Examkin

Automation and Programmability

200 questions

All types200Multiple choice102Multiple select47Matching45Ordering6
Question 121Question →

An enterprise network is deploying a Cisco Software-Defined Access (SD-Access) architecture. The network engineering team needs to configure routing protocols to ensure physical IP reachability among all switch loopback addresses used as Routing Locators (RLOCs). Which architectural layer is specifically responsible for establishing this underlying Layer 3 transport infrastructure?

Show answer & explanation

Answer: Underlay network

Answer

The underlay network is responsible for providing foundational physical Layer 3 IP reachability between all fabric nodes.
The underlay network consists of the physical network hardware, interconnecting links, and Layer 3 routing protocols (such as OSPF, IS-IS, or BGP) configured to ensure complete unicast IP reachability between all fabric nodes and RLOC interfaces. It serves as the physical backbone required to transport overlay encapsulated traffic.

Step-by-Step Solution

1
Identify the requirement described in the scenario
The requirement asks for the network component providing physical IP routing reachability among switch loopback interface addresses (RLOCs).
Before overlay tunnels can be established, physical IP connectivity must be established across the hardware devices.
2
Compare the roles of underlay, overlay, fabric control plane, and data plane encapsulation
The underlay network uses standard IGP routing (like OSPF or IS-IS) to route IP packets between physical devices and RLOCs. The overlay network operates on top of the underlay.
Without the underlay providing IP connectivity, VXLAN encapsulation and LISP control plane communication cannot function.

Key Concept

Distinction between Underlay Network, Overlay Network, and Fabric Control Plane in Software-Defined Architectures
Question 122Question →

An automation architect is designing a centralized configuration enforcement system for enterprise infrastructure. The system must operate on a pull-based model, where client agents periodically query a master server over TCP port 8140 using code files called manifests. Which configuration management mechanism is being described?

Show answer & explanation

Answer: Puppet

Answer

Puppet
Puppet uses an agent-based, pull model where managed nodes run an agent that periodically requests configuration manifests from the Puppet master server over TCP port 8140.

Step-by-Step Solution

1
Identify the key attributes mentioned in the scenario
The requirements specify a pull-based agent model, communication on TCP port 8140, and configuration files defined as manifests.
These specific operational parameters distinguish Puppet from other configuration management tools.
2
Compare against configuration management tools
Puppet natively uses Puppet DSL manifests and client agents querying the server over TCP port 8140 (HTTPS). Ansible is agentless using SSH/NETCONF and YAML playbooks. Chef uses Ruby recipes over TCP port 443.
Matching all operational parameters uniquely identifies Puppet.

Key Concept

Operational characteristics of Puppet (Agent/Pull, TCP 8140, Manifests)
Question 123Question →

An network administrator is designing a fabric-based Software-Defined Access (SD-Access) solution for a remote branch campus. Which two operational characteristics specifically describe the role and function of the underlay network within this architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: It provides physical Layer 3 IP reachability between all network devices, such as fabric edge and control plane nodes.; It relies on standard IGP routing protocols (such as IS-IS or OSPF) to transport IP packets between routed interfaces.

Answer

The underlay network provides physical Layer 3 IP reachability between all nodes and relies on standard IGP routing protocols (such as IS-IS or OSPF) to transport IP packets across physical interfaces.
The underlay network forms the physical foundation of an SDN fabric. Its primary purpose is to provide robust, high-availability Layer 3 IP reachability between all participating fabric nodes using standard Interior Gateway Protocols (IGPs) such as IS-IS or OSPF.

Step-by-Step Solution

1
Define the primary responsibility of the underlay network in SDN architectures.
The underlay consists of physical switches, routers, and links configured to ensure basic Layer 3 unicast reachability between all network infrastructure nodes.
Overlay services like VXLAN tunneling and LISP lookup require dependable IP reachability between Tunnel Endpoints (RLOCs).
2
Identify protocols operating at the underlay layer versus the overlay layer.
Underlay uses traditional routing protocols (OSPF, IS-IS, BGP) to transport IP packets, while overlay uses protocols such as VXLAN for encapsulation and LISP for mapping.
Distinguishing between physical IP transport (underlay) and virtualized service encapsulation (overlay) clarifies architectural boundaries.

Key Concept

Underlay vs. Overlay Architecture in Software-Defined Fabrics
Question 124Question →

A network administrator is evaluating configuration management tools to automate network parameter deployments across enterprise switches and routers. Which of the following statements correctly describe the architectural capabilities and operational traits of Ansible? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It operates using an agentless architecture, executing commands over SSH or NETCONF directly on target network devices.; It uses a push model where configuration playbooks written in YAML are sent from a central control node to managed devices.

Answer

Ansible operates using an agentless architecture over standard protocols like SSH/NETCONF, and it uses a push-based model executing YAML playbooks from a central control node.
Ansible is distinguished by its agentless operational design and push configuration model. Configurations are defined using human-readable YAML Playbooks on a central control machine and pushed directly to network devices over standard management protocols such as SSH and NETCONF.

Step-by-Step Solution

1
Identify Ansible's software architecture requirement on target devices.
Ansible is agentless and does not require third-party software agents running on managed network devices.
Ansible communicates directly via native management protocols such as SSH or NETCONF.
2
Determine the communication flow direction and data structure used by Ansible.
Ansible uses a push model and formats playbooks using YAML.
The control node initiates connection to managed nodes and pushes configuration changes specified in YAML Playbooks.

Key Concept

Capabilities and Architectural Differences of Configuration Management Mechanisms (Ansible vs. Puppet vs. Chef)
Estimated Time:1m 0s
Question 125Question →

An enterprise network operations team is standardizing its automation framework for campus switches. The technical requirements specify that configuration definitions must be written using Ruby domain-specific language (DSL) organized into cookbooks, and managed devices must execute a local daemon that periodically pulls state definitions from a central server over HTTPS. Which configuration management tool natively meets these specifications?

Show answer & explanation

Answer: Chef

Answer

Chef natively matches the requirement of using Ruby domain-specific language (DSL) cookbooks and an agent-based pull model over HTTPS.
Chef utilizes an agent-based architecture where managed nodes run the Chef client daemon. This daemon periodically contacts the central Chef server over HTTPS (TCP port 443) to pull configuration state rules written in Ruby DSL, organized into recipes and cookbooks.

Step-by-Step Solution

1
Analyze the configuration language requirement
Identified Ruby domain-specific language (DSL) and cookbooks, which are unique to Chef.
Ansible uses YAML playbooks, Puppet uses Puppet DSL manifests, and Chef uses Ruby DSL recipes and cookbooks.
2
Analyze the operational and transport architecture
Identified an agent-based pull model using HTTPS.
Chef client daemons installed on managed systems periodically pull updated configuration details from the Chef server over HTTPS (TCP port 443).

Key Concept

Configuration Management Mechanism Traits (Chef vs Puppet vs Ansible)
Question 126Question →

A network operations engineer is validating traffic transport across an enterprise Cisco Software-Defined Access (SD-Access) campus environment. The underlying physical switches use IS-IS routing to maintain full IP reachability between switch loopback interfaces. Which statement accurately describes how the underlay and overlay components interact during frame forwarding between endpoints?

Show answer & explanation

Answer: The underlay network provides basic IP reachability between switch loopback interfaces (RLOCs), while the overlay network uses VXLAN encapsulation to tunnel endpoint frames across the underlay.

Answer

The underlay network provides basic IP reachability between switch loopback interfaces (RLOCs), while the overlay network uses VXLAN encapsulation to tunnel endpoint frames across the underlay.
In software-defined network (SDN) architectures such as Cisco SD-Access, the underlay consists of physical hardware devices interconnected via robust Layer 3 routing protocols (OSPF, IS-IS, BGP) that guarantee IP connectivity between Routing Locators (RLOCs/VTEPs). The overlay operates logically above this underlay, encapsulating endpoint data frames into VXLAN headers to deliver virtualized networks across the physical infrastructure.

Step-by-Step Solution

1
Identify the primary function of the underlay network in a software-defined fabric.
The underlay consists of physical switches, routers, and IP routing protocols (such as OSPF or IS-IS) establishing unicast IP reachability between fabric nodes.
Underlay routing provides the underlying transport infrastructure needed for tunnel end-points (VTEPs / RLOCs) to communicate.
2
Identify the primary function of the overlay network.
The overlay creates logical tunnels over the underlay using encapsulation protocols such as VXLAN.
Encapsulating endpoint traffic inside UDP/IP packets allows Layer 2 and Layer 3 virtual networks to run independently over the physical underlay infrastructure.

Key Concept

Underlay vs Overlay Separation in Software-Defined Fabrics
Estimated Time:1m 15s
Question 127Question →

Match each software-defined networking component on the left with its primary architectural function within an enterprise fabric infrastructure on the right.

Click a left item, then click its matching right item

Items

VXLAN
Underlay IGP (e.g., IS-IS / OSPF)
LISP Control Plane
Fabric Edge Node

Matches

Show answer & explanation

Answer

VXLAN pairs with UDP payload encapsulation; Underlay IGP pairs with physical IP reachability between RLOCs; LISP Control Plane pairs with maintaining EID-to-RLOC mapping database; Fabric Edge Node pairs with connecting and authenticating end-user devices.
VXLAN handles data plane encapsulation over UDP, Underlay IGPs handle physical IP reachability, LISP handles the control plane mapping database between EIDs and RLOCs, and Fabric Edge nodes connect endpoints to the fabric network.

Step-by-Step Solution

1
Identify the data plane overlay encapsulation mechanism.
VXLAN encapsulates host traffic inside UDP headers to create virtual overlays over the physical underlay.
Overlay data plane transport relies on encapsulation protocols like VXLAN.
2
Identify the physical network reachability mechanism.
Underlay routing protocols (like IS-IS or OSPF) ensure basic IP reachability between physical nodes and loopback interfaces.
Without underlay IP connectivity, tunnel endpoints cannot exchange encapsulated packets.
3
Identify the mapping database and control plane protocol.
LISP handles the mapping of host Endpoint Identifiers (EIDs) to switch Routing Locators (RLOCs).
LISP replaces traditional MAC learning with a query/response mapping database approach.
4
Identify the fabric device role responsible for host onboarding.
Fabric Edge Nodes connect directly to endpoints, authenticate users, and encapsulate host traffic into the fabric overlay.
Fabric Edge switches act as the entry point into the software-defined access fabric.

Key Concept

Software-Defined Architectures: Overlay, Underlay, and Fabric protocol roles
Question 128Question →

An engineer is organizing the network automation architecture for an enterprise deployment. Match each configuration management framework to the combination of operational architecture, primary transport protocol, and configuration file format it utilizes.

Click a left item, then click its matching right item

Items

Ansible
Puppet
Chef

Matches

Show answer & explanation

Answer

Ansible pairs with the agentless push model using SSH/NETCONF and YAML playbooks. Puppet pairs with the agent-based pull model using TCP port 8140 and Puppet DSL manifests. Chef pairs with the agent-based pull model using TCP port 443 and Ruby DSL recipes.
Each tool is correctly matched based on its core architecture: Ansible is agentless (push, SSH/NETCONF, YAML), Puppet relies on agents over TCP 8140 (pull, Puppet DSL manifests), and Chef relies on agents over TCP 443 (pull, Ruby DSL recipes).

Step-by-Step Solution

1
Identify the operational mode and file type for Ansible.
Ansible does not require software agents on managed nodes; it pushes configuration over SSH/NETCONF using YAML files.
Ansible relies on standard management protocols natively supported on network devices.
2
Identify the operational mode, port, and file type for Puppet.
Puppet agents periodically pull configuration state over TCP port 8140 using manifests compiled in Puppet DSL.
Puppet uses a dedicated master-agent communication port (8140) and standard manifest files.
3
Identify the operational mode, port, and file type for Chef.
Chef client agents pull cookbooks/recipes written in Ruby DSL over HTTPS (TCP port 443).
Chef relies on standard Web HTTPS communication between nodes and the Chef Server.

Key Concept

Configuration Management Mechanism Capabilities (Ansible vs Puppet vs Chef)
Question 129Question →

A network administrator must select a configuration management framework to automate configuration updates on enterprise Cisco IOS XE routers. The network security policy strictly prohibits installing third-party software packages or background client daemons directly on network device operating systems. Which configuration management tool fulfills this operational requirement by using an agentless architecture over standard transport protocols such as SSH?

Show answer & explanation

Answer: Ansible

Answer

Ansible is the correct choice because it functions agentlessly over SSH or NETCONF without installing client software on managed network nodes.
Ansible utilizes an agentless architecture. It connects to network devices using native management protocols (such as SSH, NETCONF, or RESTCONF) and pushes configuration changes directly. Because no persistent agent software or daemon needs to be installed on target network devices, it complies fully with restrictive security policies.

Step-by-Step Solution

1
Analyze the operational constraint specified in the requirement.
The requirement mandates an agentless configuration tool that does not require client daemon installation on the router operating system.
Security directives prevent modifying the underlying network operating system image with third-party daemons.
2
Evaluate the architectural models of the configuration management tools.
Ansible uses an agentless push model via SSH/NETCONF, while Puppet, Chef, and SaltStack traditionally use agent daemons running locally on managed nodes.
Ansible executes playbooks remotely and parses device output without needing local agent software.

Key Concept

Agentless vs. Agent-Based Configuration Management Architectures
Estimated Time:1m 0s
Question 130Question →

A network engineer is deploying an enterprise Software-Defined Access (SD-Access) fabric that uses Virtual Extensible LAN (VXLAN) for overlay data plane encapsulation across a Layer 3 underlay routed network. During testing, endpoints sending standard 1500-byte IP packets with the Don't Fragment (DF) bit set experience packet drops when traffic traverses the fabric. Which modification to the underlay network infrastructure resolves this issue?

Show answer & explanation

Answer: Increase the Maximum Transmission Unit (MTU) size on physical underlay interfaces to accommodate encapsulation overhead.

Answer

Increase the Maximum Transmission Unit (MTU) size on physical underlay interfaces to accommodate encapsulation overhead.
VXLAN overlay encapsulation adds 50 bytes of header overhead to standard frames. To ensure that 1500-byte payload packets marked with the Don't Fragment (DF) bit can pass through the underlay without being dropped, the physical underlay infrastructure must be configured with an increased MTU (typically 1550 bytes or higher).

Step-by-Step Solution

1
Analyze the impact of overlay data plane encapsulation on packet size.
VXLAN encapsulation adds 50 bytes of overhead (Outer Ethernet + Outer IP + UDP + VXLAN headers) to original host frames.
When a 1500-byte payload frame is encapsulated by a VTEP, the total frame size exceeds the standard 1500-byte underlay MTU boundary.
2
Evaluate the behavior of packets with the Don't Fragment (DF) bit set.
Underlay routers drop packets exceeding their interface MTU because fragmentation is explicitly prohibited by the DF bit.
To prevent packet drops, the underlying physical transport network must support jumbo frames or an MTU size large enough (typically 1550-9000 bytes) to transport the full encapsulated packet without fragmentation.

Key Concept

Underlay MTU requirements for VXLAN overlay encapsulation
Question 131Question →

A network administrator is evaluating the functions of underlay and overlay components within a Cisco Software-Defined Access (SD-Access) fabric deployment. Which two statements accurately describe the responsibilities and operational relationships of the underlay and overlay networks? (Select two.)

Select all that apply

Show answer & explanation

Answer: The underlay network relies on traditional routing protocols, such as OSPF or IS-IS, to establish unicast IP reachability between physical fabric nodes.; The overlay network utilizes Virtual Extensible LAN (VXLAN) encapsulation to transport virtualized Layer 2 and Layer 3 user traffic across the underlay infrastructure.

Answer

The correct statements are that the underlay network relies on traditional routing protocols (like OSPF or IS-IS) to establish IP reachability between physical fabric nodes, and the overlay network utilizes VXLAN encapsulation to transport Layer 2 and Layer 3 user traffic across the underlay infrastructure.
In software-defined fabric architectures (like Cisco SD-Access), the underlay provides basic physical connectivity and IP reachability using traditional IGPs (such as OSPF or IS-IS). The overlay runs on top of the underlay and uses VXLAN to encapsulate Layer 2 and Layer 3 frames into UDP packets, allowing virtual network separation independently of physical cabling.

Step-by-Step Solution

1
Analyze the role of the underlay network in SDN architectures.
The underlay consists of physical switches, routers, and links running standard Layer 3 IP routing protocols (e.g., OSPF, IS-IS, BGP) to ensure IP reachability among fabric devices.
Without underlay IP reachability, overlay tunnels cannot be established between endpoints.
2
Analyze the role of the overlay network and its protocols.
The overlay is a virtual network built on top of the underlay that uses encapsulation (such as VXLAN) for data plane transport and mapping protocols (such as LISP) for control plane tracking.
Overlay networks decoupled logical user segments (VNFs/VLANs) from the underlying physical topology.
3
Evaluate the choices to select the two correct architectural statements.
Statements highlighting IGP IP reachability for underlay and VXLAN encapsulation for overlay are correct.
Misattributing LISP or VXLAN to the underlay confuses overlay data/control plane mechanics with physical transport.

Key Concept

Underlay vs. Overlay Architecture in SDN Fabrics
Question 132Question →

A network automation engineer is selecting a configuration management tool for a enterprise network environment. The organizational policy mandates an agentless architecture that uses SSH or NETCONF for transport, executes configuration tasks defined in YAML files from a centralized control machine, and pushes updates directly to managed switches and routers without installing persistent client daemons. Which configuration management tool satisfies these operational requirements?

Show answer & explanation

Answer: Ansible

Answer

Ansible is the configuration management tool that fulfills the requirement for an agentless architecture utilizing SSH/NETCONF transport, YAML configuration files (playbooks), and a push execution model.
Ansible is uniquely designed as an agentless configuration management system that communicates directly with managed devices via native transport mechanisms such as SSH or NETCONF. It uses human-readable YAML syntax for its configuration files (playbooks) and follows a push model where the control node initiates configuration changes on managed nodes.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario.
Identified key requirements: Agentless model, SSH/NETCONF transport, YAML definition files, push-based execution from control node.
Matching specific architectural traits determines the correct configuration management framework.
2
Evaluate Ansible against the identified criteria.
Ansible requires no software agent on managed nodes (agentless), uses standard SSH/NETCONF for communication, defines configurations using YAML playbooks, and pushes updates from the control node.
Ansible's architecture directly aligns with all required criteria.
3
Compare against Puppet and Chef architectures.
Puppet and Chef both primarily rely on installed client agents on managed nodes, a pull model of communication, and specific domain-specific languages (Puppet DSL and Ruby DSL respectively).
Puppet and Chef fail the agentless and YAML push requirements.

Key Concept

Ansible Architecture (Agentless, Push Model, SSH Transport, YAML Playbooks)
Question 133Question →

A network operations team is preparing to automate configuration backups and interface descriptions across Cisco IOS XE switches without installing background agent daemons on the managed devices. Which operational characteristics specifically distinguish Ansible from Puppet and Chef in this deployment scenario? (Select two.)

Select all that apply

Show answer & explanation

Answer: It uses an agentless architecture that relies on transport protocols such as SSH or NETCONF to manage target devices.; Playbooks are formatted using YAML and executed via a push-based operational model from a central control node.

Answer

Ansible is distinguished by its agentless architecture utilizing SSH/NETCONF for communication and its push-based deployment model using YAML-formatted Playbooks.
Ansible operates without needing software agents installed on network nodes. It utilizes standard SSH or NETCONF sessions to push configurations directly to switches and routers, relying on Playbooks formatted in YAML.

Step-by-Step Solution

1
Analyze Ansible's agent architecture and transport method.
Ansible communicates with managed devices natively using SSH, NETCONF, or RESTCONF without requiring agent software running on target switches.
Cisco network devices frequently operate closed operating systems where installing third-party agent daemons is impractical or unsupported.
2
Analyze Ansible's data syntax and execution workflow.
Ansible uses human-readable YAML for Playbooks and operates via a push mechanism driven by the Ansible control node.
Puppet and Chef rely primarily on pull-based agent models that periodically fetch state updates from a master server using DSL environments (Puppet DSL or Ruby).

Key Concept

Architectural differences between Ansible (Agentless, Push, SSH/YAML) versus Puppet and Chef (Agent-based, Pull, DSLs).
Estimated Time:1m 30s
Question 134Question →

An network operations team is verifying traffic delivery across a Cisco Software-Defined Access (SD-Access) fabric infrastructure. The physical underlay network is configured using an Interior Gateway Protocol (IGP) to ensure full IP reachability between all switch loopback interfaces. Which statement accurately describes the primary function of the fabric control plane when an ingress fabric edge switch needs to forward overlay traffic to a remote host?

Show answer & explanation

Answer: It uses Locator/ID Separation Protocol (LISP) mapping database lookups to correlate destination host Endpoint Identifiers (EIDs) with egress switch Routing Locators (RLOCs).

Answer

The fabric control plane uses Locator/ID Separation Protocol (LISP) mapping database lookups to correlate destination host Endpoint Identifiers (EIDs) with egress switch Routing Locators (RLOCs).
In a Cisco SD-Access fabric architecture, the control plane relies on Locator/ID Separation Protocol (LISP). LISP separates device identity (Endpoint Identifier or EID) from physical location (Routing Locator or RLOC). When an ingress fabric edge switch receives a frame destined for an overlay endpoint, it queries the LISP mapping database to locate the destination host's RLOC (the IP address of the egress fabric edge device), allowing VXLAN encapsulation to transport the payload across the underlay.

Step-by-Step Solution

1
Identify the separation of roles between underlay and overlay in Software-Defined Access (SD-Access).
The underlay provides basic IP reachability between network nodes (RLOCs), while the overlay manages host traffic (EIDs) encapsulated in VXLAN.
SD-Access separates host identity from host location to enable mobility and fabric scale.
2
Determine the control plane protocol responsible for host location mapping.
LISP serves as the control plane protocol operating on the Control Plane node (Map-Server/Map-Resolver).
When a fabric edge switch receives traffic for a destination host EID, it queries the LISP map-server to discover the IP address of the egress fabric edge switch (RLOC).
3
Select the option that correctly describes the LISP EID-to-RLOC mapping function.
The statement describing LISP mapping destination host EIDs to egress switch RLOCs is correct.
This process enables the ingress edge switch to encapsulate the packet in VXLAN addressed to the correct destination RLOC.

Key Concept

Software-Defined Architectures: Fabric Control Plane LISP EID-to-RLOC Mapping
Question 135Question →

Match each Cisco Software-Defined Access (SD-Access) architectural component or protocol on the left with its primary function on the right.

Click a left item, then click its matching right item

Items

Underlay Network
Overlay Network
Fabric Control Plane (LISP)
Fabric Data Plane (VXLAN)

Matches

Show answer & explanation

Answer

Underlay Network matches physical IP reachability using an IGP; Overlay Network matches establishing a virtualized logical topology; Fabric Control Plane (LISP) matches maintaining the EID-to-RLOC mapping database; Fabric Data Plane (VXLAN) matches encapsulating frames into IP/UDP packets.
In Cisco SD-Access fabric architecture, the underlay network handles physical IP routing via an IGP. The overlay network creates the virtualized logical topology on top of the underlay. LISP operates as the control plane mapping protocol (matching EIDs to RLOCs), and VXLAN functions as the data plane protocol (encapsulating Ethernet frames in UDP packets).

Step-by-Step Solution

1
Identify the foundation layer responsible for physical interconnectivity.
The underlay network provides basic unicast IP routing between fabric nodes using traditional protocols like IS-IS or OSPF.
Physical IP reachability is required before any tunneled overlay transport can occur.
2
Identify the logical transport layer created on top of physical infrastructure.
The overlay network represents the virtualized logical fabric carrying user endpoints.
Overlays decouple endpoint addressing and policies from physical network location.
3
Differentiate between control plane mapping and data plane encapsulation functions in SD-Access.
LISP tracks location mapping (EID to RLOC), while VXLAN encapsulates user frames inside UDP packets.
LISP provides lightweight control plane lookups, whereas VXLAN enables flexible Layer 2 and Layer 3 overlay encapsulation over a Layer 3 underlay.

Key Concept

Software-Defined Access Fabric Architecture (Underlay, Overlay, LISP Control Plane, VXLAN Data Plane)
Question 136Question →

Match each network configuration management framework on the left to its corresponding operational architecture, primary transport protocol, and native template file type on the right.

Click a left item, then click its matching right item

Items

Ansible
Puppet
Chef

Matches

Show answer & explanation

Answer

Ansible matches with the agentless SSH/NETCONF push framework using YAML Playbooks. Puppet matches with the agent-based TCP 8140 pull framework using declarative DSL Manifests. Chef matches with the agent-based TCP 443 pull framework using Ruby-based Cookbooks and Recipes.
Ansible uses an agentless architecture using SSH or NETCONF to push YAML Playbooks to target devices. Puppet uses an agent-based pull architecture over TCP 8140 using Puppet DSL Manifests. Chef uses an agent-based pull architecture over TCP 443 using Ruby Cookbooks and Recipes.

Step-by-Step Solution

1
Analyze Ansible's deployment model and communication method.
Ansible is agentless, uses push execution over SSH/NETCONF, and structures tasks in YAML Playbooks.
Ansible connects directly to targets without requiring specialized client software running on network switches or routers.
2
Analyze Puppet's communication port and file format.
Puppet uses an agent-based pull model communicating over TCP port 8140 using Manifest files written in Puppet DSL.
Puppet agents periodically check in with the Puppet Master over port 8140 to pull and enforce desired state.
3
Analyze Chef's communication port and configuration structures.
Chef uses an agent-based pull model communicating over HTTPS (TCP port 443) using Cookbooks containing Recipes written in Ruby.
Chef Client nodes poll the Chef Server securely over port 443 to download required recipes.

Key Concept

Operational attributes, transport protocols, and configuration file formats of Ansible, Puppet, and Chef
Question 137Question →

A network engineer is implementing automated switch deployment across multiple enterprise branch locations. The organization's security policy strictly forbids installing persistent software agents on network devices and requires that configuration changes be pushed directly from a central management station over standard SSH sessions using YAML-based playbooks. Which configuration management tool satisfies all of these requirements?

Show answer & explanation

Answer: Ansible

Answer

Ansible satisfies all specified requirements because it operates using an agentless, push-based model that executes automation tasks over standard SSH using YAML-formatted playbooks.
Ansible utilizes an agentless architecture that communicates directly with target network nodes over SSH or NETCONF. It operates on a push-based model where configurations are executed immediately using human-readable YAML playbooks.

Step-by-Step Solution

1
Analyze the operational constraints provided in the scenario
Identified four primary requirements: Agentless architecture (no endpoint software installation), push execution model, transport via SSH, and playbooks written in YAML format.
Comparing network constraints to standard automation framework characteristics determines tool compatibility.
2
Evaluate configuration management tools against the criteria
Ansible utilizes SSH for connection (agentless), pushes configuration updates from a control node, and formats playbooks in YAML. In contrast, Puppet and Chef rely on client agents executing periodic pull requests with Ruby-based DSLs or custom manifests.
Ansible is designed specifically to support agentless network infrastructure automation over native protocols.

Key Concept

Capabilities and architectural differences of Configuration Management mechanisms (Ansible vs Puppet vs Chef)
Question 138Question →

Network architectures strictly differentiate operational responsibilities between planes to ensure scalability and high-speed processing. Which two of the following tasks are performed by the control plane rather than the data plane? (Select two.)

Select all that apply

Show answer & explanation

Answer: Building and maintaining the Routing Information Base (RIB) through dynamic routing protocols.; Processing incoming ARP requests that are directly addressed to the local router interface.

Answer

Building and maintaining the Routing Information Base (RIB) through dynamic routing protocols, and processing incoming ARP requests that are directly addressed to the local router interface.
The correct options identify operations belonging to the control plane. Dynamic routing protocols run on the control processor to construct the Routing Information Base (RIB). Additionally, packets addressed directly to the routing device itself—such as ARP queries directed to the local router interface—cannot be handled solely by forwarding ASICs and must be punted to the control plane for processing. Conversely, packet switching, hardware FIB lookups, TTL updates, and MAC address rewrites for transit packets occur exclusively within the data plane.

Step-by-Step Solution

1
Analyze the operational responsibilities of the control plane.
The control plane manages protocol operations, path calculations, building the RIB, and handling traffic destined to the router itself (such as ARP requests for local interface IPs or routing updates).
Control plane tasks require complex processing logic handled by the main CPU.
2
Analyze the operational responsibilities of the data plane.
The data plane (forwarding plane) processes transit traffic passing through the router. It uses specialized hardware (ASICs and TCAM) to perform FIB lookups, TTL decrements, and Layer 2 frame header rewrites at wire speed.
Data plane functions are optimized for fast throughput and low latency without consuming main processor CPU cycles.
3
Evaluate the choices to select the two control plane operations.
RIB maintenance via routing protocols and processing ARP requests for local interface addresses are control plane functions. Hardware FIB lookups and packet header modifications are data plane functions.
Correctly separates plane duties based on whether the task involves network-wide intelligence/self-destined traffic versus transit packet switching.

Key Concept

Control Plane vs. Data Plane Responsibilities
Estimated Time:1m 30s
Question 139Question →

A network administrator notices that while transit data packets are forwarded rapidly across a router using hardware ASICs, traceroute traffic whose IP TTL expires at the router causes a temporary increase in main CPU utilization. Which architectural plane is directly responsible for processing these TTL-expired packets and generating the resulting ICMP Time Exceeded messages?

Show answer & explanation

Answer: Control plane

Answer

The control plane is directly responsible for processing exception packets, such as generating ICMP Time Exceeded messages when an IP packet's Time-To-Live (TTL) reaches zero.
The control plane is managed by the network device's CPU and is responsible for running routing protocols (like OSPF and BGP) as well as handling exception packets. When a transit IP packet's TTL expires, the data plane cannot complete hardware forwarding and punts the packet to the control plane CPU to construct and send an ICMP Time Exceeded packet.

Step-by-Step Solution

1
Analyze the packet handling requirement in the scenario.
The packet has an expired TTL (TTL=1 upon arrival at the Layer 3 device), requiring an ICMP Time Exceeded response to be crafted.
Hardware ASICs in the data plane are optimized for standard forwarding lookups using the FIB and TCAM, but cannot originate complex control messages.
2
Identify which plane receives exception or punted traffic.
The data plane punts the packet to the CPU, which operates in the control plane.
Control processor software handles routing protocol updates, ARP request/reply generation, and ICMP exception message creation.

Key Concept

Control Plane vs Data Plane Exception Handling
Question 140Question →

Match each network operational task or protocol interaction to its corresponding functional plane or architectural interface.

Click a left item, then click its matching right item

Items

Exchanging OSPF Hello packets and constructing the Routing Information Base (RIB)
Performing hardware-accelerated IP destination lookup using the Forwarding Information Base (FIB) in ASICs
Establishing a secure SSH session to modify interface configurations and hostname settings
Transmitting flow table entries from a centralized controller to network devices via OpenFlow

Matches

Show answer & explanation

Answer

OSPF exchange and RIB construction match the Control Plane. FIB lookup in ASICs matches the Data Plane. SSH session configuration matches the Management Plane. Controller flow table transmission via OpenFlow matches the Southbound API.
Each functional operation aligns directly with its respective architectural plane: Control Plane handles topology decision intelligence (OSPF/RIB); Data Plane handles high-speed packet transit (FIB lookups in ASICs); Management Plane handles device governance and interactive administration (SSH); and Southbound APIs bridge the controller's control decisions to the physical hardware (OpenFlow).

Step-by-Step Solution

1
Analyze routing protocol message exchange and table building.
Identified as Control Plane activity, as it makes routing decision intelligence available before packets are forwarded.
Routing protocols run in software on the CPU to dynamically discover neighbors and compute topology paths.
2
Analyze high-speed destination lookup and encapsulation.
Identified as Data Plane activity.
Transit traffic forwarding uses hardware mechanisms (ASICs/TCAM) to process incoming packets quickly.
3
Analyze device access and administrative configuration.
Identified as Management Plane activity.
SSH provides interactive administrative oversight and device configuration capabilities.
4
Analyze SDN controller-to-switch protocol communication.
Identified as Southbound API interface.
Southbound APIs facilitate the control-to-data plane separation by allowing centralized software controllers to program physical network switches.

Key Concept

Functional Separation of Control, Data, and Management Planes in Traditional and SDN Architectures
Estimated Time:1m 30s
PreviousPage 7 / 10Next
Automation and Programmability Practice Questions — Cisco CCNA — Page 7 | Examkin