Cisco Data Center Automation and Programmability Specialist — Practice Set 1

Question 1

A data center engineer wants to enable the NX-API REST interface on a Cisco Nexus switch running NX-OS. Which NX-OS configuration command enables this feature?

Accepted Answer

The NX-OS command `feature nxapi` enables the NX-API interface, which provides both NX-API REST (for managed objects) and NX-API CLI (for sending CLI commands via HTTP/HTTPS). `feature restconf` enables RESTCONF (RFC 8040) separately and does not enable NX-API. `feature netconf` enables the NETCONF interface on port 830. `ip http server` is a Cisco IOS/IOS-XE command that enables the basic HTTP server and is not applicable on NX-OS.

Question 2

An engineer sends an NX-API CLI request to a Nexus switch by posting to the `/ins` endpoint. Which key difference distinguishes this from a request to the NX-API REST endpoint `/api/mo/`?

Accepted Answer

NX-API CLI uses the /ins endpoint and accepts a payload containing a CLI command string (in the `input` field), returning the structured output (show command output) formatted as JSON or XML. NX-API REST uses the /api/mo/ endpoint and follows a managed object (MO) model, where resources are addressed by their distinguished name (DN) and CRUD operations are performed on the NX-OS object tree. Both interfaces use cookie-based (or HTTP Basic) authentication and operate over TCP/HTTPS. Neither uses UDP.

Question 3

A Python script running inside NX-OS guestshell needs to execute a NX-OS CLI command and capture its output. Which Python function provided by the `cisco.nxos` module performs this action?

Accepted Answer

Inside NX-OS guestshell, the `cisco.nxos` Python module provides the `dohost()` function, which runs a NX-OS CLI command and returns its output as a string. This is the canonical method for on-box Python scripts to interact with the NX-OS CLI. cisco.nxos.cli() does not exist. execute() and run_command() are not valid functions in the cisco.nxos module.

Question 4

A team wants to apply version control to Cisco Nexus switch configurations as part of a GitOps workflow. Which NX-OS feature must be enabled to allow the switch configuration to be exported, stored in Git, and re-applied from a file?

Accepted Answer

NX-OS supports configuration checkpointing, which saves a snapshot of the current running configuration as a named checkpoint file. These checkpoint files can be exported to an external server (via SCP/TFTP) and stored in a Git repository for version control. They can also be used to roll back to a known-good state. `feature bash-shell` enables the Linux bash shell on NX-OS but does not by itself provide config versioning. `feature telemetry` is for streaming operational data. Configuration rollback is the roll-back mechanism, which works in conjunction with checkpointing.

Question 5

An engineer builds an Ansible dynamic inventory for a Cisco Nexus environment. Which Ansible inventory plugin is specifically designed to query Cisco Nexus switches and build a dynamic inventory from their current state?

Accepted Answer

Ansible does not ship a dedicated NX-OS dynamic inventory plugin in the cisco.nxos collection. The standard approach for dynamic Nexus inventory is a custom script that queries the NX-API (REST or CLI) to enumerate devices and outputs the result as JSON conforming to the Ansible dynamic inventory format (with `_meta` and `hostvars`). amazon.aws.aws_ec2 is for AWS EC2 instances. nxos_facts with add_host is a workaround playbook technique, not a dynamic inventory plugin. ansible.builtin.constructed transforms an existing inventory but does not generate it from NX-API.

Question 6

An engineer authenticates to a Cisco APIC to use the ACI REST API. Which HTTP method and endpoint are used to obtain an authentication token?

Accepted Answer

Authentication to the Cisco APIC REST API requires a POST request to /api/aaaLogin.json (or .xml) with a JSON body containing the aaaUser object including the user's name and password attributes. On success, the APIC returns a JSON response containing the token in the aaaLogin.attributes.token field, which is then used as a cookie (APIC-cookie) or in the Authorization header for subsequent requests. A GET request cannot carry a request body for credentials. The /api/v1/auth/token path is the Cisco DNA Center authentication endpoint, not APIC.

Question 7

An engineer queries the Cisco APIC to list all EPGs (Endpoint Groups) within a tenant named `Prod` and an application profile named `WebApp`. Which ACI REST API URI correctly retrieves only the EPG objects using a subtree query?

Accepted Answer

The ACI REST API DN for an application profile is uni/tn-{tenant}/ap-{app}. To list only its direct EPG children, use query-target=children (scopes to direct children of the MO) combined with target-subtree-class=fvAEPg (filters to return only EPG objects of class fvAEPg). Option A returns all child objects regardless of class. Option C uses query parameters that do not exist in the ACI API. Option D queries the tenant MO with subtree scope, which would return all objects under the tenant, not just EPGs under a specific application profile.

Question 8

An engineer configures NETCONF on a Cisco Nexus 9000 switch. Which command verifies that NETCONF is enabled and displays the port it is listening on?

Accepted Answer

On NX-OS, the `show nxapi` command displays the status of all NX-API related features including NETCONF. It shows which interfaces NETCONF is enabled on, the listening port (830 for SSH-based NETCONF), and whether HTTP or HTTPS is configured. `show feature | include netconf` only shows whether the netconf feature is enabled or disabled, not the port details. `show nxapi status` is not a valid NX-OS command. `show netconf-yang status` is the IOS-XE command for NETCONF-YANG status, not applicable on NX-OS.

Question 9

An Ansible playbook uses the cisco.nxos collection to configure VLANs on a Nexus switch. Which module and FQCN correctly creates VLAN 100 with the name `Production`?

Accepted Answer

The current FQCN for VLAN management in the cisco.nxos collection is cisco.nxos.nxos_vlans (plural), which is the resource module accepting a list of VLAN configurations and a `state` parameter (merged, replaced, deleted, etc.). The older cisco.nxos.nxos_vlan (singular) module is deprecated in favour of nxos_vlans. cisco.nxos.nxos_config can push raw CLI lines but is less idempotent and does not provide structured state management. ansible.netcommon.cli_config is a generic module that lacks NX-OS specific handling.

Question 10

An engineer compares the openconfig-interfaces YANG model with the Cisco-NX-OS-device YANG model on a Nexus 9000. Which statement correctly distinguishes these two models?

Accepted Answer

The openconfig-interfaces model is defined by the OpenConfig consortium and provides a vendor-neutral, normalized schema for interface configuration and state that works across multiple vendor platforms. The Cisco-NX-OS-device YANG model is Cisco-proprietary and exposes NX-OS-specific constructs, feature sets, and configuration knobs that have no equivalent in the OpenConfig model (such as NX-OS-specific VPC or FabricPath parameters). They produce different NETCONF payloads with different namespaces and are not interchangeable. Both support loopback and all interface types.

Question 11

A network engineer uses Terraform with the Cisco ACI provider to define an ACI tenant. Which Terraform resource block correctly creates an ACI tenant named `Prod`?

Accepted Answer

The Cisco ACI Terraform provider uses resource types named with the `aci_` prefix followed by the object name. The correct resource type for an ACI tenant is `aci_tenant`, and the required attribute is `name`. The provider block must reference the CiscoDevNet/aci provider. `cisco_aci_tenant` is not a valid resource type in the ACI provider. Resource types use underscores, not dots (not `aci.tenant`). `aci_object` is a generic escape-hatch resource but requires specifying the class name and attributes differently.

Question 12

An Ansible playbook uses the cisco.aci collection to create an ACI EPG. Which module FQCN and required parameters are needed to create an EPG named `WebEPG` in tenant `Prod` under application profile `WebApp`?

Accepted Answer

The cisco.aci.aci_epg module (FQCN: cisco.aci.aci_epg) creates an ACI End Point Group and requires the tenant, ap (application profile), and epg parameters to construct the correct DN (uni/tn-Prod/ap-WebApp/epg-WebEPG). The state parameter controls creation (present) or deletion (absent). cisco.aci.aci_application_epg is not the correct module name. cisco.nxos.nxos_epg does not exist in the cisco.nxos collection. cisco.aci.aci_contract creates ACI contracts, not EPGs.

Question 13

An engineer uses Cisco NSO to automate NX-OS device management. Which NSO component translates NSO service model data into NX-OS-specific CLI commands?

Accepted Answer

The NSO NED (Network Element Driver) is the southbound component responsible for translating NSO's internal data model into the device-specific protocol and CLI syntax. The Cisco NX-OS NED communicates with Nexus switches via SSH CLI and handles the translation of NSO configuration objects into NX-OS configuration commands. The CDB stores the master copy of device and service configurations. The RESTCONF northbound interface exposes NSO's configuration to external systems. The service manager callback implements custom service logic but relies on the NED to push changes to the device.

Question 14

A data center team uses the Nexus Dashboard Fabric Controller (NDFC) REST API to automate fabric operations. After obtaining an authentication token, which HTTP header must be included in subsequent NDFC API requests to pass the token?

Accepted Answer

The Nexus Dashboard Fabric Controller (NDFC), formerly known as DCNM, uses a proprietary header named `X-Dcnm-Token` to pass the authentication token in all subsequent API requests after the initial login. The token is obtained by POSTing credentials to the NDFC login endpoint. X-Auth-Token is the header used by Cisco DNA Center. Authorization: Bearer is used by Intersight and other OAuth2/JWT-based APIs. APIC-cookie is the ACI APIC authentication header.

Question 15

An engineer uses the Cisco Nexus Dashboard Orchestrator (NDO) REST API to push multi-site policy from a central controller. Which primary advantage does NDO provide over managing each APIC site independently?

Accepted Answer

Cisco Nexus Dashboard Orchestrator (NDO) provides a single northbound REST API and UI to define stretched or replicated ACI policies across multiple ACI sites (Multi-Site Architecture). Changes defined at the NDO level are pushed to each site's APIC, ensuring policy consistency. NDO does not replace the individual site APICs — each site still has its own APIC cluster that handles local policy enforcement. NDO is specifically for multi-site ACI orchestration and is not an NX-OS fabric configuration tool. NDO does expose a fully documented REST API.

Question 16

A Terraform configuration for ACI defines a bridge domain resource. Which cisco ACI Terraform resource type correctly represents a bridge domain, and which attribute specifies its associated VRF?

Accepted Answer

In the Cisco ACI Terraform provider, the resource type for a bridge domain is `aci_bridge_domain`. The VRF association is defined using the `relation_fv_rs_ctx` attribute, which takes the DN of the VRF (aci_vrf resource). This mirrors the ACI object model where a bridge domain (fvBD) has a relation (fvRsCtx) to a VRF (fvCtx). `aci_vrf` defines the VRF object, not the bridge domain. `aci_bd` is not a valid resource type. `aci_network` does not exist in the ACI Terraform provider.

Question 17

An engineer uses the Cisco Intersight REST API to retrieve a list of all physical servers. Which endpoint returns the physical server inventory?

Accepted Answer

The Cisco Intersight REST API endpoint /api/v1/compute/PhysicalSummaries returns a summary of all physical server objects including rack-mount and blade servers managed by Intersight. Authentication is performed using an API key ID and RSA secret key to generate a request signature (Bearer token). /api/v1/compute/Blades returns only blade server objects. /api/v1/server/Inventory and /api/v1/ucs/servers are not valid Intersight API endpoints.

Question 18

A Python script uses the `ucsmsdk` library to query all service profiles from a Cisco UCS Manager instance. Which code correctly retrieves all LsServer objects (service profiles)?

Accepted Answer

In the ucsmsdk Python library, `handle.query_classid('LsServer')` queries all objects of the UCS Manager class `LsServer` (which represents service profiles) and returns a list of managed object instances. The handle is a UcsHandle object that was previously logged in using UcsHandle.login(). handle.get_all() is not a valid ucsmsdk method. handle.query_dn() retrieves a single object by its distinguished name. ucsmsdk.query() is not a valid function in the library.

Question 19

An engineer uses the Cisco UCS Manager XML API to authenticate and begin a session. Which XML element and attribute in the login request body correctly provides the user credentials?

Accepted Answer

The Cisco UCS Manager XML API authentication request uses the XML element `<aaaLogin>` with attributes `inName` (username) and `inPassword` (password). This POST request is sent to /nuova on the UCS Manager management IP. The response contains an `outCookie` attribute with the session token to be used in subsequent requests. The attributes `inName` and `inPassword` are the correct UCS Manager XML API parameter names. All other option formats use incorrect attribute names (username/password, user/pass) that are not recognized by the UCS Manager XML API.

Question 20

An Ansible playbook uses the cisco.ucs collection to manage UCS Manager objects. Which module allows pushing arbitrary UCS Manager managed objects defined as a dictionary, providing the most flexible approach for objects not covered by dedicated modules?

Accepted Answer

The cisco.ucs.ucs_managed_objects module is a generic module in the Cisco UCS Ansible collection that accepts a list of managed object dictionaries (specifying module class and attributes) and applies them to UCS Manager. It is the most flexible approach for managing UCS objects that lack a dedicated module. cisco.ucs.ucs_service_profile is a dedicated module only for service profiles. cisco.ucs.ucs_config_push does not exist as a module. ansible.builtin.uri can call the UCS XML API but requires manually crafting XML payloads without idempotency.

Question 21

An engineer checks the health of a Cisco HyperFlex cluster using the REST API. Which authentication method does the HyperFlex REST API use to protect its endpoints?

Accepted Answer

The Cisco HyperFlex REST API uses token-based Bearer authentication. An engineer first POSTs credentials to /aaa/v1/auth?grant_type=password to obtain an access token and refresh token. The access token is then passed as an Authorization: Bearer {token} header in subsequent API calls. SNMP community strings are used for SNMP-based monitoring, not REST API access. The HyperFlex API does not use HTTP Basic or SSH key authentication.

Question 22

An engineer queries the FLOGI (Fabric Login) database of a Cisco MDS SAN switch using the NX-API CLI interface. Which NX-OS command is sent in the NX-API CLI request to retrieve FC initiator information?

Accepted Answer

The `show flogi database` command on a Cisco MDS switch displays the Fabric Login database, which lists all devices (N ports) that have logged into the fabric including their FCID (Fibre Channel ID), WWPN (World Wide Port Name), and WWNN (World Wide Node Name). This is the primary command for discovering FC initiators and targets. When sent via NX-API CLI with JSON output format, it returns a structured JSON response. `show fc-alias database` shows FC alias definitions. `show zoneset active` shows the currently active zone set. `show vsan membership` shows which ports belong to each VSAN.

Question 23

An engineer automates FC zoning on a Cisco MDS switch using CLI automation via a Python script. In the correct order, which sequence of steps creates a new zone with a member, then activates it?

Accepted Answer

The correct sequence for FC zoning on Cisco MDS is: (1) Create the zone using `zone name {zone-name} vsan {id}`, (2) Add members to the zone using `member pwwn {wwpn}`, (3) Add the zone to an existing or new zoneset using `zoneset name {zoneset-name} vsan {id}` then `member {zone-name}`, (4) Activate the zoneset using `zoneset activate name {zoneset-name} vsan {id}`, (5) Commit the changes with `zone commit vsan {id}`. You cannot activate a zoneset before the zone and members are defined, and members must be added before activation.

Question 24

An engineer uses the Cisco NDFC SAN Controller REST API to automate VSAN creation on a Cisco MDS switch. After authentication, which HTTP method and endpoint are used to create a new VSAN?

Accepted Answer

The Cisco NDFC (Nexus Dashboard Fabric Controller) SAN Controller REST API uses a POST request to /rest/san/vsan to create a new VSAN. The request body contains a JSON object specifying the VSAN ID, name, and the fabric/switch scope. The X-Dcnm-Token authentication header obtained during login must be included. A GET to the same endpoint retrieves existing VSANs. The /api/v1/vsan/create and /dcnm/rest/lanConfig/vsan paths are not valid NDFC SAN API endpoints.

Question 25

An engineer provisions an NVMe-oF (NVMe over Fabrics) subsystem using the Redfish API on a storage controller. Which Redfish resource collection endpoint is used to manage NVMe storage subsystems?

Accepted Answer

In the DMTF Redfish specification, NVMe-oF subsystems are represented as StorageSubsystem resources under a StorageService. The correct collection path is /redfish/v1/StorageServices/{id}/StorageSubsystems, where each StorageSubsystem resource can be configured with NVMe-oF transport settings, host access, and namespace mappings. /redfish/v1/StorageServices/{id}/Volumes manages storage volumes, not the NVMe subsystem itself. /redfish/v1/NVMeDomains is not a standard Redfish resource collection. /redfish/v1/StorageServices/{id}/EndpointGroups manages fabric endpoints, which is related but not the subsystem resource itself.

300-635 DCAUTO — Cisco Data Center Automation and Programmability Specialist