I85PREP
⌘ K
CCOA study materials
CCOA study resources

CCOA (IJCAHPO) practice questions

One question at a time. Build your CCOA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Architecture and Design

In a cloud architecture, which characteristic most directly distinguishes a highly available design from a fault-tolerant design?

  1. High availability requires multi-region deployment, while fault tolerance only requires a single availability zone.
  2. High availability eliminates the need for health checks, while fault tolerance depends on them.
  3. High availability tolerates component failure with minimal interruption, while fault tolerance continues operating through failure without service interruption. Correct answer.
  4. High availability is achieved only through vertical scaling, while fault tolerance relies on horizontal scaling.

Explanation

High availability minimizes downtime and typically allows a brief interruption during failover, whereas fault tolerance aims for continuous operation with no interruption when a component fails. Both rely on redundancy, but they differ in the acceptable recovery behavior.

Question 2Cloud Architecture and Design

A team needs a storage tier for archival data accessed perhaps once a year, where retrieval latency of several hours is acceptable. Which cloud storage characteristic should drive the selection?

  1. Provisioned IOPS with guaranteed throughput
  2. Highest durability achieved through local instance storage
  3. Lowest cost per gigabyte with infrequent-access retrieval pricing Correct answer.
  4. Lowest network egress cost to the public internet

Explanation

Archival workloads are optimized by minimizing storage cost per gigabyte and accepting delayed retrieval, which is the defining trade-off of cold storage tiers. Provisioned performance and egress pricing address different requirements than long-term retention cost.

Question 3Cloud Architecture and Design

Which statement best describes the purpose of a cloud landing zone?

  1. It is a billing construct that aggregates costs across all departments.
  2. It is a container orchestration service for deploying microservices.
  3. It is a single virtual network dedicated to hosting a production database cluster.
  4. It provides a pre-configured, governed multi-account foundation with networking, identity, and logging baselines. Correct answer.

Explanation

A landing zone establishes the baseline environment for an organization's cloud estate, including account structure, identity integration, network topology, and centralized logging and guardrails. It is a foundational governance pattern rather than a workload-specific or billing-only construct.

Question 4Cloud Architecture and Design

An application runs in a single availability zone and the business requires resilience to the loss of an entire zone. What is the most direct architectural change?

  1. Deploy the application across multiple availability zones behind a load balancer. Correct answer.
  2. Increase the instance size within the same zone.
  3. Enable daily snapshots of the database volume.
  4. Add more read replicas inside the same zone.

Explanation

Zone-level resilience requires distributing redundant components across independent availability zones so that the loss of one zone leaves capacity elsewhere. Load balancing across zones provides both redundancy and continued traffic distribution.

Question 5Cloud Architecture and Design

Which design principle most directly supports the ability to scale an application horizontally in the cloud?

  1. Running all tiers on a single large virtual machine
  2. Designing application tiers to be stateless so any instance can serve any request Correct answer.
  3. Pinning each user to a specific server for the life of the session
  4. Storing session state on each individual server's local disk

Explanation

Stateless tiers allow requests to be handled by any instance, so capacity can be added or removed freely behind a load balancer. Externalizing state to a shared store is the usual companion practice for horizontal scaling.

Question 6Cloud Architecture and Design

What is the primary architectural benefit of decoupling application components with a message queue?

  1. It removes the need for any monitoring of the components.
  2. It eliminates network latency between services.
  3. It allows producers and consumers to scale and fail independently through asynchronous buffering. Correct answer.
  4. It guarantees exactly-once delivery for every message.

Explanation

A queue buffers messages so producers and consumers do not need to be available or scaled at the same time, improving resilience and elasticity. Delivery guarantees and latency characteristics depend on the specific service and configuration.

Question 7Cloud Architecture and Design

Which cloud networking construct is used to isolate resources so that they have no direct route to the public internet while still allowing outbound access through a controlled gateway?

  1. A peered connection between two VPCs
  2. A public subnet with an internet gateway route
  3. A content delivery network distribution
  4. A private subnet with a route to a NAT gateway Correct answer.

Explanation

A private subnet has no direct internet route; outbound traffic can be directed to a NAT gateway that performs the translation. This keeps resources unreachable from the internet while permitting controlled egress.

Question 8Cloud Architecture and Design

Which statement accurately describes the shared responsibility model in cloud computing?

  1. The customer is responsible for everything, including physical data center security.
  2. The model applies only to infrastructure-as-a-service offerings.
  3. The provider is responsible for all security controls once data is uploaded.
  4. Responsibility is divided, with the provider securing the cloud infrastructure and the customer securing what they configure and run in it. Correct answer.

Explanation

Under the shared responsibility model, the provider secures facilities, hardware, and the managed service foundation, while the customer secures identity, data, configuration, and workloads they deploy. The split shifts with the service model but the principle applies across IaaS, PaaS, and SaaS.

Question 9Cloud Architecture and Design

A workload's traffic varies predictably, with sharp peaks every weekday morning and near-zero load overnight. Which scaling approach best fits this pattern?

  1. Manual scaling performed quarterly
  2. Reserved capacity sized for the annual peak
  3. Scheduled scaling combined with metric-based autoscaling Correct answer.
  4. Static provisioning sized for the nightly average

Explanation

Predictable peaks are well served by schedules that pre-provision capacity ahead of known events, with metric-based autoscaling handling residual variation. This balances responsiveness against cost.

Question 10Cloud Architecture and Design

An architect must choose between relational and NoSQL storage for a workload with flexible, evolving attributes and very high write throughput. Which reasoning is most sound?

  1. Choose relational because it avoids the need for an access pattern analysis.
  2. Choose NoSQL because it guarantees strong consistency in all configurations.
  3. Choose NoSQL because schema flexibility and horizontal partitioning suit high write volume with variable attributes. Correct answer.
  4. Choose relational because it always scales writes more easily.

Explanation

NoSQL databases typically offer flexible schemas and horizontal partitioning, which align with evolving attributes and high write rates. Access patterns should still be analyzed before selecting a data model.

Question 11Cloud Architecture and Design

Which approach best protects a multi-tier application from cascading failure when a downstream dependency becomes slow?

  1. Removing all timeouts so requests eventually complete
  2. Retrying immediately and indefinitely on every failure
  3. Increasing the thread pool without limit to absorb the delay
  4. Applying timeouts, bounded retries with backoff, and circuit breakers on calls to the dependency Correct answer.

Explanation

Timeouts bound waiting, retries with backoff handle transient errors, and circuit breakers stop calls to a failing dependency so resources are not exhausted. Together these patterns contain failure rather than propagating it.

Question 12Cloud Architecture and Design

A company must keep certain regulated data within a specific country. Which architectural control most directly addresses this requirement?

  1. Encrypting data at rest with customer-managed keys
  2. Using a content delivery network with global edge locations
  3. Enabling versioning on object storage buckets
  4. Restricting deployment and storage to a region in that country using policy guardrails Correct answer.

Explanation

Data residency is enforced by controlling where resources and data are physically stored, typically through regional deployment and policy guardrails that prevent out-of-region creation. Encryption and versioning address confidentiality and durability rather than location.

Question 13Cloud Architecture and Design

What is the main architectural purpose of an API gateway in a microservices architecture?

  1. To store the primary transactional database for all services
  2. To provide a single entry point handling routing, authentication, and rate limiting for backend services Correct answer.
  3. To replace the need for service discovery entirely
  4. To compile service code into container images

Explanation

An API gateway centralizes cross-cutting concerns such as request routing, authentication, throttling, and protocol translation at the edge of the service estate. Backend services remain responsible for their own data and business logic.

Question 14Cloud Architecture and Design

An architect is designing for disaster recovery with a recovery point objective of near zero and a recovery time objective of minutes. Which strategy aligns best?

  1. Warm standby with asynchronous replication and periodic testing
  2. Multi-site active-active with continuous replication Correct answer.
  3. Nightly backups restored to a cold environment
  4. Backup to tape stored offsite

Explanation

A near-zero RPO requires continuous replication, and a minutes-level RTO requires capacity that can take over immediately, which active-active multi-site provides. The other options accept data loss or long recovery durations.

Question 15Cloud Architecture and Design

Which design choice best supports cost optimization for a batch processing workload that can tolerate interruption and runs for several hours?

  1. Spot or preemptible capacity with checkpointing to resume interrupted work Correct answer.
  2. On-demand instances sized for peak concurrency
  3. Dedicated hosts reserved for compliance isolation
  4. Provisioned IOPS volumes attached to every worker

Explanation

Interruption-tolerant batch work benefits from discounted spare capacity, provided the application checkpoints progress so interrupted tasks can resume. This lowers compute cost substantially compared with on-demand pricing.

Question 16Cloud Architecture and Design

A web application must serve users on multiple continents with low latency for static assets. Which architecture component addresses this most directly?

  1. A content delivery network caching assets at edge locations Correct answer.
  2. A single-region relational database with read replicas
  3. An auto-scaling group in one region
  4. A VPN concentrator in the headquarters region

Explanation

A CDN caches static content at edge locations close to users, reducing latency and origin load. Single-region compute and databases do not reduce the distance traveled by asset requests.

Question 17Cloud Architecture and Design

Which statement about infrastructure as code in cloud architecture is most accurate?

  1. It removes the need for change review because templates are declarative.
  2. It enables repeatable, version-controlled provisioning that reduces configuration drift. Correct answer.
  3. It applies only to networking resources.
  4. It requires manual console changes to remain authoritative.

Explanation

Infrastructure as code expresses environments in versioned templates or definitions, making provisioning repeatable and auditable and reducing drift from manual changes. Review and testing remain important parts of the workflow.

Question 18Cloud Architecture and Design

An application writes events that several independent downstream consumers must each process in order. Which messaging approach fits best?

  1. Direct synchronous HTTP calls from the producer to each consumer
  2. A publish-subscribe topic with per-consumer subscriptions preserving order Correct answer.
  3. A single queue with competing consumers
  4. A shared database table polled by all consumers

Explanation

Publish-subscribe delivers each event to every subscriber independently, and ordering can be preserved per partition or subscription. Competing consumers on a single queue would divide messages rather than deliver each to all consumers.

Question 19Cloud Architecture and Design

Which identity design most strongly supports least privilege across many cloud accounts?

  1. Federating workforce identity with role assumption scoped per account and task Correct answer.
  2. Embedding static access keys in application source code
  3. Sharing a single long-lived administrator credential among teams
  4. Granting broad permissions to simplify onboarding

Explanation

Federated identity with scoped role assumption gives users and workloads temporary credentials limited to the task and account required. This limits blast radius and removes long-lived shared secrets.

Question 20Cloud Architecture and Design

An architect observes that a service's latency rises sharply as concurrency grows past a threshold, and CPU remains moderate. Which explanation is most plausible?

  1. The load balancer is terminating TLS too slowly.
  2. The instance type is too small and requires vertical scaling.
  3. The application is leaking memory under load.
  4. A shared downstream resource such as a connection pool or database is saturating and queueing requests. Correct answer.

Explanation

Rising latency with moderate CPU often indicates contention on a shared dependency, such as a bounded connection pool or database, causing requests to queue. Identifying the saturated resource is the prerequisite for remediation.

Question 21Cloud Architecture and Design

A regulated workload requires that no single administrator can both modify data and delete audit logs. Which architectural principle does this reflect?

  1. Cost optimization through right-sizing
  2. High availability through multi-zone deployment
  3. Elasticity through autoscaling policies
  4. Defense in depth through separation of duties and least privilege Correct answer.

Explanation

Separating duties so that no individual holds both capabilities is an application of least privilege and defense in depth for privileged access. It limits the ability of any single compromised identity to both alter and erase evidence.

Question 22Cloud Architecture and Design

A team proposes an active-active deployment across two regions for a relational database. Which consideration most affects feasibility?

  1. Whether the load balancer supports TLS 1.3
  2. Whether object storage versioning is enabled in both regions
  3. Whether the database supports multi-region write replication with acceptable conflict handling and latency Correct answer.
  4. Whether the CDN has edge locations in both regions

Explanation

Active-active writes require the data store to support multi-region write replication with a defined conflict resolution model and latency the application can tolerate. Storage versioning, CDN coverage, and TLS versions do not determine write-conflict feasibility.

Question 23Cloud Architecture and Design

An architect must reduce cross-availability-zone data transfer charges for a chatty multi-tier application while preserving zone-failure resilience. Which approach is most appropriate?

  1. Increase instance size so fewer cross-zone calls occur.
  2. Replace the application with a managed service in one zone.
  3. Keep redundancy across zones but reduce chatty cross-zone traffic through caching, batching, and zone-aware routing. Correct answer.
  4. Collapse all tiers into a single availability zone to eliminate the charges.

Explanation

Cross-zone charges can be reduced by cutting unnecessary chatter, caching frequently read data, batching calls, and preferring same-zone targets where resilience permits. Retaining multi-zone redundancy preserves the availability objective.

Question 24Cloud Architecture and Design

A workload must process a stream of events exactly once for financial postings while remaining resilient to consumer restarts. Which design element is most critical?

  1. Increasing the number of consumer instances without limit
  2. Storing processing state in each consumer's memory
  3. Idempotent processing keyed on a durable event identifier with transactional offset commits Correct answer.
  4. Using a fan-out topic with no acknowledgment

Explanation

Exactly-once effects are achieved through idempotent writes keyed on a stable identifier combined with committing offsets only after successful processing. This ensures restarts do not duplicate postings.

Question 25Cloud Architecture and Design

An enterprise wants teams to deploy autonomously while enforcing network and logging standards centrally. Which combination best achieves this?

  1. A per-team account with no organizational policy controls
  2. Manual review of every deployment by a central team
  3. A multi-account structure with centralized guardrails, shared network hub, and delegated team-level permissions Correct answer.
  4. A single shared account where all teams deploy with administrator rights

Explanation

A multi-account foundation with organizational policies, a shared network hub, and delegated permissions lets teams move independently while standards are enforced centrally. It balances autonomy with governance.

Question 26Cloud Architecture and Design

Which cloud architecture principle describes designing components so that a failure in one part does not cascade to others, allowing the system to continue operating in a degraded but functional state?

  1. Fault tolerance through loose coupling and bulkheads Correct answer.
  2. Vertical scaling of the largest instance type available
  3. Centralizing all services in a single monolithic process
  4. Manual failover performed by operations staff on alert

Explanation

Loose coupling and bulkhead patterns limit the blast radius of a failure so that dependent components can continue serving traffic or degrade gracefully. Vertical scaling and monolithic designs concentrate risk rather than contain it, and manual failover introduces recovery delay rather than resilience.

Question 27Cloud Architecture and Design

An architect is selecting a compute model for an event-driven image-resizing function that runs sporadically, completes in under two seconds, and should incur no cost when idle. Which compute model best fits these requirements?

  1. Dedicated virtual machines with reserved pricing
  2. Bare-metal hosts provisioned for peak load
  3. A container cluster with a fixed minimum node count
  4. Serverless functions Correct answer.

Explanation

Serverless functions bill per invocation and execution duration, so idle time costs nothing and short sporadic tasks map directly to the execution model. Reserved VMs, fixed node pools, and bare-metal hosts all charge for provisioned capacity whether or not work arrives.

Question 28Cloud Architecture and Design

Which storage characteristic most distinguishes object storage from block storage in a cloud architecture?

  1. Block storage stores each record with user-defined metadata and a globally unique key
  2. Block storage exposes a raw volume that an operating system formats with a file system
  3. Object storage manages data as discrete named objects with metadata accessed over HTTP APIs Correct answer.
  4. Object storage requires a mounted file system to be readable by applications

Explanation

Object storage treats each item as an immutable object addressed by a key and accessed through HTTP APIs, with rich metadata and high durability at scale. Block storage instead presents raw volumes that hosts format and mount, which is a different abstraction layer.

Question 29Cloud Architecture and Design

A team needs a deployment model that lets them run the same container image identically on-premises and in the cloud without rewriting application code. Which architectural approach most directly supports this portability?

  1. Using provider-specific serverless triggers bound to one cloud vendor
  2. Containerization with an orchestrator that abstracts the underlying host infrastructure Correct answer.
  3. Rewriting the application for each target provider's proprietary runtime
  4. Relying on unmanaged physical servers configured by hand at each site

Explanation

Containers package the application and its dependencies into a portable artifact, and an orchestrator abstracts scheduling across hosts, so the same image runs in different environments. Proprietary runtimes and vendor-bound triggers create lock-in, and hand-configured physical servers are not portable artifacts.

Question 30Cloud Architecture and Design

An architect is designing a multi-tenant SaaS platform where each tenant's data must be logically isolated while sharing infrastructure for cost efficiency. Which approach best balances isolation with shared cost?

  1. A shared database with a tenant identifier on every row enforced by row-level security policies Correct answer.
  2. One database per tenant hosted on dedicated physical hardware
  3. A single shared schema with no tenant column and reliance on application filtering only
  4. A separate dedicated account and full infrastructure stack per tenant

Explanation

A shared database with a mandatory tenant key and enforced row-level security provides logical isolation while amortizing infrastructure cost across tenants. Separate stacks or dedicated hardware give stronger isolation but sacrifice the cost efficiency the requirement asks to preserve, and filtering without enforcement is unsafe.

Question 31Cloud Architecture and Design

A workload must remain available through the loss of an entire availability zone within a region. Which design most directly achieves this?

  1. Placing all state on an instance store volume attached to one host
  2. Deploying redundant instances across multiple availability zones behind a load balancer Correct answer.
  3. Deploying all instances into one availability zone with frequent snapshots
  4. Relying on a single large instance with automatic restart on failure

Explanation

Spreading redundant capacity across multiple availability zones means the loss of one zone leaves healthy capacity in others, and the load balancer routes around the failed zone. Single-zone or single-instance designs fail entirely when that zone or host is lost.

Question 32Cloud Architecture and Design

An architect is comparing synchronous request/response calls with asynchronous messaging between two microservices. Which consideration most strongly favors asynchronous messaging?

  1. The interaction must propagate an error back to the caller within the same request
  2. The caller requires an immediate response value to render the next page for the user
  3. The workflow requires strict request ordering enforced by a blocking call
  4. The producer must continue processing without waiting for the consumer and tolerate consumer downtime Correct answer.

Explanation

Asynchronous messaging decouples producer and consumer in time, so the producer can proceed while the consumer is slow or offline and messages are buffered durably. Synchronous calls are appropriate when the caller needs an immediate result or same-request error propagation.

Question 33Cloud Architecture and Design

A company is migrating a legacy application and wants to retire components incrementally while routing a growing share of traffic to the new implementation. Which pattern supports this?

  1. A pilot light disaster recovery configuration
  2. Blue-green deployment that swaps the entire application at once
  3. Strangler fig pattern with a routing layer in front of old and new components Correct answer.
  4. Big-bang cutover with no fallback path

Explanation

The strangler fig pattern places a routing facade in front of legacy and replacement components so traffic can shift gradually and each legacy piece can be retired once replaced. Big-bang and full blue-green swaps move all traffic at once, which does not support incremental retirement with gradual routing.

Question 34Cloud Architecture and Design

An architect must design a system so that a sudden tenfold spike in traffic does not overwhelm a downstream database. Which combination is most appropriate?

  1. Increasing the database connection pool on each web server without limit
  2. Removing retries and timeouts so requests wait indefinitely
  3. A queue that buffers incoming work with consumers that drain at a controlled rate Correct answer.
  4. Direct synchronous writes from every web server to the database

Explanation

A queue absorbs bursts and lets consumers process at a rate the database can sustain, providing backpressure and smoothing the spike. Direct unbounded writes or unlimited connection pools push the spike straight into the database, and removing timeouts lets failures accumulate.

Question 35Cloud Architecture and Design

Which architectural control most directly limits the impact of a compromised workload credential in a cloud environment?

  1. Scoping the credential to a narrowly defined role with only the permissions that workload needs Correct answer.
  2. Storing the credential in the application source code for easy retrieval
  3. Sharing one long-lived credential across all workloads in the account
  4. Granting the workload broad administrator permissions to avoid future changes

Explanation

Least-privilege scoping means a compromised credential can only perform the limited actions granted to that role, containing the blast radius. Broad permissions, shared credentials, and embedded secrets all expand what an attacker can do once the credential leaks.

Question 36Cloud Architecture and Design

A stateless web tier stores session data locally in each server's memory. Users are randomly logged out when the load balancer routes them to a different server. Which change best resolves this?

  1. Increase the memory allocated to each web server
  2. Externalize session state to a shared, highly available data store Correct answer.
  3. Enable sticky sessions permanently on the load balancer
  4. Reduce the number of web servers behind the load balancer

Explanation

Moving session state to a shared store makes the web tier genuinely stateless, so any server can serve any request and scaling or failures do not lose sessions. Sticky sessions mask the problem while reducing resilience and balancing flexibility.

Question 37Cloud Architecture and Design

An architect is evaluating whether to place a cache between the application and a read-heavy database. Which statement best captures the primary architectural trade-off?

  1. It removes the need for a durable primary database entirely
  2. It guarantees strong consistency because cached data is always current
  3. It eliminates the need to design for cache eviction or sizing
  4. It reduces database load and latency but introduces staleness and invalidation complexity Correct answer.

Explanation

Caching trades consistency for latency and load reduction: reads are faster and the database is shielded, but cached entries can be stale and invalidation logic becomes part of the design. A cache does not guarantee freshness, replace durable storage, or remove the need to plan eviction.

Question 38Cloud Architecture and Design

A regulated workload requires that every change to infrastructure be reviewed, versioned, and reproducible across environments. Which practice most directly satisfies this?

  1. Relying on manual runbooks executed by individuals during maintenance windows
  2. Making changes directly in the provider console and documenting them in a wiki
  3. Granting engineers standing administrator access to production
  4. Defining infrastructure declaratively in version control and applying changes through a reviewed pipeline Correct answer.

Explanation

Declarative infrastructure stored in version control gives reviewable diffs, an auditable history, and reproducible environments when applied through a pipeline. Console changes, standing admin access, and manual runbooks lack the versioning and review guarantees the requirement demands.

Question 39Cloud Architecture and Design

An architect must design a system that tolerates the loss of an entire cloud region while keeping recovery time within minutes and maintaining a warm, tested standby. Which strategy best fits?

  1. Cold standby where infrastructure is provisioned only after a disaster is declared
  2. Warm standby with continuous data replication and automated failover to the secondary region Correct answer.
  3. Backup and restore from periodic snapshots stored in a single region
  4. A single-region deployment with manual DNS changes during an outage

Explanation

A warm standby keeps a scaled-down but running copy of the environment in a second region with continuous replication, enabling automated failover within minutes. Backup-restore, single-region, and cold-standby approaches require substantial provisioning time and cannot meet a minutes-level recovery target reliably.

Question 40Cloud Architecture and Design

A service's p99 latency climbs steadily as request concurrency increases, while CPU utilization stays near forty percent and downstream calls complete quickly. Which explanation is most consistent with these observations?

  1. The network bandwidth to clients is exhausted
  2. The CPU is the bottleneck and requires a larger instance type
  3. Requests are waiting on a bounded resource such as a connection pool or thread pool that is saturated Correct answer.
  4. The downstream dependency is the source of the latency

Explanation

Rising latency with low CPU and fast downstream calls points to contention on a bounded internal resource, such as a connection or thread pool, where requests queue as concurrency grows. CPU, network, and downstream saturation would each show corresponding utilization or latency signals that the observations rule out.

Question 41Orchestration and Automation

In a Cisco Catalyst Center (formerly DNA Center) automation workflow, which component stores the intended configuration of network devices and is used as the source of truth for compliance checks?

  1. The device running configuration retrieved over SSH
  2. The SNMP MIB walk cached on the collector
  3. The syslog archive on the remote logging server
  4. The Cisco Catalyst Center inventory and configuration template database Correct answer.

Explanation

Cisco Catalyst Center maintains an intended-state database built from inventory data and configuration templates, and it compares device running configuration against that intended state to report compliance. The device itself holds actual state, not the intended source of truth, and logging or SNMP data are observational rather than authoritative configuration stores.

Question 42Orchestration and Automation

An engineer wants a Python script to create, update, and delete network devices in Cisco Catalyst Center using its northbound API. Which API style and authentication mechanism should the script use?

  1. REST over HTTPS with a token obtained from the authentication API Correct answer.
  2. NETCONF over SSH with vendor-specific RPCs
  3. SNMPv3 with authPriv USM credentials
  4. SOAP over HTTPS with WS-Security headers

Explanation

Catalyst Center exposes a REST API over HTTPS; clients first call the authentication endpoint to obtain a token and then pass that token in the X-Auth-Token header for subsequent calls. SOAP, SNMP, and NETCONF are not the northbound interface used for these object operations.

Question 43Orchestration and Automation

Which statement best describes the role of Ansible in a network automation pipeline?

  1. It is a packet broker that mirrors traffic to monitoring tools
  2. It is a declarative agent that runs permanently on each managed switch
  3. It is a configuration database that replaces the device running configuration
  4. It is an agentless orchestration tool that connects to devices over SSH or API and applies modules from a playbook Correct answer.

Explanation

Ansible is agentless: it uses a control node to reach managed devices over SSH, NETCONF, or HTTP APIs and executes modules organized in playbooks. It orchestrates changes but does not replace device configuration stores or perform traffic mirroring.

Question 44Orchestration and Automation

A YANG model defines a leaf named 'hostname' with type string inside a container 'system'. Which NETCONF path correctly addresses that leaf?

  1. system:hostname
  2. /system/hostname Correct answer.
  3. system.hostname
  4. /hostname/system

Explanation

NETCONF filters use XPath-like paths where containers and lists are separated by slashes, so a leaf inside container system is addressed as /system/hostname. Dot notation and colon notation do not represent the container hierarchy in a NETCONF subtree filter.

Question 45Orchestration and Automation

Which Cisco platform provides a model-driven, YANG-based interface for streaming telemetry and configuration on IOS XE devices?

  1. SNMPv2c polling of the IF-MIB
  2. gRPC with YANG models via the IOS XE model-driven telemetry stack Correct answer.
  3. NetFlow version 5 export
  4. TACACS+ command accounting

Explanation

IOS XE supports model-driven telemetry and configuration using YANG models transported over gRPC, giving structured, streaming data rather than polled scalar values. SNMP, TACACS+, and NetFlow serve different purposes and are not YANG-model-driven interfaces.

Question 46Orchestration and Automation

In Git, an engineer wants to isolate work on a new automation feature without affecting the mainline branch. Which action accomplishes this?

  1. Force-push the working tree to the remote main
  2. Commit directly to main and tag the commit
  3. Create a feature branch and commit changes there Correct answer.
  4. Run git stash and continue editing main

Explanation

Branching creates an independent line of development so commits on the feature branch do not alter main until they are merged. Committing to main, stashing, or force-pushing all either modify or risk the mainline rather than isolating work.

Question 47Orchestration and Automation

What is the primary purpose of an Infrastructure as Code (IaC) pipeline in network operations?

  1. To version, review, test, and consistently deploy network configuration changes Correct answer.
  2. To manually type configuration into each device console
  3. To replace routing protocols with static routes
  4. To disable configuration backups on managed devices

Explanation

An IaC pipeline treats configuration as versioned code that flows through review, automated testing, and consistent deployment, reducing drift and manual error. It does not replace routing protocols or eliminate backups.

Question 48Orchestration and Automation

Which Cisco Catalyst Center feature lets an engineer apply a common set of configuration commands to many devices by binding variables to device attributes?

  1. Device health dashboards
  2. Application policy
  3. Configuration templates with variables Correct answer.
  4. Flow analysis

Explanation

Configuration templates in Catalyst Center contain reusable command blocks with variables that are populated from device attributes or input, enabling consistent changes across many devices. Flow analysis, application policy, and health dashboards are monitoring or policy features, not configuration templating.

Question 49Orchestration and Automation

A playbook must run a task only on Cisco IOS XE devices and skip others. Which Ansible construct is most appropriate?

  1. A 'become: true' directive
  2. A 'serial' keyword set to 1
  3. An 'ignore_errors: true' directive
  4. A 'when' conditional that evaluates the detected network operating system fact Correct answer.

Explanation

The 'when' clause evaluates a condition per host, so a task can be limited to devices whose gathered facts report an IOS XE operating system. Serial controls batch size, ignore_errors changes failure handling, and become controls privilege escalation, none of which filter by platform.

Question 50Orchestration and Automation

An engineer runs an idempotent Ansible task against a device that already has the desired configuration. What is the expected outcome?

  1. The task fails because the configuration already exists
  2. The task reports changed and re-applies the configuration
  3. The task reports ok with no change to the device Correct answer.
  4. The task removes and then re-adds the configuration

Explanation

Idempotency means running the same task repeatedly converges to the same state; if the device already matches the desired state, the module reports ok without making changes. Re-applying, failing, or removing and re-adding would violate idempotent behavior.