View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q81. A Python network automation script makes an HTTPS request to a controller. The request should fail rather than wait indefinitely if the controller becomes unresponsive. Which implementation is most appropriate?

1. Remove all exception handling
   2. Configure an explicit request timeout
   3. Retry continuously without delay
   4. Disable TLS certificate validation

Correct Answer: 2. Configure an explicit request timeout

Explanation: Network automation code should define explicit timeouts for external API calls so the application does not wait indefinitely when a controller, device, or network path stops responding. The script can catch the resulting timeout exception and decide whether the condition is retryable or should terminate the workflow. Unlimited waits can cause pipelines and orchestration jobs to remain stuck for long periods. Disabling certificate validation does not solve availability problems and weakens transport security. Good API consumers combine sensible timeout values with exception handling, bounded retries, backoff, logging, and clear failure behavior.

Q82. An Ansible task saves the output of a device command so that a later task can evaluate it. Which Ansible keyword should be used?

1. register
   2. notify
   3. become
   4. serial

Correct Answer: 1. register

Explanation: The register keyword stores the result returned by an Ansible task in a variable. Later tasks can inspect fields within that result and make conditional decisions, generate reports, or perform validation. For example, output from a network command can be registered and then evaluated with a when condition. notify triggers a handler after a task reports a change, become relates to privilege escalation on supported hosts, and serial controls batch size during play execution. Registering task results is useful when automation must make decisions based on observed network state.

Q83. A Terraform configuration needs a subnet value that differs between development and production environments. Which Terraform construct is most appropriate for supplying this value without duplicating the resource configuration?

1. Provider alias only
   2. State lock
   3. Input variable
   4. Output value only

Correct Answer: 3. Input variable

Explanation: Terraform input variables allow reusable configuration to accept environment-specific values such as IP prefixes, VLAN IDs, site names, device addresses, or credentials references. The same module or resource configuration can therefore be used across development, test, and production while each environment supplies its own values. Output values expose selected information after evaluation rather than primarily providing input. State locking protects concurrent state modification, and provider aliases help manage multiple provider configurations. Variables improve reuse and reduce duplicated infrastructure code, which makes automation easier to maintain and review.

Q84. A RESTCONF client must completely replace the representation of an existing configuration resource with a supplied representation. Which HTTP method is most appropriate?

1. GET
   2. HEAD
   3. PATCH
   4. PUT

Correct Answer: 4. PUT

Explanation: HTTP PUT is commonly used to create or completely replace the representation of a resource at a specified URI. In RESTCONF, the exact behavior must comply with RFC 8040 and the target platform’s implementation, but PUT is appropriate when the client intends to replace the addressed configuration data rather than make only a partial modification. PATCH is generally better suited to partial updates. GET retrieves data, while HEAD retrieves metadata without the normal response body. Automation engineers should understand the difference because choosing the wrong method can unintentionally replace more configuration than intended.

Q85. A Python script must process a large list of devices one at a time while avoiding unnecessary creation of a second complete list in memory. Which Python approach is most appropriate?

1. Iterate over the existing collection or generator directly
   2. Copy the device list repeatedly before each operation
   3. Serialize every item to a separate database first
   4. Convert every item to an image

Correct Answer: 1. Iterate over the existing collection or generator directly

Explanation: Iterating directly over an existing collection avoids unnecessary copies and keeps automation code simple. When data can be produced lazily, a generator can be even more memory efficient because items are created as needed rather than all at once. This can matter when automation processes very large inventories or API datasets. Repeatedly copying lists consumes additional memory and CPU without improving the workflow. Network automation code should be designed for predictable resource use because inventory size can grow substantially as automation is expanded from a few devices to enterprise-scale environments.

Q86. A Git repository contains a local change to a tracked file that has not yet been committed. The engineer wants to discard that working-tree modification and restore the file from the current branch. Which command is appropriate?

1. git cherry-pick
   2. git checkout — <file> or the modern equivalent git restore <file>
   3. git merge
   4. git init

Correct Answer: 2. git checkout — <file> or the modern equivalent git restore <file>

Explanation: git checkout — <file> restores a tracked file in the working tree from the current index or commit, while modern Git also provides git restore for this purpose. This is appropriate when an engineer wants to discard local uncommitted modifications. Because the action can destroy local work, it should be used carefully. git cherry-pick applies a selected commit, git merge combines histories, and git init creates a new repository. Understanding checkout and restore behavior is important when maintaining infrastructure code and automation repositories safely.

Q87. A GitLab pipeline should stop before production deployment if network prevalidation tests fail. Which pipeline behavior is most appropriate?

1. Ignore the test result
   2. Continue deployment but hide the failure
   3. Delete the validation stage
   4. Mark the prevalidation job as a required dependency that must succeed

Correct Answer: 4. Mark the prevalidation job as a required dependency that must succeed

Explanation: A safe CI/CD pipeline should prevent deployment when required prevalidation checks fail. The deploy stage can depend on the successful completion of prevalidation jobs so the pipeline stops automatically when prerequisites are not met. This protects production infrastructure from changes made under unexpected network conditions. Hiding or ignoring failures defeats the purpose of validation. Cisco’s current AUTOCOR blueprint explicitly includes build, prevalidation, deploy, and post-validation stages, so understanding how pipeline control flow enforces these gates is important for safe network automation.

Q88. An automation engineer wants to test a routing change against a topology that closely mirrors production but does not affect real users. What is the best use of Cisco Modeling Labs?

1. Store Git credentials
   2. Replace the source of truth
   3. Build a simulation or digital twin for pre-deployment testing
   4. Act as a CA for production certificates

Correct Answer: 3. Build a simulation or digital twin for pre-deployment testing

Explanation: Cisco Modeling Labs can provide simulated Cisco network topologies that reproduce relevant aspects of production behavior. Engineers can apply proposed automation, observe routing convergence, run validation, and test failure scenarios before deploying to real infrastructure. This reduces operational risk and can be integrated into CI/CD pipelines. A simulation should still be validated against actual production differences such as software versions, scale, and physical dependencies. Cisco’s AUTOCOR training explicitly includes building CML topologies and integrating them with automated pipelines.

Q89. A YANG model defines a leaf as type boolean. Which JSON value correctly represents the enabled state?

1. “enabled”
   2. true
   3. “yes”
   4. 1 as a quoted string

Correct Answer: 2. true

Explanation: JSON provides native Boolean values true and false, and a YANG Boolean leaf maps naturally to those JSON Boolean types when encoded according to the applicable model-driven interface rules. Using arbitrary strings such as “enabled” or “yes” does not preserve the data type expected by the model. The automation client should always follow the YANG schema rather than guessing value formats. Strongly modeled data is one advantage of RESTCONF and NETCONF because automation can validate structure and data types more reliably than when parsing free-form CLI text.

Q90. A network controller API returns a Retry-After header with an HTTP 429 response. What should the automation client do?

1. Delete the requested resource
   2. Ignore the header
   3. Reauthenticate continuously
   4. Delay the next retry according to the server-provided guidance

Correct Answer: 4. Delay the next retry according to the server-provided guidance

Explanation: HTTP 429 means the client has exceeded the service’s rate limit. When the server includes a Retry-After header, the client should respect that guidance before attempting another request. Doing so reduces unnecessary load and improves the chance that later requests will succeed. The automation should also bound the number of retries and log repeated throttling conditions. Ignoring the server’s retry guidance can produce a retry storm and extend throttling. Reliable network automation must account for API rate limits because controller platforms often protect themselves from excessive request volume.

Q91. An automation solution uses NetBox as its source of truth. What is the safest behavior when the source of truth lists an interface as disabled but the live device reports it enabled?

1. Compare the discrepancy with policy and determine whether controlled remediation is authorized
   2. Always trust the live device and overwrite NetBox immediately
   3. Always shut the interface regardless of context
   4. Ignore the mismatch permanently

Correct Answer: 1. Compare the discrepancy with policy and determine whether controlled remediation is authorized

Explanation: A difference between authoritative intended state and live device state is configuration drift, but automation should not automatically assume which side is wrong. The source of truth may be stale, or the device may have been changed outside the approved process. A safe workflow identifies the discrepancy, validates intended state, checks change records or policy, and then performs controlled reconciliation if authorized. Blindly overwriting the source of truth can legitimize unauthorized changes, while blindly shutting an interface can create an outage. Source-of-truth integration requires governance as well as technical automation.

Q92. A Docker Compose file defines depends_on between two services. What does this primarily express?

1. The dependent service must use the same container image
   2. A service startup dependency relationship between the defined services
   3. Both services must expose identical ports
   4. The services must use the same volume

Correct Answer: 3. A service startup dependency relationship between the defined services

Explanation: In Docker Compose, depends_on expresses a dependency in the service startup ordering. It can help ensure that one service is started before another. Engineers should not assume basic depends_on alone guarantees that the dependency is fully ready to serve traffic; health checks and appropriate application retry behavior may still be necessary. The directive does not require services to use identical images, ports, or volumes. AUTOCOR includes interpreting Compose files containing services, networks, volumes, and links or dependencies, making these relationships important for containerized automation components.

Q93. An automation script sends event information to Syslog. What field is most useful for quickly distinguishing informational events from errors?

1. Severity level
   2. Device screen resolution
   3. Git branch name only
   4. Terraform provider checksum only

Correct Answer: 1. Severity level

Explanation: Syslog severity indicates the importance of an event, ranging from emergencies through debugging-level messages. Appropriate severity classification helps collectors, SIEM systems, dashboards, and operators prioritize events and define alerting behavior. A failed device configuration operation should not be logged at the same severity as routine debug output. Good logging should also include timestamps, device or application identity, job identifiers, and useful contextual information. AUTOCOR expects candidates to implement logging strategies using files, Syslog, and webhooks, so understanding useful log attributes is important for operational automation.

Q94. A Python script catches an exception but uses only pass, causing the workflow to continue silently. What is the main risk?

1. The script becomes more observable
   2. Failures can be hidden and later operations may run with invalid assumptions
   3. API authentication becomes stronger
   4. Terraform state is automatically repaired

Correct Answer: 2. Failures can be hidden and later operations may run with invalid assumptions

Explanation: Silently swallowing exceptions can cause automation to continue after an important operation failed. Later tasks may act on incomplete data, missing configuration, or incorrect state and can therefore make the original problem more difficult to diagnose. Exceptions should be handled intentionally: recover when the condition is understood and safe, or log meaningful context and fail clearly when continuation would be dangerous. Robust automation favors explicit error handling over broad except blocks that hide failures. Operational logs should also avoid exposing secrets while still providing enough context for troubleshooting.

Q95. An engineer needs a CA-signed certificate for a new internal automation service. Which item is sent to the certificate authority for signing?

1. The server’s private key
   2. The Git repository
   3. The certificate signing request
   4. The Terraform state file

Correct Answer: 3. The certificate signing request

Explanation: A certificate signing request, or CSR, contains the public key and identity information the certificate authority uses when issuing the certificate. The corresponding private key should remain protected on the system or key-management infrastructure and should never be sent to the CA as part of a normal signing process. After validation, the CA signs the request and returns a certificate that can be installed together with the appropriate chain. Cisco’s AUTOCOR Operations domain explicitly includes obtaining and deploying CA-signed TLS certificates, so candidates should understand this certificate lifecycle.

Q96. A generative AI system produces a Python automation script using a nonexistent library method. Which AI behavior does this illustrate?

1. Deterministic compilation
   2. State locking
   3. Idempotency
   4. Hallucination

Correct Answer: 4. Hallucination

Explanation: Generative AI can produce plausible-looking but incorrect code, commands, APIs, or library methods. This is commonly called hallucination. Network automation engineers must therefore validate generated code against authoritative documentation, lint and test it, and run it in controlled environments before production use. AI-generated automation can accelerate development but should be treated as untrusted output until verified. Cisco’s AUTOCOR blueprint explicitly includes understanding the benefits and risks of generative AI in network automation, including the need for code validation.

Q97. An AI agent retrieves current interface state through an MCP server. Which design most reduces the chance that the agent can accidentally modify configuration?

1. Expose only read-only tools through the MCP server for this use case
   2. Give the AI full configuration privileges
   3. Let any prompt execute arbitrary shell commands
   4. Disable tool-call logging

Correct Answer: 2. Expose only read-only tools through the MCP server for this use case

Explanation: If the agent’s purpose is to answer questions about network state, its MCP tools should expose only the read operations required. This creates a technical least-privilege boundary independent of what the language model requests. Even if a user attempts prompt injection or the model makes an error, unavailable write functions cannot be called through that interface. Authentication, parameter validation, and logging should also be implemented. Cisco’s AUTOCOR AI domain includes building FastMCP servers to provide network information to agents, making secure tool design an important consideration.

Q98. An engineer asks an AI assistant to recommend an ACL change. The suggestion blocks a critical monitoring system. What should the workflow do?

1. Apply the ACL because AI-generated output is authoritative
   2. Validate the recommendation against requirements and simulation or test results before deployment
   3. Delete monitoring from the design
   4. Remove post-validation from the pipeline

Correct Answer: 3. Validate the recommendation against requirements and simulation or test results before deployment

Explanation: AI recommendations can be incorrect or incomplete, so they must be validated against authoritative requirements and expected network behavior. A CML simulation, policy checks, prevalidation, or human review can reveal that the proposed ACL blocks legitimate monitoring traffic. Only validated recommendations should progress to production. High-impact network changes may also require approval and rollback mechanisms. Cisco’s current AUTOCOR exam explicitly tests evaluation of AI recommendation accuracy. AI should therefore assist network engineering rather than replace deterministic validation and change-control safeguards.

Q99. A conversational AI agent answers questions using stale interface information cached from the previous week. What architectural improvement is most appropriate?

1. Integrate the agent with a controlled source of current network state
   2. Tell users to assume all answers are current
   3. Disable timestamps
   4. Remove network data access entirely while still claiming real-time answers

Correct Answer: 1. Integrate the agent with a controlled source of current network state

Explanation: Operational questions require timely information. An LLM relying only on stale cached data can produce answers that are linguistically convincing but operationally incorrect. A controlled tool or MCP server can query an authoritative source, controller, telemetry platform, or network device when current state is needed. The agent should identify the data source and timestamp where useful. Authorization and validation must still apply to the retrieval operation. Cisco’s AUTOCOR AI objectives include constructing conversational agents connected to network information, which requires thinking carefully about data freshness as well as natural-language capabilities.

Q100. An AI agent can perform both read and write operations. Which workflow is best for a destructive configuration action such as deleting a VLAN used in production?

1. Execute it immediately whenever the model suggests it
   2. Disable authorization before deletion
   3. Require validation and an explicit approval step before the destructive tool call
   4. Delete audit records afterward

Correct Answer: 4. Require validation and an explicit approval step before the destructive tool call

Explanation: Destructive infrastructure actions deserve stronger safeguards than ordinary read operations. The workflow should validate the target and business intent, check authoritative state, assess dependencies, and require an explicit approval or other policy gate before execution. The tool identity should also have narrowly scoped permissions and all actions should be logged. Relying solely on an LLM’s decision can amplify hallucinations or prompt injection into real outages. Safe AI network automation separates conversational reasoning from deterministic authorization and change-control mechanisms.