View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q21. An Ansible playbook configures VLAN 200 on a group of Cisco network devices. The playbook is executed a second time after all devices already have the correct VLAN configuration. What behavior is most desirable?

1. Delete and recreate VLAN 200 on every execution
   2. Reload every device before checking its configuration
   3. Make no unnecessary configuration changes because the desired state already exists
   4. Generate a new VLAN ID automatically

Correct Answer: 3. Make no unnecessary configuration changes because the desired state already exists

Explanation: Idempotency is an important characteristic of infrastructure automation. An idempotent Ansible task describes the desired configuration and changes the device only when its current state differs from that desired state. Running the same playbook repeatedly should therefore produce the same final configuration without unnecessary changes. This improves predictability and reduces the possibility of outages caused by repeated commands. Recreating an already correct VLAN or reloading devices needlessly would introduce unnecessary operational risk. Network automation systems should ideally converge infrastructure toward a declared state rather than blindly issuing configuration commands every time they execute.

Q22. What is the primary purpose of the Terraform state file in an infrastructure automation workflow?

1. It maps Terraform-managed resources to the real infrastructure and records known resource state
   2. It stores only administrator passwords
   3. It replaces all Terraform configuration files
   4. It functions as a network packet capture

Correct Answer: 1. It maps Terraform-managed resources to the real infrastructure and records known resource state

Explanation: Terraform state maintains information about resources Terraform manages and associates declarations in the configuration with real infrastructure objects. Terraform uses this information when calculating changes required to reach the desired configuration. Because state can contain sensitive resource attributes, it should be protected with strong access controls and, where appropriate, encrypted remote-state storage and locking. The state file does not replace the declarative configuration itself. It is also not intended as a password vault or network capture. Reliable state management is especially important when multiple engineers or CI/CD jobs operate against the same infrastructure.

Q23. A developer uses RESTCONF to update only one leaf in an existing YANG-modeled interface configuration and does not want to replace the complete resource. Which HTTP method is best suited to a partial modification?

1. GET
   2. DELETE
   3. HEAD
   4. PATCH

Correct Answer: 4. PATCH

Explanation: HTTP PATCH is designed for partial modification of an existing resource. In a RESTCONF workflow, it can be appropriate when an automation client needs to change selected configuration data without replacing the entire representation. GET retrieves data, DELETE removes a target resource, and HEAD retrieves response metadata without returning the normal response body. The exact payload format and operation must still comply with the device’s RESTCONF implementation and YANG data model. Understanding how HTTP methods map to configuration operations is important when constructing model-driven network automation workflows using RESTCONF.

Q24. A small operations team needs to automate a simple approval workflow, but the intended users have very limited programming experience. Which automation approach should the architect consider first?

1. Build a large custom application in a low-level programming language
   2. Evaluate a low-code or no-code automation platform
   3. Require every operator to become a Python developer before using automation
   4. Avoid automation entirely

Correct Answer: 2. Evaluate a low-code or no-code automation platform

Explanation: Low-code and no-code automation can be appropriate when workflows are relatively well defined and users need to build or operate automation without extensive software-development skills. These platforms can reduce implementation time and provide graphical workflow construction, reusable connectors, and controlled user experiences. A custom application may offer more flexibility when requirements are complex, but it introduces development and maintenance costs. The automation architecture should be selected according to technical requirements, business needs, team skills, scalability, extensibility, and lifecycle requirements rather than assuming custom code is always the best solution.

Q25. A Python application repeatedly calls an API that uses bearer tokens. The access token remains valid for 60 minutes. Which design is most efficient?

1. Securely reuse the valid token until refresh or reauthentication is required
   2. Perform the complete authentication workflow before every API request
   3. Hard-code the user’s permanent password into the script
   4. Disable API authentication after the first successful call

Correct Answer: 1. Securely reuse the valid token until refresh or reauthentication is required

Explanation: Persistent authentication reduces unnecessary authentication requests by reusing a valid access token according to the API’s supported authentication model. The application should protect the token, monitor its expiration, and refresh or reacquire it through the documented workflow when necessary. Repeating a complex authentication exchange before every API call wastes resources and may create unnecessary load or trigger authentication rate limits. Hard-coding permanent credentials is unsafe and complicates rotation. Authentication should never simply be disabled. Reliable API automation requires careful management of access-token lifetime, refresh behavior, secure storage, and error handling.

Q26. A developer needs one specific commit from another Git branch but does not want to merge all changes from that branch. Which command is most appropriate?

1. git init
   2. git clean
   3. git cherry-pick
   4. git clone –mirror

Correct Answer: 3. git cherry-pick

Explanation: git cherry-pick applies the changes introduced by a selected commit onto the current branch and creates a corresponding commit there. It is useful when one particular fix or change should be incorporated without merging the complete branch history. Conflicts can still occur and must be resolved if the selected change overlaps with modifications already present on the destination branch. A full branch merge would bring additional commits that are not required. Advanced Git operations such as cherry-pick, merge, reset, checkout, and revert are important in network automation projects because infrastructure code should follow disciplined version-control practices.

Q27. What is the primary effect of using a squash merge when combining a feature branch into a main branch?

1. It permanently deletes the Git repository
   2. It combines the feature branch’s changes into a smaller consolidated commit history
   3. It prevents future commits to the main branch
   4. It converts Git files into Terraform state

Correct Answer: 2. It combines the feature branch’s changes into a smaller consolidated commit history

Explanation: Squashing combines multiple commits from a feature branch into a smaller number of commits, commonly a single commit, when merging into another branch. This can create a cleaner main-branch history by preventing temporary development commits such as minor fixes or intermediate work from cluttering the permanent project history. The underlying code changes are retained. Teams should choose a merge strategy according to collaboration and audit requirements because sometimes preserving individual commits is valuable. A squash merge does not delete the repository, prevent future development, or interact with Terraform state.

Q28. A GitLab CI/CD pipeline is designed for safe deployment of network automation changes. Which stage ordering best follows Cisco’s current AUTOCOR blueprint?

1. Deploy → build → post-validation → prevalidation
   2. Post-validation → deploy → build → prevalidation
   3. Build → deploy → prevalidation → post-validation
   4. Build → prevalidation → deploy → post-validation

Correct Answer: 4. Build → prevalidation → deploy → post-validation

Explanation: A logical network automation pipeline first builds or prepares the automation artifact, then performs prevalidation to verify assumptions and assess the environment before changes occur. Deployment applies the intended change, and post-validation confirms that the resulting network state meets expectations. This sequence reduces the risk that invalid automation or an unsuitable target environment is modified prematurely. If post-validation fails, the workflow can stop, alert an operator, or invoke rollback logic. Cisco’s current AUTOCOR blueprint explicitly identifies build, prevalidation, deploy, and post-validation stages for GitLab CE CI/CD network automation pipelines.

Q29. Why would a network automation team use Cisco Modeling Labs before deploying a major automated routing change to production?

1. To replace all production routers permanently
   2. To provide employee email services
   3. To test the automation against a simulated network topology before production deployment
   4. To store Terraform passwords

Correct Answer: 3. To test the automation against a simulated network topology before production deployment

Explanation: Cisco Modeling Labs provides a controlled environment for building and operating simulated Cisco network topologies. Automation teams can use CML to test configuration logic, API workflows, routing behavior, validation checks, and failure handling before applying changes to production. This lowers operational risk and makes it easier to reproduce problems without affecting real users. A simulation does not remove the need for production validation because the real environment can contain different software, scale, and dependencies. Cisco’s current AUTOCOR blueprint specifically includes constructing a CML simulation to test network automation solutions.

Q30. In a Docker Compose file, what is the primary purpose of defining a named volume for a service?

1. To define Git merge behavior
   2. To provide persistent or shared storage independently of the container’s writable layer
   3. To assign an OAuth scope
   4. To define an OSPF neighbor

Correct Answer: 2. To provide persistent or shared storage independently of the container’s writable layer

Explanation: Docker volumes provide storage whose lifecycle can be separate from an individual container. If a container is recreated, data stored only in the container’s writable layer may disappear, while data in a named volume can persist. Compose files can define services, networks, volumes, and related application relationships, allowing multi-container environments to be described declaratively. This is useful when automation services need persistent state, configuration, databases, or shared files. Volumes have no relationship to Git merge policy, OAuth authorization scopes, or network routing protocol neighbor formation.

Q31. What is the primary purpose of integrating a source of truth into a network automation solution?

1. Provide an authoritative record of intended network data used by automation workflows
   2. Replace all validation and error handling
   3. Store only application logs
   4. Generate random network configuration values

Correct Answer: 1. Provide an authoritative record of intended network data used by automation workflows

Explanation: A source of truth maintains authoritative information such as devices, interfaces, addresses, sites, roles, VLANs, relationships, or intended configuration attributes. Automation should consume trusted data rather than depend on manually duplicated spreadsheets or hard-coded assumptions. This improves consistency and enables workflows to compare actual network state with desired state. The source of truth must itself be governed carefully because inaccurate authoritative data can propagate errors at scale. It does not eliminate validation; automation should still verify input and actual network conditions. Cisco includes source-of-truth integration in the current AUTOCOR Infrastructure as Code domain.

Q32. What is a major advantage of model-driven telemetry compared with repeatedly polling every network device for the same operational values?

1. It requires administrators to manually collect every metric
   2. It disables structured data models
   3. It works only when no network connection exists
   4. Devices can stream subscribed data efficiently as state changes or at configured intervals

Correct Answer: 4. Devices can stream subscribed data efficiently as state changes or at configured intervals

Explanation: Model-driven telemetry enables network devices to stream structured operational data to collectors according to subscriptions. Data can be sent periodically or based on changes, depending on platform and subscription capabilities. This can provide more timely visibility and reduce the repeated request overhead associated with traditional polling. Automation architects must still plan collectors, subscriptions, storage, retention, normalization, scale, and security. Streaming large amounts of telemetry without an appropriate consumption architecture can overwhelm downstream systems. Cisco’s AUTOCOR Operations domain explicitly includes the architectural components of model-driven telemetry.

Q33. An automation service must immediately notify an external application whenever a network change workflow fails. Which logging or notification destination is particularly suitable for event-driven delivery?

1. Local text file only
   2. Webhook
   3. Printed report
   4. Device startup configuration

Correct Answer: 2. Webhook

Explanation: A webhook allows one system to send an HTTP request to another system when an event occurs. In an automation workflow, a failure can trigger a webhook that immediately informs an incident platform, collaboration system, or orchestration service. This supports event-driven integration without requiring the receiving application to continuously poll for changes. Syslog is also valuable for centralized logging, while webhooks are especially useful when another application should act on an event programmatically. Webhook endpoints should authenticate requests, validate payloads, and protect against replay or malicious input.

Q34. A network team captures device state before an automated configuration change and again afterward. Which tool is specifically included in AUTOCOR for implementing this type of change validation?

1. Microsoft Word
   2. FTP
   3. Telnet
   4. pyATS CLI tools

Correct Answer: 4. pyATS CLI tools

Explanation: pyATS provides testing and validation capabilities for network automation. A workflow can collect operational state before a change, execute the automation, gather post-change data, and compare expected outcomes. Validation can check interfaces, routing relationships, reachability, device configuration, or other operational state. This transforms automation from simply “push a change” into “apply and verify a change.” Automated post-validation is important because a successfully executed API or configuration command does not necessarily mean the business objective was achieved. Cisco’s current AUTOCOR Operations domain explicitly identifies pyATS CLI tools for change validation.

Q35. What is the correct high-level process when replacing a self-signed TLS certificate on an automation service with a CA-signed certificate?

1. Disable TLS permanently
   2. Publish the private key publicly
   3. Generate a key and CSR, have the CA sign the request, then deploy the signed certificate and required chain
   4. Rename the self-signed certificate without involving a CA

Correct Answer: 3. Generate a key and CSR, have the CA sign the request, then deploy the signed certificate and required chain

Explanation: A typical CA-signed certificate workflow begins by creating or securely using a private key and generating a certificate signing request containing the appropriate identity information. A trusted certificate authority validates and signs the request. The resulting certificate, along with necessary intermediate or root chain information, is then installed on the application or service. The private key must remain protected and should never be distributed publicly. Clients can trust the resulting TLS connection when the certificate chain and service identity are valid. AUTOCOR includes obtaining and deploying CA-signed TLS certificates as an Operations objective.

Q36. A Python network automation script requires an API password. Which approach best follows secure coding practices?

1. Retrieve the secret from an approved secret-management system at runtime
   2. Hard-code the password directly in the Git repository
   3. Print the password in every debug log
   4. Share one permanent password across all automation applications

Correct Answer: 1. Retrieve the secret from an approved secret-management system at runtime

Explanation: Sensitive credentials should be stored separately from application source code and retrieved through a secure secret-management mechanism using an appropriately authenticated workload identity. This supports access control, rotation, auditing, and reduced exposure if the source repository is copied or made public. Hard-coded secrets can remain in Git history even after a developer deletes them from the latest file. Debug logs are also inappropriate places for credentials. Secure coding for network automation includes input validation, strong authentication, and secret-management practices, all of which are included in the current AUTOCOR Operations blueprint.

Q37. A network engineer uses generative AI to create an Ansible playbook. What is the most important action before the AI-generated playbook is allowed to modify production devices?

1. Assume the generated configuration is correct because the model is advanced
   2. Disable version control
   3. Give the AI unrestricted production credentials
   4. Validate, test, and review the generated automation against requirements and authoritative documentation

Correct Answer: 4. Validate, test, and review the generated automation against requirements and authoritative documentation

Explanation: Generative AI can accelerate network automation development, but generated code can contain incorrect modules, unsupported parameters, unsafe assumptions, or fabricated syntax. AI output should therefore be reviewed and tested like code produced by any other untrusted source. Simulation, linting, unit tests, prevalidation, policy controls, and human review can reduce risk before production deployment. Organizations must also consider whether sensitive network data submitted to an AI service creates privacy or intellectual-property concerns. Cisco’s current AUTOCOR blueprint explicitly includes both benefits and risks of AI-assisted network automation development.

Q38. What is the primary purpose of an MCP server in an AI-based network automation architecture?

1. Replace all network routing protocols
   2. Provide structured tools or network information that an AI agent can access through a standardized interface
   3. Convert routers into Docker containers
   4. Disable authentication between the AI and infrastructure

Correct Answer: 2. Provide structured tools or network information that an AI agent can access through a standardized interface

Explanation: Model Context Protocol, or MCP, provides a standardized way for AI agents to interact with external information sources and tools. In a network automation scenario, an MCP server can expose controlled functions for retrieving network information or invoking approved operations. Security remains essential: the MCP server should authenticate requests, validate inputs, constrain permissions, and avoid giving the AI unrestricted infrastructure access. Cisco’s AUTOCOR v2.0 blueprint specifically requires candidates to construct an MCP server using Python FastMCP to provide network information to an AI agent.

Q39. An AI assistant recommends changing an OSPF configuration. What should an automation system do before accepting the recommendation?

1. Validate the recommendation against the network’s authoritative state, requirements, and expected outcome
   2. Apply every AI suggestion immediately
   3. Disable post-change validation
   4. Remove the existing configuration backup

Correct Answer: 1. Validate the recommendation against the network’s authoritative state, requirements, and expected outcome

Explanation: AI recommendations are probabilistic and can be incorrect even when they sound plausible. Before an AI-generated networking recommendation affects infrastructure, the automation system should compare it with authoritative network data, technical requirements, platform support, routing design, and policy constraints. Testing and simulation can further determine whether the change produces the expected result. High-impact actions may require human approval. Applying AI recommendations blindly creates operational and security risk. Cisco’s AUTOCOR AI domain specifically includes evaluating the accuracy of AI recommendations for network automation solutions.

Q40. A company is building a conversational AI agent that can answer network questions and initiate approved automation workflows. Which design is most appropriate?

1. Give the LLM direct unauthenticated administrator access to every device
   2. Treat all user prompts as trusted configuration instructions
   3. Combine the LLM with controlled network tools, strong authorization, input validation, and verification of actions
   4. Disable logging of AI-initiated operations

Correct Answer: 3. Combine the LLM with controlled network tools, strong authorization, input validation, and verification of actions

Explanation: A conversational network automation agent should separate natural-language reasoning from the actual infrastructure security boundary. The LLM can interpret intent and propose actions, while controlled tools or MCP functions enforce which operations are available. Authentication, authorization, input validation, audit logging, execution limits, and verification should apply to every network-changing operation. Sensitive or destructive tasks can require human approval. User prompts and retrieved content should be treated as untrusted input. Cisco’s current AUTOCOR blueprint includes constructing a conversational agent that uses LLMs for network automation, making safe tool integration an important architectural consideration.