18 Automation & Programmability Practice Questions & Answers

Every Automation & Programmability practice question from the Cisco CCNA 200-301 Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A network team configures 300 access switches one at a time from the CLI, and audits keep finding small differences between devices that should be identical. Which benefit does moving to template-driven automation most directly provide?
- A.Removing the need for routing protocols on devices
- B.Applying one tested template the same way everywhere✓ Answer
- C.Removing the need for engineers to review changes
- D.Guaranteeing that no switch hardware can ever fail
Automation renders every device's configuration from one validated source and pushes it the same way to every device, so the typing errors and drift of box-by-box CLI work go away. It does not remove the need for human review and testing, it does not replace control-plane protocols such as routing, and it cannot prevent hardware failures.
Ref QB-MYXT5FSource: Cisco CCNA 200-301 Exam Topics — 6.1 Explain how automation impacts network managementReport a problem with this question
2. An engineering team moves all of its switch configurations into a version-control repository and deploys every change from there. Which benefit does this infrastructure-as-code practice add?
- A.Devices accept config pushes without authentication
- B.Routing tables converge faster after a link fails
- C.Changes no longer need any testing before rollout
- D.Every change is recorded and can be rolled back✓ Answer
Version control keeps a history of every commit: who changed what and when. That gives an audit trail and lets the team redeploy a known-good earlier version. It has no effect on routing convergence, it does not remove device authentication, and changes still need testing before rollout.
Ref QB-4GSNJESource: Cisco CCNA 200-301 Exam Topics — 6.1 Explain how automation impacts network managementReport a problem with this question
3. A junior engineer is comparing a traditional campus network with a controller-based one. Which statement correctly contrasts them?
- A.Controller-based networks remove the data plane from every switch and router
- B.Controller-based networks require each device to be configured by local CLI
- C.Traditional networks centralize all routing decisions in a single core device
- D.Traditional devices are set up one by one, but a controller pushes policy to many✓ Answer
In a traditional network the control plane is distributed: each device runs its own protocols and is configured on its own. A controller-based network adds a central point that holds the network-wide view and pushes consistent policy to many devices through APIs. The devices still forward traffic in their own data planes.
Ref QB-KYKGYDSource: Cisco CCNA 200-301 Exam Topics — 6.2 Compare traditional networks with controller-based networkingReport a problem with this question
4. At a branch office, the centralized network controller loses connectivity for an hour. The switches and routers were already configured, and their routing protocols are running normally. What is the expected effect?
- A.Devices revert to factory defaults and then reboot
- B.Switches flood every frame out all of their ports
- C.All user traffic stops until the controller returns
- D.Traffic keeps flowing, but new policy changes must wait✓ Answer
The controller is a central point of management and policy, not the path that user traffic takes. The data plane runs on the devices and keeps using its existing configuration and forwarding state. What stops is the ability to push new policy, provision devices or collect assurance data until the controller is back.
Ref QB-3GEBDDSource: Cisco CCNA 200-301 Exam Topics — 6.2 Compare traditional networks with controller-based networkingReport a problem with this question
5. A router performs the four tasks below during normal operation. Which task belongs to the control plane?
- A.Exchanging OSPF updates to build its routes✓ Answer
- B.Dropping transit packets that match an ACL
- C.Accepting an administrator's SSH login
- D.Forwarding a packet out the egress interface
The control plane builds the information used for forwarding, through routing protocols such as OSPF along with STP and ARP. Forwarding packets and enforcing ACLs on transit traffic are data plane work. SSH access to the device belongs to the management plane.
Ref QB-JY86TCSource: Cisco CCNA 200-301 Exam Topics — 6.3.a Separation of control plane and data planeReport a problem with this question
6. A vendor describes its new design as software-defined networking. In SDN terms, what changes about the device planes compared with a traditional network?
- A.Control logic is centralized while devices keep forwarding✓ Answer
- B.Forwarding moves to the controller while devices only route
- C.The data and control planes merge into one device process
- D.The management plane is removed, so devices need no access
SDN separates the control plane from the data plane. Control decisions are centralized in, or abstracted into, a controller with a network-wide view, while each device's data plane keeps forwarding traffic locally. User traffic does not pass through the controller, and the devices still need management access.
Ref QB-2G3Z7CSource: Cisco CCNA 200-301 Exam Topics — 6.3.a Separation of control plane and data planeReport a problem with this question
7. In a campus fabric, the switches are joined by a routed IP network running IS-IS, and VXLAN tunnels that carry user traffic are built on top of that routed network. What are the VXLAN tunnels called?
- A.The overlay network✓ Answer
- B.The management network
- C.The underlay network
- D.The complete fabric
The underlay is the physical routed IP network, here IS-IS, that gives the devices reachability to each other. The overlay is the set of virtual tunnels, here VXLAN, built over it to carry user traffic. The fabric is the underlay and the overlay together, so it is not the name for the tunnels alone.
Ref QB-HYVTMBSource: Cisco CCNA 200-301 Exam Topics — 6.3 Describe controller-based, software defined architecture (overlay, underlay, and fabric)Report a problem with this question
8. An operations team's Python script calls a controller's REST API to pull a device inventory. The controller then uses NETCONF to change configuration on the switches. How are these two interfaces classified?
- A.Script-to-controller is southbound; controller-to-switch is northbound
- B.Script-to-controller is northbound; controller-to-switch is southbound✓ Answer
- C.Both are southbound, because both of them carry configuration data
- D.Both are northbound, because both of them are programmable APIs
An interface is classified by direction, not by what it carries. A northbound API faces up, from the controller to applications and scripts, and is typically REST with JSON. A southbound API faces down, from the controller to network devices; examples include NETCONF, RESTCONF, OpenFlow, OpFlex and SNMP.
Ref QB-9GJBEMSource: Cisco CCNA 200-301 Exam Topics — 6.3.b Northbound and Southbound APIsReport a problem with this question
9. A monitoring platform learns each link's normal latency pattern from months of telemetry. It warns staff that a WAN link is trending toward congestion before users notice anything. Which approach is this?
- A.A fixed threshold that alarms at one preset value
- B.Predictive AI/ML that forecasts from historical data✓ Answer
- C.Generative AI that writes new content from a prompt
- D.Manual review of interface counters by an engineer
Predictive AI/ML learns a baseline from historical and telemetry data and then detects anomalies or forecasts trends, so it can act before users are affected. Generative AI creates new content from prompts. A fixed threshold learns nothing and fires only after a preset value is crossed.
Ref QB-RYC6UKSource: Cisco CCNA 200-301 Exam Topics — 6.4 Explain AI (generative and predictive) and machine learning in network operationsReport a problem with this question
10. An engineer types a plain-language request into a generative AI assistant and receives a complete ACL configuration in seconds. Which statement about that output is accurate?
- A.It is safe to push directly since the request was specific
- B.It is guaranteed correct because it was learned from data
- C.It is a draft that can contain errors and needs human review✓ Answer
- D.It is predictive AI output that forecasts the needed rules
Generative AI produces new content such as configurations, scripts and summaries from a prompt. It can hallucinate plausible but wrong output. An engineer must therefore review and test any AI-generated configuration before deploying it. Creating content is generative AI, not predictive AI.
Ref QB-DCTX83Source: Cisco CCNA 200-301 Exam Topics — 6.4 Explain AI (generative and predictive) and machine learning in network operationsReport a problem with this question
11. A script must change only the description field of one interface resource on a controller, without resending the rest of that resource's fields. Which HTTP method fits this partial update?
- A.POST
- B.PATCH✓ Answer
- C.GET
- D.PUT
PATCH applies a partial modification to an existing resource. PUT replaces the entire resource with the representation sent, so any fields that are left out can be lost or reset. POST typically creates a new resource, and GET only reads.
Ref QB-WUY4U3Source: Cisco CCNA 200-301 Exam Topics — 6.5 Describe characteristics of REST-based APIs (CRUD, HTTP verbs)Report a problem with this question
12. A script presents a valid, unexpired token to a controller API and asks to delete a site. The account behind that token has read-only rights. Which response code fits this result?
- A.404 Not Found
- B.403 Forbidden✓ Answer
- C.401 Unauthorized
- D.400 Bad Request
403 Forbidden means the server knows who the client is but refuses the action because the client lacks permission. Despite its name, 401 Unauthorized means the request was not authenticated, for example a missing or invalid token. 404 means the resource does not exist, and 400 means the request itself is malformed.
Ref QB-CCFM32Source: IETF RFC 9110 — HTTP status codes 401 and 403Report a problem with this question
13. A lab script authenticates to a REST API with HTTP Basic authentication over plain HTTP on TCP port 80. Which statement about the credentials is accurate?
- A.They are only Base64-encoded, not encrypted✓ Answer
- B.They are sent once and then kept in a session
- C.They are encrypted with the server's public key
- D.They are hashed and so cannot be replayed
Basic authentication puts username:password into the Authorization header encoded in Base64, which anyone who captures the traffic can reverse. It must therefore be protected with HTTPS. Because REST is stateless, the server keeps no session, so credentials or a token are sent with every request.
Ref QB-VUMSN2Source: IETF RFC 7617 — The Basic HTTP Authentication SchemeReport a problem with this question
14. A team plans to manage its router configurations with Ansible. Which description matches how Ansible works?
- A.Agentless; a control node pushes YAML tasks over SSH✓ Answer
- B.Agent-based; devices pull manifests from a central server
- C.Agentless; devices pull Ruby recipes on a set timer
- D.Declarative HCL files reconciled against a state file
Ansible is agentless. A control node reads an inventory and runs YAML playbooks, pushing tasks to devices over SSH or device APIs through idempotent modules. Agent-based pull with manifests or Ruby recipes describes tools such as Puppet and Chef. Declarative HCL with a state file describes Terraform.
Ref QB-FCHMK5Source: Cisco CCNA 200-301 Exam Topics — 6.6 Recognize the capabilities of configuration management mechanisms such as Ansible and TerraformReport a problem with this question
15. Before changing anything, an engineer runs the Terraform step that previews which resources will be created, modified or destroyed. What does Terraform compare to build that preview?
- A.The agent's report against the server's manifest
- B.The running config against the startup config
- C.The YAML playbook against the host inventory file
- D.The declared configuration against its recorded state✓ Answer
Terraform is declarative infrastructure as code. Its HCL files describe the desired end state, and its state file records the infrastructure it manages. The plan step compares the two, after refreshing against the real infrastructure, and lists the changes. Nothing is changed until the apply step runs. Playbooks and inventories belong to Ansible, and agent manifests belong to Puppet.
Ref QB-YUPS66Source: Cisco CCNA 200-301 Exam Topics — 6.6 Recognize the capabilities of configuration management mechanisms such as Ansible and TerraformReport a problem with this question
16. A controller API returns this JSON: {"hostname": "EDGE-1", "enabled": "true", "mtu": 1500, "vlans": [10, 20]}. What is the data type of the value of the key enabled?
- A.Number
- B.Boolean
- C.String✓ Answer
- D.Null
Any JSON value enclosed in double quotes is a string, so "true" is a string. A JSON boolean is the bare lowercase literal true or false, written without quotes. Likewise 1500 is a number because it has no quotes.
Ref QB-EC6AE4Source: IETF RFC 8259 — The JavaScript Object Notation (JSON) Data Interchange FormatReport a problem with this question
17. A technician writes four candidate request bodies for an API call. Which one is valid JSON?
- A.{"name": "Gi0/1", "up": true,}
- B.{name: "Gi0/1", "up": true}
- C.{"name": "Gi0/1", "up": true}✓ Answer
- D.{'name': 'Gi0/1', 'up': true}
In JSON, keys and string values must use double quotes. A colon separates each key from its value, commas go only between pairs, and the boolean true is written unquoted. Single quotes, a trailing comma after the last pair, or an unquoted key each make the text invalid JSON.
Ref QB-XUBFZ4Source: IETF RFC 8259 — The JavaScript Object Notation (JSON) Data Interchange FormatReport a problem with this question
18. An API returns: {"device": "SW-A", "interfaces": [{"name": "Gi1/0/1", "vlan": 10}, {"name": "Gi1/0/2", "vlan": 20}]}. How many JSON objects and arrays does it contain in total?
- A.3 objects and 2 arrays
- B.1 object and 1 array
- C.3 objects and 1 array✓ Answer
- D.2 objects and 1 array
Each pair of curly braces is an object and each pair of square brackets is an array. The outer braces form one object. The value of interfaces is a single array in brackets, and that array holds two objects, one per interface. The total is 3 objects and 1 array.
Ref QB-HC8AX7Source: IETF RFC 8259 — The JavaScript Object Notation (JSON) Data Interchange FormatReport a problem with this question

1. A network team configures 300 access switches one at a time from the CLI, and audits keep finding small differences between devices that should be identical. Which benefit does moving to template-driven automation most directly provide?

2. An engineering team moves all of its switch configurations into a version-control repository and deploys every change from there. Which benefit does this infrastructure-as-code practice add?

3. A junior engineer is comparing a traditional campus network with a controller-based one. Which statement correctly contrasts them?

4. At a branch office, the centralized network controller loses connectivity for an hour. The switches and routers were already configured, and their routing protocols are running normally. What is the expected effect?

5. A router performs the four tasks below during normal operation. Which task belongs to the control plane?

6. A vendor describes its new design as software-defined networking. In SDN terms, what changes about the device planes compared with a traditional network?

7. In a campus fabric, the switches are joined by a routed IP network running IS-IS, and VXLAN tunnels that carry user traffic are built on top of that routed network. What are the VXLAN tunnels called?

8. An operations team's Python script calls a controller's REST API to pull a device inventory. The controller then uses NETCONF to change configuration on the switches. How are these two interfaces classified?

9. A monitoring platform learns each link's normal latency pattern from months of telemetry. It warns staff that a WAN link is trending toward congestion before users notice anything. Which approach is this?

10. An engineer types a plain-language request into a generative AI assistant and receives a complete ACL configuration in seconds. Which statement about that output is accurate?

11. A script must change only the description field of one interface resource on a controller, without resending the rest of that resource's fields. Which HTTP method fits this partial update?

12. A script presents a valid, unexpired token to a controller API and asks to delete a site. The account behind that token has read-only rights. Which response code fits this result?

13. A lab script authenticates to a REST API with HTTP Basic authentication over plain HTTP on TCP port 80. Which statement about the credentials is accurate?

14. A team plans to manage its router configurations with Ansible. Which description matches how Ansible works?

15. Before changing anything, an engineer runs the Terraform step that previews which resources will be created, modified or destroyed. What does Terraform compare to build that preview?

16. A controller API returns this JSON: {"hostname": "EDGE-1", "enabled": "true", "mtu": 1500, "vlans": [10, 20]}. What is the data type of the value of the key enabled?

17. A technician writes four candidate request bodies for an API call. Which one is valid JSON?

18. An API returns: {"device": "SW-A", "interfaces": [{"name": "Gi1/0/1", "vlan": 10}, {"name": "Gi1/0/2", "vlan": 20}]}. How many JSON objects and arrays does it contain in total?

Other topics in this exam