{"id":18187,"date":"2026-09-22T05:58:43","date_gmt":"2026-09-22T05:58:43","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=18187"},"modified":"2026-09-22T05:58:43","modified_gmt":"2026-09-22T05:58:43","slug":"cisco-ccnp-automation-350-901-practice-test-questions-and-exam-dumps-part13-q241-260","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/cisco-ccnp-automation-350-901-practice-test-questions-and-exam-dumps-part13-q241-260\/","title":{"rendered":"Cisco CCNP Automation 350-901 Practice Test Questions and Exam Dumps Part13 Q241-260"},"content":{"rendered":"<p><b>View Full <\/b><a href=\"https:\/\/www.examlabs.com\/350-901-exam-dumps\"><b>Cisco CCNP Automation 350-901 Exam Dumps<\/b><\/a><b> and Practice Test Dumps.<\/b><\/p>\n<p><b><br \/>\n<\/b><b>Q241. An Ansible playbook targets 100 routers, but a task that queries a central asset-management API should execute only once for the entire play. Which Ansible keyword is most appropriate?<\/b><\/p>\n<ol>\n<li><b><\/b> <span style=\"font-weight: 400;\">serial: 1<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b> <span style=\"font-weight: 400;\">delegate_to: localhost<\/span><span style=\"font-weight: 400;\"> only<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b> <span style=\"font-weight: 400;\">run_once: true<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b> <span style=\"font-weight: 400;\">gather_facts: false<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. <\/b><b>run_once: true<\/b><\/p>\n<p><b>Explanation:<\/b> <span style=\"font-weight: 400;\">run_once: true<\/span><span style=\"font-weight: 400;\"> instructs Ansible to execute a task only once rather than once for every host in the play. This is appropriate for operations such as querying a central inventory system, creating one change ticket, or retrieving shared data. The resulting information can then be distributed or referenced by later tasks as required. <\/span><span style=\"font-weight: 400;\">delegate_to<\/span><span style=\"font-weight: 400;\"> changes where a task executes but does not by itself prevent the task from executing once per inventory host. <\/span><span style=\"font-weight: 400;\">serial<\/span><span style=\"font-weight: 400;\"> controls batch size, while <\/span><span style=\"font-weight: 400;\">gather_facts<\/span><span style=\"font-weight: 400;\"> controls automatic fact collection. Using <\/span><span style=\"font-weight: 400;\">run_once<\/span><span style=\"font-weight: 400;\"> avoids redundant API requests and unnecessary processing.<\/span><\/p>\n<p><b>Q242. A Terraform team renames a resource block in its configuration but wants Terraform to recognize that the existing infrastructure object has moved to the new resource address instead of destroying and recreating it. Which feature best supports this?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> An output block<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b> <span style=\"font-weight: 400;\">terraform fmt<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> A provider alias<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> A <\/span><span style=\"font-weight: 400;\">moved<\/span><span style=\"font-weight: 400;\"> block<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. A <\/b><b>moved<\/b><b> block<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> A Terraform <\/span><span style=\"font-weight: 400;\">moved<\/span><span style=\"font-weight: 400;\"> block records that an existing resource or module address has been renamed or reorganized in configuration. Terraform can then associate the existing state with the new address instead of interpreting the refactor as a request to destroy the old object and create a new one. This is useful when cleaning up Infrastructure as Code structure without changing the actual infrastructure. Engineers should still inspect the resulting plan before applying it. Output blocks expose values, provider aliases select provider configurations, and <\/span><span style=\"font-weight: 400;\">terraform fmt<\/span><span style=\"font-weight: 400;\"> only reformats Terraform source files.<\/span><\/p>\n<p><b>Q243. A REST API response returns HTTP 201 Created after an automation client successfully creates a network object. What does this status code indicate?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> A new resource was successfully created<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Authentication is required<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> The server is temporarily unavailable<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> The requested resource was not modified<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. A new resource was successfully created<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> HTTP 201 Created indicates that the request succeeded and resulted in the creation of a new resource. The server may also provide a <\/span><span style=\"font-weight: 400;\">Location<\/span><span style=\"font-weight: 400;\"> header identifying the URI of the new object and may include a representation of the created resource in the response body. Automation code should interpret this as a successful creation event rather than treating all success responses as HTTP 200. HTTP 401 relates to authentication, while 503 indicates temporary service unavailability. Correctly interpreting HTTP response codes is important when building reliable automation that consumes controller and network-management APIs.<\/span><\/p>\n<p><b>Q244. A Python automation application must process independent API calls concurrently because each call spends most of its time waiting on network I\/O. Which Python approach should the engineer evaluate?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Replacing all functions with global variables<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Converting the API responses to images<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Asynchronous I\/O using <\/span><span style=\"font-weight: 400;\">asyncio<\/span><span style=\"font-weight: 400;\"> and compatible clients<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Executing all requests strictly one at a time<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Asynchronous I\/O using <\/b><b>asyncio<\/b><b> and compatible clients<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Asynchronous I\/O can improve throughput for workloads dominated by waiting on network responses. Python&#8217;s <\/span><span style=\"font-weight: 400;\">asyncio<\/span><span style=\"font-weight: 400;\"> framework allows one execution thread to make progress on other tasks while an API request is waiting for I\/O, provided compatible asynchronous libraries are used. This can be useful when querying many network endpoints or controllers. Concurrency should still be bounded to respect device capacity and API rate limits. Async programming also introduces complexity in exception handling, cancellation, and result aggregation, so it should be chosen when workload scale and latency justify it rather than applied indiscriminately.<\/span><\/p>\n<p><b>Q245. A Git repository contains a large feature branch. An engineer wants to inspect an older branch in a second directory without repeatedly switching the branch in the current working tree. Which Git feature is most useful?<\/b><\/p>\n<ol>\n<li><b><\/b> <span style=\"font-weight: 400;\">git clean<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b> <span style=\"font-weight: 400;\">.gitignore<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b> <span style=\"font-weight: 400;\">git reset &#8211;hard<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b> <span style=\"font-weight: 400;\">git worktree<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. <\/b><b>git worktree<\/b><\/p>\n<p><b>Explanation:<\/b> <span style=\"font-weight: 400;\">git worktree<\/span><span style=\"font-weight: 400;\"> allows multiple working directories to be associated with the same repository, with each worktree checked out at a different branch or commit. This is useful when an engineer needs to compare automation code across releases, troubleshoot an older branch, or perform parallel work without repeatedly stashing and switching the primary working directory. Each worktree still shares the underlying repository history. <\/span><span style=\"font-weight: 400;\">git clean<\/span><span style=\"font-weight: 400;\"> removes untracked files, <\/span><span style=\"font-weight: 400;\">.gitignore<\/span><span style=\"font-weight: 400;\"> defines files that should normally remain untracked, and <\/span><span style=\"font-weight: 400;\">git reset &#8211;hard<\/span><span style=\"font-weight: 400;\"> modifies the current working tree and can discard local changes.<\/span><\/p>\n<p><b>Q246. A GitLab pipeline needs to provide a database token to one deployment job, but the token should not be exposed to pipelines from unprotected feature branches. Which approach is best?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Commit the token in the repository<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Use a protected CI\/CD variable restricted to protected branches or environments<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Put the token in a public artifact<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Add the token to every pipeline log<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Use a protected CI\/CD variable restricted to protected branches or environments<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Protected CI\/CD variables can limit sensitive values to trusted branches, tags, or deployment environments. This reduces the chance that unreviewed feature-branch code can print, exfiltrate, or misuse production credentials. The secret should also be masked where supported and preferably integrated with an external secrets-management system for stronger lifecycle controls. Committing tokens to Git can expose them permanently in repository history, while artifacts and logs may have broad visibility. CI\/CD security should ensure that pipeline code, credentials, environment protections, and deployment permissions all reflect least-privilege principles.<\/span><\/p>\n<p><b>Q247. A team wants to verify that a network automation pipeline can tolerate a simulated router failure during testing. Which use of Cisco Modeling Labs best supports this requirement?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Introduce controlled node or link failures in the test topology and validate expected recovery behavior<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Test only a perfectly healthy topology<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Replace CML with a static diagram<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Disable all validation when a node fails<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Introduce controlled node or link failures in the test topology and validate expected recovery behavior<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Cisco Modeling Labs enables engineers to create controlled network scenarios, including node outages or link failures, without affecting production users. Automation can then validate whether routing convergence, redundancy, alerting, and remediation behave as expected. This is valuable because testing only successful deployments does not reveal how automation responds to degraded conditions. A CI workflow can create the topology, inject a defined fault, execute pyATS or other tests, collect evidence, and clean up afterward. Failure testing strengthens confidence that automation handles both normal operations and realistic fault conditions safely.<\/span><\/p>\n<p><b>Q248. A network automation application retrieves device inventory from an API and must reject responses that do not match the expected structure before using them. Which technique best supports this?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Trust every response automatically<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Convert the response to plain text only<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Validate the response against an expected schema<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Disable exception handling<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Validate the response against an expected schema<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Schema validation verifies that incoming data contains the expected fields, data types, allowed values, and structural relationships before automation relies on it. This can detect malformed API responses, unexpected version changes, or corrupted data early in the workflow. Python libraries and formal JSON Schema definitions can be used to implement this pattern. Validation is particularly important when API output will drive device configuration because one unexpected field can otherwise propagate incorrect changes at scale. Schema validation does not replace authentication or business-level checks, but it provides a strong structural safeguard between external APIs and infrastructure automation.<\/span><\/p>\n<p><b>Q249. A model-driven telemetry collector must distinguish telemetry streams from multiple routers that publish the same YANG paths. Which metadata is especially important?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The source device identity<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> The engineer&#8217;s Git username<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> The Docker image tag only<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> The Terraform workspace name only<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. The source device identity<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> When many devices publish identical telemetry paths, the collector must know which device generated each update. Source identity enables dashboards, alerts, analytics, and troubleshooting systems to associate a measurement with the correct router, switch, or controller. Timestamps and sensor paths are also important, but identical paths without reliable source identity would make data ambiguous. Collector architectures should therefore preserve device identity throughout ingestion, normalization, storage, and downstream processing. Metadata design is essential to telemetry quality because data without trustworthy context can produce misleading operational conclusions even when the underlying metric values are correct.<\/span><\/p>\n<p><b>Q250. A network automation application receives hundreds of telemetry events per second but should generate only one alert when the same interface repeatedly flaps during a short window. Which mechanism best reduces alert storms?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Disable monitoring permanently<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Event aggregation or suppression within a defined time window<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Create a separate alert for every telemetry sample<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Remove timestamps from all events<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Event aggregation or suppression within a defined time window<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Event aggregation groups related events into a smaller number of actionable alerts. If an interface rapidly transitions between states, generating an independent incident for every transition can overwhelm operators and incident systems. A defined suppression or correlation window can summarize repeated events while still retaining the underlying telemetry for analysis. The design should avoid hiding meaningful persistent failures, so thresholds and windows must match operational requirements. Effective automation should reduce noise without losing evidence. Alert quality is important because excessive low-value notifications can cause operators to overlook genuinely critical network conditions.<\/span><\/p>\n<p><b>Q251. A pyATS test successfully connects to a device but fails when parsing the output of a command because the device software version changed the CLI format. What is the best response?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Assume the test passed<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Delete all validation<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Verify parser support for the platform and software version and update the validation appropriately<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Convert the output to an image<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Verify parser support for the platform and software version and update the validation appropriately<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Structured parsers depend on supported platform and software output formats. A device upgrade can introduce CLI differences that an older parser does not understand. The engineer should confirm parser compatibility, update relevant libraries, or use an alternate supported data source such as a model-driven API when appropriate. Treating the parse failure as a successful test would hide uncertainty about the network state. Validation tooling itself must therefore be versioned and tested alongside infrastructure changes. Reliable automation includes maintaining parsers and test dependencies as network operating systems evolve.<\/span><\/p>\n<p><b>Q252. An automation service calls several external APIs. Operators need to trace one user request across all of those downstream calls. Which observability practice best supports this?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Remove request identifiers<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Use unrelated log formats for every service<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Log only application startup messages<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Propagate a consistent correlation or trace identifier across the workflow<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Propagate a consistent correlation or trace identifier across the workflow<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> A correlation or trace identifier allows logs and events from multiple components to be associated with one end-to-end workflow. When an automation request triggers calls to inventory, controllers, validation systems, and incident platforms, the same identifier can be included throughout those interactions. Operators can then reconstruct the sequence without relying only on timestamps or manual guesswork. The identifier should not contain sensitive information and should be generated in a way that avoids collisions. Distributed automation becomes significantly easier to troubleshoot when every component preserves consistent tracing context.<\/span><\/p>\n<p><b>Q253. An automation service is configured for mutual TLS. What additional authentication occurs compared with ordinary server-authenticated TLS?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The client also presents a certificate that the server validates<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Encryption is disabled after the handshake<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> The server no longer presents a certificate<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Both systems share the server&#8217;s private key<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. The client also presents a certificate that the server validates<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> In mutual TLS, both sides authenticate using certificates. The server presents its certificate to the client as in conventional HTTPS, and the client also presents a certificate that the server validates against trusted certificate authorities and policy. This provides strong workload or machine identity without sharing passwords. Each endpoint retains its own private key; private keys are never exchanged during normal TLS authentication. Certificate issuance, rotation, revocation, and authorization mapping still need to be managed carefully. mTLS can be useful when automation services communicate across trusted machine-to-machine interfaces requiring strong identity assurance.<\/span><\/p>\n<p><b>Q254. A development team changes the system prompt used by an AI network agent. What practice best supports controlled comparison and rollback if the new prompt performs poorly?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Replace the old prompt permanently with no record<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Version-control prompt templates and associate evaluations with each version<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Store prompts only in individual engineers&#8217; clipboard history<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Disable AI testing<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Version-control prompt templates and associate evaluations with each version<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Prompt templates are part of the behavior of an AI application and should be treated as managed configuration or code. Version control provides history, review, comparison, and rollback, while a repeatable evaluation suite allows the team to measure whether a new prompt improves or degrades technical performance. Deployment records can then identify which prompt version was active during a particular result. Without this discipline, AI behavior can change without traceability. Prompt versioning is particularly useful when network automation agents use complex system instructions, retrieval policies, and tool-selection guidance.<\/span><\/p>\n<p><b>Q255. An AI retrieval system stores document embeddings in a vector database. The user is authorized to view only documents for Site A. Which design best enforces this restriction?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Retrieve every document and ask the LLM not to mention Site B<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Remove all user identity information<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Apply authorization metadata filters during retrieval before documents reach the model<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Depend only on prompt wording<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Apply authorization metadata filters during retrieval before documents reach the model<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Access control should be enforced at retrieval time so unauthorized content is never supplied to the language model. Metadata associated with each indexed document can identify site, owner, classification, tenant, or other authorization attributes. The retrieval system then filters candidates according to the authenticated user&#8217;s permissions before semantic ranking or context assembly. Asking the model to hide unauthorized information is insufficient once that information is already in its context. This principle is especially important for network design documents, configurations, security policies, and customer-specific infrastructure information stored in shared retrieval systems.<\/span><\/p>\n<p><b>Q256. An MCP server offers a tool that can retrieve interface counters. What should happen if the AI agent supplies a device identifier that does not exist in the approved inventory?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The server should invent the closest device name<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> The server should reject the request through deterministic validation<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> The server should query every device automatically<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> The server should disable authentication<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. The server should reject the request through deterministic validation<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> MCP tool arguments should be validated independently of the model. If a requested device does not exist in the approved inventory, the server should return a controlled error rather than guessing or broadening the query. This prevents hallucinated identifiers from producing unexpected infrastructure access and makes the agent&#8217;s failure explicit. The validation layer can also check authorization, parameter type, resource limits, and allowed operations. Language models are probabilistic, so deterministic server-side controls are essential whenever AI-generated tool calls interact with real network systems.<\/span><\/p>\n<p><b>Q257. A conversational AI network agent gives a highly confident answer that conflicts with current telemetry. What should the application prioritize?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The model&#8217;s confidence wording<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> The current validated operational evidence<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> The longest generated explanation<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> The oldest cached answer<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. The current validated operational evidence<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Natural-language confidence is not evidence of technical correctness. If current validated telemetry contradicts the model&#8217;s statement, the application should prioritize the authoritative operational data. The agent can revise its explanation using that evidence or acknowledge uncertainty if sources remain inconsistent. AI systems should be designed so factual network state comes from trusted tools, telemetry, controllers, and sources of truth rather than from model intuition. This is central to safe AI-assisted operations because persuasive language can otherwise cause engineers to over-trust incorrect recommendations or diagnoses.<\/span><\/p>\n<p><b>Q258. An AI automation platform proposes a configuration change affecting 200 devices, while the user requested a change for only one site. Which safeguard should detect the mismatch before execution?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> A scope-validation check comparing requested intent with exact target inventory<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> A higher model temperature<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Removal of the change preview<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Unlimited administrator privileges<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. A scope-validation check comparing requested intent with exact target inventory<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Automation should explicitly compare the user&#8217;s requested scope with the generated execution plan. If the user requested one site but the plan targets 200 devices across several sites, the workflow should fail validation or require correction before any change is applied. Target lists should be derived from authoritative inventory and displayed clearly during review. This deterministic check limits the impact of hallucinated filters, ambiguous prompts, or programming errors. High-impact infrastructure actions should never rely solely on a language model&#8217;s interpretation of scope without an independent verification layer.<\/span><\/p>\n<p><b>Q259. A network AI assistant is used to summarize a large set of incident logs. What is the best way to reduce the risk that critical rare events disappear during summarization?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Discard raw logs after the first summary<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Use only the model&#8217;s summary for all investigations<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Preserve raw evidence and combine summarization with deterministic filtering for critical indicators<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Remove timestamps before summarizing<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Preserve raw evidence and combine summarization with deterministic filtering for critical indicators<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> Summarization is lossy by nature and can omit events the model considers less important. Critical security or operational indicators should therefore be detected using deterministic rules, searches, or analytics in addition to AI summarization. Raw logs should remain available for investigation, audit, and reprocessing. The AI can help reduce information overload and explain patterns, but it should not become the sole record of what occurred. Preserving evidence and using explicit detection logic reduces the chance that a rare but important event disappears from the operator&#8217;s view.<\/span><\/p>\n<p><b>Q260. A network automation team wants an AI agent to suggest remediations but never perform them automatically. Which architecture best satisfies this requirement?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Give the model unrestricted write tools but instruct it not to use them<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>2.<\/b><span style=\"font-weight: 400;\"> Expose read-only diagnostic tools and return remediation recommendations for human execution<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>3.<\/b><span style=\"font-weight: 400;\"> Disable audit logging<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><b>4.<\/b><span style=\"font-weight: 400;\"> Allow configuration changes whenever confidence exceeds 50%<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Expose read-only diagnostic tools and return remediation recommendations for human execution<\/b><\/p>\n<p><b>Explanation:<\/b><span style=\"font-weight: 400;\"> If the agent&#8217;s role is advisory, the safest architecture is to provide only the read capabilities necessary for diagnosis and prevent it from having write access at all. The model can gather current state, analyze evidence, and produce recommended remediation steps that an engineer reviews and executes through approved processes. This creates a stronger boundary than relying on prompt instructions to prevent use of available destructive tools. Tool permissions should reflect the intended autonomy level of the agent, while authentication, authorization, logging, and data-access controls remain enforced independently.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>View Full Cisco CCNP Automation 350-901 Exam Dumps and Practice Test Dumps. Q241. An Ansible playbook targets 100 routers, but a task that queries a central asset-management API should execute only once for the entire play. Which Ansible keyword is most appropriate? serial: 1 2. delegate_to: localhost only 3. run_once: true 4. gather_facts: false Correct [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18187"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=18187"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18187\/revisions"}],"predecessor-version":[{"id":18188,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18187\/revisions\/18188"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=18187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=18187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=18187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}