View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q381. An Ansible playbook needs to create temporary host groups dynamically based on a device attribute discovered during execution. Which Ansible capability is most appropriate?

1. group_by
   2. notify
   3. block
   4. serial

Correct Answer: 1. group_by

Explanation: The Ansible group_by module can create dynamic inventory groups during playbook execution based on discovered facts or variables. For example, routers can be grouped according to software version, platform family, device role, or operational state and then targeted by later plays. This is useful when the required grouping is not known before execution. notify triggers handlers, block groups tasks for common handling, and serial controls batch size. Dynamic grouping can make large automation workflows more adaptable while still allowing later tasks to apply the correct configuration or validation logic to appropriate device categories.

Q382. A Terraform module receives an optional object whose attribute might not exist. The configuration should safely use a fallback value instead of failing evaluation. Which Terraform function is most suitable?

1. file()
   2. try()
   3. timestamp()
   4. toset()

Correct Answer: 2. try()

Explanation: Terraform’s try() function evaluates expressions in order and returns the first one that does not produce an error. It is useful when a module accepts optional or variable-shaped input and needs a safe fallback if a particular attribute is unavailable. For example, try(var.device.description, “Managed by Terraform”) can use a default description when the optional attribute is missing. file() reads file content, timestamp() returns the current timestamp, and toset() converts a collection to a set. Fallback expressions should still be designed carefully so genuine configuration mistakes are not unintentionally hidden.

Q383. A RESTCONF client needs to retrieve a resource and its immediate children but should avoid receiving deeply nested descendant data. Which RESTCONF capability should the engineer investigate?

1. HTTP CONNECT
   2. Git sparse checkout
   3. Supported depth query behavior
   4. Terraform lifecycle rules

Correct Answer: 3. Supported depth query behavior

Explanation: RESTCONF defines query capabilities that can control the scope of returned modeled data. Where supported, the depth parameter can limit how deeply descendant nodes are included in the response. This can reduce response size when an automation workflow needs a parent resource and only a limited amount of nested data. Engineers should verify the target device’s implementation and use precise resource paths as well. Excessively broad queries can waste bandwidth and processing resources when scaled across many devices. Git and Terraform features do not control RESTCONF response depth, while HTTP CONNECT serves a completely different purpose.

Q384. A Python automation script counts how many interfaces belong to each operational state. The engineer wants missing dictionary keys to start automatically at zero. Which data structure is especially convenient?

1. bytes
   2. tuple
   3. frozenset
   4. collections.defaultdict

Correct Answer: 4. collections.defaultdict

Explanation: A defaultdict can automatically create a default value when code accesses a missing key. For counting interface states, a defaultdict(int) initializes missing counters to zero, allowing code to increment values directly without checking whether each key already exists. This can make aggregation logic shorter and clearer. A normal dictionary can accomplish the same task with methods such as get(), and collections.Counter is also useful for counting scenarios. Choosing the appropriate Python structure simplifies automation code and reduces unnecessary conditional logic when processing large device inventories or telemetry datasets.

Q385. A network API returns HTTP 409 Conflict when automation attempts to create a resource. What should the client investigate first?

1. Whether the requested operation conflicts with the current resource state or an existing object
   2. Whether the TLS certificate has exactly six months remaining
   3. Whether the response should be converted to XML
   4. Whether the Git repository has untracked files

Correct Answer: 1. Whether the requested operation conflicts with the current resource state or an existing object

Explanation: HTTP 409 indicates that the server cannot complete the request because it conflicts with the current state of the target resource or system. For example, automation may be attempting to create an object whose identifier already exists, or a state transition may be incompatible with the resource’s current condition. The client should inspect the API’s error details and determine whether it should retrieve current state, choose a different identifier, or alter the requested operation. A 409 is not primarily a TLS or source-control issue, and blindly retrying the identical request may simply reproduce the same conflict.

Q386. An engineer needs to determine which commit and author last changed each line of a network automation file. Which Git command is most appropriate?

1. git stash
   2. git blame
   3. git clean
   4. git init

Correct Answer: 2. git blame

Explanation: git blame annotates lines in a file with information about the commit and author responsible for the most recent change to each line. It can help engineers investigate why a network automation statement was introduced, identify the relevant commit for further review, or find contextual history surrounding a configuration rule. It should be used as a diagnostic tool rather than as a substitute for collaborative review. git stash stores temporary local changes, git clean removes untracked files, and git init initializes a repository. Version history is especially valuable when Infrastructure as Code directly controls production behavior.

Q387. A GitLab pipeline includes a noncritical documentation job that should be reported if it fails but must not prevent network validation and deployment jobs from continuing. Which job behavior is most appropriate?

1. Delete the job entirely
   2. Make every later job ignore all failures
   3. Configure that specific job as allowed to fail
   4. Convert it into a production deployment job

Correct Answer: 3. Configure that specific job as allowed to fail

Explanation: CI/CD systems can distinguish between required jobs and nonblocking informational jobs. Marking a specific noncritical job as allowed to fail lets the pipeline report the failure while continuing required stages. This should be used selectively; security checks, syntax validation, prevalidation, deployment gates, and post-validation should remain blocking when their success is required for safe network changes. Broadly ignoring all failures would undermine the pipeline’s control function. Pipeline design should clearly identify which results are advisory and which results constitute mandatory quality or operational gates.

Q388. A CML integration test modifies device configurations extensively. The team wants every new test run to start from the same known lab state. Which strategy best supports this?

1. Allow previous test changes to accumulate indefinitely
   2. Ask engineers to remember all prior changes
   3. Skip initialization to reduce pipeline time
   4. Recreate or restore the topology from a controlled baseline before each test

Correct Answer: 4. Recreate or restore the topology from a controlled baseline before each test

Explanation: Integration tests are most reliable when they begin from a known state. Recreating the CML topology or restoring an approved baseline removes configuration drift introduced by previous tests and makes failures reproducible. The baseline definition should be version controlled and associated with the automation being tested. Reusing an unknown state can cause one test run to influence another and produce intermittent failures. After initialization, the pipeline can apply the candidate change, run deterministic validation, preserve useful evidence, and clean up. Repeatability is a core requirement for trustworthy automated network testing.

Q389. A model-driven telemetry system should report an analog metric only when the value changes by more than a meaningful threshold, reducing insignificant updates. Which concept best describes this behavior?

1. Deadband filtering
   2. Git rebasing
   3. Terraform import
   4. Certificate pinning

Correct Answer: 1. Deadband filtering

Explanation: Deadband filtering suppresses telemetry updates when changes are smaller than a defined threshold. This can reduce unnecessary traffic and storage for noisy metrics that fluctuate slightly but do not represent meaningful operational changes. For example, an automation platform may care about significant temperature or utilization changes rather than every tiny variation. Thresholds must be selected carefully because an overly large deadband can hide important trends. Telemetry architecture should balance update frequency, fidelity, collector capacity, storage, and operational requirements. Deadband behavior is unrelated to source-control or Infrastructure as Code operations.

Q390. An operations team wants to measure how long a network automation job takes from its initial request through validation, device changes, and final completion. Which observability metric is most appropriate?

1. Number of Git branches
   2. End-to-end workflow latency
   3. Certificate key length
   4. Number of YAML comments

Correct Answer: 2. End-to-end workflow latency

Explanation: End-to-end workflow latency measures the elapsed time from the beginning of an automation request to its final completion. Breaking the measurement into stages can reveal whether delays occur in API calls, approvals, device configuration, telemetry checks, or post-validation. Tracking latency over time also helps detect performance regressions after application or infrastructure changes. A complete operational view should combine latency with success rate, error rate, throughput, and resource utilization. Good observability allows teams to distinguish a correct but slow automation system from one that meets both functional and operational performance requirements.

Q391. A pyATS test should mark a validation section as not applicable on routers that do not support the tested feature. What is the best testing behavior?

1. Mark every unsupported router as failed
   2. Delete the router from inventory permanently
   3. Skip the test for devices where the prerequisite feature is not applicable
   4. Report success without recording that the test was not executed

Correct Answer: 3. Skip the test for devices where the prerequisite feature is not applicable

Explanation: A test should distinguish genuine failure from a condition that does not apply to a particular platform or device role. If a feature is intentionally unsupported or irrelevant, the test can be skipped with an appropriate reason rather than reported as failed or falsely reported as passed. This produces more accurate pipeline results and helps operators understand test coverage. Applicability criteria should come from authoritative device metadata or platform capabilities, not arbitrary assumptions. Good automated validation records whether a test passed, failed, errored, or was skipped and provides enough context to explain that result.

Q392. A Dockerfile installs compilers and package-building tools that are needed only while building the automation application. What is the best method to keep those tools out of the production image?

1. Run the production container in privileged mode
   2. Use a multi-stage Docker build
   3. Publish additional container ports
   4. Store the compiler inside a persistent volume

Correct Answer: 2. Use a multi-stage Docker build

Explanation: A multi-stage Docker build separates build-time dependencies from the final runtime image. Compilation tools and development packages can exist in an earlier stage, while only the resulting application artifacts and required runtime libraries are copied into the final stage. This reduces image size and may reduce attack surface by removing unnecessary software. It also supports cleaner, more reproducible container builds. Production images should still use trusted base images, vulnerability scanning, non-root execution where practical, secure secrets handling, and controlled dependencies. Multi-stage builds solve packaging concerns rather than runtime authorization.

Q393. An automation client wants to detect a potentially revoked TLS certificate without downloading a full certificate revocation list. Which mechanism can provide certificate status dynamically?

1. Git signing
   2. Terraform validation
   3. Docker image digest
   4. OCSP

Correct Answer: 4. OCSP

Explanation: The Online Certificate Status Protocol allows a client or related TLS component to obtain revocation status for a particular certificate from an OCSP responder. This can provide more focused status checking than downloading an entire certificate revocation list. Actual client behavior depends on platform configuration and PKI policy, and some environments also use OCSP stapling to improve privacy and performance. Revocation is important when a certificate or private key is compromised before normal expiration. Certificate lifecycle management therefore includes issuance, trust-chain validation, renewal, revocation, and protection of associated private keys.

Q394. A team uses an external generative AI service to help troubleshoot network logs. Before logs are submitted, what control best reduces accidental disclosure of confidential information?

1. Classify and redact sensitive fields before sending the data to the AI service
   2. Include every password to improve context
   3. Disable organizational data-handling policies
   4. Make all internal logs publicly accessible first

Correct Answer: 1. Classify and redact sensitive fields before sending the data to the AI service

Explanation: Network logs can contain internal addresses, usernames, tokens, customer information, configuration details, or other sensitive data. Before sending data to an external AI service, the application should identify information that is not appropriate for disclosure and redact, tokenize, minimize, or otherwise protect it according to organizational policy. The team should also review provider retention, training, contractual, and access-control terms. Redaction does not eliminate every AI risk, but it helps enforce data-minimization principles and reduces the consequences of unnecessary disclosure while preserving enough operational context for useful troubleshooting.

Q395. An engineer wants an LLM to generate configuration in a specific syntax and provides two correct example input-output pairs in the prompt. Which prompting technique is being used?

1. Unsupervised model training
   2. Few-shot prompting
   3. Certificate enrollment
   4. Terraform state migration

Correct Answer: 2. Few-shot prompting

Explanation: Few-shot prompting provides the model with a small number of examples demonstrating the desired input-output relationship or response format. This can improve consistency when the model must generate structured network configuration, classify operational events, or follow a specialized convention. The examples should be representative and free of confidential information unless the AI environment is approved to process it. Few-shot prompting does not guarantee correctness; generated configuration still requires schema validation, policy checking, testing, and authorization. Prompt design is one component of the broader AI automation architecture rather than an infrastructure safety boundary.

Q396. A retrieval system must answer queries that include exact interface identifiers such as GigabitEthernet0/0/1 as well as conceptual questions about routing design. Which retrieval approach may improve coverage?

1. Use only random document selection
   2. Remove all exact identifiers from the index
   3. Combine keyword-based and semantic retrieval
   4. Use semantic search but disable metadata entirely

Correct Answer: 3. Combine keyword-based and semantic retrieval

Explanation: Semantic vector retrieval is effective for conceptual similarity, while lexical or keyword search can be stronger for exact identifiers, command names, error codes, and interface labels. A hybrid retrieval system combines both approaches and can improve recall across diverse network questions. Results can then be reranked and filtered according to authorization, freshness, and source authority. Hybrid retrieval does not guarantee a correct final answer, but it gives the model better candidate evidence. Network documentation often contains both conceptual prose and highly specific technical strings, making a mixed retrieval strategy valuable.

Q397. An MCP-enabled AI agent can read router state and propose changes, but write tools require a separate approval token generated only after an engineer reviews the plan. What security benefit does this provide?

1. It makes the LLM deterministic
   2. It removes the need for authentication
   3. It allows retrieved documents to bypass policy
   4. It creates a technical approval boundary before privileged execution

Correct Answer: 4. It creates a technical approval boundary before privileged execution

Explanation: Requiring a separate approval token means that conversational reasoning alone cannot authorize a production-changing tool call. The AI can gather data and prepare a plan, but the privileged execution path becomes available only after an authorized review process generates the required capability. This provides a stronger control than simply asking the model to wait for approval in natural language. The backend should verify the token’s scope, target, expiration, and relationship to the approved change. Audit logs should record both the approval and execution so production modifications remain attributable and reviewable.

Q398. An MCP tool returns 50,000 interface records, but the agent normally needs fewer than 20. Which API design best improves efficiency?

1. Always return all records so the model can decide
   2. Support server-side filtering, result limits, and pagination
   3. Disable interface queries
   4. Convert all records into one long unstructured string

Correct Answer: 2. Support server-side filtering, result limits, and pagination

Explanation: Tool interfaces should allow callers to request only the data they need. Server-side filters, pagination, and explicit result limits reduce controller load, network transfer, MCP server memory consumption, and LLM context usage. The server can also enforce maximum limits even when the model requests an excessive result set. Efficient tool design improves both reliability and security because resource consumption is bounded deterministically. The model should not be expected to receive massive datasets and discard most of them afterward. Filtering should also respect authorization so broad queries cannot expose unrelated resources.

Q399. An AI fault detector raises 100 alarms, and 80 of those alarms correspond to real faults. Which evaluation metric describes the proportion of raised alarms that were correct?

1. Recall
   2. Latency
   3. Precision
   4. Availability

Correct Answer: 3. Precision

Explanation: Precision measures the proportion of positive predictions that are actually correct. In this scenario, 80 of 100 alarms represent real faults, giving a precision of 80 percent. Recall asks a different question: what proportion of all real faults the system successfully detected. Both metrics are useful because a system can achieve high recall by raising many alarms while suffering poor precision, or high precision while missing many real conditions. Network AI evaluation should choose metrics according to operational consequences and should not rely only on a single aggregate accuracy number when different error types have different costs.

Q400. An AI-assisted automation change passes all prechecks but produces unexpected production behavior after deployment. Which workflow characteristic is most important for limiting impact?

1. A tested rollback procedure triggered when post-validation fails
   2. Removing previous known-good configurations
   3. Disabling post-change monitoring
   4. Preventing operators from stopping automation

Correct Answer: 1. A tested rollback procedure triggered when post-validation fails

Explanation: Even thoroughly validated changes can behave unexpectedly in production because simulations and prechecks cannot reproduce every dependency. Post-validation should determine whether the actual network reached the expected state. If critical checks fail, the automation should have a tested rollback strategy capable of restoring a known-good configuration or otherwise containing the impact. Rollback behavior must itself be tested because an unverified recovery process can compound an outage. AI-generated changes should follow the same disciplined change lifecycle as other automation: plan, validate, approve as needed, deploy, verify, and recover predictably when outcomes differ from expectations.