Cisco Service Provider Automation and Programmability Specialist — Practice Set 1

Question 1

A service provider engineer configures IOS XR dial-out telemetry using gRPC. Which IOS XR configuration keyword specifies the model-driven telemetry sensor path that defines which operational data is streamed?

Accepted Answer

In Cisco IOS XR Model-Driven Telemetry (MDT), a `sensor-path` is configured within a sensor-group and specifies the YANG path of the operational data to be streamed (e.g., Cisco-IOS-XR-infra-statsd-oper:infra-statistics/interfaces/interface/latest/generic-counters). The `destination-group` specifies where to send the telemetry data (collector IP and port). `subscription-id` identifies the subscription that links sensor-groups and destination-groups. `encoding` specifies the data format (gpb, gpbkv, json).

Question 2

An engineer compares gNMI subscription modes for IOS XR telemetry collection. Which gNMI subscription mode sends an update only when the value of a subscribed leaf changes?

Accepted Answer

The gNMI ON_CHANGE subscription mode instructs the device to send an update message only when the value of a subscribed data leaf changes from its previous value, reducing unnecessary data transmission for slowly-changing state. SAMPLE mode sends periodic updates at a fixed interval regardless of whether the value has changed. POLL mode is a request-response mode where the client explicitly polls for updates. STREAM is a top-level subscription type that encompasses both SAMPLE and ON_CHANGE modes, not a mode itself.

Question 3

An engineer uses Python and Netmiko to connect to a Cisco IOS XR router over SSH for automation. Which Netmiko `device_type` value correctly identifies an IOS XR SSH target?

Accepted Answer

In Netmiko, the correct device_type for Cisco IOS XR over SSH is `cisco_xr`. This is distinct from `cisco_ios` (used for IOS and IOS-XE) and `cisco_nxos` (used for NX-OS). The string `cisco_iosxr` and `cisco_iosxr_ssh` are not valid Netmiko device_type strings. Using the correct device_type ensures Netmiko uses the appropriate prompt pattern, pagination handling, and configuration mode entry sequence for IOS XR.

Question 4

An engineer wants to navigate the Cisco IOS XR YANG model for interface configuration. Which YANG module contains the container for configuring interface IP addresses on IOS XR?

Accepted Answer

The Cisco-IOS-XR-ifmgr-cfg YANG module is the Cisco-native model for IOS XR interface management configuration (ifmgr = interface manager, cfg = configuration). It contains the `interface-configurations` top-level container with `interface-configuration` list entries keyed by active/pre-configured state and interface name. The ietf-interfaces and openconfig-interfaces models also work on IOS XR for standard interface parameters. Cisco-IOS-XE-native is the IOS-XE model and is not applicable on IOS XR.

Question 5

A service provider DevOps team wants to store IOS XR device configurations in a Git repository and trigger automated deployments when changes are committed. Which CI/CD pipeline component is responsible for detecting the Git push event and executing the deployment pipeline?

Accepted Answer

In a GitOps CI/CD workflow, a webhook or pipeline trigger (such as a GitLab CI .gitlab-ci.yml pipeline trigger or a Jenkins webhook) detects the git push event and automatically starts the pipeline stages (lint, test, deploy). The CI/CD server is the orchestrator that reacts to the VCS event. An Ansible playbook is the deployment mechanism executed by the pipeline, not the trigger. NSO service packages implement service logic. NETCONF lock is a datastore concurrency control operation unrelated to pipeline triggering.

Question 6

An engineer sends a NETCONF edit-config RPC to an IOS XR router using the candidate datastore and then issues a `<commit/>` RPC. Which NETCONF capability must the device advertise for the candidate datastore workflow to be supported?

Accepted Answer

The `urn:ietf:params:netconf:capability:candidate:1.0` capability (RFC 6241) advertises that the device supports the candidate configuration datastore. This is required to use edit-config targeting the candidate datastore and then issue a `<commit/>` RPC to apply the changes to the running configuration. Without this capability, only the running datastore can be directly modified. The startup capability is for persisting config across reloads. rollback-on-error causes automatic rollback if edit-config fails. confirmed-commit provides auto-rollback if a confirming commit is not received within a timeout.

Question 7

An engineer uses RESTCONF to configure a static route on a Cisco IOS XR router using the Cisco-IOS-XR-ip-static-cfg YANG module. Which HTTP method should be used to add a new static route entry without removing existing routes?

Accepted Answer

RFC 8040 defines the RESTCONF PATCH method to perform a partial update that merges the supplied content with the existing resource, adding or modifying only the specified items without deleting unspecified sibling entries. This is equivalent to NETCONF edit-config with merge operation. PUT replaces the entire target resource with the supplied content, which would remove any existing routes not included in the payload. POST creates a new resource (used for list entries). DELETE removes a resource.

Question 8

An engineer configures BGP-LS (BGP Link-State) on an IOS XR router to export network topology information, including SRGB (Segment Routing Global Block) information, to an SDN controller. Which BGP address family is used to carry link-state topology and SR information?

Accepted Answer

BGP-LS (RFC 7752) uses the BGP address family `link-state link-state` (AFI 16388 / SAFI 71) to distribute network topology information including nodes, links, and prefixes from IS-IS or OSPF link-state databases to an SDN controller. The SRGB (Segment Routing Global Block) advertised by each node is included in the Node NLRI as a BGP-LS attribute. ipv4 unicast carries standard IPv4 prefixes. vpnv4 unicast carries VPN routes. ipv4 labeled-unicast (BGP-LU) carries label bindings for IPv4 prefixes in SR-MPLS deployments but is not the BGP-LS address family.

Question 9

An engineer constructs a gNMI path to subscribe to interface input byte counters on an IOS XR router using the Cisco native YANG model. Which path element correctly identifies this counter in the Cisco-IOS-XR-infra-statsd-oper model?

Accepted Answer

The Cisco-IOS-XR-infra-statsd-oper YANG module exposes interface statistics. The correct path to input byte counters uses the container hierarchy: infra-statistics → interfaces → interface (keyed by interface-name) → latest → generic-counters → bytes-received. The openconfig-interfaces path option A is valid on IOS XR for OpenConfig counters but uses `in-octets` not `bytes-received` and references the openconfig model, not the Cisco native statsd model. Option C uses an incorrect non-existent module path. Option D uses the ietf-interfaces-state model, which is deprecated in RFC 8343.

Question 10

An engineer uses the NETCONF yang-push subscription mechanism on IOS XR to receive periodic updates for a YANG path. Which NETCONF RPC is used to establish a yang-push subscription?

Accepted Answer

RFC 8641 defines YANG-Push, which uses the NETCONF `` RPC to establish a dynamic subscription with stream="yang-push". The subscription request includes a `periodic` or `on-change` update trigger and the YANG XPath or subtree filter for the data of interest. The device then sends `` or `` notifications. `` is a one-time pull operation. `` modifies configuration, not subscriptions. `` (RFC 5277) is for the older NETCONF event notification stream and does not support yang-push periodic updates.

Question 11

An engineer reviews the YANG model hierarchy for the openconfig-bgp module. Which YANG node type is used to define a list of BGP neighbors, each identified by a unique IP address key?

Accepted Answer

In YANG (RFC 7950), a `list` node defines a sequence of list entries that are each identified by one or more key `leaf` nodes. In openconfig-bgp, the `neighbor` list is keyed by `neighbor-address`, allowing multiple BGP neighbors to be represented with unique keys. A `container` groups related nodes but does not have multiple keyed instances. A `leaf` holds a single value. A `leaf-list` holds multiple values of the same type but without structured sub-nodes or keys.

Question 12

A service provider uses Cisco Crosswork Network Controller to automate SR-TE (Segment Routing Traffic Engineering) policy deployment. Which Crosswork component provides the path computation functionality for SR-TE policies?

Accepted Answer

The Cisco Crosswork Optimization Engine (which incorporates SR-PCE, Segment Routing Path Computation Element functionality) provides path computation and SR-TE policy management, including bandwidth-aware path calculation and traffic engineering policy instantiation on IOS XR devices. Crosswork Health Insights monitors network health using streaming telemetry. Crosswork Change Automation automates configuration changes via playbooks. Crosswork Data Gateway is a data collection and normalization component that aggregates telemetry before forwarding to applications.

Question 13

A service provider uses Cisco WAN Automation Engine (WAE) to perform traffic engineering optimization. Which WAE database stores the current network topology and traffic matrix used for path computation?

Accepted Answer

Cisco WAN Automation Engine uses a network model (based on the MATE/Cariden technology) that stores the complete network topology (nodes, links, capacities), current traffic demands, and IGP/TE attributes. WAE collects this information via BGP-LS, SNMP, or other sources and uses it for path computation, what-if analysis, and optimization. The Traffic Engineering Database (TED) is an OSPF/IS-IS construct on the router, not a WAE database. WAN-CDB is not an official WAE term. Cisco Performance Monitor is a different product.

Question 14

An engineer writes an Ansible playbook to configure BGP on a Cisco IOS XR router using the cisco.iosxr collection. Which module FQCN is used to configure BGP parameters on IOS XR?

Accepted Answer

The cisco.iosxr Ansible collection provides resource modules for IOS XR configuration. The module for configuring global BGP parameters on IOS XR is cisco.iosxr.iosxr_bgp_global, which manages AS number, router ID, and BGP global attributes. There are separate modules for neighbour configuration (iosxr_bgp_neighbor_address_family) and address families. cisco.ios.ios_bgp is for Cisco IOS/IOS-XE, not IOS XR. cisco.iosxr.iosxr_bgp is the older deprecated module. ansible.netcommon.bgp_global does not accept a platform parameter in this manner.

Question 15

An engineer uses Terraform with the Cisco IOS XR provider to manage an IOS XR interface. Which Terraform resource type is used to configure a Cisco IOS XR interface?

Accepted Answer

The Cisco IOS XR Terraform provider (CiscoDevNet/iosxr) uses resource type names prefixed with `iosxr_`. The resource for interface configuration is `iosxr_interface`. The provider communicates with IOS XR via gNMI, translating the Terraform resource attributes into gNMI Set operations on the corresponding YANG model paths. `cisco_iosxr_interface` is not the correct resource type prefix. `iosxr_gnmi` is a generic escape-hatch resource for sending raw gNMI payloads. `cisco_interface` with a platform attribute does not exist in this provider.

Question 16

A service provider monitors Cisco IOS XR Non-Stop Routing (NSR) state via automation. Which IOS XR show command displays the NSR operational state for BGP to confirm that NSR synchronization is complete before a planned RP failover?

Accepted Answer

On Cisco IOS XR, the command `show bgp nsr` displays the Non-Stop Routing synchronization state for BGP, including whether the active and standby RPs are synchronized and whether NSR is operational. This output can be parsed programmatically (via Netmiko or gNMI) to confirm that NSR is in a ready state before initiating a planned RP failover. `show redundancy` shows the general RP redundancy state. `show nsr all-table` does not exist as a valid IOS XR command. `show bgp summary` shows BGP neighbour counts and prefixes but not NSR state.

Question 17

Cisco Crosswork Change Automation allows SP engineers to create automated network change workflows called playbooks. Which statement correctly describes Crosswork Change Automation playbooks?

Accepted Answer

Cisco Crosswork Change Automation playbooks are orchestration workflows that define a sequence of actions including pre-checks (verifying current device state), configuration changes pushed via Cisco NSO or NETCONF, and post-checks (verifying the change was applied correctly). They can be scheduled, rolled back, and integrated with Crosswork Health Insights for automated anomaly response. They are not standard Ansible playbooks, do not use SNMP for configuration, and are not Terraform HCL files.

Question 18

In Cisco NSO architecture, which component stores the master copy of all device configurations and service instance data?

Accepted Answer

The NSO CDB (Configuration Database) is the central datastore that holds the master copy of all device configurations and service instance data in NSO's YANG-modeled schema. All northbound interfaces (RESTCONF, NETCONF, NSO CLI, Web UI) read from and write to the CDB. The NED translates CDB data into device-specific protocols. The RESTCONF northbound API is an interface to access the CDB. The service manager handles service lifecycle callbacks but ultimately persists data to the CDB.

Question 19

An engineer onboards a Cisco IOS XR router to Cisco NSO and synchronizes its configuration into the CDB. Which sequence of NSO CLI commands correctly adds the device and pulls its current configuration?

Accepted Answer

To onboard a device in NSO: (1) Use `devices add` (or configure the device in the devices list) to define the device's address, port, NED, and credentials in the CDB; (2) `commit` to save the device definition to the CDB; (3) `devices sync-from` to pull the device's current running configuration from the device into the CDB. sync-from cannot succeed before the device is committed because NSO needs the device definition to establish the connection. sync-to pushes the CDB config TO the device, which is the opposite direction.

Question 20

An engineer designs an NSO service YANG model for L3VPN provisioning. Which YANG extension or statement is required to mark the service model as an NSO service point so that NSO invokes the service callback when instances are created or deleted?

Accepted Answer

In NSO YANG service models, the `ncs:servicepoint` extension (from the tailf-ncs.yang module) is added to the service list to register it as an NSO service point. This causes NSO to invoke the registered Java or Python service callback (create, delete, re-deploy) whenever a service instance is created, modified, or deleted. `tailf:action` defines an RPC action within a YANG model. `tailf:callpoint` is used for data provider callbacks in YANG models but is distinct from service points. `ncs:device-profile` is not a valid NSO extension for service points.

Question 21

A service provider uses NSO Layered Service Architecture (LSA) to manage a large-scale SP network with thousands of devices. Which NSO LSA tier is responsible for directly communicating with the network devices using NEDs?

Accepted Answer

In NSO Layered Service Architecture (LSA), the Lower NSO instances (also referred to as the Resource Facing Service layer) are directly connected to network devices via NEDs. They manage a subset of devices and expose device and resource-facing services via NETCONF to the Upper NSO. The Upper NSO (CFS layer) handles customer-facing service logic, decomposes services into resource-facing service calls, and orchestrates the lower NSO instances. This architecture scales NSO to very large networks by distributing device management. LSA does not have a separate 'Orchestrator tier'.

Question 22

An engineer uses the NSO RESTCONF northbound API to instantiate an L3VPN service. The service package is named `l3vpn` and the service list is also named `l3vpn`. Which HTTP method and URI correctly create a new L3VPN service instance?

Accepted Answer

To create a new service instance via NSO's RESTCONF northbound API, a POST request is sent to /restconf/data/{module}:{list} with the new service instance data in the JSON or XML body. POST is used to add a new entry to a YANG list (service list). A GET retrieves existing instances. PUT replaces an existing resource and /restconf/operations is for invoking YANG actions, not for service data. PATCH performs a partial update on an existing resource but cannot create a new list entry with a POST-equivalent semantic in RFC 8040 RESTCONF.

Question 23

An engineer writes a pyATS test to verify BGP neighbour state on a Cisco IOS XR router after a configuration change. After connecting to the device, which Python call retrieves structured BGP summary data using Genie?

Accepted Answer

device.parse('show bgp summary') invokes the Genie parser for the `show bgp summary` command on the device's specific OS (iosxr in this case) and returns a structured Python dictionary. The result can be inspected programmatically to check neighbour states, prefix counts, and uptime. device.execute() sends the command and returns raw unstructured text. Genie.get_parser() is not a valid function signature. device.learn('bgp') runs multiple show commands and builds a comprehensive Genie Feature model of the BGP configuration and state, which is more heavyweight than a single parse.

Question 24

An automation engineer designs a canary deployment strategy for service provider configuration changes. Which statement best describes the canary deployment approach in an SP network automation context?

Accepted Answer

A canary deployment applies a change to a small, representative subset of production devices (the 'canaries') first, then monitors telemetry and KPIs for a validation window. If the canaries show healthy metrics, the change is progressively rolled out to the remaining devices in waves. This limits blast radius if the change has an unexpected negative impact. It is not a simultaneous rollout to all devices. It goes beyond lab-only testing to include a controlled production subset. NETCONF confirmed-commit is a complementary safety mechanism but is not the definition of canary deployment.

Question 25

An engineer uses Cisco Modeling Labs (CML) to simulate an IOS XR topology before deploying automation scripts to production. Which primary benefit does CML provide in a pre-deployment testing workflow?

Accepted Answer

Cisco Modeling Labs (CML) is a network simulation platform that runs actual Cisco device images (IOS XR, IOS-XE, NX-OS, etc.) as virtual machines. This allows engineers to build realistic simulated topologies and test automation scripts, NETCONF/RESTCONF payloads, gNMI subscriptions, and Ansible playbooks against real IOS XR behaviour before applying changes to production. CML does not provide hardware line-rate performance testing. It does not replace pyATS but integrates with it (pyATS testbeds can target CML devices). It is not a SaaS tool for auto-generating playbooks.

300-535 SPAUTO — Cisco Service Provider Automation and Programmability Specialist