Cisco 300-435: Automating and Programming Cisco Enterprise Solutions (ENAUTO) v2.0

Last checked November 10, 2026 against the official Cisco exam page.

1. Question 1Controller-Based Network Automation

   A Python script authenticates to a controller REST API with a username and password, receives a token, and sends that token with each later request. The first calls succeed, but after a while every call returns HTTP 401. Which cause is most likely?

   1. AThe token has expired, so the script must request a new token before it continues
   2. BThe northbound API port has closed, so the controller stopped listening for new requests
   3. CThe script must switch to SNMP, because REST tokens are only valid for read operations
   4. DThe controller now blocks all GET requests from scripts, so only POST calls are accepted
   Show answer and explanationHide answer

   Correct answer: A

   Controller tokens are time-limited, so an expired token returns 401 and the script must request a new one. Blocked GET requests, a closed port or switching to SNMP do not explain a pattern where early calls succeed and later calls fail with 401.

2. Question 2Device-Level Network Automation

   A Python script must push a list of configuration lines to 20 IOS XE routers over SSH with Netmiko. It must enter configuration mode, send each line and leave configuration mode without custom prompt handling. Which Netmiko method fits?

   1. Asend_config_set, which enters configuration mode, sends each line and then exits configuration mode
   2. Bwrite_channel, which sends raw characters to the session and leaves prompt handling to the script
   3. Cfind_prompt, which returns the current device prompt string so the script can compare it
   4. Dsend_command, which runs one exec-mode command on the device and returns its output text
   Show answer and explanationHide answer

   Correct answer: A

   send_config_set handles entering configuration mode, sending each line and exiting, so the script needs no custom prompt handling. send_command is for exec-mode commands, write_channel sends raw characters, and find_prompt only returns the prompt.

3. Question 3Operations

   An automation pipeline changes an access switch, then calls a platform API to read the operational state of the same interfaces. The pipeline fails the change if any interface is not up as expected. What is this step?

   1. APost-change validation through a platform API, which confirms the device matches its intent
   2. BWebhook registration, which tells an external system whenever a configuration change is made to a device
   3. CDay-0 provisioning, which loads the first configuration onto a device that has none
   4. DModel-driven telemetry dial-in, which pulls interface counters from the device on demand
   Show answer and explanationHide answer

   Correct answer: A

   Post-change validation calls the platform API after a change to confirm that operational state matches what was intended, and it can stop the pipeline when it does not. Day-0 provisioning, webhook registration and telemetry dial-in each serve a different purpose in the lifecycle.

4. Question 4AI in Automation

   An AI agent reads change tickets and can run approved CLI commands on routers. A ticket contains hidden text that tells the agent to disable an access list, and the agent follows it. Which security risk does this describe?

   1. ACertificate validation failure, where the agent cannot verify the router's TLS identity
   2. BBrute-force login, where the agent repeatedly guesses passwords for router accounts
   3. CDenial of service, where the agent floods the controller with more requests than it can handle
   4. DPrompt injection, where untrusted text in the input overrides the agent's intended instructions
   Show answer and explanationHide answer

   Correct answer: D

   Prompt injection happens when untrusted content such as a ticket tells the model to act against its instructions, which is what happened here. Certificate failures, brute-force logins and denial of service are different attacks that do not rely on hidden instructions in the agent's input.

5. Question 5Network Automation Foundation

   A network engineer needs interface state from a router that exposes a feature no standard model covers yet. Which kind of YANG model should the engineer use for that feature?

   1. AIETF standard models, which are defined by the IETF and aimed at vendor-neutral use
   2. BOpenConfig models, which are developed by network operators and aimed at multi-vendor use
   3. CGeneric SNMP MIB objects, which are compiled into the device image and polled by managers
   4. DNative vendor models, which are written for one platform and cover its full feature set
   Show answer and explanationHide answer

   Correct answer: D

   Native models are written by one vendor for its own platform, so they expose platform-specific features that standard models may not yet cover. IETF and OpenConfig models are vendor-neutral and cover common features, and SNMP MIBs are not YANG models.