{"id":18175,"date":"2026-09-22T05:56:51","date_gmt":"2026-09-22T05:56:51","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=18175"},"modified":"2026-09-22T05:56:51","modified_gmt":"2026-09-22T05:56:51","slug":"cisco-ccnp-automation-350-901-practice-test-questions-and-exam-dumps-part7-q121-140","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/cisco-ccnp-automation-350-901-practice-test-questions-and-exam-dumps-part7-q121-140\/","title":{"rendered":"Cisco CCNP Automation 350-901 Practice Test Questions and Exam Dumps Part7 Q121-140"},"content":{"rendered":"<p><b>View Full<\/b><a href=\"https:\/\/www.examlabs.com\/350-901-exam-dumps\"> <b>Cisco CCNP Automation 350-901 Exam Dumps<\/b><\/a><b> and Practice Test Dumps.\u00a0<\/b><\/p>\n<p><b><br \/>\n<\/b><b>Q121. An Ansible playbook changes an OSPF configuration and should restart a related service only when that configuration task reports a change. Which Ansible mechanism is most appropriate?<\/b><\/p>\n<ol>\n<li><b><\/b> <span style=\"font-weight: 400;\">register<\/span><span style=\"font-weight: 400;\"> only<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b> <span style=\"font-weight: 400;\">serial<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> A handler triggered with <\/span><span style=\"font-weight: 400;\">notify<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b> <span style=\"font-weight: 400;\">check_mode<\/span><span style=\"font-weight: 400;\"> only<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. A handler triggered with <\/b><b>notify<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Ansible handlers are tasks that normally run only when notified by another task that reports a change. This is useful when an operational action, such as restarting or reloading a service, should occur only after its configuration has actually been modified. The configuration task uses <\/span><span style=\"font-weight: 400;\">notify<\/span><span style=\"font-weight: 400;\">, and the corresponding handler executes later in the play. This reduces unnecessary disruptive operations during idempotent playbook runs. <\/span><span style=\"font-weight: 400;\">register<\/span><span style=\"font-weight: 400;\"> stores task results, while <\/span><span style=\"font-weight: 400;\">serial<\/span><span style=\"font-weight: 400;\"> controls batch execution. <\/span><span style=\"font-weight: 400;\">check_mode<\/span><span style=\"font-weight: 400;\"> previews potential changes but does not provide the event-driven execution behavior required in this scenario.<\/span><\/p>\n<p><b>Q122. A Terraform configuration needs to read information about an already existing network object without creating or managing that object. Which Terraform construct should be used?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Output block<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Local variable only<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Managed resource block<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Data source<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Data source<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Terraform data sources allow a configuration to query information about infrastructure that already exists and is not being created as a managed resource by that particular configuration. The returned attributes can then be referenced when building other resources or calculating configuration values. For example, a workflow might query an existing network, site, or platform object and use its identifier when creating new resources. A managed resource block tells Terraform to manage lifecycle state for the object. Outputs expose values from a configuration, while locals calculate reusable expressions. Data sources are therefore appropriate for read-only infrastructure lookups.<\/span><\/p>\n<p><b>Q123. A RESTCONF client needs to update the description of interface <\/b><b>GigabitEthernet1<\/b><b> in a YANG list where the interface name is the list key. What must the client include in the request URI?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Only the top-level RESTCONF root<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> The key identifying the specific interface list entry<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> A Git commit hash<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> A Terraform state serial number<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. The key identifying the specific interface list entry<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> YANG lists contain multiple entries distinguished by one or more key leaves. When a RESTCONF client targets one particular list entry, the resource path must identify that entry using the appropriate key value according to RESTCONF URI rules. Without the key, the request could refer to the entire list rather than the intended interface. The payload must also conform to the YANG schema and use the correct namespace and data hierarchy. Git and Terraform identifiers are unrelated. Correctly constructing resource URIs is essential for precise model-driven configuration and for avoiding accidental modification of unintended objects.<\/span><\/p>\n<p><b>Q124. A Python automation script must identify device names that appear in both an inventory API response and a monitoring-system response. Which Python data type is especially useful for finding the intersection efficiently?<\/b><\/p>\n<ol>\n<li><b><\/b> <span style=\"font-weight: 400;\">set<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b> <span style=\"font-weight: 400;\">str<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b> <span style=\"font-weight: 400;\">bytes<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b> <span style=\"font-weight: 400;\">float<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. <\/b><b>set<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Python sets are collections of unique values and support operations such as intersection, union, and difference. Converting device-name collections from two systems into sets makes it straightforward to identify names present in both by calculating their intersection. This is often simpler and more efficient than using deeply nested loops, especially for larger inventories. Strings represent textual values, bytes represent binary data, and floats represent numeric values. Automation engineers should select data structures according to the operation being performed because appropriate structures can make code clearer, faster, and less error-prone.<\/span><\/p>\n<p><b>Q125. An API returns HTTP 401 for an automation request even though the target resource exists. What should the application investigate first?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Network MTU only<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Terraform formatting<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Git branch history<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Missing, expired, or invalid authentication credentials<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Missing, expired, or invalid authentication credentials<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> HTTP 401 indicates that the request lacks valid authentication credentials for the target resource. The automation application should verify whether the access token, API key, session credential, or other authentication information is missing, expired, malformed, or otherwise rejected. Depending on the API, the client might need to refresh a token or perform the documented authentication flow again. HTTP 403 generally indicates that the caller has been authenticated but lacks authorization for the requested action. Robust automation should distinguish these conditions and avoid blindly retrying an authentication failure without first correcting or refreshing the credential.<\/span><\/p>\n<p><b>Q126. A Git repository contains a feature commit that must be copied to a release branch without merging the rest of the feature branch. Which operation is most appropriate?<\/b><\/p>\n<ol>\n<li><b><\/b> <span style=\"font-weight: 400;\">git reset &#8211;hard<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b> <span style=\"font-weight: 400;\">git cherry-pick<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b> <span style=\"font-weight: 400;\">git init<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b> <span style=\"font-weight: 400;\">git clean -fd<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. <\/b><b>git cherry-pick<\/b><\/p>\n<p><b>Explanation:<\/b> <span style=\"font-weight: 400;\">git cherry-pick<\/span><span style=\"font-weight: 400;\"> applies the changes introduced by a selected commit onto the current branch and creates a corresponding new commit. This is useful when a specific fix needs to be promoted to a release branch while other development commits remain on the feature branch. The operation can produce conflicts if the target branch differs significantly, so the resulting code should still be reviewed and tested. <\/span><span style=\"font-weight: 400;\">git reset<\/span><span style=\"font-weight: 400;\"> changes branch history, <\/span><span style=\"font-weight: 400;\">git init<\/span><span style=\"font-weight: 400;\"> creates a repository, and <\/span><span style=\"font-weight: 400;\">git clean<\/span><span style=\"font-weight: 400;\"> removes untracked files. Cherry-pick is designed specifically for selectively transferring commits.<\/span><\/p>\n<p><b>Q127. A GitLab pipeline builds a network automation container image. What is the best reason to assign a unique immutable image tag based on a commit identifier?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> It makes the deployed artifact traceable to the exact source revision<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> It prevents Docker from using networking<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> It eliminates the need for testing<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> It automatically resolves Git conflicts<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. It makes the deployed artifact traceable to the exact source revision<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> An immutable image tag based on a Git commit identifier creates a clear relationship between a built container and the exact source revision that produced it. This improves troubleshooting, rollback, auditing, and reproducibility because operators can identify precisely which code is running. Generic mutable tags such as <\/span><span style=\"font-weight: 400;\">latest<\/span><span style=\"font-weight: 400;\"> can change over time and make it harder to determine which artifact was actually deployed. A commit-based tag does not replace vulnerability scanning, testing, or artifact signing, but it strengthens traceability throughout the CI\/CD lifecycle. It has no role in Docker networking or Git conflict resolution.<\/span><\/p>\n<p><b>Q128. A CML-based CI test passes when one router is present, but the automation fails when the topology includes 100 devices because the script processes devices strictly one at a time. Which improvement should be evaluated?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Remove all error handling<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Disable the simulation<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Introduce controlled concurrency where the platform and APIs safely support it<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Add artificial delays to every operation<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Introduce controlled concurrency where the platform and APIs safely support it<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Sequential processing can become a scalability bottleneck when automation expands to many devices. Controlled concurrency can improve execution time by allowing multiple independent operations to proceed in parallel. However, concurrency must be bounded according to device capabilities, controller rate limits, shared resources, and failure-handling requirements. Unlimited parallelism can overload devices or APIs and create unpredictable behavior. A realistic CML topology can help teams test scalability before production. The correct solution is not simply to make everything parallel, but to design concurrency intentionally with limits, timeouts, retries, and safe aggregation of results.<\/span><\/p>\n<p><b>Q129. A Docker Compose service must be considered healthy only after an internal HTTP endpoint returns success. Which Compose feature should be configured?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Git hook<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Named volume<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Terraform output<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Health check<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Health check<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Docker health checks allow the platform to execute a command periodically to determine whether a containerized application is actually functioning correctly. For an HTTP service, the check can call a local health endpoint and evaluate its result. A running container process does not necessarily mean the application is ready or healthy, so health checks provide a more meaningful operational status. Other services or orchestration logic can use this information when deciding whether to send traffic or consider dependencies available. Named volumes provide storage, while Git and Terraform constructs do not evaluate container application health.<\/span><\/p>\n<p><b>Q130. A source-of-truth platform stores device serial numbers, sites, roles, and intended interface assignments. Why should automation avoid storing duplicate independent copies of the same authoritative information in many scripts?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Duplicate copies can drift and create inconsistent automation decisions<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Python cannot read repeated data<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> REST APIs prohibit duplicated values<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Git cannot store inventory files<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Duplicate copies can drift and create inconsistent automation decisions<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> When the same authoritative information is manually copied into scripts, spreadsheets, and local files, those copies can diverge over time. One workflow may then use an old site assignment while another uses the current value, producing inconsistent changes. Centralizing authoritative network data in a source of truth reduces duplication and gives automation a consistent reference point. Local caching can still be used when designed carefully, but ownership and synchronization must be clear. A source of truth is valuable not merely because it stores data, but because it establishes which system owns the intended network information.<\/span><\/p>\n<p><b>Q131. In a model-driven telemetry architecture, what is the main purpose of defining a subscription?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Create a Git branch<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Generate a TLS private key<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Specify what telemetry data should be streamed and under what update behavior<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Build a Docker image<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Specify what telemetry data should be streamed and under what update behavior<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> A telemetry subscription tells a network device or telemetry system which modeled data should be sent to a collector and how updates should occur. Depending on the implementation, data may be sampled periodically or sent when changes occur. Well-designed subscriptions collect the information needed for monitoring without overwhelming devices, networks, collectors, or storage systems. The chosen paths, frequencies, and destinations should align with operational requirements. Git branches, certificate keys, and Docker images serve unrelated development or security functions. Subscription design is therefore central to scalable model-driven telemetry architecture.<\/span><\/p>\n<p><b>Q132. A network automation service sends a webhook to an incident-management platform when deployment validation fails. Which security measure best verifies that the webhook was sent by the legitimate automation service?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Remove HTTPS<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Validate a cryptographic signature or shared message authentication value<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Trust any request reaching the endpoint<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Accept requests anonymously from the Internet<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Validate a cryptographic signature or shared message authentication value<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> A webhook receiver should verify that an incoming request came from an authorized sender and was not modified in transit. Many systems use an HMAC or similar signature calculated over the payload with a shared secret, while other designs can use mutual TLS or signed tokens. HTTPS should also protect the transport. Simply knowing the endpoint URL is not sufficient authentication because attackers might discover and invoke it. Webhook payloads should additionally be validated for schema, size, replay attempts, and permitted values before triggering downstream incident or automation actions.<\/span><\/p>\n<p><b>Q133. A pyATS test checks that the routing table contains a specific prefix after a network change. What makes this test more valuable than simply checking whether the configuration command succeeded?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> It validates the resulting operational state rather than only the configuration action<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> It automatically signs a TLS certificate<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> It prevents Git conflicts<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> It replaces all source-of-truth data<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. It validates the resulting operational state rather than only the configuration action<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> A configuration command can be accepted by a device even when the desired network outcome does not occur. A routing policy might be syntactically valid but fail to install a route because of another dependency. By checking the actual routing table, pyATS verifies the operational effect that matters to the network. This distinction is central to reliable automation: deployment and validation are separate concerns. Post-validation allows pipelines to detect unexpected outcomes and trigger rollback or investigation rather than assuming that successful configuration transport equals successful network behavior.<\/span><\/p>\n<p><b>Q134. A Python automation script must compare a user-provided VLAN ID with the allowed range of 1 through 4094 before generating configuration. What secure coding control should be applied?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Log the raw input without validation<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Pass the value directly into a CLI command<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Convert all input to administrator commands<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Validate type and range before use<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Validate type and range before use<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> External input should be validated before it influences device configuration. The script should confirm that the VLAN value is numeric and within the permitted range and can also reject values reserved or prohibited by organizational policy. This reduces the chance of malformed data, accidental misconfiguration, or command injection reaching the device. Validation should occur as early as practical in the workflow and should fail clearly when the value is unacceptable. Logging can preserve sanitized details, but logging does not replace validation. Secure coding is particularly important because automation can apply bad input at large scale.<\/span><\/p>\n<p><b>Q135. A network automation service uses an API client ID and secret. The organization wants the secret rotated without modifying the application&#8217;s source code. What design is best?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Hard-code the secret in every Python module<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Retrieve the credential from a centralized secrets-management service<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Store the secret in the public Git repository<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Print the secret into deployment logs<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Retrieve the credential from a centralized secrets-management service<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> A secrets-management platform separates credential lifecycle from application source code. The automation service can authenticate to the secret store using a workload identity and retrieve the current credential at runtime. Administrators can then rotate the API secret centrally without committing new passwords to the repository. This also enables auditing and more granular access control. If a secret is hard-coded into Git, it may remain visible in repository history after removal. Logs are similarly inappropriate for secrets because they are often widely replicated. Central secret management therefore improves rotation and reduces accidental exposure.<\/span><\/p>\n<p><b>Q136. A generative AI assistant writes an Ansible ACL task that is syntactically valid but accidentally permits <\/b><b>any any<\/b><b>. Which control should catch this before deployment?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> A larger LLM context window<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Removing all policy checks<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Automated policy validation plus code review and testing<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Giving the AI full device access<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Automated policy validation plus code review and testing<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> AI-generated code can be syntactically correct while still violating network or security intent. Automated policy checks can detect dangerous ACL patterns such as unrestricted permits, while code review and controlled testing provide additional protection. CI\/CD should treat AI-generated automation exactly like other untrusted code and require the same or stronger validation. A larger context window does not guarantee the model will make safe decisions. Direct production access increases the potential impact of mistakes. AI can accelerate automation development, but deterministic controls should decide whether generated configuration satisfies organizational policy.<\/span><\/p>\n<p><b>Q137. A company uses a public AI coding assistant to generate network automation. Which intellectual-property issue should the architecture team evaluate?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Whether OSPF supports areas<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> How submitted and generated code is retained, licensed, or used by the service provider<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Whether VLAN IDs are numeric<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Whether CML uses virtual routers<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. How submitted and generated code is retained, licensed, or used by the service provider<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> AI coding services can introduce intellectual-property questions involving proprietary code submitted in prompts, generated output, model-training practices, retention, and licensing terms. Organizations should review provider contracts and service policies before sending confidential network automation or architecture information. Enterprise offerings may provide controls that differ from public consumer services. Developers should also validate generated code for third-party licensing implications where relevant. Cisco&#8217;s current AUTOCOR AI domain explicitly identifies IP ownership and data privacy among the risks of AI-assisted network automation development.<\/span><\/p>\n<p><b>Q138. An MCP server exposes both <\/b><b>get_routes<\/b><b> and <\/b><b>delete_route<\/b><b>. The AI assistant is intended only for troubleshooting. What should the server do?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Expose only the read-only <\/span><span style=\"font-weight: 400;\">get_routes<\/span><span style=\"font-weight: 400;\"> capability to that assistant<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Give the assistant unrestricted access to both functions<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Disable caller authentication<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Allow user prompts to decide permissions dynamically<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Expose only the read-only <\/b><b>get_routes<\/b><b> capability to that assistant<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Tool access should follow least privilege and match the agent&#8217;s intended function. If the conversational assistant exists only for troubleshooting, it does not need a route-deletion tool. Removing or withholding destructive functionality provides a stronger security boundary than merely prompting the LLM not to use it. The MCP server should also authenticate callers, validate parameters, log tool invocations, and apply authorization independently of user wording. This design reduces the impact of prompt injection, model hallucination, or accidental tool selection.<\/span><\/p>\n<p><b>Q139. An AI agent reports that a routing change succeeded, but pyATS post-validation shows that the expected routes are missing. Which result should the automation system trust for the final deployment decision?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The AI statement because it is natural language<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Whichever result appears first<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> The operator&#8217;s assumption without evidence<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Deterministic post-validation of actual network state<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Deterministic post-validation of actual network state<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> The actual network state is the authoritative measure of whether the change achieved its intended outcome. An AI model can summarize or interpret results, but its statements are probabilistic and may be incomplete or incorrect. pyATS or equivalent deterministic tests can inspect live routing state and compare it against explicit expected conditions. If those tests fail, the pipeline should treat the deployment as unsuccessful regardless of an optimistic AI narrative. This illustrates a key architecture principle for AI-assisted automation: language models can assist reasoning, but deterministic infrastructure validation should control high-impact decisions.<\/span><\/p>\n<p><b>Q140. A conversational agent uses current telemetry, source-of-truth information, and operational logs to answer network questions. What is the strongest way to reduce hallucinated answers?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Ask the model to answer without any external evidence<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Disable access to authoritative data<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Ground responses in retrieved authoritative data and require the agent to distinguish evidence from inference<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Increase model temperature for maximum creativity<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Ground responses in retrieved authoritative data and require the agent to distinguish evidence from inference<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> An operational AI assistant is more reliable when its answers are grounded in current authoritative sources such as telemetry, controllers, source-of-truth systems, logs, and validated device state. The agent should base factual claims on retrieved evidence and clearly separate observed data from reasoning or recommendations. This does not eliminate hallucination, so deterministic validation and human review remain important for high-impact actions. Removing authoritative data forces the model to rely more heavily on pretrained information or guesswork. Grounded retrieval therefore improves factual reliability in conversational network automation.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps.\u00a0 Q121. An Ansible playbook changes an OSPF configuration and should restart a related service only when that configuration task reports a change. Which Ansible mechanism is most appropriate? register only 2. serial 3. A handler triggered with notify 4. check_mode only Correct Answer: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18175"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=18175"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18175\/revisions"}],"predecessor-version":[{"id":18176,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18175\/revisions\/18176"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=18175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=18175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=18175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}