Network Automation

A network engineer maintains an Ansible playbook that configures VLANs on Cisco IOS XE switches using the cisco.ios collection. Before a scheduled maintenance window, the change-management team requires proof of exactly what changes the playbook would apply to production—without altering any device configuration. The engineer wants to run the existing playbook unchanged and produce a per-task report of predicted modifications. Which approach satisfies this requirement?

You are writing an Ansible playbook to configure OSPF on a fleet of Cisco IOS-XE routers. Your team has standardized on structured, model-driven data and wants the playbook to push configuration via NETCONF/YANG rather than screen-scraping CLI. Which combination of connection plugin and module type should you use in your play so the tasks communicate with the devices correctly?

A network engineer must deploy a standardized extended ACL to 40 IOS-XE routers using Ansible. The ACL entries vary per site and are defined as a list of dictionaries (each with fields like sequence, action, protocol, source, and destination) in group_vars. The engineer wants to render the full ACL configuration dynamically from this data and push it via a single task, avoiding hard-coded CLI lines. Which approach best meets this requirement?

You are writing an Ansible playbook to configure interface descriptions on Cisco IOS-XE switches. A requirement states that only interfaces currently in an 'administratively down' state should have their description updated to 'RESERVED', while operational interfaces must remain untouched. You gather interface facts with the ios_facts module. Which approach correctly implements this conditional per-interface configuration in a single task loop?

An engineer runs an Ansible playbook against 40 Cisco IOS-XE routers to apply a large OSPF configuration block using the ios_config module over the network_cli connection. On several routers with slow response times, the play fails with 'command timeout triggered, timeout value is 30 secs'. The configuration itself is valid and applies successfully when entered manually. Without changing the OSPF task logic, which action most directly resolves these timeout failures?

A network engineer must run an Ansible playbook against a fleet of Cisco IOS-XE routers to audit only their OSPF-related running configuration. The playbook currently uses the cisco.ios.ios_facts module, but each run takes several minutes because it collects all device facts (hardware, interfaces, default config, etc.). The engineer wants to significantly reduce runtime while still retrieving enough data to inspect the OSPF configuration. Which change to the ios_facts task best achieves this?

Your team maintains a large Ansible project that configures VLANs, interfaces, and ACLs across hundreds of Cisco IOS-XE switches. The current single playbook has become unwieldy. You want to package the reusable VLAN-provisioning logic (tasks, default variables, and handlers) into a shareable unit that other playbooks can call, and you need the tasks to be evaluated and included at the time the play parses, so that any tags on individual tasks inside the unit are honored when someone runs the playbook with '--tags vlan_create'. Which approach meets these requirements?

Your team commits an Ansible project to a shared Git repository to automate OSPF and interface configuration across IOS-XE devices. A security audit flags that plaintext device passwords appear in the group_vars/all.yml file. You must keep the credentials in version control but ensure they are not readable in plaintext, while still allowing playbooks to run unattended in a CI/CD pipeline. Which approach best satisfies these requirements?

You are writing a Python script using the ncclient library to push OSPF configuration to an IOS-XE device over NETCONF. The configuration XML includes a new OSPF process and several network statements. Requirements: if any part of the OSPF config is rejected by the device, the entire change must be rolled back automatically so the router is never left in a partial state, and the script must raise an exception for the CI/CD pipeline to catch. Which approach best satisfies these requirements?

Your team must build asset management reporting for a fleet of legacy IOS switches that do not support RESTCONF or NETCONF. Using Python with the Netmiko library, you retrieve raw output from 'show interfaces status' and 'show vlan brief' over SSH. The business requirement is to transform this unstructured CLI text into structured Python dictionaries so the data can be loaded into a JSON inventory database without writing fragile custom regular expressions for each command. Which approach best meets this requirement?

You are writing a Python script that uses the requests library to push OSPF configuration to a production IOS-XE device via RESTCONF over HTTPS. The device presents a certificate signed by your organization's internal enterprise CA. During testing you received an SSLError, so a colleague suggests adding verify=False to every request. Security policy forbids disabling certificate validation in production. Which approach lets the script authenticate the device's certificate while complying with policy?

You are writing a Python script that reads the intended VLAN configuration from a YAML source of truth and pushes it to a Catalyst 9300 via RESTCONF. Business requirements state the script must (1) only send changes when the running device config differs from the intended config, and (2) never remove VLANs that were configured out-of-band by another team. Which approach best satisfies both requirements?

You are writing a Python script that uses RESTCONF (RFC 8040) against a Cisco IOS XE device to persist the current interface and ACL configuration so it survives a reboot. Your script has already applied changes to the running configuration via PATCH requests. Which additional RESTCONF operation must your script issue to guarantee the applied configuration is retained after a device power cycle?

You are writing a Python script using the requests library to push an OSPF area configuration to an IOS-XE device via RESTCONF. When the device rejects a malformed payload, it returns an HTTP 400 status. Your operations team needs the script to log the specific reason for the failure (such as which leaf failed validation) so they can troubleshoot without opening the device. Where in the HTTP response should your code look to extract this structured error detail?

You are writing a Python script that queries a controller's REST API to build an asset-management inventory of all network devices. The API documentation states that GET /api/v1/devices returns at most 50 records per response and includes a top-level JSON field "next" containing the URL of the following page (null when there are no more pages). Your first request returns 50 devices, but your inventory only ever contains those 50. Which change correctly retrieves the complete device list?

You are writing a Python script to push an OSPF interface cost change to an IOS-XE device using RESTCONF. Your team requires that the script send the request in JSON, target only the single interface's OSPF configuration without affecting other OSPF settings on that interface, and fail gracefully if the resource path does not already exist. Which combination of HTTP method and header/behavior should the script use?

You maintain a Python script that manages OSPF on Cisco IOS XE devices via RESTCONF (RFC 8040). A network engineer asks you to remove a single OSPF network statement (network 10.1.0.0 0.0.255.255 area 0) from process 1 without affecting any other OSPF configuration or restarting the process. The YANG data for that list entry is keyed by ip, mask, and area. Which approach correctly removes only that one statement?

You are writing a Python script that uses RESTCONF against an IOS XE device to retrieve the running OSPF configuration. The OSPF container has deeply nested areas, networks, and interface sub-elements, but for a quick dashboard you only need the top-level OSPF process IDs and their router-id — not the full nested tree. Retrieving the entire subtree is slow and returns megabytes of JSON. Which RESTCONF query parameter should you add to the GET request to limit how many levels of nested descendants are returned?

You are writing a Python script that uses the requests library and RESTCONF (RFC 8040) to update the description on a set of interfaces across many IOS-XE devices. Multiple automation jobs may run concurrently, and your team requires that an update must fail rather than silently overwrite a change made by another job since your script last read the resource. Which approach correctly implements this safeguard using standard RESTCONF/HTTP mechanisms?

You are writing a Python script that uses the requests library and RESTCONF (RFC 8040) to add a new VLAN (VLAN 250) to an IOS-XE device. The VLAN does not yet exist in the running datastore, and you must ensure the operation FAILS if the resource already exists (to avoid silently overwriting an existing VLAN configuration). Which HTTP method and target URI approach correctly implements this requirement?