Cisco 350-501 Practice Test 66
Question 650
For an original SPCOR service-provider engineering scenario, consider: Two concurrent CI jobs write the same Terraform state for network infrastructure and produce conflicting resource identities. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Delete the state whenever drift appears and immediately apply all proposed replacements without any plan review.
- Change: Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
- Check: Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox.
- Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
Explanation
Correct Answer
C:Evidence: Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox.
D:Acceptance: Reviewed plans converge expected resources without conflicting state writes or unapproved destructive network actions.
Incorrect Answers
A:Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
B:Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption. Use this instead: Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
E:Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. Two concurrent CI jobs write the same Terraform state for network infrastructure and produce conflicting resource identities.
Question 651
A service provider network engineer is reviewing this backbone or customer-service scenario: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius. A proposed shortcut is: Delete the state whenever drift appears and immediately apply all proposed replacements without any plan review. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types.
- Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
- Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle.
- Delete the state whenever drift appears and immediately apply all proposed replacements without any plan review.
Explanation
Correct Answer
B:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
Incorrect Answers
A:Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
C:Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
D:Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption. Applied case: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
Question 652
A Cisco service provider design review finds: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius. The team proposes: Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation.
- Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
- SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
- YANG defines containers lists keys and typed leaves, allowing supported protocol clients to validate configuration independently of arbitrary CLI text layouts.
Explanation
Correct Answer
B:Relevant validation before approval: Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox. Applied case: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
Incorrect Answers
A:RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation. A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
C:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
D:YANG defines containers lists keys and typed leaves, allowing supported protocol clients to validate configuration independently of arbitrary CLI text layouts. A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
Question 653
The service provider operations team has not yet approved a change. Current evidence indicates: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox.
- Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab.
- Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
- Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
Explanation
Correct Answer
A:Confirm afterward that: Reviewed plans converge expected resources without conflicting state writes or unapproved destructive network actions. Applied case: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
Incorrect Answers
B:Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
C:This option addresses a different service provider engineering topic (Ansible inventory templates and idempotent configuration) rather than the documented Terraform providers state locking and plan review decision.
D:Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
Question 654
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Reviewed plans converge expected resources without conflicting state writes or unapproved destructive network actions.
- Read and write requests affect only approved modeled resources and invalid payloads receive specific diagnosable errors.
- Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass.
- Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable.
Explanation
Correct Answer
A:Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption. The approved implementation step was: Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
Incorrect Answers
B:Read and write requests affect only approved modeled resources and invalid payloads receive specific diagnosable errors. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
C:Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
D:Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable. A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius.
Question 655
An implementation sign-off request identifies the following problem: A provider deletes an interface out of band and Terraform proposes its replacement, but the operator applies the plan without reviewing the intended blast radius. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types. Verify: Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab.
- Change: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident. Verify: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Change: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields. Verify: Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic.
- Change: Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply. Verify: Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox.
Explanation
Correct Answer
D:The change is successful only when: Reviewed plans converge expected resources without conflicting state writes or unapproved destructive network actions.
Incorrect Answers
A:Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
B:Change: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
C:Change: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields. Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
Question 656
A service provider network engineer is reviewing this backbone or customer-service scenario: A newly delivered PE downloads boot configuration from an unauthenticated HTTP endpoint and accepts an attacker-controlled image. A proposed shortcut is: Disable image signature checks and publish a shared root password in a world-readable bootstrap URL. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
- Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration.
- Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle.
- Disable image signature checks and publish a shared root password in a world-readable bootstrap URL.
Explanation
Correct Answer
C:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
Incorrect Answers
A:Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
B:Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
D:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
Question 657
A Cisco service provider design review finds: A newly delivered PE downloads boot configuration from an unauthenticated HTTP endpoint and accepts an attacker-controlled image. The team proposes: Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
- RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation.
- SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
- Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
Explanation
Correct Answer
D:Demonstrable success requires: New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected. This principle explains the proposed technical approach, which is: Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle.
Incorrect Answers
A:Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
B:RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
C:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
Question 658
The service provider operations team has not yet approved a change. Current evidence indicates: A newly delivered PE downloads boot configuration from an unauthenticated HTTP endpoint and accepts an attacker-controlled image. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab.
- Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
Explanation
Correct Answer
B:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. Confirm afterward that: New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected.
Incorrect Answers
A:Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
C:Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
D:Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
Question 659
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A newly delivered PE downloads boot configuration from an unauthenticated HTTP endpoint and accepts an attacker-controlled image. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- The service converges consistently or exposes a recoverable failure without silent partial configuration across customers.
- New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected.
- Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported.
- Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable.
Explanation
Correct Answer
B:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The service converges consistently or exposes a recoverable failure without silent partial configuration across customers. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
C:Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
D:Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
Question 660
For an original SPCOR service-provider engineering scenario, consider: A newly delivered PE downloads boot configuration from an unauthenticated HTTP endpoint and accepts an attacker-controlled image. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Check: Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
- Change: Anchor ZTP to verified enrollment and software artifacts with authenticated provisioning endpoints and per-device credential lifecycle.
- Disable image signature checks and publish a shared root password in a world-readable bootstrap URL.
- Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
Explanation
Correct Answer
A:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. Acceptance: New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected.
C:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. Applied case: A newly delivered PE downloads boot configuration from an unauthenticated HTTP endpoint and accepts an attacker-controlled image.
Incorrect Answers
B:Check: Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
D:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
E:Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
