A CML-based test must verify that an automation workflow behaves correctly when one routing device becomes unreachable halfway through execution. What should the test primarily evaluate?

1. Whether every topology icon has the same color
   2. Whether the automation handles partial failure without corrupting unaffected devices
   3. Whether Git contains a README file
   4. Whether all devices can be configured without authentication

Correct Answer: 2. Whether the automation handles partial failure without corrupting unaffected devices

Explanation: Real automation workflows must handle partial failures safely. If one router becomes unreachable while a multi-device change is underway, the workflow should identify the failure, preserve accurate results for successfully processed devices, avoid applying unsafe follow-up actions, and trigger appropriate recovery or notification. CML provides a controlled environment for deliberately introducing such failures without impacting users. This type of test evaluates resilience rather than only the happy path. Robust network automation should define transaction boundaries, rollback behavior, retries, failure reporting, and how later devices are treated when part of a deployment fails.

Q369. A telemetry analytics platform receives interface utilization as percentages from one source and raw byte counters from another. What should happen before the measurements are compared directly?

1. Normalize or derive the values into comparable metrics
   2. Add the raw values together immediately
   3. Remove all timestamps
   4. Convert both measurements to arbitrary text

Correct Answer: 1. Normalize or derive the values into comparable metrics

Explanation: Measurements with different semantics cannot be compared meaningfully until they are normalized into compatible representations. A raw byte counter represents a cumulative quantity, while utilization percentage represents a rate relative to interface capacity. The telemetry pipeline may need to calculate deltas over time, convert units, derive bit rates, and incorporate interface speed before making a valid comparison. Preserving metadata such as timestamps and units is therefore critical. Collecting structured telemetry solves many parsing problems, but downstream analytics still require careful normalization so mathematically valid computations also represent operationally meaningful comparisons.

Q370. A network automation application’s logs contain timestamps but do not specify the timezone. What improvement most helps distributed troubleshooting?

1. Remove all timestamps
   2. Use random local times on each server
   3. Log timestamps in a consistent timezone such as UTC with explicit timezone information
   4. Replace timestamps with Git commit IDs

Correct Answer: 3. Log timestamps in a consistent timezone such as UTC with explicit timezone information

Explanation: Distributed automation may run across controllers, CI workers, telemetry systems, and network devices located in different regions. Using a consistent time standard such as UTC with explicit timezone information makes it much easier to correlate events accurately. Merely recording a local clock value without its timezone creates ambiguity, particularly during daylight-saving transitions or multi-region investigations. Time synchronization must also be reliable so timestamps reflect actual event ordering. Structured logs should combine accurate time with identifiers such as workflow ID, device, operation, and application version to support efficient end-to-end troubleshooting.

Q371. A pyATS validation suite includes temporary test configuration that must always be removed after testing, even if one of the test cases fails. Which test structure should contain this cleanup logic?

1. An unconditional setup-only section
   2. A common cleanup section
   3. The Git commit message
   4. The CML node definition only

Correct Answer: 2. A common cleanup section

Explanation: Cleanup sections are intended to restore or release resources after testing, including when validation sections fail. A pyATS common cleanup phase can remove temporary configuration, disconnect sessions, collect final diagnostics, or perform other teardown actions required to leave the environment in a known state. Setup performs preparation before testing and is not the appropriate place for final resource release. Reliable cleanup matters in CI/CD because abandoned configuration or sessions can interfere with later pipeline runs and make tests non-repeatable. Test lifecycle design should explicitly consider preparation, validation, error handling, and cleanup.

Q372. A Docker image is referenced by a mutable tag such as latest. The deployment team needs to guarantee it runs the exact image that passed validation. What should it use instead?

1. An image digest identifying the immutable image content
   2. A randomly selected tag
   3. The container hostname
   4. A Git stash identifier only

Correct Answer: 4. An image digest identifying the immutable image content

Explanation: A container image digest identifies specific image content cryptographically and does not change when a mutable tag is later moved to another image. Deploying by digest therefore helps ensure that production uses exactly the image that was scanned and tested. Tags remain useful as human-friendly labels, but tags such as latest can point to different image contents over time. Strong supply-chain workflows can associate the source commit, build artifact, image digest, scan results, and deployment record. This improves reproducibility and prevents accidental substitution of a newly tagged but unvalidated image.

Q373. A TLS certificate is intended exclusively for authenticating an HTTPS automation server. Which certificate extension can indicate that the certificate is appropriate for server authentication?

1. Git object type
   2. Terraform lifecycle block
   3. Extended Key Usage containing server authentication
   4. Syslog severity

Correct Answer: 3. Extended Key Usage containing server authentication

Explanation: The Extended Key Usage extension can constrain the purposes for which a certificate should be used. A TLS server certificate commonly includes server authentication usage, while client certificates may include client authentication depending on the PKI design. Certificate validation can therefore consider not only the trust chain and hostname but also whether the certificate is authorized for the intended cryptographic purpose. PKI design should additionally address SAN identities, key protection, expiration, renewal, and revocation. A certificate that chains to a trusted CA is not automatically appropriate for every possible authentication purpose.

Q374. An API returns pagination information through standard HTTP Link headers containing a relationship of next. What should a well-designed client do?

1. Parse the next-link information and follow it until no next relation remains
   2. Ignore pagination and process only page one
   3. Guess page URLs independently of the server
   4. Resubmit the first page repeatedly

Correct Answer: 1. Parse the next-link information and follow it until no next relation remains

Explanation: Some REST APIs expose pagination using HTTP Link headers rather than placing continuation information in the response body. A robust client should follow the API’s documented next relation instead of assuming a particular page-number format. This makes the application more resilient to implementation details and ensures that all requested objects are processed. The workflow should detect loops, enforce reasonable result limits, and handle errors on later pages. Pagination is especially important in network automation because inventories and event datasets can easily contain thousands of objects that should not be returned in one response.

Q375. A Python application must process two device lists in parallel and should raise an error if the lists unexpectedly have different lengths. Which modern zip() behavior can help detect this issue?

1. Convert both lists to strings first
   2. Use strict zip-length checking where supported
   3. Ignore extra values silently by design
   4. Delete the larger list

Correct Answer: 2. Use strict zip-length checking where supported

Explanation: Standard zip() traditionally stops when the shortest iterable is exhausted, which can silently hide mismatched input lengths. Modern Python supports strict zip checking, which raises an error when the iterables do not have equal lengths. This is useful when corresponding collections must contain exactly matching records, such as device names and management addresses. Detecting the inconsistency early is safer than silently ignoring data from the longer collection. More generally, automation should validate assumptions about input structure rather than relying on behavior that can conceal incomplete or inconsistent inventory data.

Q376. An AI coding assistant generates a JSON object describing a proposed network change. Before the object is passed to deterministic automation, what should happen?

1. Execute it immediately because it is valid JSON
   2. Treat all model-generated fields as trusted
   3. Validate the output against an approved schema and policy constraints
   4. Remove all required fields

Correct Answer: 3. Validate the output against an approved schema and policy constraints

Explanation: Structured AI output is still untrusted input. A JSON object may parse successfully while containing unsupported operations, incorrect device identifiers, unexpected fields, or unsafe values. The automation layer should validate both structure and semantics using a predefined schema and deterministic policy checks before execution. This separates probabilistic generation from infrastructure control. The system can reject invalid output or ask the model to produce a corrected proposal. Schema-constrained interfaces improve reliability, but authorization, target validation, business policy, and change-impact checks remain necessary for production network actions.

Q377. A vector-search system returns document chunks based on closeness between the query embedding and stored document embeddings. What is this process primarily measuring?

1. Semantic similarity in the embedding space
   2. Git commit age
   3. Router CPU utilization
   4. TLS key length

Correct Answer: 2. Semantic similarity in the embedding space

Explanation: Embeddings map text or other data into numerical vectors designed so semantically related content tends to be closer in the resulting vector space. Retrieval systems compare the query vector with stored document vectors using an appropriate similarity or distance measure and return relevant candidates. This enables retrieval based on meaning rather than exact keyword matches alone. Vector similarity does not determine whether a source is authoritative, current, or authorized for the user. Network AI systems should therefore combine semantic retrieval with metadata filtering, provenance, freshness controls, and access enforcement before supplying context to the model.

Q378. An MCP-enabled AI agent requests the same expensive diagnostic tool repeatedly even though the first call already returned the needed answer. Which improvement is most appropriate?

1. Increase tool permissions
   2. Remove all tool descriptions
   3. Allow unlimited duplicate calls
   4. Add orchestration logic that reuses valid results and limits redundant tool invocations

Correct Answer: 4. Add orchestration logic that reuses valid results and limits redundant tool invocations

Explanation: AI agents may make unnecessary repeated tool calls because language-model reasoning is probabilistic. The surrounding orchestration layer can cache suitable recent results, detect duplicate requests, enforce invocation limits, and expose clear tool descriptions to reduce unnecessary infrastructure load. Caching must consider freshness because operational network state can change quickly. Expensive or high-volume tools should also have quotas and timeouts. The correct architecture does not rely solely on the model to optimize resource consumption; deterministic controls should manage tool efficiency, cost, and capacity while still allowing fresh queries when operational requirements justify them.

Q379. A new AI network assistant release performs correctly in testing, but the organization wants to limit operational impact during the first production rollout. Which deployment strategy is most appropriate?

1. Deploy immediately to all users and devices
   2. Disable production monitoring
   3. Use a limited canary rollout and expand only after observing acceptable behavior
   4. Remove rollback capability

Correct Answer: 3. Use a limited canary rollout and expand only after observing acceptable behavior

Explanation: A canary rollout exposes a new system version to a limited portion of production traffic or users before broad deployment. This allows the team to observe real-world accuracy, tool behavior, latency, error rates, and operational side effects while limiting the blast radius of unexpected regressions. If performance is acceptable, deployment can expand gradually; if not, the release can be rolled back. AI systems benefit from staged rollout because offline evaluation cannot perfectly reproduce every production prompt, retrieval result, or tool interaction. Monitoring and rollback should therefore remain part of the release process.

Q380. An AI troubleshooting assistant was accurate when deployed, but months later network architecture and operating procedures have changed substantially. Its recommendations are becoming less reliable. What should the team do?

1. Continue using the original evaluation results forever
   2. Reevaluate the assistant against current representative scenarios and update its models, prompts, retrieval data, or tools as needed
   3. Disable all current network documentation
   4. Increase confidence thresholds without testing

Correct Answer: 2. Reevaluate the assistant against current representative scenarios and update its models, prompts, retrieval data, or tools as needed

Explanation: AI performance can degrade as the environment it operates in changes. Network redesigns, new platforms, modified procedures, updated documentation, and different operational patterns can make an originally successful evaluation set less representative. The organization should run ongoing evaluations using current scenarios and investigate regressions in model behavior, prompts, retrieval content, or tool integrations. This is analogous to monitoring drift in other automated systems. Historical accuracy is useful evidence but does not guarantee future reliability. Continuous evaluation helps ensure that AI-assisted automation remains aligned with the current production network and operational requirements.