Cisco CCNP Automation (350-901 AUTOCOR) Practice Exam

What the Cisco CCNP Automation (350-901 AUTOCOR) exam covers

• Network Automation229 questions
• Infrastructure as Code239 questions
• Operations159 questions
• AI in Automation156 questions

Free 350-901 AUTOCOR practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 783-question bank.

1. Question 1Network Automation

   An engineer must push VLAN configuration to fifty IOS XE switches using Ansible. Which connection type do the cisco.ios modules expect?

   • Anetwork_cli, which drives the device over SSHCorrect
   • Blocal, which runs the module on the control node
   • Cwinrm, which is used for Windows hosts
   • Ddocker, which executes inside a container
   ✓ Correct answer: A

   The network connection plugin opens a persistent session to the device and the module runs on the control node, issuing commands over that session, which is why no agent is installed on the switch. Setting it correctly in the inventory or play is what makes the modules work at all.

   Why the other options are wrong

   • BThe local connection runs on the control node without a device session.
   • CThe winrm connection is used for Windows hosts rather than IOS XE.
   • DThe docker connection executes inside a container.
2. Question 2Infrastructure as Code

   A network engineer must understand what a Git tag provides for a network automation release. What is its role?

   • AA stable name for a specific commitCorrect
   • BA branch that tracks ongoing work
   • CA record of who approved the change
   • DA copy of the repository at that point
   ✓ Correct answer: A

   Marking the commit that was deployed means a pipeline, a rollback or an audit can refer to it by a meaningful name rather than an identifier, and unlike a branch it does not move as work continues. Annotated tags also carry a message and an author.

   Why the other options are wrong

   • BA branch moves as work continues rather than naming one commit.
   • CApproval is recorded by the review process rather than a tag.
   • DA tag references a commit rather than copying the repository.
3. Question 3Network Automation

   A NetDevOps team must settle how an Ansible playbook should treat a device that reports an unexpected platform. What is safest?

   • AFail that host with a clear message about the mismatchCorrect
   • BContinue and apply the rendered configuration regardless
   • CFall back to sending raw command lines over the CLI
   • DSkip the host silently and carry on with the other hosts
   ✓ Correct answer: A

   Modules are written against particular platforms, so applying them to something else produces either an error deep inside the module or, worse, a partially applied configuration that nobody expected. Failing that host with a clear message leaves the estate untouched and names exactly what was wrong.

   Why the other options are wrong

   • BApplying configuration rendered for another platform risks a partial or damaging change.
   • CFalling back to raw command lines guesses at the unknown platform's syntax.
   • DSkipping the host silently hides that a device was left unconfigured.
4. Question 4AI in AutomationSelect all that apply

   An automation lead is weighing what makes an AI recommendation safe to apply automatically. Which TWO conditions would be required? (Choose TWO)

   • AThe change is verified against intent before it is appliedCorrect
   • BThe change is reversible and its effect is boundedCorrect
   • CThe model expressed high confidence in the answer
   • DThe recommendation was produced quickly
   • EThe recommendation is phrased in precise language
   ✓ Correct answer: A, B

   Automatic application is only defensible when something other than the model has checked the change against recorded intent and when a mistake can be undone with a bounded effect. Confidence, speed and phrasing are properties of the output rather than evidence about it.

   Why the other options are wrong

   • CHigh expressed confidence is not evidence that the change is correct.
   • DProducing the recommendation quickly says nothing about its safety.
   • EPrecise phrasing is a property of the text rather than the change.
5. Question 5Infrastructure as Code

   An automation lead is weighing how a pipeline should treat a stage that has never failed. What is prudent?

   • AConfirm it can fail, since a check that cannot is not checkingCorrect
   • BRemove it, since a stage that has found nothing so far is waste
   • CRun it less frequently, since a stable stage costs pipeline time
   • DTrust it, since a perfect record shows the check is working
   ✓ Correct answer: A

   A validation whose assertion is trivially satisfied, or whose command exits successfully whatever happens, passes forever while providing no protection at all. Deliberately introducing a fault to confirm it fails is the only way to know the stage is doing its job.

   Why the other options are wrong

   • BRemoving the stage assumes it works and is unnecessary, rather than establishing either.
   • CRunning it less often reduces whatever protection it gives without verifying that it gives any.
   • DA perfect record is equally consistent with a check that is trivially satisfied and tests nothing.
6. Question 6AI in AutomationSelect all that apply

   A platform team is working out what to include when handing an AI-assisted workflow to another team. Which TWO matter? (Choose TWO)

   • AWhat the agent may doCorrect
   • BHow to verify its answers and where its data comes fromCorrect
   • CThe prompt templates used internally
   • DThe provider's pricing for each request
   • EThe number of tools its server exposes
   ✓ Correct answer: A, B

   A receiving team needs to know what the agent can do without asking and how to check anything it says, because those two determine how much they can rely on it and what could go wrong. Prompt templates and pricing are implementation and commercial detail.

   Why the other options are wrong

   • CInternal prompt templates are implementation detail that changes.
   • DProvider pricing is a commercial matter rather than an operational one.
   • EThe number of exposed tools does not describe the boundary.
7. Question 7Network AutomationSelect all that apply

   A team is deciding what to automate first in a network. Which TWO candidates are strongest? (Choose TWO)

   • AA task performed frequently and identicallyCorrect
   • BA task where manual error causes real outagesCorrect
   • CA task performed once every few years
   • DA task requiring judgement about each case
   • EA task nobody currently performs at all
   ✓ Correct answer: A, B

   Automating something done weekly returns the investment quickly, and automating something where a typo takes a site offline returns it in avoided incidents, so those two are where the first effort belongs. Rare and judgement-heavy work rarely repays the effort.

   Why the other options are wrong

   • CA task performed once every few years rarely repays the effort.
   • DA task requiring judgement about each case resists automation.
   • EA task nobody currently performs has no established value.
8. Question 8Network Automation

   A campus switch already carries VLANs 10, 20, 30 and 40. The play below runs against it for the first time. ```yaml - name: Apply the approved access VLANs hosts: campus_switches gather_facts: false tasks: - name: Push the VLAN list cisco.ios.ios_vlans: config: - vlan_id: 10 name: USERS - vlan_id: 20 name: VOICE state: overridden ``` What does the run leave on the switch?

   • AVLANs 10 and 20 only, since 30 and 40 are removedCorrect
   • BVLANs 10, 20, 30 and 40, with 10 and 20 renamed
   • CAn error, because overridden needs every VLAN id
   • DVLANs 30 and 40 only, since 10 and 20 already exist
   ✓ Correct answer: A

   Overridden makes the device match the supplied config exactly, so VLANs 10 and 20 are kept and every other non-default VLAN is deleted. That is what separates it from merged, which only adds or updates what is listed, and from replaced, which rewrites only the VLANs named in the config. The state key is the whole question here: the same config block with state merged would leave 30 and 40 in place.

   Why the other options are wrong

   • BVLANs 30 and 40 do not survive an overridden run, and the state key does not control renaming.
   • CA partial list is exactly what overridden expects; the module deletes what the config omits instead of raising an error.
   • DVLANs 10 and 20 are named in the config, so they are the two that stay; 30 and 40 are the ones removed.
9. Question 9Operations

   This module is committed to the automation repository. ```python DEVICE_USER = "netops" DEVICE_PASS = "Summer2026!" CATALYST_TOKEN = "4f8b2c19d77a" def connect(host): return ConnectHandler(device_type="cisco_ios", host=host, username=DEVICE_USER, password=DEVICE_PASS) ``` Why is rotating the password not enough once this is noticed?

   • AThe commit history keeps the old password for anyone with the repositoryCorrect
   • BThe connect helper caches the old password until the runner restarts
   • CThe token in the module is derived from the password that was rotated
   • DRotation invalidates the device sessions the helper has already opened
   ✓ Correct answer: A

   Editing the file changes only the current state; every clone and every fetched commit still holds the old value, so the secret has to be treated as disclosed and replaced everywhere it was valid. That means rotating both the device password and the Catalyst token, and moving them into a secret store or environment injection so the repository never holds them again. Rewriting history helps only where every copy can be reached.

   Why the other options are wrong

   • BThe helper reads the constants at call time and caches nothing, so a restart is not what keeps the value alive.
   • CThe Catalyst token is a separate credential; it is exposed by the same commit rather than derived from the password.
   • DExisting device sessions are not what makes this serious: the disclosed value remains in the repository history.
10. Question 10Infrastructure as Code

    PROD_PW is a project variable with the protect setting on, and this pipeline is running on feature/acl-refresh. ```yaml validate: stage: prevalidate script: ansible-playbook push.yml --check -e "pw=$DEV_PW" deploy: stage: deploy environment: production script: ansible-playbook push.yml -e "pw=$PROD_PW" ``` Why does only the deploy job fail to authenticate?

    • AThe production environment blocks file level variables
    • BThe deploy stage runs before the variable is created
    • CA protected variable is absent on an unprotected branchCorrect
    • DAnsible drops extra variables whose value is empty
    ✓ Correct answer: C

    The validation job succeeds because its credential is an ordinary variable that every pipeline receives, and it runs in check mode where a weak failure would be easy to miss anyway. The deploy job asks for a protected variable while running on a feature branch, so nothing is injected, the argument expands to an empty string and the device rejects the login. Either the branch has to be protected, or the deployment has to run from a branch that already is, which is the usual arrangement. Naming the environment does not change variable availability by itself.

    Why the other options are wrong

    • AAn environment records where a job deploys to and does not filter which variables a job receives.
    • BProject variables exist before any pipeline starts, so no stage can run earlier than one being defined.
    • DThe play still receives the argument and sends the empty value on to the device, which is what produces the authentication error.

Who this Cisco CCNP Automation (350-901 AUTOCOR) practice exam is for

This practice set is for anyone preparing for the Cisco CCNP Automation (350-901 AUTOCOR) exam - from first-time candidates building a foundation to experienced Cisco practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Cisco CCNP Automation (350-901 AUTOCOR) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Cisco CCNP Automation (350-901 AUTOCOR) exam.

Related Cisco resources

• Cisco CCNP Automation (350-901 AUTOCOR) study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Cisco CCNP ENARSI (300-410) practice examRelated
• Cisco CCNP ENCOR 350-401 practice examRelated
• Cisco CCNP Security SCOR (350-701) practice examRelated

Cisco CCNP Automation (350-901 AUTOCOR) practice exam FAQ