Operations

You are deploying a CA-signed TLS certificate to a network automation web service that presents its API over HTTPS. The public CA issued you a device certificate signed by an intermediate CA, which in turn is signed by the root CA. After installing only the device certificate, some clients report 'unable to get local issuer certificate' errors while others connect fine. What is the correct action to resolve this for all clients?

You are deploying a network automation web service that must present a CA-signed TLS certificate to clients. You have generated a 2048-bit RSA private key on the server. Which sequence correctly describes the next steps to obtain and deploy the CA-signed certificate?

A model-driven telemetry collector receives interface counter data from 40 IOS-XE routers using a dial-out gRPC subscription with a 1-second cadence. Operators notice periodic gaps in the time-series data, and device logs show 'telemetry: unable to send segment, dropping data' messages during peak traffic periods. CPU on the routers spikes near the collection intervals. The collector itself shows no ingestion errors and is far below its resource limits. What is the MOST likely cause and appropriate fix?

A model-driven telemetry pipeline streams interface statistics from an IOS-XE router to a gRPC collector. Operators report that the collector receives data for 'in-octets' and 'out-octets' but the 'oper-status' leaf that alerting depends on is always absent from every message. The subscription uses on-change reporting and the encoding is negotiated successfully. A packet capture confirms telemetry frames are arriving with valid payloads. What is the MOST likely cause of the missing leaf?

Your team deployed a model-driven telemetry (MDT) dial-out subscription from an IOS XE router to a Telegraf collector over gRPC. The router logs show the subscription is in a 'valid' state and the transport session is established, but the collector receives packets that it logs as 'unable to unmarshal metric' and stores no data points. The Telegraf gNMI/cisco_telemetry_mdt input plugin was configured expecting self-describing GPB (key-value) encoding. What is the most likely cause of the collector failing to decode the telemetry stream?

After a network automation job pushes a bulk interface configuration change to a distribution switch, your CI pipeline runs a pyATS verification job. The job log shows: the pre-change snapshot learned 48 interfaces in 'up' state, and the post-change 'Diff' output reports one interface changed from oper_status 'up' to 'down' with no other differences. The intended change was only to update interface descriptions. What should you conclude and do next?

A network automation service writes structured events to a centralized syslog collector using the standard Python logging module with a SysLogHandler. Operators report that INFO-level 'config pushed' messages arrive at the collector, but WARNING-level messages about partial rollback failures never appear. The application code calls logger.warning() at the correct points, and the collector is confirmed reachable. Reviewing the initialization code, you find: logger.setLevel(logging.INFO) on the logger and handler.setLevel(logging.ERROR) on the SysLogHandler. What is the root cause and correct fix?

Your network automation script pushes structured log events to a centralized incident management platform via an HTTP webhook. After a recent update to the platform's ingestion endpoint, all log deliveries began failing. The script logs the following for each attempt: 'POST https://logs.example.com/v2/ingest returned 401 Unauthorized; body: {"error":"missing or invalid API token"}'. Local file logging continues to work normally. What is the most likely cause and appropriate fix?

A network automation service written in Python runs in production and pushes config changes via RESTCONF. During normal operation the on-call team is overwhelmed by log volume, but when a rare failure occurs they lack the detailed variable values needed to troubleshoot. The developer wants a logging strategy where routine operational events are recorded compactly, while detailed diagnostic data (payloads, variable state) can be captured on demand without a code change. Which approach best meets these requirements?

A network automation platform runs dozens of concurrent playbook executions, each triggered by a different change request. Operators complain that when they search the aggregated syslog stream for a failed job, they cannot reliably tie individual log lines back to the specific execution that produced them, because messages from parallel runs are interleaved. You are asked to improve the logging strategy so failures can be traced end-to-end. Which change most directly solves this problem?

Your network automation platform runs nightly config-compliance jobs. The operations team requires two things: (1) every compliance check result must be persisted to the central rsyslog server for long-term audit retention, and (2) only critical drift events (severity CRITICAL) must instantly page the on-call engineer through the team's Slack channel. You are designing the Python logging configuration. Which approach best satisfies both requirements?

You are designing a model-driven telemetry (MDT) solution to stream interface counters from IOS-XE routers into a time-series database. Your teammate asks you to explain which architectural component determines WHICH data is collected from the device's YANG data store. Which MDT component defines the specific set of data nodes that the device streams?

You are designing a model-driven telemetry solution for a data center fabric. The operations team wants near-real-time notification whenever an interface operational status transitions (up/down), but they want to minimize the volume of redundant telemetry data sent when interfaces are stable for long periods. Which subscription configuration best meets these requirements?

Your team is deploying model-driven telemetry (MDT) from a fleet of IOS-XE routers to a centralized Telegraf collector using gRPC. The routers sit behind a NAT boundary, and the security team will only permit the routers to initiate outbound connections to the collector's IP and port; no inbound connections toward the routers are allowed. Which telemetry subscription architecture must you configure on the routers to satisfy this constraint?

Your team runs a model-driven telemetry pipeline where several thousand interface counters are streamed every 5 seconds from a fleet of IOS-XE routers to a centralized collector over a dial-out gRPC subscription. The collector team reports that WAN bandwidth to the telemetry collector is saturated and CPU on the collector is high while parsing incoming messages. Management asks you to reduce on-the-wire message size and parsing overhead without changing the sensor paths or cadence. Which change to the telemetry subscription encoding best meets this requirement?

Your team deployed a model-driven telemetry solution where IOS-XE routers use dial-out gRPC subscriptions to push telemetry to a central collector over a TLS-encrypted channel. After enabling TLS on the collector with a certificate signed by your internal CA, the routers report the subscription state as 'Connecting' and never reach 'Valid', while the collector logs show TLS handshake failures. The collector's certificate chain and private key are correctly installed. What is the most likely cause and correct remediation?

A network automation team is designing a model-driven telemetry (MDT) pipeline for streaming BGP neighbor state from IOS-XE routers into a time-series database for dashboards. They want to understand which architectural component is responsible for decoding the incoming binary payloads before they are normalized and written to storage. In a typical MDT architecture, which component performs the decoding of the streamed data into structured records?

Your team runs a pyATS job after every automated BGP configuration push to validate that all neighbors return to the Established state. You want the validation to compare a freshly learned operational state against a previously saved snapshot taken before the change, and to fail the pipeline stage automatically if any neighbor differs. Which pyATS CLI approach best accomplishes this change validation?

A network automation engineer must add change validation to a CI pipeline for IOS-XE routers. After each deployment, the pipeline should confirm that all BGP neighbors return to the Established state and that no interfaces flapped, using pyATS from the command line without writing custom Python test scripts. Which pyATS CLI approach best satisfies this requirement?

After pushing an OSPF configuration change via a CI pipeline, you want to add a change-validation step that runs from the shell (no Python test script) to confirm the device is reachable and capture structured operational state for later comparison. You have a pyATS testbed.yaml defining the device. Which pyATS CLI command produces machine-readable JSON output of parsed CLI data that your pipeline can archive and diff against a baseline?