Automation and Assurance

A service provider automation team is choosing between Ansible and Terraform to manage the running configuration of hundreds of Cisco IOS XR routers. A key requirement is that re-running the same automation job repeatedly must not create duplicate or conflicting configuration if the device is already in the desired state. Which characteristic of Ansible directly satisfies this requirement?

A network engineer is bringing a new IOS XR router into a streaming telemetry platform. Before subscribing to any paths, the engineer wants the collector to programmatically discover which YANG models, gNMI version, and data encodings (JSON, JSON_IETF, PROTO) the router supports so the collector can select a compatible encoding. Which gNMI RPC should the collector issue to obtain this information?

A service provider is deploying model-driven telemetry from an IOS XR router to a centralized collector. The network team wants the collector to initiate a persistent gNMI session to the router, and the router should stream operational data continuously as counters change, rather than at fixed intervals. Which combination of gNMI transport model and subscription mode should be configured to meet this requirement?

A service provider is deploying model-driven telemetry from an IOS XR router to a collector. Security policy requires that both the router and the collector mutually authenticate each other using X.509 certificates before any telemetry data is streamed, and the router must initiate the connection to the collector. Which combination of gRPC/gNMI settings satisfies these requirements?

A network engineer is configuring gNMI dial-out (target-initiated) telemetry on an IOS-XR router toward a collector that is reachable only across a fully trusted, isolated out-of-band management network. Management insists on the simplest possible transport configuration for a lab validation, so the engineer configures the gRPC session without any certificate trustpoint or TLS parameters. After committing, the router attempts to establish the session but the collector, which is listening for plaintext gRPC on port 57400, never receives a connection. What is the most likely reason the session fails to come up?

A network engineer configures a gNMI dial-in subscription over TLS between a Cisco IOS XR router and a telemetry collector. The router presents a server certificate whose Common Name and Subject Alternative Name contain only the router's loopback IP address (10.0.0.1), but the collector initiates the session using the router's DNS hostname (rtr1.example.com). SNMP and NETCONF over SSH work fine. The gNMI session fails during the TLS handshake with a certificate validation error on the collector. Which action resolves the failure while keeping TLS validation enabled?

A network engineer is pushing a large configuration change to an IOS XR router over NETCONF. The device supports the :candidate and :confirmed-commit capabilities. The engineer wants to apply the change but ensure the router automatically reverts to the previous configuration if connectivity to the management station is lost before the change can be verified. Which NETCONF operation sequence achieves this?

A service provider is modernizing its management plane to support automated, programmatic configuration of thousands of IOS XR routers. The operations team requires a protocol that uses structured data models, supports transactional configuration with candidate/commit semantics, and runs over a secure transport by default. Which protocol best satisfies these management plane requirements?

A service provider engineer configures Flexible NetFlow with IPFIX export on an IOS XR router to monitor customer traffic. Long-lived TCP sessions (bulk file transfers lasting several minutes) are underrepresented in the collector's reports, while the collector shows expected records for short flows. The engineer wants long-lived flows to be periodically reported to the collector while they are still active, without waiting for the session to terminate. Which flow monitor cache timer adjustment achieves this?

A service provider engineer is configuring Flexible NetFlow on an IOS XE router to export flow records to a collector at 10.50.1.20 using UDP port 4739 in IPFIX format. The engineer has already created a flow record 'FR-INGRESS' and a flow exporter 'EXP-COLLECTOR'. Traffic must be sampled and monitored on ingress of GigabitEthernet0/0/1. Which additional configuration component MUST be created and applied to the interface to complete the flow monitoring pipeline?

A service provider engineer is building a Flexible NetFlow (IPFIX) configuration on an IOS XR PE router to export traffic statistics. In the flow record, the engineer configures source and destination IPv4 addresses, IP protocol, and Layer 4 ports as 'match' fields, and byte/packet counters plus first/last timestamps as 'collect' fields. During validation, a colleague asks why some fields are configured as 'match' and others as 'collect'. What is the correct explanation of the distinction between match and collect fields in a Flexible NetFlow record?

A service provider is deploying flow monitoring on a Cisco IOS XR router with several 100GbE core-facing interfaces. The network team reports that enabling full 1:1 flow accounting on these interfaces caused elevated CPU/NPU load and dropped flow records. They must retain statistically meaningful traffic visibility while reducing the volume of flows processed and exported. Which configuration approach best meets these requirements?

A service provider is deploying Cisco NSO to automate the provisioning of L3VPN services across a network containing Cisco IOS XR, Cisco IOS XE, and Juniper routers. The network team wants operators to request a VPN service using a single high-level payload, while NSO handles translating that request into the correct device-specific configuration for each platform. Which NSO capability directly enables this behavior?

A network engineer is writing a Python script that uses RESTCONF to retrieve the configuration of a single interface named 'GigabitEthernet0/0/0/0' from an IOS XR device. The interface data is modeled as a YANG list keyed on the interface name. Which RESTCONF request URI correctly targets that specific list entry?

A network automation engineer is writing a Python script that uses RESTCONF to update the configuration of an IOS XR router. The engineer wants to send a payload that replaces the entire contents of a specific interface's configuration container, removing any leaves not present in the payload, while leaving all other interfaces untouched. Which HTTP method should the script use against the interface resource URI?

A network engineer is writing a Python script that uses RESTCONF to add a brand-new loopback interface to an IOS XE router. The interface does not yet exist in the running datastore, and the engineer wants the request to fail if an interface with the same name already exists (to avoid overwriting an existing configuration). Which HTTP method should the script use against the interfaces collection resource?

A service provider is deploying hundreds of new IOS-XR routers to remote sites using Secure Zero Touch Provisioning (RFC 8572). During onboarding, each device must cryptographically verify that the bootstrap server it contacts is authorized by the true owner before applying any configuration. Which artifact provides this assurance by binding the device's serial number to its rightful owner and is signed by the device manufacturer?

A service provider NOC uses an SNMPv2c-based monitoring platform to poll edge routers. Security policy requires that the read-only community string can retrieve only the interface (IF-MIB) subtree and must be denied access to all other MIB objects. On a Cisco IOS device, which configuration approach correctly enforces this restriction?

A service provider requires that all SNMP management traffic to their IOS XR routers be both authenticated and encrypted. An engineer creates an SNMPv3 group and user but notices that a network management station is still able to poll the router even though the packets are being sent in cleartext. Reviewing the configuration, the engineer finds the user was created with the 'auth' security level. Which change correctly enforces both authentication and encryption for this SNMPv3 user?

A service provider NOC monitors an IOS XR router using SNMPv3 with authPriv. After the router's chassis is RMA'd and replaced, the monitoring server can no longer poll the device even though the SNMPv3 username, authentication password, and privacy password on the server are unchanged and match the router's configuration. The router shows the v3 user is still configured. What is the most likely cause of the authentication failure?