View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.

Q101. A Python network automation application receives an API response containing device records. Some records do not contain the optional location key. Which approach most safely retrieves this value without raising a KeyError when it is missing?

1. Access device[“location”] without checking
   2. Use device.get(“location”) with an appropriate default
   3. Convert the dictionary into a string first
   4. Delete any record that lacks the key

Correct Answer: 2. Use device.get(“location”) with an appropriate default

Explanation: Python dictionaries provide the get() method for retrieving a key while safely handling cases in which the key does not exist. The method can return None or a caller-supplied default rather than raising a KeyError. This is useful when automation consumes APIs where some attributes are optional. Direct bracket access is appropriate when a field is guaranteed to exist, but it is less resilient for optional data. Robust network automation should validate API responses and gracefully handle missing values instead of crashing or discarding otherwise useful device records.

Q102. An Ansible playbook needs to apply an ACL task only when the variable enable_edge_acl is set to true. Which mechanism should be used?

1. A when conditional on the task
   2. A handlers block only
   3. A register statement without a condition
   4. A new inventory file for each execution

Correct Answer: 1. A when conditional on the task

Explanation: Ansible’s when statement controls whether a task runs based on a Boolean expression or other evaluated condition. If enable_edge_acl is true, the ACL task executes; otherwise, Ansible skips it. This allows one reusable playbook to support multiple environments or device roles without duplicating entire playbooks. Handlers are intended for tasks triggered by notifications, and register stores task results for later use. Conditional execution is fundamental to building maintainable automation that adapts safely to variables, platform state, or previous task outcomes.

Q103. A Terraform engineer wants to expose the management IP address of a newly created network appliance so another automation workflow can consume it. Which Terraform construct should be used?

1. A provider block
   2. A lifecycle block
   3. A state lock
   4. An output value

Correct Answer: 4. An output value

Explanation: Terraform output values expose selected information from a Terraform configuration after evaluation. An output can reference an attribute such as a management IP address, resource identifier, or generated endpoint and make it available to operators or downstream automation. Variables provide input into a configuration, while outputs communicate useful resulting values. Provider blocks configure communication with infrastructure platforms, and state locks prevent conflicting concurrent operations. Outputs are particularly useful when one automation stage provisions infrastructure and a later workflow needs attributes from the newly created resources.

Q104. A RESTCONF client wants to remove a configured loopback interface represented by a YANG-modeled resource. Which HTTP method is most appropriate?

1. GET
   2. HEAD
   3. DELETE
   4. OPTIONS

Correct Answer: 3. DELETE

Explanation: HTTP DELETE is used to remove the resource identified by the target URI. In a RESTCONF workflow, deleting a YANG-modeled configuration object such as an interface generally uses DELETE against the appropriate data resource. GET retrieves data, HEAD requests response metadata without the normal body, and OPTIONS describes supported communication options rather than removing configuration. Automation clients should still verify that the resource exists, check the returned status code, and perform post-change validation to ensure the deletion produced the intended network state.

Q105. A network team must automate a workflow that includes complex calculations, multiple external APIs, conditional logic, and a custom operator interface. Which automation approach is most appropriate?

1. A custom application
   2. A simple static spreadsheet only
   3. Manual CLI changes
   4. A no-code tool regardless of feature limitations

Correct Answer: 1. A custom application

Explanation: A custom application is often appropriate when automation requires specialized business logic, numerous API integrations, complex state handling, custom user interaction, or functionality not well supported by declarative or low-code frameworks. Infrastructure as Code and no-code tools remain valuable for use cases that fit their strengths, but the architecture should be selected according to requirements rather than tool preference. A custom application introduces software-development and maintenance responsibilities, so teams should consider testing, observability, security, and lifecycle management before choosing this approach.

Q106. A Git repository contains a commit that introduced an incorrect ACL and was already pushed to a shared branch. Which operation best removes the ACL change while preserving the existing shared history?

1. git reset –hard followed by force push
   2. Delete the repository
   3. git revert the offending commit
   4. git init in the same directory

Correct Answer: 3. git revert the offending commit

Explanation: git revert creates a new commit that reverses the changes introduced by an earlier commit while preserving all existing history. This is the safest normal approach on shared branches because collaborators do not need to reconcile a rewritten commit graph. A hard reset followed by a force push can rewrite shared history and disrupt other users. For network automation repositories, preserving traceability is especially useful because configuration changes may need to be audited or correlated with production events.

Q107. A GitLab pipeline uses a container image for its Python test job. The job works locally but fails in CI because the image lacks a required system package. What should the team do?

1. Ignore the CI failure
   2. Use or build a runner image containing the documented required dependencies
   3. Remove all tests
   4. Run the deployment directly from a developer laptop

Correct Answer: 2. Use or build a runner image containing the documented required dependencies

Explanation: CI jobs should execute in reproducible environments containing the runtimes, libraries, and system packages required by the automation. If a pipeline container image lacks a dependency, the correct solution is to update the job image or create a controlled build image that includes all documented prerequisites. This makes CI behavior predictable and prevents “works on my machine” problems. Removing tests or bypassing CI would only hide the inconsistency. Reproducible pipeline environments are critical when network changes depend on automated validation before production deployment.

Q108. A CML test topology is launched automatically during a CI pipeline. What should happen after all validation tests finish successfully if the topology is needed only for that pipeline run?

1. Leave every lab running permanently
   2. Convert the lab into production infrastructure
   3. Remove Git history
   4. Tear down the temporary topology to release resources

Correct Answer: 4. Tear down the temporary topology to release resources

Explanation: Ephemeral test environments should generally be destroyed after they have served their purpose. A CI pipeline can create a CML topology, execute configuration and validation tasks, capture results, and then tear down the lab to release compute and memory resources. This improves repeatability and reduces unnecessary infrastructure consumption. Keeping temporary labs running can create cost, resource exhaustion, and state drift. Pipeline cleanup should also execute when tests fail, where practical, so abandoned test topologies do not accumulate over time.

Q109. A source of truth lists the intended VLAN for an interface as 30, but the device currently uses VLAN 40. What type of condition has been detected?

1. Certificate revocation
   2. Configuration drift
   3. Git squash merge
   4. API pagination

Correct Answer: 2. Configuration drift

Explanation: Configuration drift occurs when the actual infrastructure state differs from the approved or declared desired state. In this case, the source of truth expects VLAN 30 while the live device reports VLAN 40. The automation workflow should determine whether the device was changed outside the approved process or whether the source of truth is outdated before performing remediation. Detecting drift is a major advantage of declarative automation and Infrastructure as Code, but automatic correction should still follow appropriate validation and change-control policy.

Q110. A telemetry collector receives interface utilization every 100 milliseconds from thousands of ports, but operators only need one-minute trend data. Which design can reduce storage and processing requirements?

1. Increase sampling frequency further
   2. Store every raw sample forever
   3. Disable telemetry completely
   4. Aggregate or downsample the data according to operational requirements

Correct Answer: 4. Aggregate or downsample the data according to operational requirements

Explanation: High-frequency telemetry can generate very large datasets. If operators only need one-minute trend information, the architecture can aggregate raw samples into summary statistics such as averages, maximums, percentiles, or rates and retain detailed data only for a shorter period. This reduces long-term storage and query costs while preserving useful operational insight. The appropriate strategy depends on troubleshooting needs because overly aggressive aggregation can remove detail required for transient-event analysis. Telemetry design should balance freshness, fidelity, storage, transport capacity, and business value.

Q111. A pyATS parser returns structured interface output as Python dictionaries instead of raw CLI text. What is a major automation benefit?

1. Structured fields are easier to validate programmatically than arbitrary command text
   2. It prevents every network outage
   3. It eliminates the need for test logic
   4. It automatically creates Terraform state

Correct Answer: 3. Structured fields are easier to validate programmatically than arbitrary command text

Explanation: Structured parser output allows automation to reference specific fields such as operational state, protocol state, addresses, counters, or descriptions without manually parsing text using fragile regular expressions. This makes validation code clearer and more resilient to formatting differences. The automation still needs explicit test logic to determine which values are acceptable. Structured data does not guarantee a network is healthy, but it provides a better foundation for repeatable state comparison and automated verification than unstructured CLI output.

Q112. A Python automation job catches a connection exception and logs it with logger.exception(). What additional information is typically included compared with a basic error message?

1. A new device configuration
   2. Stack-trace information for the active exception
   3. A Terraform execution plan
   4. A CA-signed certificate

Correct Answer: 1. Stack-trace information for the active exception

Explanation: Python’s logger.exception() is normally used while handling an exception and records the supplied message together with exception traceback information. The traceback can show the code path that led to the failure and is valuable when troubleshooting automation errors. Care should still be taken to avoid logging sensitive secrets or full authentication payloads. Logging should include enough context to identify the job, device, request, and failure while protecting confidential information. High-quality error logs reduce time spent reproducing intermittent automation problems.

Q113. An internal automation API uses TLS but its private key file is readable by every user on the server. What should the administrator do?

1. Restrict filesystem permissions so only the service identity and necessary administrators can access the private key
   2. Upload the private key to a public repository
   3. Email the key to all developers
   4. Disable TLS

Correct Answer: 4. Restrict filesystem permissions so only the service identity and necessary administrators can access the private key

Explanation: A TLS private key is a high-value secret because anyone who obtains it may be able to impersonate the service or undermine confidentiality depending on the protocol and circumstances. File permissions should restrict access to only the service account and authorized administrators. High-value keys can also be stored in HSMs or key-management services. The key should never be published or broadly distributed. TLS security depends not only on certificate validity but also on the protection of the corresponding private key throughout its lifecycle.

Q114. A network automation service uses a bearer token that appears in exception logs. Which secure coding change should be made?

1. Log the token more frequently
   2. Redact or exclude secrets from logs
   3. Commit the token to Git instead
   4. Disable API authentication

Correct Answer: 2. Redact or exclude secrets from logs

Explanation: Logs are often copied into SIEM systems, troubleshooting bundles, tickets, and collaboration platforms, so credentials appearing in log messages can spread far beyond the original application. Automation code should explicitly redact bearer tokens, passwords, API keys, and other secrets from normal and exception logging. It should still preserve useful context such as request identifiers, target systems, and non-sensitive error details. If a real token has already been exposed, the token should generally be revoked or rotated rather than merely removed from future logs.

Q115. A generative AI assistant produces an Ansible module name that does not exist. What should the engineer do before using the output?

1. Validate the module and syntax against authoritative Ansible and platform documentation
   2. Assume the module exists because the response is detailed
   3. Disable testing
   4. Give the AI production credentials and let it determine the result

Correct Answer: 1. Validate the module and syntax against authoritative Ansible and platform documentation

Explanation: Generative AI output can contain plausible but nonexistent commands, libraries, modules, or parameters. This is one form of hallucination. Engineers should confirm generated automation against authoritative documentation and test it in controlled environments before production use. Linting, CI validation, simulation, and code review add additional safeguards. The level of confidence in the language model should not replace technical validation. Cisco’s current AUTOCOR AI domain explicitly requires understanding AI-assisted automation benefits and risks, including code-validation requirements.

Q116. An engineer wants an AI system to generate a Python function that returns interface utilization as JSON. Which prompt element most directly improves output consistency for downstream automation?

1. Ask for “something useful” with no details
   2. Omit the requested output format
   3. Specify the required JSON schema or exact output structure
   4. Ask for several unrelated tasks simultaneously

Correct Answer: 3. Specify the required JSON schema or exact output structure

Explanation: Automation benefits from predictable machine-readable output. A prompt that clearly specifies expected fields, types, formatting, constraints, and examples gives the model a better chance of producing output that downstream systems can validate and consume. The result must still be parsed and verified because generative AI is probabilistic. Vague prompts increase ambiguity and can produce inconsistent responses. Structured output requirements are especially useful when AI-generated content becomes input to deterministic network automation workflows.

Q117. An MCP server exposes a function that retrieves router inventory. What is the most important reason to validate function arguments before querying the backend?

1. To reduce the chance of invalid or malicious AI-generated input reaching network systems
   2. To eliminate authentication requirements
   3. To give the model unrestricted database access
   4. To remove audit logging

Correct Answer: 2. To reduce the chance of invalid or malicious AI-generated input reaching network systems

Explanation: MCP function parameters may originate from user prompts or model-generated tool calls and should therefore be treated as untrusted input. Validation can confirm expected device names, identifiers, query limits, formats, and permitted values before the request reaches the network or source of truth. Authorization should also confirm that the requesting identity is allowed to access the requested resource. Input validation is an important boundary between probabilistic AI reasoning and deterministic infrastructure operations, particularly when AI agents are allowed to use real network tools.

Q118. A conversational network agent needs to explain why an interface is down. Which data combination gives the strongest operational context?

1. Only the interface name
   2. Interface state, recent logs, configuration, neighboring state, and relevant telemetry
   3. The user’s favorite color
   4. A year-old cached answer

Correct Answer: 3. Interface state, recent logs, configuration, neighboring state, and relevant telemetry

Explanation: Troubleshooting usually requires context from multiple sources. Interface status reveals the current condition, configuration shows intended settings, logs can identify transitions or errors, neighboring-device state can indicate link dependencies, and telemetry can show recent trends. Feeding this structured evidence into an AI assistant can produce a more grounded explanation than asking the model to infer the cause from a device name alone. The data should be current, authorized, and validated. AI reasoning is most useful when connected to trustworthy operational evidence rather than relying solely on pretrained knowledge.

Q119. An AI agent recommends changing an ACL because it believes an application server is unused. The asset database shows that the server supports a critical monthly batch process. What should the automation architecture do?

1. Compare the recommendation with authoritative asset and dependency data before permitting the change
   2. Delete the asset database because it disagrees with the model
   3. Apply the change immediately
   4. Disable rollback

Correct Answer: 4. Compare the recommendation with authoritative asset and dependency data before permitting the change

Explanation: AI recommendations must not override authoritative operational and business data automatically. If the asset database identifies a critical dependency that the model did not account for, the proposed ACL modification could create an outage. The automation architecture should use deterministic checks against sources of truth, dependency information, policy, and change requirements before a destructive or connectivity-affecting action is permitted. Human approval may also be appropriate. This illustrates why AI agents should be integrated into existing governance rather than becoming the sole decision-maker.

Q120. A network team wants an AI assistant to perform a configuration change only after the user explicitly confirms the exact generated command set. Which design pattern is being used?

1. Unattended autonomous execution
   2. Human-in-the-loop approval
   3. Anonymous configuration management
   4. Disabled authorization

Correct Answer: 1. Human-in-the-loop approval

Explanation: Human-in-the-loop design places an explicit human decision point between AI-generated recommendations and high-impact actions. The AI can interpret intent, generate commands, explain expected effects, and prepare an automation plan, but an authorized user must confirm the exact change before the tool executes it. This reduces the risk of hallucination, prompt injection, misunderstanding, or missing business context causing an outage. Approval does not replace technical authorization, validation, logging, or rollback; it complements them as an additional safeguard for impactful infrastructure changes.