Cisco 350-901 DEVCOR/AUTOCOR: Infrastructure and Automation

Domain 5 tests automating network and infrastructure change safely: declarative models, idempotency, NETCONF/RESTCONF/YANG, streaming telemetry, and tools such as Ansible, Terraform, and NSO. The exam rewards convergence and rollback over one-off CLI scripts.

Automation rules

• Declarative means describing desired state; imperative means describing steps. Idempotency means repeated runs converge to the same state without duplicating changes.
• YANG models configuration and state. NETCONF uses SSH and XML with datastores such as running, candidate, and startup. Typical flow: lock, edit-config, validate, commit, unlock. commit confirmed rolls back unless confirmed.
• RESTCONF maps YANG to HTTPS with JSON or XML. GET reads, POST creates, PUT replaces, PATCH merges, and DELETE removes.
• gNMI over gRPC provides get, set, and subscribe operations, including streaming telemetry. Push telemetry scales better than repeated SNMP polling.
• Ansible uses inventory, playbooks, and modules; prefer modules over raw CLI commands and use check mode for dry runs.
• Terraform uses providers, plan, and apply. Keep state remote and locked; detect drift; never commit state containing secrets.
• NSO orchestrates devices through YANG service models and abstracts device-specific interfaces.

Worked example

Change an interface description with NETCONF. Reasoning: lock the candidate datastore, send edit-config with the new description, validate, commit, then unlock. If validation fails, discard the candidate so the running configuration is untouched. Repeating the same edit with the same description produces no additional change, which is idempotent. If the change is risky, use commit confirmed with a rollback timer and confirm only after verification.

Traps

• Editing the running datastore directly and bypassing candidate validation.
• Failing to lock before a read-modify-write sequence.
• Screen-scraping CLI output instead of using YANG models.
• Writing scripts that append configuration on every run instead of converging.
• Committing Terraform state with credentials, or ignoring drift between plan and reality.