Cisco Enterprise Automation and Programmability Specialist — Practice Set 1

Question 1

A network engineer writes a Python script to build a device inventory dictionary. The script stores router hostnames as keys and their management IP addresses as values. Which Python data structure is most appropriate for this use case?

Accepted Answer

A Python dictionary (dict) is the correct choice because it stores key-value pairs, allowing direct lookup of an IP address using the hostname as a key in O(1) average time. A list of tuples would require iterating all entries to find a match. A set stores only unique values with no associated data. A bytearray is used for mutable sequences of bytes, not key-value mappings.

Question 2

A network automation engineer wants to use Python's `re` module to extract all IPv4 addresses from the output of a `show ip interface brief` command stored in a string. Which function should be used to return all non-overlapping matches as a list?

Accepted Answer

re.findall() scans the entire string and returns a list of all non-overlapping matches of the pattern, making it ideal for extracting all IP addresses from multi-line show output. re.match() only checks at the beginning of the string and returns at most one match. re.search() scans for the first match anywhere in the string and returns a single match object. re.compile() compiles a regex pattern into a pattern object but does not perform a search by itself.

Question 3

A network automation engineer clones a shared Git repository, makes changes to a device configuration template, and wants to push those changes. In the correct order, which sequence of Git commands should be used?

Accepted Answer

The correct Git workflow is: (1) git add to stage changes in the working directory to the index (staging area); (2) git commit to record the staged snapshot into the local repository history with a commit message; (3) git push to upload the local commits to the remote repository. Pushing before committing is invalid. Committing before staging is not possible because unstaged files are not included in the commit.

Question 4

An engineer is setting up a Python project for network automation and wants to isolate package dependencies so they do not conflict with the system Python installation. Which command creates a virtual environment named `netauto_env` using the standard library?

Accepted Answer

python3 -m venv netauto_env invokes the built-in venv module (available since Python 3.3) to create an isolated virtual environment in a directory called netauto_env. pip install is used to install packages, not create environments. virtualenv is a third-party tool with a different syntax and is not part of the standard library. There is no `pip create` subcommand.

Question 5

A DevOps team wants to automate network configuration deployments using a CI/CD pipeline. Which description correctly defines the role of a CI/CD pipeline in network automation?

Accepted Answer

A CI/CD (Continuous Integration/Continuous Deployment) pipeline automates the workflow of integrating code changes from a Git repository, running automated tests (lint, syntax checks, pyATS tests), and deploying validated configurations to network devices. Tools such as Jenkins and GitLab CI are vendor-agnostic and support any device programmable via API or CLI. CI/CD does not replace version control — it depends on it. It is not a graphical tool and is not Cisco-proprietary.

Question 6

A network engineer establishes a NETCONF session to a Cisco IOS-XE router. On which TCP port does NETCONF operate, and what transport protocol carries it?

Accepted Answer

RFC 6242 mandates that NETCONF run over SSH on TCP port 830. SSH provides the secure transport layer for NETCONF, with the client and server exchanging hello messages to advertise capabilities after the SSH session is established. Port 443 is used by RESTCONF (HTTPS/TLS). Port 80 is unencrypted HTTP. SNMP operates on UDP 161 and is an entirely different management protocol.

Question 7

An engineer uses RESTCONF to retrieve the running configuration of interface GigabitEthernet1 on a Cisco IOS-XE device using the ietf-interfaces YANG model. Which URI correctly identifies this resource?

Accepted Answer

RFC 8040 defines the RESTCONF URI structure as /restconf/data/{module}:{container}/{list}={key}. The correct path is /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1, where ietf-interfaces is the YANG module name, interfaces is the container, interface is the list node, and GigabitEthernet1 is the key value. The /restconf/config and /restconf/operational paths were used in an earlier RESTCONF draft (draft-bierman) and are not part of RFC 8040. NETCONF uses a completely different RPC-based structure, not a URI path.

Question 8

A network engineer reviews a YANG model snippet for IOS-XE interface configuration. The model contains a `list interface` node with a `leaf name` as the key, a `leaf description`, and a `container ipv4`. Which NETCONF RPC operation would correctly modify only the description of interface GigabitEthernet2 without affecting other configured parameters?

Accepted Answer

The NETCONF edit-config RPC with operation="merge" updates only the specified nodes and leaves all unspecified sibling nodes unchanged, making it the correct choice for modifying a single leaf. The "replace" operation replaces the entire target node and all its children with the supplied content, which would remove any existing sub-configuration not included in the RPC. The "create" operation fails with a data-exists error if the node already exists. delete-config removes an entire datastore, not a single node.

Question 9

A network engineer wants to subscribe to IOS-XE streaming telemetry data using gNMI. Which gNMI RPC operation is used to establish a persistent streaming subscription to a sensor path?

Accepted Answer

The gNMI Subscribe RPC establishes a persistent bidirectional streaming channel between the client and the device. The client sends a SubscribeRequest specifying the subscription list (paths, mode, and interval), and the device streams SubscribeResponse messages containing updates. gNMI Get is a one-time retrieval of state or configuration data. gNMI Set modifies the device configuration. gNMI Capabilities is used to discover which YANG models and encodings the device supports.

Question 10

An engineer navigates the Cisco-IOS-XE-native YANG model in YANG Suite. The model uses the prefix `native`. Which of the following correctly represents the XPath to the hostname leaf within this model?

Accepted Answer

In YANG, an XPath expression must use the module name (or its prefix) to identify the top-level namespace. The Cisco-IOS-XE-native YANG module defines a top-level container called `native` and a `hostname` leaf directly within it, giving the XPath /Cisco-IOS-XE-native:native/hostname. The ietf-interfaces path references the standard IETF interfaces model, not the IOS-XE native model. The prefixes cisco-xe and native are not canonical module names. The hostname is not under a router container in this model.

Question 11

A network engineer uses Python and Netmiko to connect to a Cisco IOS-XE router and run a show command. Which Netmiko method sends a show command and returns the output as a string?

Accepted Answer

Netmiko's send_command() method sends a single show-style command to the device, waits for the prompt to return, and returns the CLI output as a string. send_config_set() is used to send a list of configuration commands in configuration mode. connect() is not a Netmiko method; the connection is established by instantiating ConnectHandler(). enable() sends the enable command to enter privileged EXEC mode but does not execute or return show output.

Question 12

An engineer writes a Netmiko script to connect to a Cisco IOS-XE device. Which `device_type` value must be supplied to the `ConnectHandler` to correctly identify a Cisco IOS-XE SSH target?

Accepted Answer

In Netmiko, the device_type for Cisco IOS and Cisco IOS-XE devices when connecting over SSH is cisco_ios. Netmiko uses the same driver for both classic IOS and IOS-XE because they share the same SSH CLI behaviour. cisco_xe and cisco_iosxe are not valid Netmiko device_type strings. cisco_router is not a recognized Netmiko type. For IOS-XR the correct type is cisco_xr, and for NX-OS it is cisco_nxos.

Question 13

A network engineer wants to run a Python script stored at `/flash/check_bgp.py` inside the IOS-XE guestshell. Which IOS-XE privileged EXEC command launches the script?

Accepted Answer

The correct IOS-XE privileged EXEC command to execute a Python script inside guestshell is `guestshell run python3 /flash/check_bgp.py`. The `guestshell run` command executes a single Linux command inside the guestshell container without launching an interactive shell. `guestshell enable` activates the guestshell feature but does not run scripts. `app-hosting run` is used with the application hosting infrastructure (IOx), not directly with guestshell scripting. The `execute` keyword is not a valid IOS-XE command in this context.

Question 14

A network engineer uses Nornir to run a task against a filtered subset of devices. The inventory contains hosts tagged with the group `core_routers`. Which Nornir code snippet correctly filters the inventory to run only against hosts in that group?

Accepted Answer

Nornir uses F filter objects from nornir.core.filter to filter inventory based on host attributes. The correct syntax is nr.filter(F(groups__contains='core_routers')).run(task=my_task), where groups__contains checks whether the host belongs to the specified group. nr.run() does not accept a group keyword argument. nr.filter(group=...) without F objects is not the correct Nornir API. nr.inventory.filter() is not a valid method in the Nornir inventory API.

Question 15

An engineer compares three Python SSH libraries for network automation: Paramiko, Netmiko, and NAPALM. Which statement correctly distinguishes these libraries?

Accepted Answer

Paramiko is a low-level Python implementation of the SSHv2 protocol, providing basic SSH channel and session control. Netmiko is built on top of Paramiko and adds network-device-specific handling such as automatic prompt detection, paging handling, and configuration mode entry for many vendor platforms. NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support) provides a vendor-neutral API with standardized methods (get_interfaces, load_merge_candidate, etc.) and supports multiple backends including Cisco IOS, IOS-XR, NX-OS, Arista EOS, and Juniper JunOS.

Question 16

A network engineer wants to retrieve a list of all network devices managed by Cisco DNA Center using the REST API. Which HTTP method and URI path should be used?

Accepted Answer

The Cisco DNA Center Intent API endpoint for retrieving all managed network devices is a GET request to /dna/intent/api/v1/network-device. This returns a JSON response containing a list of device objects with details such as hostname, IP address, platform, and software version. POST to that endpoint is not used for retrieval. The /dna/system/api/v1/auth/token endpoint is a POST used to obtain the authentication token (X-Auth-Token), not to list devices. The /dna/intent/api/v1/devices path does not exist.

Question 17

An engineer uses the Cisco SD-WAN vManage REST API to query device information. Which endpoint retrieves the list of all devices registered with vManage?

Accepted Answer

The vManage REST API base path is /dataservice/. The endpoint to retrieve all devices (vEdges, vSmarts, vBonds, and vManage itself) is a GET request to /dataservice/device. Authentication is performed first by posting credentials to /j_security_check, which returns a session cookie used for subsequent requests. The /vmanage/api/v1/ path format is not the correct vManage API structure. The /sdwan/intent/ path is not a valid vManage endpoint.

Question 18

An Ansible playbook needs to push a list of interface configuration commands to a Cisco IOS-XE router using the cisco.ios collection. Which task module and FQCN (Fully Qualified Collection Name) correctly applies configuration lines?

Accepted Answer

The cisco.ios.ios_config module (FQCN: cisco.ios.ios_config) is the correct module for pushing configuration commands to Cisco IOS and IOS-XE devices in Ansible. It accepts a `lines` parameter for configuration commands and a `parents` parameter for the hierarchical configuration context. cisco.ios.ios_command is used for running show commands and capturing output, not for pushing configuration. ansible.netcommon.cli_config is a generic module that requires a specific connection plugin. cisco.ios.ios_cli does not exist as a module name.

Question 19

A network engineer uses Cisco NSO to preview the native CLI commands that will be pushed to a device before committing a service change. Which NSO CLI command displays the native device CLI output that would result from the pending commit?

Accepted Answer

In Cisco NSO's ncs_cli, the command `commit dry-run outformat native` shows exactly which native CLI commands NSO would send to the managed device without actually committing the changes. This is essential for verifying correctness before applying changes. `commit check` validates the configuration semantics against the YANG model but does not show native CLI. `commit simulate` is not a valid NSO command. `validate outformat` is not a valid NSO command; `validate` alone checks for semantic errors but does not show native output.

Question 20

An engineer queries the Cisco Meraki Dashboard API and receives an HTTP 429 response. Which response header should the engineer inspect to determine how long to wait before retrying?

Accepted Answer

The Cisco Meraki Dashboard API returns HTTP 429 (Too Many Requests) when the rate limit is exceeded. The Retry-After header in the 429 response specifies the number of seconds the client should wait before making another request. X-RateLimit-Limit indicates the maximum number of calls allowed per window but does not specify a wait time after a 429. X-Auth-Token is the header used to pass the API key for authentication. X-Meraki-Wait is not a real Meraki API header.

Question 21

A network engineer writes an Ansible playbook to collect interface facts from a Cisco IOS-XE device using the cisco.ios collection. Which module returns structured data about all interfaces including their operational state and IP addressing?

Accepted Answer

The cisco.ios.ios_facts module gathers structured facts from Cisco IOS and IOS-XE devices and populates Ansible variables such as ansible_net_interfaces with detailed per-interface data including IP addressing, operational state, and MTU. cisco.ios.ios_command with 'show interfaces' returns unstructured text output that requires parsing. cisco.ios.ios_interface is not the correct module name; the correct modules are ios_l2_interfaces and ios_l3_interfaces for interface configuration. ansible.builtin.gather_facts collects information about the Ansible control node, not the network device.

Question 22

An engineer uses pyATS and Genie to parse the output of `show interfaces` on a Cisco IOS-XE device named `router1`. Which Python code snippet correctly retrieves the structured parsed output?

Accepted Answer

In pyATS with the Genie library, device.parse('show interfaces') sends the command to the device and returns a structured Python dictionary parsed by the appropriate Genie parser for the device's OS. router1.execute() runs the command but returns raw unstructured string output without parsing. Genie.parse() is not a valid standalone function call with this signature. router1.genie_parse() is not a valid Genie/pyATS API method.

Question 23

An engineer uses Genie Diff to compare pre-change and post-change `show ip route` parsed output. What is the purpose of using Genie Diff in this context?

Accepted Answer

Genie Diff operates on two structured Python dictionaries produced by Genie parsers and produces a human-readable diff showing exactly which keys were added, removed, or modified between the two snapshots. In a pre/post-change workflow, this lets engineers quickly verify that only the intended routing changes occurred (e.g., a new prefix was added) and no unintended routes were removed. It is not a Git diff tool and does not modify device configuration or validate YANG syntax.

Question 24

An engineer designs an automated rollback mechanism for a NETCONF-based change workflow. Which NETCONF capability ensures that changes are automatically rolled back if the client does not confirm the commit within a specified timeout?

Accepted Answer

The NETCONF :confirmed-commit capability (RFC 6241) allows a client to issue a confirmed commit with a timeout value (confirm-timeout). If the client does not send a confirming commit within the timeout period, the device automatically rolls back to the configuration that existed before the confirmed commit. This provides a safe change mechanism where a misconfiguration that breaks connectivity will self-heal. :rollback-on-error rolls back a failed edit-config operation but does not handle post-commit connectivity issues. :candidate enables the candidate datastore. :startup enables the startup configuration datastore.

Question 25

A network engineer writes a pyATS testbed YAML file to define a Cisco IOS-XE device for automated testing. Which testbed section correctly maps the device connection to a Cisco IOS-XE SSH target?

Accepted Answer

A pyATS testbed YAML file requires the `devices` top-level key, with each device having at minimum a `type`, `os`, and `connections` section. For IOS-XE, `os: iosxe` selects the correct pyATS/Genie OS abstraction layer. Under `connections`, the `cli` connection entry specifies `protocol: ssh` and the management `ip`. Option B is missing the `os` key and uses incorrect connection key naming. Option C uses `hosts` which is Ansible inventory syntax, not pyATS. Option D uses `inventory` which is not the pyATS testbed format.

300-435 ENAUTO — Cisco Enterprise Automation and Programmability Specialist