Cisco 350-501 Practice Test 64
Question 630
For an original SPCOR service-provider engineering scenario, consider: A provider provisions a multi-device EVPN service by issuing CLI snippets independently and cannot identify which sites were changed after the third router fails. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types.
- Check: Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision.
- Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
- Check: Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification.
- Claim a shell loop performing separate SSH commands gives the same service-level atomicity as modeled orchestration.
Explanation
Correct Answer
B:NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion. Required intervention: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
C:NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion. Acceptance: The service converges consistently or exposes a recoverable failure without silent partial configuration across customers.
Incorrect Answers
A:Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
D:Check: Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
E:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
Question 631
A service provider network engineer is reviewing this backbone or customer-service scenario: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs. A proposed shortcut is: Claim a shell loop performing separate SSH commands gives the same service-level atomicity as modeled orchestration. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Claim a shell loop performing separate SSH commands gives the same service-level atomicity as modeled orchestration.
- Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
- Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
- Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident.
Explanation
Correct Answer
B:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs.
Incorrect Answers
A:NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion. Use this instead: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
C:Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
D:Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
Question 632
A Cisco service provider design review finds: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs. The team proposes: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
- NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
- NETCONF uses modeled XML RPC messages and datastore operations; an active SSH transport or accepted candidate does not necessarily mean a committed change.
- Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
Explanation
Correct Answer
B:Demonstrable success requires: The service converges consistently or exposes a recoverable failure without silent partial configuration across customers. Applied case: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs.
Incorrect Answers
A:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
C:NETCONF uses modeled XML RPC messages and datastore operations; an active SSH transport or accepted candidate does not necessarily mean a committed change. A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs.
D:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
Question 633
The service provider operations team has not yet approved a change. Current evidence indicates: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
- Inspect capabilities, URL module prefix, requested HTTP method, Content-Type and returned status with a nonproduction test interface.
- Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision.
- Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
Explanation
Correct Answer
C:NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion. Applied case: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs.
Incorrect Answers
A:This option addresses a different service provider engineering topic (gNMI gRPC dial-out streaming and mutual TLS) rather than the documented Cisco NSO services transactions and dry-run policies decision.
B:Inspect capabilities, URL module prefix, requested HTTP method, Content-Type and returned status with a nonproduction test interface. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
D:Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts. A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs.
Question 634
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected.
- Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported.
- Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported.
- The service converges consistently or exposes a recoverable failure without silent partial configuration across customers.
Explanation
Correct Answer
D:NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected. A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs.
B:Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
C:Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
Question 635
An implementation sign-off request identifies the following problem: A network automation engineer deletes a customer L3VPN instance using raw device commands but leaves orphaned route policies on two PEs. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle. Verify: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. Verify: Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision.
- Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates. Verify: Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
- Change: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident. Verify: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
Explanation
Correct Answer
B:NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion. The change is successful only when: The service converges consistently or exposes a recoverable failure without silent partial configuration across customers.
Incorrect Answers
A:Change: Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle.
C:Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates.
D:Change: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident. NSO can map a service model to multi-device configuration with controlled transactions, enabling auditable service-level creation, modification and deletion.
Question 636
A service provider network engineer is reviewing this backbone or customer-service scenario: A service provider playbook targets a misspelled inventory group and reports no failed tasks although none of the required PEs were changed. A proposed shortcut is: Treat a zero-fail play recap as proof every intended router was modified without validating inventory membership. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates.
- Select supported RESTCONF data paths and HTTP operations, preserve YANG schema types and handle documented status and error bodies.
- Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration.
- Treat a zero-fail play recap as proof every intended router was modified without validating inventory membership.
Explanation
Correct Answer
A:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
Incorrect Answers
B:Select supported RESTCONF data paths and HTTP operations, preserve YANG schema types and handle documented status and error bodies. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
C:Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
D:Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
Question 637
A Cisco service provider design review finds: A service provider playbook targets a misspelled inventory group and reports no failed tasks although none of the required PEs were changed. The team proposes: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
- Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
- RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation.
- Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
Explanation
Correct Answer
B:Demonstrable success requires: Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported. This principle explains the proposed technical approach, which is: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates.
Incorrect Answers
A:Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
C:RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
D:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
Question 638
The service provider operations team has not yet approved a change. Current evidence indicates: A service provider playbook targets a misspelled inventory group and reports no failed tasks although none of the required PEs were changed. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic.
- Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
Explanation
Correct Answer
D:Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes. Confirm afterward that: Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported.
Incorrect Answers
A:Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
B:Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
C:Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
Question 639
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A service provider playbook targets a misspelled inventory group and reports no failed tasks although none of the required PEs were changed. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Model-compliant requests accept correct data and reject wrong leaf paths or types without unintended configuration changes.
- Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported.
- Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass.
- Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden.
Explanation
Correct Answer
B:Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Model-compliant requests accept correct data and reject wrong leaf paths or types without unintended configuration changes. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
C:This option addresses a different service provider engineering topic (gNMI gRPC dial-out streaming and mutual TLS) rather than the documented Ansible inventory templates and idempotent configuration decision.
D:Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
Question 640
For an original SPCOR service-provider engineering scenario, consider: A service provider playbook targets a misspelled inventory group and reports no failed tasks although none of the required PEs were changed. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Check: Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
- Change: Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration.
- Treat a zero-fail play recap as proof every intended router was modified without validating inventory membership.
- Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates.
Explanation
Correct Answer
B:Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes. Acceptance: Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported.
E:Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes. Applied case: A service provider playbook targets a misspelled inventory group and reports no failed tasks although none of the required PEs were changed.
Incorrect Answers
A:Check: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
C:Change: Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
D:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
