Cisco CCNP Enterprise 350-401 ENCOR EEM Applets and Orchestration Models Practice Test

 

Topic 21 covers eem applets and orchestration models for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

An EEM applet should run only when IOS XE logs that `GigabitEthernet1/0/24` changed state to down. Which event detector is the best fit?

1. A Catalyst Center task query that polls unrelated asynchronous work.
2. A YANG list key that identifies the interface in a RESTCONF payload.
3. A manual `event none` registration that requires an operator every time.
4. A watchdog timer that runs every minute regardless of interface state.
5. Use a syslog event pattern specific to the intended interface-down message.

Correct Answer: E

 

Correct Answer

Answer E is correct because The syslog event detector can trigger an applet when a regular-expression pattern matches the targeted message.

Incorrect Answers

Answer A is incorrect because Controller task status does not directly register a local IOS XE EEM syslog trigger.

Answer B is incorrect because A YANG key identifies modeled data and is not an EEM event detector.

Answer C is incorrect because Manual invocation does not satisfy the requirement for automatic reaction to the syslog event.

Answer D is incorrect because A periodic timer does not inherently correlate execution with the specific interface-down event in the requirement.

 

Question 2

A router must capture `show processes cpu` every five minutes even when no fault occurs. Which EEM event mechanism is most appropriate?

1. A recurring timer event configured for the required interval.
2. A manual event that an administrator launches after each interval.
3. A REST 404 response from an external controller.
4. A syslog pattern that matches any line containing the word CPU.
5. An interface-state event tied to a random uplink.

Correct Answer: A

 

Correct Answer

Answer A is correct because A watchdog or recurring timer can trigger an applet periodically without waiting for a separate fault message.

Incorrect Answers

Answer B is incorrect because Manual invocation defeats the requirement for unattended periodic collection.

Answer C is incorrect because An HTTP resource error is not the local periodic trigger requested for the router.

Answer D is incorrect because A syslog detector depends on a matching message and cannot guarantee execution every five minutes.

Answer E is incorrect because Interface changes are unrelated to the fixed periodic schedule in the requirement.

 

Question 3

An EEM applet uses `event syslog pattern “DOWN”` and unexpectedly triggers for unrelated tunnel, routing, and interface messages. What should be corrected first?

1. Disable EEM authorization so every trigger can run more commands.
2. Change every interface name so the word DOWN never appears in syslog.
3. Narrow the regular expression to the intended message context.
4. Increase the router’s NTP stratum so fewer syslog messages are generated.
5. Convert the applet into a Puppet agent catalog.

Correct Answer: C

 

Correct Answer

Answer C is correct because A broad pattern can match many unrelated syslog lines; adding specific context reduces false triggering.

Incorrect Answers

Answer A is incorrect because Authorization affects action execution and does not make the triggering pattern more selective.

Answer B is incorrect because Renaming interfaces does not address the event detector’s unspecific pattern logic.

Answer D is incorrect because Time synchronization does not correct an overly broad regular-expression match condition.

Answer E is incorrect because Changing orchestration architecture is unnecessary for a local pattern-selection defect.

 

Question 4

Two EEM applets perform the same diagnostic actions. Applet A uses an automatic syslog detector; Applet B uses `event none`. Which TWO statements correctly distinguish their invocation? Choose TWO.

1. Applet B requires explicit invocation because `event none` does not register an automatic detector.
2. Applet B runs every time any syslog message is generated.
3. Applet A can run when the matching syslog event occurs without an operator starting it.
4. Both applets require a Puppet agent on the router before EEM can execute.
5. `event none` is a synonym for a five-minute watchdog timer.
6. Applet A can never be disabled after it is registered.

Correct Answers: A, C

 

Correct Answers

Answer A is correct because A manual EEM applet has no autonomous event trigger and therefore must be invoked explicitly.

Answer C is correct because A registered syslog event detector automatically triggers the applet when its pattern matches.

Incorrect Answers

Answer B is incorrect because Without a syslog detector, generic syslog activity does not automatically launch the manual applet.

Answer D is incorrect because EEM is an IOS XE feature and does not depend on a Puppet agent for local execution.

Answer E is incorrect because A manual event and a recurring timer are different EEM event-registration mechanisms.

Answer F is incorrect because EEM policy configuration can be changed or removed; registration does not make the applet permanent.

 

Question 5

A syslog-triggered applet must include the affected interface in its diagnostic output. Which information should the design preserve for the action stage?

1. A random interface selected after the trigger.
2. Preserve the triggering interface data.
3. The first page of an unrelated controller inventory response.
4. Only the applet’s configuration timestamp.
5. The router’s serial number instead of the event data.

Correct Answer: B

 

Correct Answer

Answer B is correct because The action needs event-specific data so it can collect diagnostics for the interface that actually triggered the policy.

Incorrect Answers

Answer A is incorrect because Random selection breaks the required correlation between the event and the diagnostic target.

Answer C is incorrect because External inventory pagination does not provide the local triggering interface context required by the action.

Answer D is incorrect because The registration time does not identify which interface generated the current event.

Answer E is incorrect because Device identity does not substitute for the specific interface value needed by the troubleshooting action.

 

Question 6

An EEM applet must enter global configuration mode and shut a test interface after a controlled trigger. Which sequence is valid when the EEM CLI session starts below configuration mode?

1. Create a YANG list key before every CLI mode transition.
2. Enter interface configuration directly from an unauthenticated API session.
3. Run the syslog event command after shutdown because events are actions.
4. Enter the required CLI privilege and configuration modes before issuing changes.
5. Issue `shutdown` first and then enter privileged EXEC if the command fails.

Correct Answer: D

 

Correct Answer

Answer D is correct because Configuration commands require the CLI session to reach the necessary privilege and configuration modes in the proper order.

Incorrect Answers

Answer A is incorrect because YANG schema keys have no role in sequencing EEM CLI commands through EXEC and configuration modes.

Answer B is incorrect because EEM CLI actions use the device CLI session and must satisfy its mode and authorization requirements.

Answer C is incorrect because The event statement registers the trigger; it is not a post-change CLI action.

Answer E is incorrect because The action should establish the required mode before sending commands that depend on it.

 

Question 7

An EEM applet may shut an interface when a fault is detected, but the operations team requires evidence of the prechange state. Which TWO actions should occur before the shutdown? Choose TWO.

1. Restart the device immediately to maximize the amount of new evidence.
2. Record a syslog message or other audit indication that the automated remediation is about to run.
3. Collect the relevant show-command output that documents the current interface and protocol state.
4. Erase the logging buffer so only postchange evidence remains.
5. Disable the event detector so the current invocation cannot finish.
6. Change the router hostname to the incident number.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because An explicit audit record helps correlate the trigger with the subsequent disruptive action.

Answer C is correct because Capturing evidence before disruption preserves the information needed to understand the original failure condition.

Incorrect Answers

Answer A is incorrect because A reboot would destroy useful transient state and is more disruptive than the required bounded interface action.

Answer D is incorrect because Deleting evidence before a disruptive action undermines the stated troubleshooting and audit requirement.

Answer E is incorrect because Disabling registration does not satisfy the need to capture evidence for the action already being executed.

Answer F is incorrect because Renaming the device is unrelated to preserving the required technical evidence before remediation.

 

Question 8

An EEM applet runs `show ip interface brief` and the requirement is to preserve the command output for later troubleshooting. Which design is most appropriate?

1. Replace the show command with a 404 HTTP response.
2. Rely on NTP to convert transient output into a persistent file.
3. Explicitly capture or forward the diagnostic command output.
4. Use the event pattern itself as the output file contents.
5. Assume every CLI action automatically stores complete output permanently in startup configuration.

Correct Answer: C

 

Correct Answer

Answer C is correct because The output must be explicitly captured or transmitted; merely executing the show command does not guarantee later persistence.

Incorrect Answers

Answer A is incorrect because An unrelated HTTP error cannot provide the requested local interface-state output.

Answer B is incorrect because Time synchronization adds timestamps but does not store arbitrary CLI command output.

Answer D is incorrect because The event detector decides when to run and does not replace capturing the command’s actual result.

Answer E is incorrect because CLI command output is not automatically written into startup configuration for later analysis.

 

Question 9

An applet receives event data indicating `severity=critical` or `severity=warning`. Only critical events should trigger a configuration rollback; warnings should collect diagnostics only. What construct should the applet use?

1. A controller inventory GET because local conditions cannot control EEM actions.
2. Use a conditional branch that evaluates the event value.
3. A lower NTP stratum so warnings become critical events.
4. An agentless orchestration tool solely to compare the two string values.
5. A broader syslog pattern so both severities always execute the same rollback.

Correct Answer: B

 

Correct Answer

Answer B is correct because Conditional EEM logic can choose different action sequences based on the supplied event data.

Incorrect Answers

Answer A is incorrect because EEM can use event information to influence local action logic without requiring a controller inventory query.

Answer C is incorrect because Time synchronization has no role in changing the severity classification supplied by the event.

Answer D is incorrect because External orchestration is unnecessary for a simple bounded conditional branch inside the EEM policy.

Answer E is incorrect because Making the trigger broader would remove the required distinction between warning and critical handling.

 

Question 10

An applet lists actions `1.0`, `2.0`, `10.0`, and `3.0`. The author intended the final cleanup command to run last, but labeled it `2.0`. What should be corrected?

1. Increase interface bandwidth so the labels sort faster.
2. Rename the applet because names determine which action runs last.
3. Use a REST task identifier as the action label so controller order is inherited.
4. Change the event detector because action labels do not affect order.
5. Relabel the actions so cleanup executes after the preceding actions.

Correct Answer: E

 

Correct Answer

Answer E is correct because EEM action labels determine action ordering, so the labels must reflect the intended sequence rather than their visual placement alone.

Incorrect Answers

Answer A is incorrect because Interface capacity has no relationship to EEM action ordering.

Answer B is incorrect because The applet name identifies the policy and does not override the configured action label sequence.

Answer C is incorrect because EEM action labels are local policy sequence values and are unrelated to external controller task identifiers.

Answer D is incorrect because The trigger determines when the applet starts, while action labels determine the order of its actions.

 

Question 11

An applet triggers on syslog text `LINK-RESET` and one of its own actions writes `LINK-RESET remediation started` to syslog. The applet repeatedly retriggers itself. What is the best correction?

1. Convert every CLI action to a YANG leaf.
2. Change the event pattern or emitted message so the applet’s own logging cannot satisfy its trigger condition.
3. Increase the timer interval even though the applet uses no timer detector.
4. Add more identical syslog actions so the first loop completes sooner.
5. Disable interface logging globally so no operational events are recorded.

Correct Answer: B

 

Correct Answer

Answer B is correct because The current action creates the same text that the detector matches, producing a recursive trigger loop.

Incorrect Answers

Answer A is incorrect because Changing representation does not address the causal loop between the emitted syslog text and the event pattern.

Answer C is incorrect because A timer setting cannot correct recursion created by a syslog event matching the applet’s own message.

Answer D is incorrect because Additional matching messages would create more trigger opportunities and worsen the recursive behavior.

Answer E is incorrect because Suppressing all logging is unnecessarily broad; the safer fix is to remove the self-matching condition.

 

Question 12

An EEM applet triggers correctly but its CLI action receives an authorization failure when attempting a privileged configuration command. Which TWO checks are most relevant? Choose TWO.

1. Increase the syslog severity of the triggering message.
2. Assume a successful trigger proves all subsequent actions are authorized.
3. Change the applet name to `admin` so IOS XE grants privilege automatically.
4. Add a Catalyst Center pagination parameter to the local CLI command.
5. Verify the policy’s authorization behavior matches the organization’s intended security design.
6. Verify the EEM CLI session is associated with a username or privilege that is authorized for the command.

Correct Answers: E, F

 

Correct Answers

Answer E is correct because Authorization bypass and session identity settings affect whether privileged actions are permitted and should be deliberate.

Answer F is correct because EEM CLI actions are subject to session identity and authorization unless an explicitly supported bypass is configured.

Incorrect Answers

Answer A is incorrect because Trigger severity does not grant additional CLI privilege to the action session.

Answer B is incorrect because Event registration and action authorization are separate stages; a policy can trigger and still fail during command execution.

Answer C is incorrect because Policy naming does not confer AAA privilege or command authorization.

Answer D is incorrect because Controller pagination has no relationship to local EEM CLI authorization.

 

Question 13

A flapping interface generates five matching events within seconds. Each applet instance tries to change the same route, causing conflicting updates. Which TWO design controls best address the concurrency risk? Choose TWO.

1. Rate-limit or otherwise suppress duplicate trigger handling within the defined remediation window.
2. Use the same action label for every command so they execute simultaneously.
3. Remove all verification so each invocation finishes faster.
4. Restart the routing process on every event so each invocation begins from a clean state.
5. Add a bounded guard or state check so a new invocation does not repeat a change already in progress or already applied.
6. Make the syslog pattern more generic so additional events trigger the applet.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because Controlling duplicate invocations can prevent a burst of events from launching overlapping configuration actions.

Answer E is correct because Idempotent state checks reduce conflicting repeated configuration when multiple events arrive close together.

Incorrect Answers

Answer B is incorrect because Action labels define policy ordering and do not provide a safe concurrency mechanism across separate applet instances.

Answer C is incorrect because Faster execution does not eliminate conflicting state changes and removes safeguards that could detect them.

Answer D is incorrect because Repeated process restarts would be disruptive and do not solve the underlying duplicate-trigger control problem.

Answer F is incorrect because Broader matching increases event volume and therefore makes the concurrency problem worse.

 

Question 14

`show event manager policy registered` confirms an applet is registered, but the expected file is never created when the event occurs. Which conclusion is most accurate?

1. The only possible fix is to remove EEM and use a controller API.
2. Registration proves the policy is installed, not that every action later executes successfully; action-level evidence still must be checked.
3. The event cannot have occurred because registered policies never miss actions.
4. Registration guarantees every future action succeeds as long as the device remains powered.
5. The missing file proves the syslog event detector is syntactically invalid.

Correct Answer: B

 

Correct Answer

Answer B is correct because EEM registration and runtime action success are separate states, so command, authorization, or destination failures can still occur.

Incorrect Answers

Answer A is incorrect because The symptoms do not justify replacing the mechanism before checking the local action execution evidence.

Answer C is incorrect because The event may have triggered while a subsequent action failed; registration alone cannot distinguish those stages.

Answer D is incorrect because Runtime conditions and authorization can cause actions to fail even though the policy is registered.

Answer E is incorrect because A missing output artifact does not by itself identify whether the trigger, action, permission, or storage destination failed.

 

Question 15

An applet temporarily disables an unstable interface for 60 seconds and then re-enables it. What should the validation plan verify after the automatic change?

1. The interface returns to the intended state, dependent services recover, and the applet does not continue retriggering unexpectedly.
2. The REST API returns 404 for an unrelated task ID.
3. Only that the shutdown command appeared in the configuration history.
4. The router has a different hostname after recovery.
5. Only that the applet remains registered.

Correct Answer: A

 

Correct Answer

Answer A is correct because A bounded remediation must verify both restoration of the changed resource and absence of a harmful repeated-trigger condition.

Incorrect Answers

Answer B is incorrect because An unrelated controller response does not prove local interface and service recovery after EEM actions.

Answer C is incorrect because Evidence of the disruptive action alone does not prove recovery or that the automation stopped safely.

Answer D is incorrect because Hostname changes are unrelated to validating the bounded interface remediation.

Answer E is incorrect because Registration does not establish that recovery actions executed or that the service returned to the intended condition.

 

Question 16

A configuration-management platform uses a resident service on every managed server. The central system sends desired state to that service, which applies changes locally. Which architecture characteristic is present?

1. A YANG model because every local daemon is a schema.
2. A stateless REST read with no local execution component.
3. An EEM event detector because all resident agents are IOS XE applets.
4. An agent-based model requiring managed nodes to run and maintain the local agent software.
5. A purely agentless model because a central server exists.

Correct Answer: D

 

Correct Answer

Answer D is correct because A resident process on each managed node is the defining operational dependency of this agent-based design.

Incorrect Answers

Answer A is incorrect because A software agent performs management actions, whereas YANG defines modeled data structure.

Answer B is incorrect because The local service actively applies configuration and therefore is more than a read-only remote query.

Answer C is incorrect because General orchestration agents are separate from the IOS XE EEM subsystem.

Answer E is incorrect because Central coordination can exist in either model; the resident managed-node service makes this architecture agent-based.

 

Question 17

A team compares Puppet-style agents with an Ansible-style network workflow. Which TWO distinctions are accurate for the stated models? Choose TWO.

1. Agent-based orchestration eliminates all certificate, upgrade, and software-lifecycle considerations.
2. Agentless automation has no dependency on management reachability to the target.
3. An agent-based system can have a resident process periodically communicate with its central server and apply local state.
4. A resident agent automatically makes every change safe for the network design.
5. Agentless network automation can execute from a control node and reach devices remotely over supported transports such as SSH or HTTPS.
6. Both models require the same daemon to run locally on every router.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because Puppet’s agent-server model uses a local agent that retrieves and applies a compiled catalog and reports results.

Answer E is correct because Ansible network modules execute from the control node and communicate remotely rather than requiring the same resident agent on each network device.

Incorrect Answers

Answer A is incorrect because Resident agents introduce software and trust relationships that themselves require lifecycle management.

Answer B is incorrect because Remote execution still depends on a usable management transport and credentials to the managed device.

Answer D is incorrect because Execution architecture cannot prove the operational correctness or business suitability of a requested configuration.

Answer F is incorrect because Agentless network automation is specifically designed to avoid installing such a resident automation agent on each network device.

 

Question 18

An enterprise manages 18,000 servers with resident orchestration agents. A critical agent vulnerability requires a new version across the fleet. Which operational cost is most directly exposed by this event?

1. The fleet should disable TLS because encrypted connections create agent vulnerabilities.
2. The issue is solely a network-routing metric problem.
3. Agent-based systems never require upgrades because the central server updates itself only.
4. The organization must coordinate the lifecycle and upgrade of software installed on many managed nodes.
5. Changing the YANG module revision on routers automatically patches server agents.

Correct Answer: D

 

Correct Answer

Answer D is correct because A large resident-agent fleet creates patching, compatibility, deployment, and version-management work across the endpoints.

Incorrect Answers

Answer A is incorrect because Removing transport security would introduce risk and does not solve a software vulnerability in the agent.

Answer B is incorrect because Routing can affect connectivity but does not remove the endpoint software lifecycle requirement in the scenario.

Answer C is incorrect because The stated vulnerability is in the resident agent, so managed-node software must be addressed.

Answer E is incorrect because YANG schemas on network devices do not replace deployment of a corrected agent package to servers.

 

Question 19

A disconnected industrial server must continue enforcing its latest desired state and running local remediation during a four-hour loss of WAN connectivity. Which model characteristic best supports that local-execution requirement?

1. A narrower REST pagination limit.
2. A remote-only push from a control node that has no path to the site during the outage.
3. A syslog pattern on an unrelated campus switch.
4. A controller inventory GET performed from headquarters during the outage.
5. A resident agent that can evaluate and apply locally available policy while temporarily disconnected, if the product is designed for that behavior.

Correct Answer: E

 

Correct Answer

Answer E is correct because Local execution can continue without a live push session when the agent and required policy are already present on the node.

Incorrect Answers

Answer A is incorrect because Pagination affects API result size and does not provide local execution during loss of WAN reachability.

Answer B is incorrect because A central push cannot reach the disconnected node while the required management path is unavailable.

Answer C is incorrect because An event on a different device cannot substitute for the local execution required on the disconnected server.

Answer D is incorrect because Reading central inventory does not execute remediation on a node that cannot currently be reached.

 

Question 20

A network team considers an orchestration platform that requires installing its own runtime agent directly on every managed device. Half of the routers do not support that runtime. What is the decisive architectural constraint?

1. The team should ignore endpoint support because the central server can force any binary to execute.
2. A larger task identifier will make the unsupported agent compatible.
3. Those routers cannot participate in that agent-based design unless the product offers another supported management method.
4. Changing the routers’ BGP local preference will add the missing runtime.
5. The routers can participate automatically because all network devices accept arbitrary resident agents.

Correct Answer: C

 

Correct Answer

Answer C is correct because A mandatory local agent cannot run on endpoints that lack the required runtime or installation support.

Incorrect Answers

Answer A is incorrect because Central control does not override managed-device platform restrictions on installing and running software.

Answer B is incorrect because Controller task correlation values have no relationship to local runtime compatibility.

Answer D is incorrect because Routing policy does not create software execution support on the managed platform.

Answer E is incorrect because Network platforms often restrict local software environments, and the scenario explicitly states the required runtime is unsupported.

 

Question 21

An agentless network automation system runs modules on a control node and manages routers remotely. Which TWO prerequisites are still required for a typical push operation? Choose TWO.

1. A supported remote management transport such as SSH or HTTPS to the target.
2. An EEM applet for every command in the playbook.
3. A Puppet catalog compiled locally on every network device.
4. A permanently open user-data tunnel through the automation controller.
5. Credentials or another supported authentication method for the managed device.
6. A resident copy of the same automation agent daemon on every router.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because Agentless does not mean connectionless; the control node still needs a protocol path to reach the device.

Answer E is correct because Remote execution still must authenticate and obtain the privileges required for the requested operation.

Incorrect Answers

Answer B is incorrect because EEM can automate local events but is not required for every command issued by an external agentless platform.

Answer C is incorrect because A Puppet catalog is specific to that agent-based workflow and is not a generic prerequisite for agentless network automation.

Answer D is incorrect because Management connectivity is required, but user traffic does not have to traverse the automation control node.

Answer F is incorrect because Agentless network automation specifically avoids requiring that orchestration agent on each target device.

 

Question 22

A control node uses one highly privileged credential to push configuration to 3,000 routers. What security/operational concern should the design address first?

1. The control node should store the password in every playbook in clear text for availability.
2. The routers should disable authentication because the orchestration server is trusted.
3. The only concern is the number of API pages returned by inventory.
4. Centralized credentials create a large blast radius, so secret protection, least privilege, rotation, and scoped access are important.
5. Agentless architecture means credentials are unnecessary after inventory is created.

Correct Answer: D

 

Correct Answer

Answer D is correct because A single credential usable across thousands of targets concentrates privilege and therefore increases the impact of theft or misuse.

Incorrect Answers

Answer A is incorrect because Embedding reusable privileged secrets in plain text increases exposure and conflicts with secure credential management.

Answer B is incorrect because Trust in the control node does not justify removing authentication from managed network interfaces.

Answer C is incorrect because Pagination can affect data retrieval but does not address the stated credential concentration risk.

Answer E is incorrect because Remote management sessions still require an authentication mechanism and appropriate privilege on the targets.

 

Question 23

A branch router remains healthy and forwards user traffic, but a WAN ACL blocks SSH and HTTPS from the automation control node. An agentless push fails. What is the best explanation?

1. The push depends on management-plane reachability from the control node even though the router’s data plane can continue forwarding.
2. Changing the router’s hostname would restore blocked SSH and HTTPS reachability.
3. The router must be failed because user forwarding and management reachability are the same path by definition.
4. The control node should switch to a Puppet agent that is already installed, even though the scenario states no such agent exists.
5. Agentless tools execute all commands locally on the router without a management session.

Correct Answer: A

 

Correct Answer

Answer A is correct because Agentless remote execution requires the control node to reach a supported management transport on the target.

Incorrect Answers

Answer B is incorrect because The stated ACL is the management-path constraint, and renaming the device does not remove that filtering.

Answer C is incorrect because A device can forward traffic while a management ACL separately blocks the control node’s remote-access protocols.

Answer D is incorrect because Introducing an unsupported or absent agent is not a valid explanation for the current agentless failure.

Answer E is incorrect because Network automation modules can execute on the control node and therefore need a remote connection to operate on the target.

 

Question 24

A playbook reports success after applying an intended VLAN configuration to a switch. Which statement best describes what agentless architecture alone guarantees?

1. The playbook success proves every user application works end to end.
2. It does not by itself guarantee long-term desired state; persistence, drift detection, validation, and rerun behavior depend on the tool and workflow.
3. The switch’s YANG schema becomes immutable after an agentless change.
4. The switch now runs a resident orchestration daemon despite using an agentless workflow.
5. The configuration can never change again because agentless tools permanently lock managed resources.

Correct Answer: B

 

Correct Answer

Answer B is correct because Agentless describes how automation reaches and executes against targets, not a universal guarantee that configuration can never drift afterward.

Incorrect Answers

Answer A is incorrect because Configuration application success is narrower than service-level validation across dependent systems.

Answer C is incorrect because Automation execution does not freeze platform schemas or model revisions.

Answer D is incorrect because Agentless network automation specifically avoids requiring such a resident automation agent on the managed switch.

Answer E is incorrect because Remote execution does not prevent later manual, automated, or failure-driven configuration changes.

 

Question 25

A company has 200 remote sites. Sites may be disconnected for hours during maintenance. Some server workloads can run resident management agents, but network routers cannot. Which THREE observations should guide the orchestration design? Choose THREE.

1. Resident agents can support local execution on compatible servers during temporary loss of central reachability, subject to the product’s cached-policy behavior.
2. Agent-based systems eliminate all need for central credentials, certificates, or lifecycle management.
3. Routers that cannot host the required agent favor a supported agentless remote-management method when connectivity is available.
4. Agentless tools continue pushing configuration through a site even when no management path exists.
5. A single architecture must be forced on every endpoint even when platform support differs.
6. Agentless pushes to disconnected sites must be deferred or retried because the control node cannot reach the targets during the outage.

Correct Answers: A, C, F

 

Correct Answers

Answer A is correct because Local agent execution can reduce dependence on a live push session when required policy and runtime remain available on the server.

Answer C is correct because Endpoint runtime constraints can make agentless SSH/HTTPS-style management the practical option for network devices.

Answer F is correct because Remote execution depends on management reachability and therefore cannot complete while the site is unreachable.

Incorrect Answers

Answer B is incorrect because Resident agents still require trust, software maintenance, and secure communication with their management infrastructure.

Answer D is incorrect because Without a reachable remote transport, a central agentless push cannot execute on the isolated target devices.

Answer E is incorrect because The scenario explicitly presents different endpoint capabilities, so a mixed architecture can be more appropriate than forcing an unsupported model.