Cisco Certified Network Associate (CCNA) Automation — Practice Set 1

Question 1

A Python script uses the `requests` library to poll a Cisco IOS-XE device via RESTCONF. The script must understand which OSI layer governs the IP addressing used in the RESTCONF URI. Which OSI layer handles logical IP addressing?

Accepted Answer

The Network layer (Layer 3) of the OSI model handles logical IP addressing and routing of packets between networks. RESTCONF relies on HTTP (Layer 7) for its API calls, which in turn depend on TCP (Layer 4) for reliable transport, and IP (Layer 3) for addressing and routing to the device. The Data Link layer handles MAC addressing within a local segment. Understanding this layering helps network automation engineers debug connectivity issues when a RESTCONF call fails.

Question 2

A network automation engineer is writing a Python script that sends API calls to multiple devices. The script needs to determine whether two IP addresses are in the same subnet before attempting a direct connection. Given the address 10.10.20.45 and mask /28, what is the network address of this subnet?

Accepted Answer

A /28 has a block size of 16 (2^(32-28) = 16). Subnet boundaries for 10.10.20.x are at multiples of 16: .0, .16, .32, .48, .64, etc. The address 10.10.20.45 falls in the range 10.10.20.32–10.10.20.47, so the network address is 10.10.20.32. The broadcast address is 10.10.20.47. 10.10.20.40 and 10.10.20.48 are host and next-network addresses respectively, not network addresses. 10.10.20.16 is the network address of the preceding subnet.

Question 3

A network automation script generates Ethernet frames and must populate the correct EtherType value in each frame's header. Which EtherType value identifies an IPv4 payload?

Accepted Answer

EtherType 0x0800 identifies an IPv4 payload in an Ethernet frame. EtherType 0x0806 identifies ARP. EtherType 0x86DD identifies IPv6. EtherType 0x8100 indicates an 802.1Q VLAN-tagged frame. Network automation engineers who work with packet crafting tools (such as Scapy in Python) must know these values when constructing or parsing frames programmatically.

Question 4

An automation script checks the reachability of a list of hosts using ICMP before running configuration tasks. Which Python snippet correctly sends a single ping to 192.168.1.1 and checks for success on a Linux system?

Accepted Answer

The `os.system()` call executes the system ping command and returns the exit code — 0 on success (host reachable), non-zero on failure. This is the standard portable approach for a quick reachability check in Python without installing third-party libraries. Options B and C reference modules (`ping`, `icmp`) that are not part of the Python standard library and do not exist with those interfaces. The `socket` module does not have a `ping()` function — raw ICMP requires crafting packets with `socket.SOCK_RAW`, which requires root privileges and significantly more code.

Question 5

A network automation engineer is comparing TCP and UDP for a new telemetry streaming application that sends device metrics every 500 ms. The application can tolerate occasional lost messages but requires minimal overhead. Which transport protocol is BEST suited?

Accepted Answer

UDP is connectionless and has no retransmission or acknowledgment overhead, making it ideal for telemetry streams where low latency and high throughput matter more than guaranteed delivery. Dropped metrics are acceptable because the next sample arrives shortly. TCP's per-segment ACKs and retransmissions introduce latency and head-of-line blocking that degrade real-time telemetry. ICMP is a network-layer diagnostic protocol, not a transport protocol for application data. TCP does not natively support multicast.

Question 6

An Ansible playbook uses the `ios_config` module to push VLAN configuration to a switch. The playbook must verify that the VLAN database is updated. After the playbook runs, which IOS command confirms that VLAN 50 was created with the name 'AUTOMATION'?

Accepted Answer

`show vlan brief` displays all VLANs in the VLAN database including their VLAN ID, name, status, and assigned ports — this is the standard command for verifying VLAN creation and naming. `show interfaces vlan 50` shows the Layer 3 SVI interface status, not the VLAN database entry. `show running-config vlan 50` may not display the VLAN name on all platforms depending on where VLANs are stored (vlan.dat vs running-config). `show ip interface vlan 50` shows IP address information for the SVI interface, not VLAN database membership.

Question 7

A Python automation script uses Netmiko to connect to a switch and verify trunk port configuration. The script runs `show interfaces trunk` and parses the output. Which of the following Netmiko method calls correctly sends this command and returns the output as a string?

Accepted Answer

`send_command()` is the Netmiko method for sending a single show (exec-mode) command and returning the output as a string. It handles prompts, timing, and output capture automatically. `send_config_set()` is used to send a list of configuration commands (it enters configuration mode first) — it should not be used for show commands. `execute()` and `run_command()` are not Netmiko methods; they do not exist in the Netmiko API.

Question 8

An EtherChannel is configured between two switches using LACP. A Python script reads the interface status via RESTCONF and receives the following JSON snippet:

{
    "oper-status": "up",
    "channel-group": {
      "number": 1,
      "mode": "active"
    }
  }

The script must confirm that the EtherChannel is properly negotiating. What does the 'mode: active' value indicate?

Accepted Answer

LACP mode 'active' means the interface actively initiates LACP negotiation by sending LACP PDUs (Protocol Data Units) to the peer. For a channel to form, at least one side must be 'active'. PAgP uses 'desirable' and 'auto' modes, not 'active' and 'passive'. Forced (non-negotiated) EtherChannel uses mode 'on'. LACP mode 'passive' listens for LACP PDUs but does not initiate — it is the opposite of 'active'. The JSON output confirms this is an LACP-negotiated interface.

Question 9

An automation script provisions new access points using a Cisco WLC REST API. The script needs to assign an AP to a specific AP group. Which WLC architecture component manages the AP group assignments and communicates policy to lightweight APs?

Accepted Answer

In a centralized wireless architecture, the Wireless LAN Controller (WLC) manages all AP configurations including AP groups, SSID profiles, and WLAN policies, and distributes them to lightweight APs via the CAPWAP control channel. Autonomous APs manage their own configuration locally and are not appropriate for centralized REST API provisioning. Cisco DNA Center can orchestrate WLCs but does not replace the WLC's role in managing AP groups directly. The RADIUS server handles authentication, not AP configuration.

Question 10

A network engineer configures STP PortFast on an access port to speed up host connectivity. Which IOS command enables PortFast on a single interface?

Accepted Answer

`spanning-tree portfast` entered under an individual interface configuration context enables PortFast on that specific port, causing it to skip the STP Listening and Learning states and transition directly to Forwarding. This is appropriate only for ports connected to end devices (hosts), never to switches or hubs. `spanning-tree mode portfast` is not valid IOS interface syntax. `spanning-tree portfast default` in global config enables PortFast on all access ports globally. `no spanning-tree` is not valid IOS syntax for disabling STP per-interface.

Question 11

A Python script using the `requests` library sends a RESTCONF GET request to retrieve OSPF neighbor information from a Cisco IOS-XE router. The script checks the HTTP response status code. Which status code indicates that the request was successful and data was returned?

Accepted Answer

HTTP status code 200 OK indicates that the GET request was successful and the response body contains the requested data. 201 Created is returned after a successful POST that created a new resource. 204 No Content indicates success but with no response body (common for DELETE operations). 404 Not Found means the requested YANG path or resource does not exist on the device. Network automation scripts must check for 200 to confirm that OSPF neighbor data was successfully retrieved.

Question 12

A router running OSPF area 0 has the following routing table output:

Router# show ip route
  O    172.16.0.0/16    [110/65] via 10.0.0.2, GigabitEthernet0/1
  O IA 10.1.1.0/24     [110/20] via 10.0.0.2, GigabitEthernet0/1
  C    10.0.0.0/30      is directly connected, GigabitEthernet0/1

What does the 'O IA' code on the 10.1.1.0/24 route indicate?

Accepted Answer

In Cisco IOS routing tables, 'O' denotes an OSPF intra-area route (within the same area) and 'O IA' denotes an OSPF inter-area route — a route that was learned from a different OSPF area and advertised into the local area by an Area Border Router (ABR) using Type 3 Summary LSAs. 'O E1' and 'O E2' denote external OSPF routes redistributed from other routing protocols. 'IA' stands for inter-area, not any metric threshold. Administrative distance is shown in the brackets (e.g., [110/20]) and does not appear as a route code.

Question 13

An Ansible playbook uses the `ios_command` module to run `show ip route` on a router and stores the output in a variable. The playbook then uses a `when` condition to trigger a task only if the output contains 'O' (OSPF) routes. Which Ansible filter correctly checks if the string 'O' appears in the registered output variable `route_output`?

Accepted Answer

The Ansible `regex_search` filter applies a regular expression to a string. Using `\bO\b` (word boundary anchors) matches the route code 'O' as a standalone word token, preventing false matches on strings like 'OSPF' or 'O IA'. The `match` test in Ansible checks from the beginning of the string — it would fail unless 'O' appears at the very start of the output. Option B checks for '0 ' (digit zero, not letter O) — a typo that would never match OSPF codes. Option D is not valid Jinja2/Ansible syntax (`contains` is not a recognized operator).

Question 14

A network automation engineer needs to configure a static default route on a router via RESTCONF using an HTTP PUT request. Which YANG data path is used in the RESTCONF URI to configure IOS-XE static routing?

Accepted Answer

The IETF standard YANG model `ietf-routing` is supported on Cisco IOS-XE for static route configuration. The RESTCONF path `/restconf/data/ietf-routing:routing/control-plane-protocols` is used to configure routing protocols including static routes. Cisco-native models also exist (e.g., `Cisco-IOS-XE-native`), but the IETF model path in Option A is the standards-based correct answer. Option B is a fictional API path. Option C uses `/restconf/config/` which is not the correct RESTCONF root (it should be `/restconf/data/`). Option D describes a NETCONF path format, not RESTCONF.

Question 15

An automation engineer configures EIGRP named mode on a router. Which IOS configuration block correctly enables EIGRP named mode for AS 100 and advertises the 10.0.0.0/8 network?

Accepted Answer

EIGRP named mode uses `router eigrp ` (a string name, not an AS number) as the top-level command, followed by `address-family ipv4 unicast autonomous-system ` to define the address family and AS number. Network statements within the address family use wildcard masks. Option A is classic EIGRP mode (uses AS number directly on the `router eigrp` line). Option C mixes `router eigrp named` (invalid syntax) with a subnet mask (EIGRP `network` commands use wildcard masks). Option D is not valid IOS syntax.

Question 16

A network automation script parses `show ip route` output and must identify routes with Equal-Cost Multi-Path (ECMP) load balancing. OSPF has two equal-cost paths to 172.16.0.0/24. How does Cisco IOS display ECMP in the routing table?

Accepted Answer

When Cisco IOS installs multiple equal-cost paths in the routing table (ECMP), the same destination prefix appears with multiple `via <next-hop>` entries — each on its own line under the same prefix. For example: `O 172.16.0.0/24 [110/20] via 10.0.0.1 ... / [110/20] via 10.0.0.2 ...`. There is no primary/backup labeling for ECMP paths. Cisco IOS does not discard equal-cost paths (OSPF supports up to 4 equal-cost paths by default, configurable via `maximum-paths`). 'E' is not a valid route code for ECMP.

Question 17

A network automation script configures a Cisco router as a NAT overload (PAT) device. The inside interface is GigabitEthernet0/0 and the outside interface is GigabitEthernet0/1. Which IOS commands correctly define the inside and outside NAT interfaces?

Accepted Answer

`ip nat inside` is applied under the interface facing the private (internal) network, and `ip nat outside` is applied under the interface facing the public (external) network. These are interface-level commands. Without these designations, NAT translation does not occur. Option B has them reversed (inside and outside). Option C incorrectly uses `ip nat pool` syntax, which is for defining a pool of public addresses — it cannot reference interfaces directly. Option D attempts global-config syntax, but `ip nat inside/outside` are interface-level commands only.

Question 18

A network monitoring Python script queries a Cisco router's SNMP agent using SNMP v2c. The script receives a 'Timeout' error. A colleague suggests switching to SNMP v3. Which capability does SNMPv3 provide that SNMPv2c lacks?

Accepted Answer

SNMPv3 adds user-based security (USM) with authentication (using MD5 or SHA hashing) and privacy/encryption (using AES or DES) — capabilities absent in SNMPv1 and SNMPv2c, which use plain-text community strings for authentication. MIB-II objects are supported by all SNMP versions. UDP port 161 (queries) and 162 (traps) are used by all SNMP versions. SNMP traps are supported by SNMPv1, v2c, and v3. The timeout error is likely a network or community string issue, not an SNMPv3-specific feature.

Question 19

An automation script must classify traffic to prioritize VoIP packets. The script reads DSCP markings from packet headers. Which DSCP value is used to mark Expedited Forwarding (EF) traffic, typically used for VoIP RTP streams?

Accepted Answer

DSCP 46 (binary 101110) is the Expedited Forwarding (EF) per-hop behavior, defined in RFC 3246. It guarantees low latency, low jitter, and low packet loss — making it the standard marking for VoIP RTP bearer streams. DSCP 0 is Best Effort (default). DSCP 26 is Assured Forwarding class 3 drop precedence 1 (AF31), used for business-critical applications. DSCP 34 is AF41, used for high-priority interactive video. Network automation QoS classification scripts and Cisco MQC policy-maps use these values to differentiate traffic treatment.

Question 20

A network automation engineer is writing a Python script that connects to a Cisco router via SSH using Paramiko. Before connecting, the script must ensure SSH is enabled on the device and that the vty lines use SSH only. Which IOS configuration correctly restricts vty access to SSH and requires local authentication?

Accepted Answer

`transport input ssh` restricts the vty lines to accept only SSH connections, blocking Telnet. `login local` requires authentication against the local username database. Together these enforce encrypted, authenticated management access — a prerequisite for Paramiko-based automation scripts. Option B allows only Telnet (unencrypted). Option C allows all transport methods and disables authentication entirely, which is a serious security risk. `ip ssh version 2` is a global configuration command, not a valid vty line subcommand.

Question 21

A Python script automates ACL deployment. The script pushes the following ACL to a router:

access-list 110 deny   tcp 10.0.0.0 0.0.0.255 any eq 23
  access-list 110 permit ip any any

The ACL is applied inbound on GigabitEthernet0/0. What does this ACL accomplish?

Accepted Answer

The first ACL entry matches TCP packets sourced from any address in 10.0.0.0/24 (wildcard 0.0.0.255) destined for any host on destination port 23 (Telnet) and denies them. The wildcard mask 0.0.0.255 matches all source addresses in 10.0.0.0/24. The `any` in the destination means any destination IP. `eq 23` matches TCP destination port 23 (Telnet). The second entry `permit ip any any` explicitly permits all remaining IP traffic (which would otherwise be dropped by the implicit deny). The ACL does not block all traffic, only Telnet from that specific subnet.

Question 22

An automation pipeline must ensure all managed switches have port security enabled on user-facing ports. Which Cisco IOS command enables port security on an interface and sets the maximum allowed MAC addresses to 2?

Accepted Answer

`switchport port-security` enables port security on the interface (the interface must first be configured as an access port). `switchport port-security maximum 2` sets the maximum number of learned MAC addresses to 2. Both commands are entered under interface configuration mode. Options B, C, and D use incorrect command syntax — `port-security enable`, `switchport security`, and `ip port-security` are not valid Cisco IOS commands.

Question 23

A network engineer writes a Python script using the `requests` library to send a RESTCONF GET request to a Cisco IOS-XE router. The target URI is `https://192.168.1.1/restconf/data/ietf-interfaces:interfaces`. Which headers must the script include to indicate that it expects a JSON response?

Accepted Answer

RESTCONF uses the media type `application/yang-data+json` (defined in RFC 8040) to indicate JSON-encoded YANG data. The `Accept` header tells the server what format the client wants in the response. Using `application/json` (Option A) is technically a generic JSON MIME type and may work on some implementations, but `application/yang-data+json` is the correct RESTCONF-specific media type for JSON responses. `text/html` is for web pages. `application/xml` is for XML, not JSON. Authorization headers are also required but the question asks specifically about indicating JSON format.

Question 24

A network automation engineer writes the following Python snippet using Netmiko to configure a hostname and then retrieve it:

```python
from netmiko import ConnectHandler
device = {
    'device_type': 'cisco_ios',
    'host': '10.0.0.1',
    'username': 'admin',
    'password': 'cisco'
}
net_connect = ConnectHandler(**device)
net_connect.send_config_set(['hostname NewRouter'])
output = net_connect.send_command('show running-config | include hostname')
print(output)
```

What is the MOST likely output of the print statement?

Accepted Answer

`send_config_set()` enters configuration mode, sends the commands, then exits back to privileged EXEC mode. `send_command()` is then called in privileged EXEC mode and runs `show running-config | include hostname`, which reads the running configuration — which is updated immediately when `hostname NewRouter` was applied. The output will show `hostname NewRouter`. There is no restriction on using `send_command` after `send_config_set`. The change does appear in the running-config immediately (even before `write memory`). The prompt `NewRouter#` is not what `send_command` returns — it returns only the command output.

Question 25

A network engineer uses Cisco DNA Center's northbound REST API to retrieve a list of all network devices. The API endpoint is `GET /dna/intent/api/v1/network-device`. After authenticating, the engineer receives a 401 Unauthorized response on subsequent requests. What is the MOST likely reason?

Accepted Answer

Cisco DNA Center's northbound REST API uses token-based authentication. The initial authentication call to `POST /dna/system/api/v1/auth/token` returns a token. This token must be included in the `X-Auth-Token` HTTP header on every subsequent API request. Omitting this header on follow-up requests results in a 401 Unauthorized response, even after a successful initial login. GET is a valid and supported HTTP method for the device inventory endpoint. DNA Center's northbound REST API does support device inventory queries. HTTP 401 means unauthorized (authentication failure), not server overload (which would be HTTP 503 or 429).

200-301 CCNA — Cisco Certified Network Associate (CCNA) Automation