Cisco CCNP Enterprise 350-401 ENCOR NETCONF and RESTCONF Configuration and Verification Practice Test
Topic 14 covers netconf and restconf configuration and verification for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.
Question 1
A controller can SSH to an IOS XE router on TCP/22 with the same username used for automation, but a NETCONF client cannot open a NETCONF session. The router configuration contains no NETCONF-YANG enablement. What is the most direct correction?
Correct Answer: C
Correct Answer
Answer C is correct because ordinary SSH reachability does not by itself enable the NETCONF subsystem/service.
Incorrect Answers
Answer A is incorrect because packet capture may observe the failure but does not enable the missing service.
Answer B is incorrect because first-hop redundancy is unrelated to the NETCONF service.
Answer D is incorrect because routing may already be sufficient because SSH succeeds; the missing NETCONF service is explicit.
Answer E is incorrect because NETCONF on IOS XE is designed to use secure transport rather than solving missing service enablement with Telnet.
Question 2
NETCONF-YANG is enabled on a router, but the automation host cannot establish the SSH transport. A ping to the management address works and a service-level ACL permits the host. `show ip ssh` indicates SSH is disabled because RSA keys were never generated. What should be fixed first?
Correct Answer: A
Correct Answer
Answer A is correct because NETCONF depends on a working SSH transport; IP reachability and service ACL alone are insufficient.
Incorrect Answers
Answer B is incorrect because traffic mirroring is unrelated to the missing SSH service.
Answer C is incorrect because the session has not reached XML exchange yet.
Answer D is incorrect because a model revision does not enable SSH. It does not satisfy the stem’s governing point: NETCONF session troubleshooting should separate IP reachability, SSH transport, and NETCONF subsystem/service prerequisites.
Answer E is incorrect because that avoids rather than corrects the required NETCONF transport.
Question 3
An automation host opens an interactive SSH CLI session to a router successfully, but a NETCONF library reports that the NETCONF subsystem cannot be opened. Credentials and IP reachability are valid. Which interpretation is best?
Correct Answer: A
Correct Answer
Answer A is correct because generic CLI and NETCONF use the same secure transport but different application/subsystem behavior.
Incorrect Answers
Answer B is incorrect because that is not established by successful CLI SSH.
Answer C is incorrect because the SSH session already proves ordinary unicast reachability.
Answer D is incorrect because the application service can still be disabled or restricted.
Answer E is incorrect because the subsystem fails before any configuration RPC is processed.
Question 4
After opening a NETCONF session, the server sends a `<hello>` containing a set of capabilities. Why should the client inspect that list before choosing an operation?
Correct Answer: C
Correct Answer
Answer C is correct because capability negotiation lets a client tailor operations to supported behavior.
Incorrect Answers
Answer A is incorrect because they describe NETCONF/YANG support rather than forwarding counters.
Answer B is incorrect because the hello advertises features, not the complete device configuration.
Answer D is incorrect because advertisement indicates availability, not mandatory use. It does not satisfy the stem’s governing point: Use NETCONF capability exchange to determine supported operations/datastores/features before invoking optional behavior.
Answer E is incorrect because authentication occurs through the transport/AAA context; capability exchange does not grant identity.
Question 5
A script plans to edit the `candidate` datastore and commit it later. The NETCONF server hello does not advertise the `:candidate` capability. What is the safest action?
Correct Answer: E
Correct Answer
Answer E is correct because optional datastore behavior should be based on advertised capabilities.
Incorrect Answers
Answer A is incorrect because datastores have distinct semantics and cannot be substituted by name.
Answer B is incorrect because transport encryption does not control candidate support. It does not satisfy the stem’s governing point: Optional NETCONF datastores such as candidate must be advertised before a client relies on them.
Answer C is incorrect because candidate is an optional capability, not universally guaranteed.
Answer D is incorrect because SNMP cannot add a NETCONF protocol capability. It does not satisfy the stem’s governing point: Optional NETCONF datastores such as candidate must be advertised before a client relies on them.
Question 6
A client needs current interface operational counters without modifying the device. Which NETCONF intent is appropriate?
Correct Answer: A
Correct Answer
Answer A is correct because a read operation retrieves data without changing configuration.
Incorrect Answers
Answer B is incorrect because operational counters are not pending candidate configuration. It does not satisfy the stem’s governing point: Use NETCONF read RPCs/filters to retrieve operational data; do not use configuration RPCs for observation.
Answer C is incorrect because locking controls datastore access; it does not retrieve operational counters.
Answer D is incorrect because configuration editing is unnecessary and a blank edit does not express the intended data query.
Answer E is incorrect because session termination does not retrieve counters. It does not satisfy the stem’s governing point: Use NETCONF read RPCs/filters to retrieve operational data; do not use configuration RPCs for observation.
Question 7
A NETCONF client must change the description of one interface in the writable running datastore. Which RPC family is intended for this task?
Correct Answer: D
Correct Answer
Answer D is correct because edit-config is the standard configuration-edit operation. This directly matches the stem’s governing point: NETCONF configuration changes use `<edit-config>` against a supported writable datastore.
Incorrect Answers
Answer A is incorrect because hello negotiates capabilities rather than applying config. It does not satisfy the stem’s governing point: NETCONF configuration changes use `<edit-config>` against a supported writable datastore.
Answer B is incorrect because NETCONF RPCs are not RESTCONF HTTP methods. It does not satisfy the stem’s governing point: NETCONF configuration changes use `<edit-config>` against a supported writable datastore.
Answer C is incorrect because get-config retrieves configuration and does not apply changes.
Answer E is incorrect because closing the session does not edit configuration. It does not satisfy the stem’s governing point: NETCONF configuration changes use `<edit-config>` against a supported writable datastore.
Question 8
Two automation systems may edit the same datastore during a maintenance window. One workflow requires exclusive access while it prepares a coordinated set of changes. What NETCONF mechanism is designed for this concern when the server supports it?
Correct Answer: D
Correct Answer
Answer D is correct because locking can prevent conflicting NETCONF edits by other sessions while the transaction is prepared.
Incorrect Answers
Answer A is incorrect because path diagnostics do not serialize configuration transactions. It does not satisfy the stem’s governing point: NETCONF datastore locks can coordinate concurrent configuration clients when supported and used correctly.
Answer B is incorrect because mirroring cannot protect a configuration datastore. It does not satisfy the stem’s governing point: NETCONF datastore locks can coordinate concurrent configuration clients when supported and used correctly.
Answer C is incorrect because logging does not coordinate writers. It does not satisfy the stem’s governing point: NETCONF datastore locks can coordinate concurrent configuration clients when supported and used correctly.
Answer E is incorrect because transport flow control does not provide datastore write exclusivity.
Question 9
A NETCONF library successfully opens a session but the server immediately returns an XML framing/parsing error after the client sends a hand-built request with mismatched tags. Which layer should be corrected first?
Correct Answer: C
Correct Answer
Answer C is correct because the transport is established; malformed XML/framing prevents the server from parsing the RPC.
Incorrect Answers
Answer A is incorrect because Layer 2 topology is not the direct cause after session establishment.
Answer B is incorrect because synthetic probing does not repair malformed RPC syntax.
Answer D is incorrect because routing has already delivered the NETCONF session traffic.
Answer E is incorrect because SNMP credentials are unrelated to NETCONF XML parsing.
Question 10
A NETCONF client sends two RPCs asynchronously with message-id values 101 and 102. Replies arrive in the opposite order. How should the client associate them?
Correct Answer: B
Correct Answer
Answer B is correct because message-id exists so clients can correlate replies with requests, including out-of-order completion.
Incorrect Answers
Answer A is incorrect because arrival order is not a safe correlation key for concurrent RPCs.
Answer C is incorrect because transport sequence numbers are not the NETCONF application correlation mechanism.
Answer D is incorrect because hostname does not distinguish concurrent requests in one session.
Answer E is incorrect because out-of-order replies can be correlated correctly with identifiers.
Question 11
A NETCONF `<edit-config>` returns success. The change is critical and the operator wants to verify the device now exposes the intended modeled value. What should follow?
Correct Answer: D
Correct Answer
Answer D is correct because a read-back verifies the resulting modeled state rather than relying solely on RPC acceptance.
Incorrect Answers
Answer A is incorrect because later validation can catch normalization, interaction or unintended target mistakes.
Answer B is incorrect because closing adds no evidence about resulting state. It does not satisfy the stem’s governing point: Verify important changes by reading back the relevant modeled state/configuration after the edit.
Answer C is incorrect because deleting evidence does not verify configuration. It does not satisfy the stem’s governing point: Verify important changes by reading back the relevant modeled state/configuration after the edit.
Answer E is incorrect because that does not inspect the changed modeled value.
Question 12
A NETCONF reply contains `<rpc-error>` with an error-tag indicating `access-denied`. IP/SSH connection and authentication succeeded. What is the best interpretation?
Correct Answer: E
Correct Answer
Answer E is correct because access-denied is an application authorization result, distinct from connectivity failure.
Incorrect Answers
Answer A is incorrect because it parsed enough of the RPC to return a NETCONF error response.
Answer B is incorrect because malformed content would use different error semantics; access-denied specifically points to authorization.
Answer C is incorrect because the established session/reply contradicts a total path outage.
Answer D is incorrect because the client received an RPC reply, proving return communication at that time.
Question 13
A script targets `<candidate>` and receives an error that the datastore is unsupported. A different script editing `<running>` works under the same account. What is the strongest conclusion?
Correct Answer: E
Correct Answer
Answer E is correct because the same credentials succeed against another supported datastore, isolating the feature/datastore mismatch.
Incorrect Answers
Answer A is incorrect because SNMP does not enable datastores. It does not satisfy the stem’s governing point: Use server capabilities/errors to distinguish unsupported datastore behavior from authorization and transport problems.
Answer B is incorrect because the server returned an application error. It does not satisfy the stem’s governing point: Use server capabilities/errors to distinguish unsupported datastore behavior from authorization and transport problems.
Answer C is incorrect because successful running-datastore NETCONF edits disprove that claim. It does not satisfy the stem’s governing point: Use server capabilities/errors to distinguish unsupported datastore behavior from authorization and transport problems.
Answer D is incorrect because the other script succeeds with it. It does not satisfy the stem’s governing point: Use server capabilities/errors to distinguish unsupported datastore behavior from authorization and transport problems.
Question 14
A NETCONF filter uses the wrong XML namespace for the interface model. The RPC is syntactically valid but returns no matching interface data. What should be checked?
Correct Answer: B
Correct Answer
Answer B is correct because YANG-modeled XML is namespace-sensitive; the wrong namespace can select nothing.
Incorrect Answers
Answer A is incorrect because Layer 2 election does not change XML namespaces.
Answer C is incorrect because flow telemetry is unrelated. It does not satisfy the stem’s governing point: YANG-modeled NETCONF filters must use the correct model namespaces and schema paths.
Answer D is incorrect because logging metadata does not determine NETCONF model selection.
Answer E is incorrect because gateway redundancy is unrelated to XML model namespaces.
Question 15
A NETCONF client gets a successful SSH connection and `<hello>`, then an `<rpc-error>` on a configuration edit. Which statement best separates the evidence?
Correct Answer: D
Correct Answer
Answer D is correct because the failure occurs after session establishment and should be investigated at the transaction layer.
Incorrect Answers
Answer A is incorrect because the error response itself is the first evidence to inspect.
Answer B is incorrect because the server is reachable and replying. It does not satisfy the stem’s governing point: Separate NETCONF connection success from transaction success; inspect `rpc-error` details for the failed operation.
Answer C is incorrect because rpc-error exists specifically for operation failures. It does not satisfy the stem’s governing point: Separate NETCONF connection success from transaction success; inspect `rpc-error` details for the failed operation.
Answer E is incorrect because the failure is an application reply, not a transport timeout.
Question 16
A RESTCONF client can ping an IOS XE device, but HTTPS requests to the RESTCONF root are refused. The configuration has `restconf` but HTTPS server services are disabled. What must be enabled?
Correct Answer: B
Correct Answer
Answer B is correct because RESTCONF is HTTP-based and depends on the IOS HTTP services described by the platform documentation.
Incorrect Answers
Answer A is incorrect because multicast routing is unrelated to RESTCONF HTTPS service availability.
Answer C is incorrect because synthetic measurement is unrelated. It does not satisfy the stem’s governing point: RESTCONF requires its HTTP/HTTPS service prerequisites in addition to RESTCONF configuration.
Answer D is incorrect because packet mirroring does not host the API. It does not satisfy the stem’s governing point: RESTCONF requires its HTTP/HTTPS service prerequisites in addition to RESTCONF configuration.
Answer E is incorrect because routing feature selection does not enable the web service.
Question 17
A RESTCONF GET to an interface resource returns `404 Not Found`. Authentication works, and a GET to the RESTCONF root succeeds. The client URL uses a path from an old, different YANG module. What should be corrected?
Correct Answer: D
Correct Answer
Answer D is correct because RESTCONF resource paths map to YANG-modeled data; a wrong model path can identify no resource.
Incorrect Answers
Answer A is incorrect because routing policy does not correct the API resource URI.
Answer B is incorrect because transport security is not the cause of a model-path 404 after root access works.
Answer C is incorrect because SNMP is not required for RESTCONF YANG paths.
Answer E is incorrect because ping cannot retrieve modeled API data. It does not satisfy the stem’s governing point: RESTCONF URLs address YANG-modeled resources; use the model and path actually supported by the device.
Question 18
An automation host gets TCP connection refused when it accesses the device RESTCONF HTTPS port. A different host can use RESTCONF successfully, and a service-level ACL permits only that different host. What is the most relevant check?
Correct Answer: A
Correct Answer
Answer A is correct because a service ACL can block RESTCONF access for one source while the service works for another.
Incorrect Answers
Answer B is incorrect because the TCP/API access is blocked before payload parsing.
Answer C is incorrect because spanning-tree is unrelated to source-specific API filtering. It does not satisfy the stem’s governing point: RESTCONF reachability can be restricted by service-level ACLs independently of the service being up for other clients.
Answer D is incorrect because description text does not normally authorize the service.
Answer E is incorrect because telemetry aging does not control RESTCONF access. It does not satisfy the stem’s governing point: RESTCONF reachability can be restricted by service-level ACLs independently of the service being up for other clients.
Question 19
A RESTCONF client sends a configuration update with `Content-Type: text/plain` containing JSON text. The server rejects the request as unsupported media. What should the client do?
Correct Answer: C
Correct Answer
Answer C is correct because RESTCONF uses structured YANG payload media types rather than arbitrary text/plain.
Incorrect Answers
Answer A is incorrect because that would switch to SNMP rather than correct the API request.
Answer B is incorrect because the server needs correct content negotiation/typing, not less information.
Answer D is incorrect because encoding text does not make the media type a valid RESTCONF YANG payload.
Answer E is incorrect because packet mirroring does not alter API media semantics.
Question 20
A script attempts an HTTP PATCH against a RESTCONF resource that the platform exposes as operational read-only state. GET succeeds but the write is rejected. What is the correct interpretation?
Correct Answer: D
Correct Answer
Answer D is correct because YANG schema access properties distinguish configuration data from state data.
Incorrect Answers
Answer A is incorrect because HTTP read support does not make a data node writable.
Answer B is incorrect because the protocol respects model semantics. It does not satisfy the stem’s governing point: RESTCONF operations are constrained by YANG model semantics; operational/read-only nodes cannot be configured merely because they can be read.
Answer C is incorrect because SNMP version does not make a RESTCONF node writable.
Answer E is incorrect because ICMP is unrelated to node writability. It does not satisfy the stem’s governing point: RESTCONF operations are constrained by YANG model semantics; operational/read-only nodes cannot be configured merely because they can be read.
Question 21
A script must retrieve a YANG-modeled interface resource without changing it. Which HTTP method is the natural RESTCONF choice?
Correct Answer: C
Correct Answer
Answer C is correct because GET retrieves a resource representation without requesting a configuration change.
Incorrect Answers
Answer A is incorrect because POST is commonly used to create/invoke depending on resource semantics, not simple retrieval.
Answer B is incorrect because DELETE removes a resource when permitted. It does not satisfy the stem’s governing point: Use HTTP GET to retrieve RESTCONF resource data.
Answer D is incorrect because PATCH modifies part of a resource when supported.
Answer E is incorrect because PUT is used to create/replace a target resource representation depending on semantics.
Question 22
An automation workflow needs to modify only one leaf in an existing writable RESTCONF resource while preserving unspecified siblings. Which operation best expresses a partial update when supported?
Correct Answer: E
Correct Answer
Answer E is correct because PATCH is intended for partial modification rather than replacing the whole resource.
Incorrect Answers
Answer A is incorrect because that removes the resource rather than changing one leaf.
Answer B is incorrect because GET is retrieval, not a write. It does not satisfy the stem’s governing point: Use a supported partial-update method such as PATCH when the requirement is to change selected data without replacing the whole resource.
Answer C is incorrect because TRACE is not the RESTCONF configuration method for this task.
Answer D is incorrect because HEAD does not apply configuration. It does not satisfy the stem’s governing point: Use a supported partial-update method such as PATCH when the requirement is to change selected data without replacing the whole resource.
Question 23
A RESTCONF workflow needs to create a new child list entry under a parent collection, and the API/model supports creation with POST at that parent. Which sequence is best?
Correct Answer: C
Correct Answer
Answer C is correct because the creation target and modeled payload should follow the resource/model semantics and be read back afterward.
Incorrect Answers
Answer A is incorrect because packet mirroring is unrelated to API creation. It does not satisfy the stem’s governing point: RESTCONF resource creation should target the model-defined parent/resource with the supported HTTP method and be verified after success.
Answer B is incorrect because logging does not configure RESTCONF resources. It does not satisfy the stem’s governing point: RESTCONF resource creation should target the model-defined parent/resource with the supported HTTP method and be verified after success.
Answer D is incorrect because that is destructive and contrary to the requirement.
Answer E is incorrect because retrieval does not create resources. It does not satisfy the stem’s governing point: RESTCONF resource creation should target the model-defined parent/resource with the supported HTTP method and be verified after success.
Question 24
A RESTCONF DELETE returns a successful status for a configurable list entry. Before reporting completion, what is a good verification step?
Correct Answer: C
Correct Answer
Answer C is correct because read-back verifies the resulting state and limits accidental over-deletion.
Incorrect Answers
Answer A is incorrect because the returned status is useful but state verification is stronger for critical changes.
Answer B is incorrect because source identity does not verify the deletion result.
Answer D is incorrect because that removes evidence rather than verifying state. It does not satisfy the stem’s governing point: After important RESTCONF writes/deletes, verify resulting modeled state with a read operation.
Answer E is incorrect because a service restart is not needed for ordinary verification.
Question 25
A RESTCONF PUT uses a JSON object whose hierarchy omits the YANG module container required at the target resource. The server returns a schema/data error. What should be corrected?
Correct Answer: A
Correct Answer
Answer A is correct because RESTCONF structured data must conform to the model expected at the URI.
Incorrect Answers
Answer B is incorrect because notifications do not correct RESTCONF payload schema. It does not satisfy the stem’s governing point: RESTCONF payloads must conform to the YANG schema and the hierarchy expected at the addressed resource.
Answer C is incorrect because schema errors point to modeled content, not necessarily transport fragmentation.
Answer D is incorrect because YANG node names are not derived from the hostname.
Answer E is incorrect because RESTCONF expects structured modeled data, not arbitrary CLI text.
Popular posts
Recent Posts
