CCNA Automation and Programmability Practice Questions

How to work these questions

1. Start with the verb: GET reads, POST creates, PUT replaces, PATCH changes part of a resource, DELETE removes it.
2. Read the resource next: the path names what you act on (/devices/42), and anything after ? is a query parameter that filters or sorts the result.
3. Check the headers: Content-Type says what format the body is in, Accept says what you want back, and Authorization or a token header proves who you are.
4. Read the status code before the body: 2xx worked (200, 201, 204), 400 bad request, 401 not authenticated, 403 not allowed, 404 not found, 500 server fault.
5. Only then read the body: walk the JSON path one step at a time, keys inside { } and zero-based positions inside [ ].
6. For tool and architecture questions, name the pair being tested (north/south, push/pull, underlay/overlay, control/data) and eliminate answers that swap it.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Concept

   A router is running OSPF, accepting SSH logins and forwarding user traffic. Which of these tasks belongs to the control plane?

   1. Exchanging OSPF LSAs to build the routing table
   2. Forwarding a packet out an interface using the FIB
   3. Accepting an SSH session from an administrator
   4. Rewriting the Layer 2 header on an outgoing frame
   Show the answer

   Answer: A

   Control plane = decides (routing protocols, STP, ARP tables being built). Data plane = forwards user traffic using what the control plane built. Management plane = how people and tools reach the device (SSH, SNMP, APIs). In controller-based networking the control plane is partly centralized in the controller.

   • A. OSPF talks to neighbors and decides which routes go into the routing table. Deciding how traffic should be forwarded is exactly what the control plane does.
   • B. Looking up the destination in the FIB and switching the packet out an interface is the data plane, the part that actually moves user traffic.
   • C. SSH, SNMP, syslog and similar access to the device itself belong to the management plane, not the control plane.
   • D. Building a new Layer 2 header for each forwarded packet is part of forwarding, so it is a data plane job.

2. Question 2 of 10Concept

   In a controller-based network, which statement about the controller's APIs is correct?

   1. Southbound APIs let your scripts query the controller over REST
   2. Northbound APIs, usually REST, let applications use the controller
   3. NETCONF and OpenFlow are northbound APIs facing the applications
   4. Northbound APIs write flow entries directly into switch hardware
   Show the answer

   Answer: B

   Picture the controller in the middle: applications above it use the northbound API (REST), devices below it are reached through southbound APIs (NETCONF, RESTCONF, OpenFlow, CLI/SSH, SNMP). If an answer puts NETCONF or OpenFlow on the north side, it is wrong.

   • A. Scripts and applications sit above the controller, so the REST calls they make use the northbound interface, not the southbound one.
   • B. The northbound interface faces applications, scripts and orchestration tools, and it is normally a REST API that returns JSON.
   • C. NETCONF, RESTCONF, OpenFlow and plain CLI over SSH are how a controller reaches the devices below it, which makes them southbound.
   • D. Programming the devices is the job of the southbound side; the northbound API never talks to switch hardware directly.

3. Question 3 of 10Exhibit

   A script loads the JSON document in the exhibit into a variable named data. What value does data["devices"][0]["interfaces"][1]["ipv4"] return?

   {
     "site": "branch-12",
     "devices": [
       {
         "hostname": "BR12-RTR1",
         "role": "wan-edge",
         "interfaces": [
           {"name": "GigabitEthernet0/0/0", "ipv4": "203.0.113.18", "enabled": true},
           {"name": "GigabitEthernet0/0/1", "ipv4": "10.12.0.1", "enabled": true}
         ]
       },
       {
         "hostname": "BR12-SW1",
         "role": "access",
         "interfaces": [
           {"name": "Vlan10", "ipv4": "10.12.10.2", "enabled": false}
         ]
       }
     ]
   }

   1. 203.0.113.18
   2. 10.12.10.2
   3. 10.12.0.1
   4. GigabitEthernet0/0/1
   Show the answer

   Answer: C

   Walk a JSON path one step at a time: a key in quotes selects a value inside an object { }, a number selects a position inside an array [ ], counting from 0. Write down where you are after each step before you look at the answers.

   • A. 203.0.113.18 is interfaces[0], the first interface of the first device. JSON arrays are indexed from 0, so [1] is the second entry.
   • B. 10.12.10.2 belongs to devices[1], the switch BR12-SW1, and it is that device's only interface, interfaces[0].
   • C. devices[0] is BR12-RTR1, its interfaces array has two objects, and [1] is the second one, whose ipv4 key holds the string 10.12.0.1.
   • D. GigabitEthernet0/0/1 is the value of the name key in the right object, but the path asks for the ipv4 key, not name.

4. Question 4 of 10Exhibit

   A script sends the request in the exhibit to a network controller and gets the response shown. What is the most likely cause?

   Request:
   GET /api/v1/network-device?family=Switches HTTP/1.1
   Host: 192.0.2.50
   Accept: application/json
   
   Response:
   HTTP/1.1 401 Unauthorized
   Content-Type: application/json
   
   {"error": "Authentication required"}

   1. The query parameter family=Switches is not valid here
   2. The resource /api/v1/network-device does not exist
   3. The user is authenticated but lacks read permission
   4. The request carries no authentication token header
   Show the answer

   Answer: D

   401 = not authenticated (no or bad credentials or token), 403 = authenticated but not allowed, 404 = resource not found, 400 = the request itself is malformed. Check the request headers first: a protected API needs an Authorization or token header on every call.

   • A. An unknown or badly formed query parameter would give 400 Bad Request or simply an empty list, not 401 Unauthorized.
   • B. A resource that does not exist returns 404 Not Found. The server here never got as far as looking up the resource.
   • C. Being known to the server but not allowed to do something returns 403 Forbidden. A 401 means the server does not know who you are.
   • D. The request has only Host and Accept headers. Without an Authorization header or a token header such as X-Auth-Token, the server answers 401 Unauthorized.

5. Question 5 of 10Exhibit

   The exhibit shows a short Ansible playbook. How does this change reach the routers in the branch_routers group?

   ---
   - name: Set NTP on branch routers
     hosts: branch_routers
     gather_facts: no
     connection: ansible.netcommon.network_cli
     tasks:
       - name: Configure NTP server
         cisco.ios.ios_config:
           lines:
             - ntp server 192.0.2.123

   1. An agent on each router pulls the playbook every 30 minutes
   2. The control node pushes the commands to each router over SSH
   3. Each router downloads the YAML file and applies it with NETCONF
   4. The control node sends the lines through an OpenFlow controller
   Show the answer

   Answer: B

   Ansible = agentless, push, YAML playbooks, run from a control node, usually over SSH (or NETCONF/API when configured). Puppet and Chef = agent on the managed node, which pulls its configuration from a server. In YAML, indentation shows structure and a leading dash marks a list item.

   • A. Ansible is agentless. Nothing is installed on the routers and they do not pull anything; that pull-by-agent model describes Puppet and Chef.
   • B. Ansible runs on a control node and pushes changes. With connection: network_cli it opens an SSH session to each router in the group and sends the configuration lines.
   • C. The routers never see the YAML file. Also, network_cli means CLI over SSH; a NETCONF session would use connection: netconf.
   • D. Ansible does not need an SDN controller in the path. It connects to each managed device itself.

6. Question 6 of 10Concept

   Which two statements about configuration management and automation tools are correct? (Choose two.)

   1. Ansible is agentless and pushes changes to devices over SSH.
   2. Puppet is agentless and pushes changes to devices over SSH.
   3. Terraform compares desired config with its state to plan changes.
   4. Chef nodes never pull; they wait for the server to push recipes.
   5. Ansible playbooks are written in XML and run on each device.
   Show the answer

   Answer: A and C

   Ansible: agentless, push, YAML, SSH. Puppet and Chef: agent-based, pull from a server. Terraform: declarative, providers for each platform, a state file that lets it plan only the needed changes.

   • A. Ansible needs no agent on the managed node. The control node connects, usually over SSH for network devices, and pushes the change.
   • B. Puppet is the classic agent-based tool: an agent on the managed node pulls its catalog from the Puppet server. The agentless SSH push model is Ansible's.
   • C. Terraform is declarative: you describe the end state, it records what it built in a state file, and terraform plan shows the difference before apply makes the changes through providers.
   • D. Chef is agent-based and the Chef client pulls its configuration from the Chef server, the opposite of what this says.
   • E. Playbooks are YAML, and they run on the control node, not on the managed devices.

7. Question 7 of 10Scenario

   You are explaining a Cisco SD-Access fabric to a new colleague. Fabric edge nodes must learn which edge node an endpoint sits behind, then tunnel the user traffic to that node across the routed underlay. Which protocols do these two jobs?

   1. VXLAN finds the endpoint location; LISP tunnels the traffic
   2. BGP EVPN finds the endpoint location; GRE tunnels the traffic
   3. LISP finds the endpoint location; VXLAN tunnels the traffic
   4. IS-IS finds the endpoint location; MPLS tunnels the traffic
   Show the answer

   Answer: C

   SD-Access: underlay = the physical routed network (often IS-IS, built by LAN automation), overlay = virtual network on top. Overlay control plane = LISP, data plane = VXLAN, policy plane = Cisco TrustSec (SGTs). Catalyst Center (formerly DNA Center) is the controller that builds and manages it.

   • A. The roles are swapped. VXLAN is the encapsulation of the overlay data plane; it does not keep a database of endpoint locations.
   • B. SD-Access does not use BGP EVPN with GRE for the fabric overlay. That combination is not how Catalyst Center builds the fabric.
   • C. LISP is the overlay control plane: the control plane node holds the endpoint-to-location mappings. VXLAN is the overlay data plane that carries the traffic between fabric nodes.
   • D. IS-IS is a common underlay routing protocol and only provides reachability between the fabric nodes' loopbacks. MPLS is not the SD-Access data plane.

8. Question 8 of 10Scenario

   A new WAN Edge router is installed at a branch in a Cisco Catalyst SD-WAN deployment. Which component does it contact first to authenticate and to learn the addresses of the other controllers?

   1. SD-WAN Manager (formerly vManage)
   2. SD-WAN Controller (formerly vSmart)
   3. Catalyst Center (formerly DNA Center)
   4. SD-WAN Validator (formerly vBond)
   Show the answer

   Answer: D

   Catalyst SD-WAN roles: Validator (vBond) = orchestration, first contact and authentication; Controller (vSmart) = control plane, OMP routes and policies; Manager (vManage) = management GUI and API; WAN Edge (vEdge/cEdge) = the routers that carry the data plane.

   • A. SD-WAN Manager is the management plane: the GUI and API where you build templates and policies and monitor the fabric. It is not the first point of contact.
   • B. The SD-WAN Controller is the control plane. It runs OMP with the WAN Edges and distributes routes and policies, but only after the router has been authenticated.
   • C. Catalyst Center manages campus networks and SD-Access. It is not part of the SD-WAN fabric join process.
   • D. The SD-WAN Validator is the orchestration plane. It authenticates the new WAN Edge, tells it where the Controllers and Manager are, and helps with NAT traversal.

9. Question 9 of 10Concept

   A script must add a new site object to a controller through its REST API. If the call succeeds and the server creates the object, which method and status code do you expect?

   1. POST, then 201 Created
   2. GET, then 200 OK
   3. PATCH, then 404 Not Found
   4. DELETE, then 204 No Content
   Show the answer

   Answer: A

   CRUD to HTTP: Create = POST, Read = GET, Update = PUT (replace) or PATCH (partial change), Delete = DELETE. Success codes: 200 OK, 201 Created, 204 No Content. Client errors start with 4 (400, 401, 403, 404), server errors with 5 (500).

   • A. Create in CRUD maps to POST, and 201 Created is the status that confirms a new resource was made.
   • B. GET is the Read operation. It returns data with 200 OK but creates nothing.
   • C. PATCH changes part of an existing resource, and 404 means the target was not found, so nothing was created.
   • D. DELETE removes a resource. 204 No Content says it worked with no body returned, but that is the opposite of creating.

10. Question 10 of 10Scenario

    Your team is looking at two features of a network management platform. Feature 1 learns the normal latency and error levels for each link and warns before a link is likely to degrade. Feature 2 drafts a configuration snippet from a request typed in plain English. Which statement is accurate?

    1. Both are generative AI, so their output can be deployed as is
    2. Feature 1 is generative AI and Feature 2 is predictive AI
    3. Feature 1 is predictive AI; Feature 2's output needs review
    4. Neither uses machine learning; both are fixed threshold rules
    Show the answer

    Answer: C

    Predictive AI/ML learns patterns from data to classify, forecast or spot anomalies (for example assurance baselines). Generative AI creates new content such as text or configuration. Both help operations, neither replaces the engineer: treat AI output as a suggestion to verify.

    • A. Feature 1 creates no new content, so it is not generative. And no AI output should go to production without a human checking it.
    • B. The labels are swapped. Learning a baseline to forecast trouble is predictive; producing new text or config from a prompt is generative.
    • C. Feature 1 learns from historical data to forecast and flag anomalies, which is predictive AI/ML. Feature 2 generates new content, and generated config can be wrong, so an engineer must verify it.
    • D. A learned per-link baseline is the opposite of a fixed threshold, and drafting config from plain English needs a generative model.

Common mistakes

• Calling NETCONF, RESTCONF or OpenFlow northbound APIs, when they connect the controller down to the devices.
• Counting JSON array positions from 1 instead of 0, which picks the wrong object every time.
• Mixing up 401 and 403: 401 means the server does not know who you are, 403 means it knows and says no.
• Describing Ansible as agent-based or pull-based, which is the Puppet and Chef model.
• Swapping the SD-Access protocols: LISP is the control plane and VXLAN is the data plane, not the other way round.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA VLANs and Trunking: Practice Questions
• CCNA ACL Practice Questions
• CCNA NAT, PAT and Port Forwarding Practice Questions
• CCNA Spanning Tree Protocol: Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP
• CCNA Wireless Fundamentals Practice Questions
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA Security Fundamentals Practice Questions (200-301)
• CCNA QoS Practice Questions (200-301)
• CCNA practice test: all domains