The controller stack, top to bottom
Box by box, or through a controller
| Point of comparison | Traditional | Controller-based |
|---|---|---|
| How a change is made | A CLI session on each device | Policy entered once and rendered per device by the controller |
| Unit of change | One device | A site, a group of devices or a whole fabric |
| Source of truth | Each device’s running configuration | The controller’s database |
| Drift detection | People comparing configurations after the fact | The controller compares intended and actual state |
| What tools talk to | CLI output and SNMP, parsed device by device | Documented APIs that return structured data |
Reading a REST exchange
| Code or auth type | Meaning | Example |
|---|---|---|
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection: the resource is elsewhere | 301 Moved Permanently |
| 4xx | Client error: fix the request | 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found |
| 5xx | Server error: the API side failed | 500 Internal Server Error, 503 Service Unavailable |
| Basic auth | Username and password, Base64-encoded in a header, so safe only inside TLS | Authorization: Basic … |
| Bearer token | A token obtained once, then sent with every call until it expires | Authorization: Bearer … |
| API key | A static key issued by the service | A custom header or a query parameter |
Status codes per RFC 9110, Basic per RFC 7617, Bearer per RFC 6750. REST calls ride HTTPS on TCP 443, so the transport behavior underneath is the TCP covered in network components, cabling and TCP/UDP. Topic 6.5 also pairs each CRUD operation with an HTTP verb and asks which verbs change state; drill that pairing in the frames below until you can name the verb from the action.
Tools and terms the topics name
- Ansible
- Agentless: connects to each device over SSH or an API and pushes changes, with the work described in YAML (Ansible documentation). Named in v1.1 topic 6.6; v2.0 topic 5.5 asks you to use it to run commands.
- Terraform
- Declarative infrastructure as code written in HashiCorp Configuration Language (HCL). It keeps a state file and shows a plan before it applies changes (Terraform docs). Named in v1.1 topic 6.6 only.
- Infrastructure as code (IaC)
- Configuration kept as versioned text files and applied by a tool. v2.0 topic 5.3 lists it among network management approaches.
- Underlay
- The physical IP network that gives every fabric node reachability.
- Fabric
- Underlay and overlay managed together as one system, typically by a controller.
Planes, tools and AI: where each topic leads
Topic 6.3 separates the control plane from the data plane and puts a management plane beside them; which job sits where, and what moves when a controller arrives, is mapped on control plane vs data plane. Topic 6.6 pairs two configuration tools with different models, push-based and agentless against declarative with a state file, compared in detail on Ansible vs Terraform.
Topic 6.4 asks you to explain where generative models, machine learning and prediction fit into network operations. Read the frames for the kind of output each family produces, and keep one rule in view across both: anything a model proposes is a suggestion an engineer verifies before it reaches a production device.
Where this lands in v2.0
In the v2.0 topics (version dates), this material moves into Domain 5.0, AI, and Network Operations and Management, at 10%. Its topics cover agentic AI in operations (5.1), choosing a generative-AI prompt by its parts, namely data classification, output format, persona and instructions (5.2), management approaches including IaC (5.3) and using Ansible to run commands (5.5). REST, JSON and the SDN items leave the list, and so does Terraform. Cisco’s exam description adds that candidates may have to judge the output and recommendations of AI agents and network assistants.
Data classification is the security habit inside the prompt topic: decide which device data, such as configurations holding secrets, may go into a prompt before you write it.
Automation frames
Vocabulary carries this set: one misread acronym or verb turns a right idea into a wrong option. For a mixed run that includes this area, use the practice test filtered to automation and APIs.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 018 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 018
Which statement best describes the application of JSON in network automation?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: JSON is a text format for objects and arrays, so a controller, a script and a device can exchange data in a form all of them parse.
Note on B
JSON is plain text; any encryption comes from TLS or another protocol carrying it.
Note on C
Integrity checks use hashes or signatures; JSON only structures data.
Note on D
JSON is a data format, not a database index or query engine.
Best answer: A · why
JSON (JavaScript Object Notation, RFC 8259) is a lightweight text format of objects in braces, arrays in brackets and key-value pairs. REST APIs on controllers and devices return and accept JSON, so scripts and tools can read and send configuration and state. Security comes from HTTPS, not from JSON.
- Frame 002 of 018
How does the separation of the control plane and data plane in a controller-based network automation architecture improve network management?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Decentralized intelligence is the traditional model, where every device runs its own control plane.
Note on B
Correct: the controller holds the control logic and pushes policy, so changes are made once instead of box by box.
Note on C
Per-device policy processing is what controller-based designs remove.
Note on D
Centralizing control reduces manual per-device configuration rather than increasing it.
Best answer: B · why
In controller-based networking, a central controller takes over much of the control and management work: it holds the network view, computes policy and programs devices through southbound APIs, while the devices keep forwarding in the data plane. Admins and scripts use northbound APIs, so a policy is defined once and applied everywhere.
- Frame 003 of 018
What is the primary benefit of generative AI in network operations?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
AI tools work with data and text; installing hardware still needs people.
Note on B
Earning revenue is not an operational function of generative AI in the network.
Note on C
Correct: generative models produce new text such as configs, scripts and documentation, which an engineer then reviews.
Note on D
Generated output can be wrong, so engineers still check and approve changes.
Best answer: C · why
Generative AI produces new content from a prompt: draft configurations, automation scripts, documentation or troubleshooting summaries. In network operations this speeds up routine work, but the output must be reviewed and tested before it reaches devices. Predictive AI, by contrast, forecasts issues from telemetry.
- Frame 004 of 018
Which protocol is primarily used for automating the configuration of network devices?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
TFTP only copies files such as images and configs, with no structured configuration model.
Note on B
HTTPS is a transport; RESTCONF runs over it, but HTTPS alone does not define device configuration.
Note on C
SSH gives secure CLI access and carries NETCONF, but by itself it is a session protocol, not a configuration API.
Note on D
Correct: NETCONF reads and edits device configuration as structured XML based on YANG models, usually over SSH port 830.
Best answer: D · why
NETCONF (RFC 6241) is built for programmatic configuration: it uses XML-encoded operations such as get-config and edit-config, YANG data models, and runs over SSH on TCP 830. RESTCONF offers similar access over HTTPS with JSON or XML. TFTP, HTTPS and SSH are transports, not configuration protocols.
- Frame 005 of 018
How can predictive AI algorithms improve automated network management in controller-based architectures?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Predictive models cover performance as well as security, such as link or capacity trends.
Note on B
Prediction depends on historical data; without it there is nothing to learn patterns from.
Note on C
Correct: models trained on historical and live telemetry spot trends that lead to failures, so teams act before users are hit.
Note on D
Predictive analytics usually runs centrally on the controller or in the cloud, not as isolated device actions.
Best answer: C · why
Predictive AI and machine learning learn normal patterns from historical and live telemetry (interface errors, utilization, latency, client health) and flag trends that usually lead to problems, such as a link heading toward saturation. In a controller-based network the controller can then alert or suggest a fix before users notice.
- Frame 006 of 018
Which of the following shows the correct XML object format?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The last element has no tags, so ‘Puffy > fish’ is stray text and the document is not well formed.
Note on B
Dollar signs, colons and braces are not XML syntax, and the tags are never closed.
Note on C
Correct: every element has a matching start and end tag, and all three are nested inside the Pets root element.
Note on D
Square brackets and commas are JSON-style syntax, and the Whiskers element is never closed.
Best answer: C · why
Well-formed XML has one root element, every element opened and closed with matching tags, proper nesting and no stray separators. A Pets root element holding Max, Whiskers and Puffy, each with its own closing tag, meets those rules. Brackets and commas belong to JSON, and a missing closing tag breaks XML.
- Frame 007 of 018
In a JSON-encoded data structure, what symbol is used to denote an object?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Parentheses are not part of JSON syntax at all.
Note on B
Correct: curly braces enclose a JSON object, a set of key-value pairs such as {“hostname”: “R1”}.
Note on C
Square brackets mark an array, an ordered list of values, not an object.
Note on D
Angle brackets belong to XML tags, not JSON.
Best answer: B · why
JSON has two containers: an object in curly braces, holding comma-separated “key”: value pairs, and an array in square brackets, holding an ordered list. Keys are double-quoted strings, and values can be strings, numbers, true, false, null, objects or arrays.
- Frame 008 of 018
Which of the following is a valid JSON format for an API response?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The keys are not in double quotes, which JSON requires for every key.
Note on B
A semicolon separates the pairs, but JSON only allows commas.
Note on C
The outer object is never closed; one closing brace is missing at the end.
Note on D
Correct: quoted keys, colons between keys and values, commas between pairs and balanced braces make it valid.
Best answer: D · why
Valid JSON needs double-quoted keys and string values, a colon between each key and its value, commas between pairs, and every brace and bracket closed. Numbers such as 123 are not quoted. Unquoted keys, semicolons, trailing commas and missing braces all make a parser reject the text.
- Frame 009 of 018
In Ansible, which type of file contains an ordered list of tasks that need to be executed?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The inventory lists the hosts and groups Ansible manages, not the tasks.
Note on B
A module is a single unit of work, such as ios_config, that a task calls.
Note on C
Correct: a playbook is a YAML file of plays, each running an ordered list of tasks against inventory hosts.
Note on D
A role packages tasks, variables and templates for reuse and is pulled into a playbook.
Best answer: C · why
Ansible is agentless and pushes changes over SSH or an API. An inventory defines hosts and groups, a playbook written in YAML holds plays with ordered tasks, each task calls a module such as cisco.ios.ios_config, and roles bundle reusable tasks and variables.
- Frame 010 of 018
In REST-based API communications for network automation, what is the primary role of the HTTP verb ‘PUT’?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Reading a resource without changing it is the job of GET.
Note on B
Removing a resource is done with DELETE.
Note on C
Correct: PUT replaces the resource with the supplied state, so sending the same request twice leaves the same result.
Note on D
Non-idempotent submission for processing describes POST, the usual verb for creating resources in CRUD.
Best answer: C · why
REST maps CRUD to HTTP verbs: POST creates, GET reads, PUT (full replace) and PATCH (partial change) update, and DELETE removes. PUT is idempotent: repeating the same request leaves the resource in the same state. POST is not idempotent, so repeating it can create duplicates.
- Frame 011 of 018
What is the primary function of the data plane in SDN architecture?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: the data plane forwards packets using the tables that the control plane, or the controller, has built.
Note on B
Storing device configuration is a management-plane function.
Note on C
Deciding how traffic should be routed is the control plane’s job.
Note on D
Offering services to applications is the controller’s northbound API.
Best answer: A · why
Networks split into planes: the control plane builds forwarding decisions (routing protocols, STP, or a central SDN controller), the data plane forwards packets using the resulting tables, and the management plane carries admin access such as SSH and SNMP. In SDN, the controller exposes northbound APIs to applications and programs devices southbound.
- Frame 012 of 018
Which term describes the architecture where physical network infrastructure carries traffic for multiple isolated virtual networks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Spine-leaf describes a physical topology where each leaf connects to every spine, not virtual networks.
Note on B
Mesh describes how devices are cabled to each other, not virtual networks on top.
Note on C
Correct: an overlay builds virtual networks with tunnels such as VXLAN on top of the physical underlay.
Note on D
A fabric is the whole system of underlay plus overlay managed as one, not the virtual networks themselves.
Best answer: C · why
Controller-based designs use three terms: the underlay is the physical network and its IP routing, the overlay is the set of virtual networks built over it with tunnels such as VXLAN, and the fabric is the combination managed as one. Many isolated virtual networks can share the same underlay.
- Frame 013 of 018
In the context of network automation, what does YANG stand for?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The name is not built from automation or grammar words; YANG is a data modeling language.
Note on B
YANG and YAML are unrelated; YAML is a serialization format used by tools such as Ansible.
Note on C
No gateway is involved; YANG describes data models and is not a device.
Note on D
Correct: YANG stands for Yet Another Next Generation, a language that models configuration and state data.
Best answer: D · why
YANG (Yet Another Next Generation, RFC 7950) is a data modeling language: it defines the structure of configuration and operational data on a device. NETCONF and RESTCONF carry data that follows those YANG models, encoded in XML or JSON.
- Frame 014 of 018
In the context of network automation, which sentence accurately describes the function of REST APIs?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: REST APIs let management systems, controllers and scripts read and change device or controller data over HTTP.
Note on B
VLAN trunks separate traffic at Layer 2; APIs have nothing to do with tagging.
Note on C
Topology discovery uses protocols such as CDP and LLDP; an API may expose the result but does not discover it.
Note on D
REST APIs talk to management and control functions; the data plane forwards packets in hardware.
Best answer: A · why
A REST API exposes resources at URLs and uses HTTP verbs (GET, POST, PUT, PATCH, DELETE), usually with JSON, so scripts and management systems can read and change a controller’s or device’s data. Controllers offer REST as a northbound API; it is stateless, and each request carries its own authentication.
- Frame 015 of 018
In network automation, what does CRUD stand for?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
These words describe network tasks, not the four data operations behind CRUD.
Note on B
Configure and deploy are activities, not part of the create-read-update-delete set.
Note on C
This mixes networking terms; CRUD names operations on data.
Note on D
Correct: Create, Read, Update and Delete map to POST, GET, PUT or PATCH, and DELETE in REST.
Best answer: D · why
CRUD names the four basic operations on data: Create, Read, Update and Delete. In REST APIs they map to POST, GET, PUT or PATCH, and DELETE. Response codes report the result: 2xx success, 4xx client error, 5xx server error.
- Frame 016 of 018
Which of the following is NOT typically a benefit of implementing network automation?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Automation applies tested templates the same way every time, which does cut typing mistakes.
Note on B
Correct: automation does not lower security needs; credentials, APIs and tooling must be protected too.
Note on C
Consistency is a main benefit, since every device gets the same configuration.
Note on D
Pushing changes by script is much faster than configuring devices one by one.
Best answer: B · why
Network automation reduces human error, keeps configurations consistent and speeds up deployment and change. It does not reduce security requirements: automation servers, API tokens and stored credentials become valuable targets, and one wrong script can reach every device, so access control and testing matter more.
- Frame 017 of 018
What HTTP verb would you use to retrieve resource information from a REST API without modifying any data?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
POST creates a resource or submits data, so it changes state.
Note on B
DELETE removes the resource, the opposite of read-only.
Note on C
Correct: GET is the safe, read-only verb that returns a resource without changing it.
Note on D
PUT replaces a resource with new data.
Best answer: C · why
GET retrieves a representation of a resource and is defined as safe: it should not change data on the server. POST creates, PUT replaces, PATCH changes part of a resource and DELETE removes it. A successful GET usually returns 200 OK with a JSON body.
- Frame 018 of 018
Which aspect of an automation framework primarily focuses on integrating and improving IT infrastructure through continuous delivery and automated testing?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
NetOps refers to network operations work in general, not a delivery practice built on testing pipelines.
Note on B
Correct: DevOps joins development and operations through continuous integration, delivery and automated testing.
Note on C
AIOps applies machine learning to operational data to spot and predict problems.
Note on D
SecOps joins security and operations teams; its focus is protection, not delivery pipelines.
Best answer: B · why
DevOps is a practice that brings development and operations together through version control, continuous integration and delivery (CI/CD) and automated testing, so changes ship in small, tested steps. Applied to networks, the same pipeline idea is often called NetDevOps.
Automation questions
Is Python programming part of this topic?
Neither topic list names a programming language. v1.1 asks you to read JSON and explain REST; v2.0 asks you to use Ansible to run commands, which means reading and adjusting YAML rather than writing a program.
Is Catalyst Center the same product as DNA Center?
Yes. Cisco renamed its campus controller Catalyst Center; some Cisco pages still use the older name.
What is the difference between a controller’s northbound and southbound APIs?
Direction. The northbound API faces the apps, scripts and tools above the controller and is usually REST over HTTPS; southbound protocols face the routers, switches and access points the controller manages (RFC 7426 names the layers).
Concepts in this study area
- Control vs data planePlanes, controllers and the direction of each API.
- Ansible vs TerraformProcedural vs declarative, playbooks vs plan, idempotence.