Cisco 350-901 Practice Exam Questions & Answers
6 Free Questions
· Last reviewed: October 4, 2026
· Prepared & Reviewed by the ValidExamDumps Editorial Team
Exam Facts
Cisco 350-901 Exam Details
Key details for this exam, checked against the published exam outline
550
Practice Questions (Our Bank)
120 minutes
Exam Duration
USD 400
Official Exam Fee
- Exam Code
- 350-901
- Full Name
- Designing, Deploying and Managing Network Automation Systems
- Issuing Body
- Cisco
- Question Format (Our Bank)
- Multiple Choice, Drag & Drop
- Delivery
- Pearson VUE testing centre or online proctored
- Eligibility
- No formal prerequisites. Cisco recommends three to five years of hands-on experience with network automation and software development.
- Validity
- 3 years
Practice Questions
Free 350-901 Practice Questions
Each question shows the correct answer and an explanation of why it is right
VA
ValidExamDumps Editorial Team
Every question and its answer is checked by our 350-901 exam
preparation team, who also write the explanation shown with each one.
How we research and review these pages
Refer to the exhibits which show the documentation associated with the create port object API cafl in Cisco Firepower Threat Defense, and a cURL command. Which data payload completes the cURL command to run the APi call?
A)
B)
C)
D)
Correct Answer:
C
Explanation
Meraki SSIDs are managed through the network SSID endpoint using PUT requests. The PUT method updates an existing SSID resource. The request path /networks/{networkId}/ssids/{number} targets the specific SSID within a network. The JSON payload with {'enable': true} sets the SSID to active. GET requests retrieve data rather than modify it. POST would create a new resource. DELETE would remove the SSID entirely.
Refer to the exhibit.
Which parameter is missing from the JSON response to confirm the API version that is
used?
Correct Answer:
C
Explanation
To confirm the API version used in a JSON response, the missing parameter is typically version or api_version. This parameter explicitly indicates which API version generated the response, allowing clients to handle version-specific response formats and deprecation warnings appropriately.
A team of developers created their own CA and started signing certificates for all of their loT devices, Which action will make the browser
accept these certificates?
Correct Answer:
B
Explanation
The Meraki Dashboard API requires you to specify the network ID, HTTP method, and the data payload when updating a resource. The network ID 11111111 identifies which network to modify. PUT is the correct HTTP method for updating an existing resource. The payload contains the SSID configuration including the name 371767916. These three elements are essential to properly construct the API request for enabling the SSID.
A network automation team is designing an artificial intelligence-based monitoring framework to use federated orchestration to address sensitive integrations. To ensure that operations meet enterprise standards, the workflow analyzes system interactions and decision flows generated by automated compliance validation. Which process interprets the associated network automation exposure?
Correct Answer:
B
Explanation
NX-OS devices support NETCONF as the encrypted transport protocol for configuration management. NETCONF operates over HTTPS or SSH to ensure encryption. When using Ansible with NX-OS, NETCONF provides encrypted device access and supports asynchronous operations through native protocol capabilities. SSH provides encryption but is less structured than NETCONF for configuration tasks. HTTP lacks encryption entirely. SNMP is for monitoring, not configuration. Telnet is unencrypted. The combination of NETCONF and HTTPS ensures both encryption and asynchronous request handling.
Refer to the exhibit.
An application's REST API GET call is tested to the inventory database. Which missing code must be included to limit
the number of values that are returned from the query to 20?
Correct Answer:
D
A web application has those requirements for HTTP cache control:
The client browser must be prevented from storing responses that contain sensitive information.
Assets must be downloaded from the remote server every time.
Which header must the engineer use?
Correct Answer:
B
Explanation
To prevent the client browser from storing responses containing sensitive information and force assets to be downloaded from the remote server every time, the engineer must use the Cache-Control: no-store header.
HTTP cache control headers:
no-store - prevents all caching (browser and intermediary proxies); most restrictive and appropriate for sensitive datano-cache - allows caching but requires revalidation with server each time (less strict)private - restricts caching to browser only, not proxiespublic - allows any cache to store the response
For the stated requirement of preventing client storage AND forcing fresh downloads, Cache-Control: no-store is the correct header. It can be combined with Pragma: no-cache for additional compatibility with older clients.
Full Access
Get the complete 350-901 question set
- 550 questions covering all exam domains
- Correct answers with explanations, like the free questions above
- PDF and online practice test
- 90 days of free updates
Domain 1: Network Automation
30%
1.1 Construct a network automation solution with Ansible to manage configurations such as VLANs, OSPF, asset management, interface settings, and ACLs; 1.2 Construct a network automation solution with Terraform to manage configurations such as VLANs, OSPF, asset management, interface settings, and ACLs; 1.3 Construct a network automation solution with RESTCONF (RFC 8040), given the YANG model, to manage configurations such as VLANs, OSPF, asset management, interface settings, and ACLs; 1.4 Construct a network automation solution with Python to manage configurations such as VLANs, OSPF, asset management, interface settings, and ACLs; 1.5 Select the network automation approach to achieve technical and business requirements considering options such as infrastructure as code framework, low code/no code, and custom applications; 1.6 Construct a network automation solution that consumes REST APIs including extended API attributes (such as pagination, complex authentication workflows, and rate limiting), error handling, and persistent authentication
Sample questions from this domain above:
Q3Q5
Domain 2: Infrastructure as Code
30%
2.1 Use version control operations with Git; 2.1.a Merge a branch including squash and conflict resolution; 2.1.b git cherry-pick; 2.1.c git reset; 2.1.d git checkout; 2.1.e git revert; 2.2 Diagnose a GitLab CE CI/CD pipeline failure such as missing dependency, incompatible versions of components, and failed tests; 2.3 Construct a GitLab CE CI/CD pipeline to deploy a network automation solution including stages for:; 2.3.a build; 2.3.b prevalidation; 2.3.c deploy; 2.3.d post-validation; 2.4 Construct a network simulation with Cisco Modeling Labs (CML) to test the network automation solution; 2.5 Interpret a Docker Compose file including services, networks, volumes, and links; 2.6 Integrate source of truth into a network automation solution; 2.7 Construct a YAML or JSON representation of a network configuration given a YANGbased data model
Domain 3: Operations
20%
3.1 Describe architectural components of model-driven telemetry; 3.2 Implement a logging strategy for a network automation solution targeting destinations such as syslog or webhooks; 3.3 Diagnose problems with network automation given logs and output related to an event; 3.4 Implement change validation for a network automation solution using pyATS CLI tools; 3.5 Describe the process to obtain and deploy CA-signed TLS certificates; 3.6 Implement secure coding practices into a network automation solution to meet input validation, authentication, and secret management requirements
Sample questions from this domain above:
Q1Q2Q6
Domain 4: AI in Automation
20%
4.1 Describe the benefits and risks of AI-assisted code development for network automation such as data privacy, IP ownership, and code validation; 4.2 Interpret the security risks in a given AI-based network automation solution; 4.3 Construct an MCP server to provide network information to an AI-agent using Python FastMCP; 4.4 Construct a conversational agent that leverages LLMs for network automation; 4.5 Evaluate the accuracy of AI recommendations on a network automation solution
Sample question from this domain above:
Q4
FAQ
350-901 Exam FAQ
Common questions about the exam itself
What background do I need before taking 350-901 AUTOCOR?
Cisco has no formal prerequisites since removing the CCNA requirement for CCNP-level exams. However, Cisco recommends three to five years of hands-on experience with network automation and software development before you sit the exam, as it tests practical skills across Python, Ansible, Terraform, REST APIs and Cisco platforms at the professional level.
How does 350-901 relate to other exams in the CCNP Automation track?
350-901 AUTOCOR is the core exam for CCNP Automation and also the qualifying written exam for the CCIE Automation lab. To earn the full CCNP Automation certification you must pass 350-901 plus one concentration exam of your choice. Passing just the core exam earns you the Cisco Certified Automation Specialist - Core badge on its own.
What is the exam format and how much time do I get?
You have 120 minutes to answer approximately 90 to 110 questions. The exam includes multiple-choice, multiple-response, drag-and-drop and code snippet questions covering Python, YAML and JSON. The format is delivered through Pearson VUE either at a physical testing centre or via online proctored exam.
What is the passing score for 350-901?
Cisco does not publish a fixed passing score. Instead the exam uses scaled scoring where the cut score is set statistically based on question difficulty. Industry sources suggest around 75 percent or approximately 825 out of 1000 points, but you should aim for 85 percent or higher on full-length practice tests to build a safety margin.
How long is the 350-901 certification valid?
Your CCNP or CCIE Automation certification remains valid for three years from the date you pass 350-901. You can renew it by passing any one professional concentration exam in the Automation track or by earning 80 Continuing Education credits through approved Cisco learning activities.
What does 350-901 cost and can I retake it if I fail?
The exam costs USD 400 plus applicable taxes per attempt. If you fail, you must wait five calendar days beginning the day after your failed attempt before you can retake the same exam. After the waiting period you pay the full exam fee again to schedule your next attempt.
Which objective area in 350-901 do candidates find most challenging?
Application Deployment and Security and Infrastructure and Automation are typically the most challenging domains because they require hands-on experience with Docker, Kubernetes, CI/CD pipelines, Ansible, Terraform and network configuration protocols like RESTCONF. Focus on lab work with these tools rather than just reading the theory.
How long should I spend studying for 350-901?
Most candidates need three to six months of focused preparation depending on your background. If you already have experience with Python, REST APIs and at least one Cisco platform, you might prepare in three months. If you are starting from scratch, plan for six months of consistent study with hands-on labs.
What job roles does the 350-901 certification map to?
This certification is designed for network automation engineers, software developers, system integration developers, network designers, infrastructure architects and senior test development engineers. It validates skills in designing and deploying applications on Cisco infrastructure, making you competitive for roles that bridge networking and software development.
Can I use Cisco Learning Credits to pay for 350-901?
Yes. Cisco customers and learning partners can redeem their Cisco Learning Credits for certification exam vouchers to cover the cost of 350-901 and other exams. Check with your Cisco account team or Cisco Learning partner to see if you have credits available.
