View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q61. A Python automation script receives a JSON response containing hundreds of network devices. The engineer needs to select only devices whose role is edge-router. Which approach is most appropriate?

1. Convert the JSON into an image
   2. Restart the API server
   3. Ignore the device role field
   4. Parse the JSON and filter the returned objects based on the role attribute

Correct Answer: 4. Parse the JSON and filter the returned objects based on the role attribute

Explanation: REST APIs commonly return structured JSON containing arrays and nested objects. A Python automation application should deserialize the response and inspect the relevant fields programmatically. Filtering by the role attribute allows the workflow to select only the intended devices before performing additional operations. Ignoring structured fields can cause automation to target unintended systems. Restarting the API server is unrelated to data selection, and converting JSON into an image would destroy its machine-readable structure. Reliable automation depends on correctly parsing and validating structured API responses before making network changes.

Q62. An Ansible inventory contains routers grouped under branch_routers. The administrator wants one play to run only against that group. Which playbook field identifies the target group?

1. vars
   2. hosts
   3. tasks
   4. handlers

Correct Answer: 2. hosts

Explanation: The hosts field in an Ansible play defines which inventory hosts or groups the play targets. Setting hosts: branch_routers directs the play to execute against members of that inventory group. The tasks section describes the actions to perform, vars defines variables, and handlers contains event-driven tasks commonly triggered by notify. Accurate host targeting is essential in network automation because a valid configuration applied to the wrong device group can cause widespread disruption. Ansible is explicitly included in Cisco’s current AUTOCOR network automation domain.

Q63. A Terraform resource has already been created in production outside Terraform. The automation team wants Terraform to begin managing that existing resource without creating a duplicate. Which operation is most appropriate?

1. terraform destroy
   2. terraform fmt
   3. Import the existing resource into Terraform state
   4. Delete the production resource first

Correct Answer: 3. Import the existing resource into Terraform state

Explanation: Terraform import associates an existing real-world resource with a Terraform resource address so that Terraform can begin tracking it in state. The configuration should also describe the resource appropriately so future plans reflect the intended desired state. Destroying the existing resource is unnecessary and potentially disruptive. terraform fmt only reformats configuration files. Importing is particularly useful during infrastructure-as-code adoption when resources already exist but must gradually move under Terraform management. State should be protected and reviewed carefully after import because future Terraform actions depend on accurate resource mappings.

Q64. A RESTCONF client needs to retrieve the running configuration of an interface without changing it. Which HTTP method should it use?

1. GET
   2. DELETE
   3. PATCH
   4. POST

Correct Answer: 1. GET

Explanation: HTTP GET retrieves the representation of a RESTCONF resource without modifying it. For example, an automation client can query interface configuration or operational data defined by a YANG model. PATCH and PUT are typically associated with configuration modifications, DELETE removes resources, and POST can invoke creation or operations depending on the API. Read-only GET requests are useful during prevalidation and troubleshooting because they allow automation to inspect current network state before determining whether a change is necessary. Cisco’s AUTOCOR blueprint explicitly includes constructing RESTCONF automation solutions from YANG models.

Q65. A network automation team wants to decide whether to build a custom Python application or use an Infrastructure as Code framework. Which factor should have the greatest influence?

1. The developer’s favorite programming language
   2. The color of the network devices
   3. Technical and business requirements of the automation use case
   4. The number of monitors in the operations center

Correct Answer: 3. Technical and business requirements of the automation use case

Explanation: Automation architecture should be selected according to requirements rather than personal tool preference. Infrastructure as Code can be ideal for declarative state management and repeatable provisioning, while a custom application can provide more flexibility for complex logic, integrations, or user interfaces. Low-code/no-code platforms may be appropriate for simpler operational workflows. Factors such as scalability, maintainability, skills, governance, workflow complexity, APIs, and lifecycle requirements should all influence the decision. Cisco explicitly tests selecting an automation approach based on technical and business requirements in the AUTOCOR Network Automation domain.

Q66. A GitLab CI job fails because the Python version in the runner is older than the version required by the automation code. What is the best resolution?

1. Update the runner or job environment to a compatible Python version
   2. Ignore the failed job and deploy anyway
   3. Delete the automation tests
   4. Remove the Python version requirement from documentation only

Correct Answer: 4. Update the runner or job environment to a compatible Python version

Explanation: CI/CD environments must provide versions of runtimes, libraries, and tools that are compatible with the automation being executed. If the pipeline runner uses an incompatible Python version, the correct fix is to align the execution environment with the application’s documented requirements or update the code appropriately. Ignoring failed jobs or removing tests defeats the purpose of CI validation. Reproducible build environments are important because automation should behave consistently across developer systems and pipeline runners. Cisco’s AUTOCOR blueprint explicitly includes diagnosing GitLab pipeline failures caused by incompatible component versions.

Q67. A network engineer is resolving a Git merge conflict. What indicates that a file still contains unresolved conflict sections?

1. Conflict markers such as <<<<<<<, =======, and >>>>>>>
   2. The file has a .yaml extension
   3. The repository contains a README file
   4. The branch has a remote tracking reference

Correct Answer: 1. Conflict markers such as <<<<<<<, =======, and >>>>>>>

Explanation: Git inserts conflict markers into files when it cannot automatically merge overlapping changes. The sections between <<<<<<<, =======, and >>>>>>> show competing versions from the branches involved. The engineer must review the intended content, edit the file to the correct final state, remove the markers, stage the resolved file, and complete the merge. The file extension and presence of other repository files do not determine whether a conflict exists. Automation repositories should also run syntax and functional validation after conflicts are resolved because a textually resolved merge can still produce invalid infrastructure configuration.

Q68. Why is post-validation important after an automated ACL deployment?

1. It replaces the need for version control
   2. It verifies that the network state and behavior match the intended result after deployment
   3. It prevents Git commits from being created
   4. It removes the need for prevalidation

Correct Answer: 2. It verifies that the network state and behavior match the intended result after deployment

Explanation: Automation can complete successfully from a tooling perspective while still producing an incorrect operational outcome. Post-validation checks the actual network after deployment to verify expected ACL entries, reachability, routing, service access, or other requirements. Tools such as pyATS can automate these checks and compare observed state with expected results. Prevalidation and post-validation serve complementary purposes: prevalidation checks readiness before a change, while post-validation confirms success afterward. Cisco’s current AUTOCOR blueprint explicitly includes post-validation and pyATS-based change validation as core automation skills.

Q69. A team wants a repeatable virtual topology containing IOS XE routers that can be created for every CI pipeline run and destroyed afterward. Which Cisco technology best supports this use case?

1. Cisco Modeling Labs
   2. Webex Messaging
   3. Cisco ISE guest portal
   4. Syslog only

Correct Answer: 4. Cisco Modeling Labs

Explanation: Cisco Modeling Labs provides virtualized Cisco network topologies that can serve as reproducible test environments or digital twins for automation. A pipeline can launch a test topology, apply automation, run validation, and tear down the lab afterward. This helps detect failures before production changes occur and allows developers to reproduce network conditions consistently. Cisco’s AUTOCOR course specifically includes launching CML test topologies with Python and integrating CML environments into CI pipelines. Webex and Syslog do not provide simulated routing and switching infrastructure.

Q70. A model-driven telemetry subscription is configured to send interface counters every second from thousands of devices. Which architecture concern becomes especially important?

1. The color of dashboard widgets
   2. Git merge strategy only
   3. Collector, transport, and storage scalability
   4. DHCP lease duration

Correct Answer: 1. Collector, transport, and storage scalability

Explanation: High-frequency telemetry from thousands of devices can generate substantial data volume. The automation architecture must ensure collectors, message transports, processing systems, and storage backends can ingest and retain the data at the required rate. Retention policies and aggregation can also affect storage cost and query performance. Overly aggressive subscriptions can overwhelm collectors or network links without providing meaningful operational value. Cisco’s AUTOCOR Operations domain includes model-driven telemetry architecture with specific emphasis on data consumption and storage considerations.

Q71. An automation application sends notifications to both a SIEM and a collaboration platform whenever a job fails. Which logging design principle does this demonstrate?

1. Events can be routed to multiple destinations according to operational needs
   2. Automation should write only to local files
   3. Error events should never leave the application host
   4. Webhooks should replace all logging mechanisms

Correct Answer: 2. Events can be routed to multiple destinations according to operational needs

Explanation: Modern automation systems often send telemetry to different destinations for different purposes. A SIEM can retain and correlate structured events for security and operations, while a webhook can notify collaboration or incident-management systems immediately. Local application logs may still be useful for debugging. The appropriate design can therefore include file logs, Syslog, webhooks, and centralized observability platforms simultaneously. Cisco’s AUTOCOR Operations domain expects candidates to understand logging strategies including files, Syslog, and webhooks.

Q72. A pyATS test obtains interface state from a router and compares it with an expected result. What should the test do if a required uplink is administratively and operationally down?

1. Always mark the test successful
   2. Delete the interface configuration automatically without policy
   3. Hide the result from the pipeline
   4. Fail the validation according to the defined expected state

Correct Answer: 3. Fail the validation according to the defined expected state

Explanation: Automated tests should evaluate observed network state against explicit expected conditions. If a required uplink must be operational but is down, the validation should fail and return actionable information to the pipeline. The pipeline can then stop further deployment, trigger rollback, or alert an engineer according to the workflow design. Automatically modifying configuration from a validation test can be unsafe unless remediation is intentionally designed. Cisco emphasizes pyATS-based validation in AUTOCOR because safe automation must verify actual network outcomes rather than merely check whether configuration commands completed.

Q73. A Python script needs to handle API responses that might contain invalid JSON. Which approach is most appropriate?

1. Assume every response is always valid JSON
   2. Disable HTTP status checking
   3. Catch the parsing exception and handle the error explicitly
   4. Retry forever without inspecting the response

Correct Answer: 2. Catch the parsing exception and handle the error explicitly

Explanation: Robust automation cannot assume every API response contains valid JSON. A proxy error, server failure, HTML error page, or malformed API response may cause JSON parsing to fail. The application should check the HTTP status, attempt to parse the expected content, catch relevant exceptions, and log or return a meaningful error. It can retry only when the condition is actually transient. Ignoring status codes or retrying indefinitely can conceal the underlying issue. Error handling is essential because automation failures must stop safely rather than continue with missing or corrupt data.

Q74. A TLS-enabled automation service presents a certificate whose hostname does not match the URL used by the client. What should the client do by default?

1. Accept the certificate automatically
   2. Fail certificate validation rather than silently trusting the mismatch
   3. Disable encryption
   4. Replace HTTPS with Telnet

Correct Answer: 3. Fail certificate validation rather than silently trusting the mismatch

Explanation: TLS certificate validation includes checking whether the server identity in the certificate matches the hostname the client intended to reach. A mismatch can indicate a configuration problem or an attempted man-in-the-middle attack. Automation should generally fail securely rather than globally disable verification. Administrators should correct DNS, the service URL, or the certificate SAN entries and ensure the certificate chain is trusted. Cisco’s AUTOCOR Operations objectives include obtaining and deploying CA-signed TLS certificates, making correct certificate validation an important operational skill.

Q75. An automation repository needs a secret for a CI job. Which GitLab mechanism is most appropriate?

1. Hard-code the secret in the playbook
   2. Store the password in the README
   3. Commit it in a .env file
   4. Use a protected CI/CD variable or integrated secret-management mechanism

Correct Answer: 1. Use a protected CI/CD variable or integrated secret-management mechanism

Explanation: CI/CD secrets should remain separate from version-controlled application and infrastructure files. Protected variables or external secret-management systems allow pipelines to receive required credentials at runtime while limiting who can view or use them. The values can also be rotated without rewriting repository history. Hard-coded credentials can remain recoverable from Git history even after being removed from the current file. Cisco’s AUTOCOR blueprint explicitly includes secure coding practices such as secret management, making proper pipeline credential handling an important automation design skill.

Q76. An engineer asks a generative AI system to produce a Terraform configuration. Which prompt is likely to produce the most useful result?

1. “Do automation.”
   2. A prompt containing clear requirements, target platform, constraints, expected output format, and relevant context
   3. A prompt with no description of the desired infrastructure
   4. A prompt that deliberately omits platform and version information

Correct Answer: 4. A prompt containing clear requirements, target platform, constraints, expected output format, and relevant context

Explanation: Generative AI performs better when the prompt clearly defines the task, constraints, target environment, relevant data, and desired output format. For network automation, useful context can include platform type, software version, intended state, security requirements, and whether the output should be Python, Ansible, Terraform, or another format. Even well-constructed prompts do not guarantee correct code, so generated output must still be validated. Cisco’s AUTOCOR AI domain explicitly includes the use of generative AI for network automation development and the need to evaluate generated recommendations.

Q77. A network engineer sends complete production configurations containing passwords to a public generative AI service. What is the primary concern?

1. Sensitive data and intellectual-property exposure
   2. OSPF will immediately stop working
   3. Git branches will be deleted
   4. CML cannot launch topologies afterward

Correct Answer: 3. Sensitive data and intellectual-property exposure

Explanation: Production configurations can contain secrets, internal addressing, architecture, access policies, hostnames, business-sensitive details, and intellectual property. Sending them to a public AI service can create retention, privacy, compliance, or ownership concerns depending on the provider and account type. Sensitive data should be minimized or redacted, and organizations should evaluate approved enterprise AI services and contractual protections. AI assistance can be valuable, but Cisco explicitly calls out data privacy and intellectual-property considerations as risks of AI-assisted network automation development.

Q78. An MCP tool allows an AI agent to run show commands on routers. What is the safest permission model?

1. Give the tool full configuration mode access
   2. Grant only the read-only commands needed by the agent
   3. Use an unauthenticated administrator session
   4. Allow arbitrary shell commands

Correct Answer: 2. Grant only the read-only commands needed by the agent

Explanation: AI-integrated tools should follow least privilege. If the purpose of an MCP tool is to retrieve network state, the underlying identity should receive only the read permissions or commands necessary for that function. This prevents a prompt injection, hallucination, or coding defect from escalating into an unauthorized network change. The MCP layer should also validate parameters and log calls. Providing unrestricted configuration or shell access would unnecessarily expand the blast radius. Cisco includes MCP server construction with FastMCP as a required current AUTOCOR AI skill.

Q79. A conversational AI agent proposes shutting an interface because it believes the interface is unused. The source of truth shows the interface serves a critical backup path. What should happen?

1. The proposal should be rejected or escalated because it conflicts with authoritative network information
   2. The AI should shut the interface immediately
   3. Delete the source of truth
   4. Disable validation to avoid disagreement

Correct Answer: 4. The proposal should be rejected or escalated because it conflicts with authoritative network information

Explanation: AI recommendations should be advisory until verified against authoritative data and defined policy. If the source of truth identifies the interface as critical, the automation system should not allow the model’s unsupported assumption to override that information. The conflict should be rejected, investigated, or escalated to an operator. This illustrates why AI-based network agents need deterministic validation and authorization layers. Cisco’s current AUTOCOR objectives specifically include evaluating AI recommendation accuracy and constructing LLM-based conversational network automation agents.

Q80. A team wants an AI network agent to answer natural-language questions such as “Which branch routers have interfaces down?” What architecture best supports this?

1. An LLM with no network data access
   2. A static text file manually updated once per year
   3. An LLM connected through controlled tools or an MCP server to current network data
   4. Direct unauthenticated CLI access from the public Internet

Correct Answer: 1. An LLM connected through controlled tools or an MCP server to current network data

Explanation: A language model can interpret natural-language intent, but it needs controlled access to current network information to answer operational questions reliably. An MCP server or other structured tool layer can retrieve approved interface or device data and present it to the model. The tool should enforce authentication, authorization, parameter validation, and logging. A model with no network data may hallucinate an answer, while stale static files cannot represent current state. Cisco’s AUTOCOR v2.0 AI domain specifically includes MCP servers and conversational agents that use LLMs for network automation.