Free 300-435 practice test: 30 questions with answers

Controller tokens are time-limited, so an expired token returns 401 and the script must request a new one. Blocked GET requests, a closed port or switching to SNMP do not explain a pattern where early calls succeed and later calls fail with 401.

The for loop repeats a block once per list item, which is what one VLAN block per entry needs. An if block renders conditionally, set assigns a variable, and default is a filter that supplies a fallback rather than repeating output.

The default filter returns the supplied string when a variable is undefined, so the template prints no-description. upper, trim and int change or convert a value that exists, and they do not supply a fallback for an undefined variable.

A collection bundles modules, plugins and roles and is the standard way vendor content for controllers is distributed. Inventory lists targets, handlers run after notifications, and vault encrypts secrets, so none of them packages vendor content.

Scalable Group Tags in Cisco TrustSec label endpoints by group, so policy follows the identity regardless of IP address or port. VLANs and IP-based access lists tie policy to location or addressing, and port security limits MAC addresses rather than identifying groups.

Comparing running configuration with an approved template to find drift is configuration compliance checking. Day-0 provisioning, telemetry and image management are different activities that cover device onboarding, monitoring and the software lifecycle.

send_config_set handles entering configuration mode, sending each line and exiting, so the script needs no custom prompt handling. send_command is for exec-mode commands, write_channel sends raw characters, and find_prompt only returns the prompt.

The NETCONF lock operation, defined in RFC 6241, gives one session exclusive write access to a datastore so other sessions cannot change it. get-config only reads, commit applies a candidate configuration, and discard-changes removes uncommitted candidate edits.

RFC 8040 defines application/yang-data+json for JSON-encoded YANG data and application/yang-data+xml for XML. The other media types describe web pages or unstructured text and do not identify YANG-modeled content.

Idempotence means a module checks current state and changes only what differs, so repeated runs are safe. Agentless operation, ad hoc commands and forks describe how Ansible connects or runs, not whether a repeated run changes anything.

Zero-touch provisioning lets a device with factory defaults obtain its initial configuration on first boot, which matches the need. Manual console pasting requires staff with console access, a nightly backup runs only after configuration exists, and SNMP write access does not supply a starting configuration.

HTTP 401 means the server could not authenticate the request, so missing or incorrect credentials are the likely cause. An unknown leaf or malformed body usually returns 400 Bad Request, and an unsupported verb usually returns 405 Method Not Allowed.

Post-change validation calls the platform API after a change to confirm that operational state matches what was intended, and it can stop the pipeline when it does not. Day-0 provisioning, webhook registration and telemetry dial-in each serve a different purpose in the lifecycle.

Dial-out telemetry has the router initiate the session and push data, which suits a collector that cannot reach the device. Dial-in reverses the connection direction, SNMP polling is request-response, and syslog carries log messages rather than model-driven telemetry.

On-change subscriptions send updates only when a monitored value changes, which reduces traffic. Periodic subscriptions send at a sample interval, a trap-style alarm is not a model-driven telemetry subscription type, and polling is request-driven rather than a subscription.

A webhook pushes an HTTP POST to a receiver when the event happens, so the operations server does not need to poll. An hourly CSV export, an SNMP polling loop and a manual email digest all depend on the operations server or an engineer pulling information on a schedule.

Centralized software image management tracks the image on each device and lets operators plan and stage upgrades from one place. Simulation, webhooks and access policy address different needs and do not provide a version inventory with upgrade staging.

A simulated copy of the topology, such as a digital twin or modeling lab, lets the team observe the change without affecting users. Testing on a production switch, checking a spreadsheet or relying on emailed approval does not test the routing behavior in a safe copy.

Prompt injection happens when untrusted content such as a ticket tells the model to act against its instructions, which is what happened here. Certificate failures, brute-force logins and denial of service are different attacks that do not rely on hidden instructions in the agent's input.

AI-generated code can contain invented API calls or flawed logic, so it needs review, checks against vendor documentation and lab testing. Running it directly, sharing credentials with the assistant or skipping review all increase risk without verifying correctness.

Assurance platforms use AI to learn normal behavior, flag anomalies and suggest probable causes, and operators still validate the findings. Storing shared credentials, replacing device configuration and disabling access control are unsafe and are not functions of AI assurance.

Least privilege, human approval and audit logging limit what a mistaken or compromised agent can do. Storing keys in a repository exposes secrets, and unrestricted command access removes the controls that keep automated actions safe.

AI assistants can invent plausible API names, so the call must be checked against the library's documentation and tested before it touches devices. Trusting confidence, deleting error handling or upgrading blindly does not verify the call.

AI recommendations should be reviewed against the evidence and approved through change control before they reach production. Applying everything automatically, ignoring recommendations outright or relying on vendor statements removes the human check the process needs.

Native models are written by one vendor for its own platform, so they expose platform-specific features that standard models may not yet cover. IETF and OpenConfig models are vendor-neutral and cover common features, and SNMP MIBs are not YANG models.

NETCONF runs over SSH, by default on port 830, and provides datastore operations such as lock and edit-config. RESTCONF uses HTTPS and HTTP methods, SNMP uses MIBs, and gNMI uses gRPC, so none of them matches the SSH, XML and lock requirements.

RESTCONF, defined in RFC 8040, maps YANG data to HTTP resources and supports JSON and XML encodings. The SSH session, candidate datastore and port 830 details belong to NETCONF, which is defined in RFC 6241.

In RFC 8340 tree diagrams, rw means config true, so the node is configuration that can be written, and ro means config false, so it is state that can only be read. Swapping these meanings, or using rw and ro for notifications and RPCs, misreads the diagram.

pyang is a YANG compiler and validator that can output tree diagrams and sample XML skeletons, which helps build payloads. Netmiko sends CLI over SSH, Ansible Vault encrypts secrets, and EEM runs on-box actions, so none of them generates payload skeletons from models.

RFC 7951 requires the top-level member and any member from a different module than its parent to be prefixed with the module name, while other members stay unqualified. Qualifying every member is not required, and list keys and headers do not determine the prefix rule.