200-301 CCNA · Cisco · Automation and Programmability · Bank updated 2026-09-20
200-301 CCNA practice questions: Automation and Programmability
5 free questions from 7 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Automation and Programmability section of our 200-301 CCNA bank (7 questions on this area, which carries 10% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
1/5 · Automation and Programmability
An operations team has to add one VLAN and one matching access list to 400 access switches. Until now every change was typed into a console session per device. The team now keeps the change in a file that an automation tool renders and applies to all 400 switches from one control host. Which statement about that tool is accurate?
ADevices are changed one at a time inside one transaction, and a failure part-way rolls the estate back.
BEach switch keeps a copy of the file and re-applies it after a reload, reverting console changes.
CRunning the same file again reports which switches no longer match it, as well as changing them.
DThe tool derives the access list from the VLAN it is given, leaving the engineer just the VLAN to state.
Show answer & explanation
C is correct. Topic 6.1. Automation moves the unit of work from a device to a definition: the same rendered configuration reaches every target from one control host, so the differences that accumulate when 400 devices are edited by hand largely disappear, and because the file states what the devices are meant to look like, re-running it is at the same time a correction and a compliance report. What does not come with it is atomicity or self-healing on the device: a run iterates and reports per-device results, an unreachable switch fails its own task rather than blocking the rest, and nothing on the switch re-applies the definition by itself after a reload. Cisco frames the same idea for controller-based operations, describing intent APIs that provide policy-based abstraction of business intent, allowing an operator to focus on an outcome to achieve instead of struggling with the mechanisms that implement that outcome. What never changes is the engineer's responsibility for the content of the change.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 6: Automation and Programmability
2/5 · Automation and Programmability
A campus that used to be managed device by device through the CLI now runs under Cisco Catalyst Center. The controller appliance has to be taken out of service for four hours for an upgrade, and the change board asks the network team to name, in one line, what the campus loses while it is down. Which function stops for those four hours?
ACollection of assurance and telemetry data from the campus devices
BEnforcement of the group-based policy on the fabric switches and routers
CAuthentication of wired clients by 802.1X against the campus ISE servers
DAdvertisement of the campus SSIDs by the wireless access points on site
Show answer & explanation
A is correct. Topic 6.2. The difference between a traditional network and a controller-based one is where configuration and policy are authored, not where packets are forwarded or where the protocols run. Cisco states the boundary directly: while Catalyst Center is not part of the SD-Access data plane or control plane, its availability directly affects how the fabric is provisioned, maintained and operated; and a Catalyst Center outage does not impact wired and wireless traffic forwarding, but it does affect all management plane functions, including fabric provisioning and automation, device onboarding, lifecycle management and Plug-and-Play, software image management, templates and compliance checks, as well as assurance and telemetry and the deployment of policy changes. For a change board the window is therefore a freeze on change and on visibility, not an outage: the campus keeps forwarding, keeps authenticating and keeps applying what it already holds, but nobody can see how well it is doing so.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 6: Automation and Programmability
3/5 · Automation and Programmability
In a software-defined architecture the control plane, which decides where traffic should go, is described as separated from the data plane, which moves the packets. A network engineer who has only ever run protocols on the devices themselves asks what that separation actually changes in the way the network works. Which statement describes it?
AEach packet is sent to the controller for inspection and comes back with a forwarding decision.
BThe forwarding tables are computed centrally and programmed into the devices ahead of the traffic.
CThe devices stop holding forwarding tables, and the controller rewrites each header on their behalf.
DThe control-plane protocols are moved onto a dedicated out-of-band management network.
Show answer & explanation
B is correct. Topic 6.3.a. The control plane is the set of processes that decide where traffic should go and build the tables used for forwarding; the data plane, or forwarding plane, moves the packets using those tables. Separating them does not put a controller in the packet path: it moves the computation of the tables to a central place and pushes the result into the devices before the traffic arrives, so the hardware keeps forwarding at line rate and keeps doing so if the path to the controller is lost. In Cisco SD-Access the separation is visible in the roles: the control plane node is based on LISP map-server and map-resolver functionality and tracks all endpoints in the fabric, associating each with the routing locator of a fabric edge node, while VXLAN encapsulation carries the actual data packets in the overlay. Endpoints and their subnets belong to the overlay, not to the underlay, which is the routed transport the fabric runs on top of.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 6: Automation and Programmability
4/5 · Automation and Programmability
A ticketing application asks the network controller over HTTPS for the list of managed devices and receives a JSON document. Separately, the controller pushes the resulting configuration to the switches it manages. Which statement maps these two exchanges to the correct interfaces?
ABoth exchanges use the northbound interface, both of them starting at the controller itself.
BThe application-to-controller exchange is southbound, and the controller-to-device one is northbound.
CBoth exchanges use the southbound interface, the controller being client in one and server in the other.
DThe application-to-controller exchange is northbound and the controller-to-device one is southbound.
Show answer & explanation
D is correct. Topic 6.3.b. Cisco states that the intent API is a northbound REST API that exposes specific capabilities of the controller platform and that the RESTful intent API uses HTTPS verbs (GET, POST, PUT and DELETE) with JSON structures to discover and control the network. On the other side, a device package enables the controller to communicate with a device by encapsulating the southbound protocol used to communicate with it. The simple rule that survives the exam room: applications and orchestration systems live above the controller and talk to it northbound; switches, routers and access points live below it and are reached southbound.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 6: Automation and Programmability
5/5 · Automation and Programmability
A team keeps the definition below in the same repository as the rest of its runbooks and wants to apply it to switches that are already carrying production traffic.
- name: Add the guest VLAN
hosts: access_switches
gather_facts: no
tasks:
- name: Create VLAN 40
cisco.ios.ios_vlans:
config:
- vlan_id: 40
name: GUEST
state: merged
Which tool consumes a definition written in this form, and how does it reach the switches?
AAnsible, run from an agent installed on each switch that pulls the definition on a schedule.
BAnsible, run from a control node that reaches each switch over SSH with existing credentials.
CTerraform, run from a control node that reaches each switch over SSH with existing credentials.
DTerraform, run from a provider plugin installed on each switch and reconciled to a state file.
Show answer & explanation
B is correct. Topic 6.6. The definition is an Ansible playbook: a list of plays in YAML, each with hosts and a list of tasks, where each task calls a module such as cisco.ios.ios_vlans with its own arguments. Ansible's documentation stresses low maintenance overhead by avoiding the installation of additional software across the infrastructure, and its network guide states that network modules do not run on the managed nodes but are executed on the Ansible control node, with CLI over SSH as the most common protocol, selected through the ansible_connection variable. Idempotency belongs to the same picture: when the system is already in the state the playbook describes, Ansible does not change anything however often the playbook runs, which is what state: merged expresses here. Terraform is centrally run and agentless too, but it differs on both points this item asks about: its declarative files are written in HCL, and it reaches platforms through provider plugins that call their APIs while keeping a state file as the source of truth.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 6: Automation and Programmability
Other 200-301 CCNA areas
The same kind of free sample for every other section of the 200-301 CCNA bank:
Study Automation and Programmability with instant feedback
6 free questions · filter study mode by area and difficulty · error log with spaced repetition · no card, no dumps, no ads.
Create your free account →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by Cisco. 200-301 CCNA and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official Cisco materials (as of September 2026); always confirm current details with the vendor before booking.