CCNA Automation and Programmability: 170 practice questions

12 of the 170 Automation and Programmability questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. Use a controller to define policy while switches perform: Which approach best satisfies both requirements?

1. Configure each switch independently and document every local policy change.

   Individual configuration can enforce policy, but it creates repetitive work and weakens centralized visibility.
2. Replace switch configurations with manually edited JSON files on a technician's workstation.

   Local files may standardize content, but they provide neither controller visibility nor reliable deployment coordination.
3. Configure one switch and copy its running configuration manually to every other switch.

   Copying configurations can improve similarity, but manual distribution remains device-by-device and lacks centralized policy control.
4. Use a controller to define policy while switches perform local packet forwarding. ✓

   A controller centralizes policy and visibility, while network devices continue forwarding traffic through their data planes.

Controller-based policy centralizes management while switches retain local data-plane forwarding.

2. Verify switch-to-monitoring reachability: Which conclusion should guide troubleshooting first?

1. The monitoring application must be replaced because the automation host can reach it successfully.

   Automation-host reachability does not prove switch-subnet reachability or required return paths and ports.
2. Verify switch-to-monitoring reachability, routing, filtering, and credentials before changing the consistent template. ✓

   The feature may be consistently configured while a switch-side path, access rule, or credential dependency fails.
3. The automation template is inconsistent because successful deployment cannot occur without monitoring registration.

   Configuration deployment and monitoring registration are separate operations, so successful template application remains possible.
4. The switches probably need different telemetry configurations because identical templates cannot support scale.

   Identical templates commonly improve consistency; scale alone does not explain simultaneous registration failure.

Consistent deployment proves configuration delivery, not reachability or successful service registration.

3. The configuration remains unchanged: What occurs when the play runs against the switch?

1. The configuration remains unchanged, so no save occurs. ✓

   The requested description already exists, and the stated running and startup configurations match. Therefore the first task makes no change and save_when: modified does not save.
2. The controller installs an agent before applying the interface configuration.

   Ansible network_cli uses the configured network connection and does not require installing an agent on IOS XE.
3. The play fails because parents cannot be used with ios_config lines.

   ios_config supports hierarchical configuration by using parents together with configuration lines.
4. The description is reapplied, and the running configuration is saved.

   ios_config compares the requested configuration with the device state; it does not needlessly reapply an existing line, and the save condition is not met.

The requested state already exists and running equals startup, so neither configuration nor startup storage changes.

4. GET retrieved an existing resource: Which conclusion is correct?

1. GET retrieved an existing resource, while POST submitted data that created a new shipment. ✓

   GET retrieves the identified shipment, whereas POST commonly submits a new resource representation for creation.
2. GET and POST are equivalent because both requests used HTTPS and valid credentials.

   Transport security and authentication do not change the distinct semantics of HTTP request methods.
3. GET created shipment 4812, while POST only retrieved the newly created resource.

   A successful GET normally retrieves data, while 201 Created indicates POST caused resource creation.
4. GET replaced shipment 4812, while POST partially updated that same shipment.

   GET is retrieval, and POST to the collection endpoint does not imply partial modification of shipment 4812.

GET retrieves; POST commonly creates a resource at a collection endpoint.

5. `priority` is the key: Which statement correctly identifies the JSON key and value relationship?

1. `labels` is a numeric key whose value is the string `edge`.

   The labels key maps to an array containing strings, not to a numeric key or single string value.
2. `enabled` is the key, and its value is the string `true`.

   The value true is JSON boolean data, not a quoted string value.
3. `device` is the key, and its value is an array containing `sw12`.

   The device key maps directly to the string sw12 rather than an array structure.
4. `priority` is the key, and its value is the number 3. ✓

   The object contains the double-quoted key priority followed by the numeric JSON value 3.

The priority member has a numeric value of 3 within the JSON object.

6. HTTPS from VLAN 20 users to 10.10.50.10 is denied: What forwarding behavior results if the proposal is accepte

1. HTTPS is permitted because the destination server address appears after the protocol field.

   The syntax correctly matches TCP traffic to the specified destination host and destination port.
2. Only traffic originating from 10.10.50.10 is denied because the ACL is inbound.

   Inbound application on VLAN 20 evaluates packets entering from 10.10.20.0/24 toward the server.
3. All traffic from VLAN 20 users is denied because extended ACLs stop after one deny.

   Only matching HTTPS reaches the deny; the explicit later permit allows other IP traffic.
4. HTTPS from VLAN 20 users to 10.10.50.10 is denied, while other IP traffic is permitted. ✓

   The first entry denies matching HTTPS, and the following permit allows all remaining IP traffic inbound.

The first ACL entry blocks matching HTTPS, and the explicit permit allows other IP traffic.

7. Use the installed route: What should the switch do?

1. Drop the packet because the controller is unreachable.

   The stated architecture retains forwarding information locally, so controller loss does not invalidate this installed route.
2. Broadcast the packet because the destination is outside the local network.

   The destination matches the installed routed prefix; a switch does not broadcast it as an unknown local destination.
3. Send the packet to the controller for a forwarding decision.

   The data plane already has a matching installed route and resolved next hop, so per-packet controller access is unnecessary.
4. Use the installed route. ✓

   10.40.8.25 matches the installed 10.40.0.0/16 route, and the resolved next hop can be reached through the up/up interface despite controller loss.

The switch continues using its installed matching route.

8. The dashboard becomes stale: What behavior should administrators expect?

1. The dashboard becomes stale, while existing switch forwarding continues under the retained policy. ✓

   Loss of telemetry affects visibility, but retained policy and forwarding entries continue handling traffic locally.
2. The dashboard remains current because controller visibility is independent of controller connectivity.

   Without connectivity, the controller cannot receive current switch telemetry or represent new operational state.
3. New traffic bypasses switches and travels directly to the unreachable controller.

   Packets remain within the network data path; controller connectivity does not create a replacement forwarding path.
4. All access switches immediately erase forwarding entries because policy distribution stopped.

   The stated architecture explicitly retains installed policy and forwarding entries during controller outages.

Controller loss stops fresh visibility, but switches continue forwarding with retained policy and entries.

9. Compare the pilot's running ACL: Which verification step is most appropriate?

1. Check the pilot's uptime and immediately deploy the ACL to every tenant switch.

   Uptime does not verify ACL content or behavior, and immediate expansion defeats staged rollout protection.
2. Compare the pilot's running ACL with the version-controlled intended policy, then test both traffic cases. ✓

   Configuration comparison confirms deployment, while permitted and denied tests verify actual behavior before wider rollout.
3. Confirm the automation server has network access, then delete the pilot's old ACL.

   Automation reachability does not validate policy behavior, and deleting the old ACL increases unnecessary exposure.
4. Review the switch hostname only, because matching device identity proves correct policy operation.

   Device identity confirms target selection but cannot prove rule order, matching, or forwarding behavior.

Compare intended and deployed policy, then test permitted and denied traffic on the pilot.

10. The branch remains unchanged until an apply operation: What should the administrator expect immediately afterw

1. Terraform destroys unmanaged VLANs first because every plan reconciles by deleting untracked resources.

   Terraform does not automatically destroy arbitrary unmanaged resources merely because they are absent from state.
2. Terraform creates the VLAN and records it in state because the plan found one addition.

   A plan previews proposed changes but does not create infrastructure or update managed state by itself.
3. The branch remains unchanged until an apply operation executes the approved planned change. ✓

   Terraform plan calculates and displays intended actions; apply is required to modify infrastructure and state.
4. Terraform applies the change only if the provider supports automatic approval during planning.

   Planning does not apply changes, regardless of provider capabilities or any automatic approval behavior.

Terraform plan previews changes; infrastructure remains unchanged until terraform apply runs.

11. GET it and compare with the saved baseline: Which verification step best resolves the uncertainty?

1. GET it and compare with the saved baseline. ✓

   A new GET returns the complete current resource, and comparison with the saved pre-change representation reveals whether unrelated fields changed.
2. Replace it with PUT using only the description.

   PUT could replace omitted properties and create additional changes instead of safely verifying the earlier PATCH.
3. Repeat PATCH and inspect only its status code.

   A success status indicates request processing but does not reveal the values of unrelated resource fields.
4. Inspect the switch's console history over SSH.

   CLI history does not necessarily show the complete API resource representation or prove which fields changed.

GET the resource and compare it with the saved pre-change representation.

12. No traffic; element [0] denies it first: Which traffic is affected by element [1]?

1. 10.20.30.0/24 to 10.50.0.0/16 is denied.

   That condition belongs to element [2], and the earlier element [0] already denies the traffic before element [2] is reached.
2. The first deny applies.

   Element [0] is the first deny, but this response does not identify the traffic affected by element [1].
3. 10.20.30.0/24 to 10.40.0.0/16 is permitted.

   Although element [1] specifies that permit, the earlier source-based deny matches first and prevents element [1] from affecting traffic.
4. No traffic; element [0] denies it first. ✓

   Any source in 10.20.30.0/24 is also within 10.20.0.0/16, so element [0] matches first and denies the traffic before element [1] is evaluated.

Element [0] denies the traffic first, so element [1] affects no traffic.

Other CCNA domains

• IP Connectivity — 425 questions →
• Network Access — 340 questions →
• Network Fundamentals — 339 questions →
• Security Fundamentals — 255 questions →
• IP Services — 170 questions →
• All 1699 CCNA questions →
• CCNA certification: requirements, cost and exam format →