6.7 Automation and Programmability — Comprehensive Review

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

6.7 Automation and Programmability — Comprehensive Review

Key Takeaways Explain This Topic AI

SDN separates control plane from data plane; the controller is the brain that programs the devices.

Northbound APIs (REST) connect apps to the controller; southbound APIs (NETCONF/RESTCONF) connect controller to devices.

Ansible (agentless, SSH, YAML) handles Day-2 config; Terraform (declarative, HCL, state file) handles Day-0 provisioning.

REST verbs map to CRUD: GET=read, POST=create, PUT/PATCH=update, DELETE=delete; responses are JSON over HTTPS.

AI/ML in networking: predictive AI forecasts failures, generative AI creates configs, ML baselines and detects anomalies.

Last updated: June 2026

Review Strategy

Automation is 10% of the CCNA 200-301 v1.1 exam — about 8 to 12 of roughly 100 questions in 120 minutes. It is the newest and most under-prepared domain, so a tight grasp here is easy marks. The questions are conceptual: compare, identify, and read, never code. This section consolidates the whole chapter.

Traditional vs. Controller-Based (SDN)

Aspect Traditional Controller-Based (SDN)
Control plane Distributed (each device) Centralized (controller)
Configuration CLI per device API / policy-based
Scalability Limited Excellent
Consistency Variable High
Visibility Per-device Network-wide

The controller talks UP to apps through northbound REST APIs and DOWN to devices through southbound protocols. Cisco's enterprise controller is DNA Center, now Catalyst Center , delivering intent-based networking — you declare intent, it configures the boxes.

Config Management Tools at a Glance

Feature Ansible Terraform Puppet
Agent Agentless (SSH) Agentless (API) Agent-based
Language YAML HCL Puppet DSL
Model Push, procedural Declarative Pull, declarative
State file No Yes Yes (server)
Best for Network config (Day-2) Provisioning (Day-0) Server config
REST and JSON Quick Facts

Verbs → CRUD: GET=Read, POST=Create, PUT/PATCH=Update, DELETE=Delete.

Status classes: 2xx success, 3xx redirect, 4xx client error, 5xx server error. Know 200, 201, 401, 403, 404, 500.

REST is stateless and returns JSON over HTTPS; tokens ride in every request.

JSON: {} = object, [] = array, keys are quoted strings, arrays are zero-indexed, no comments allowed.

NETCONF vs. RESTCONF

Both are southbound management protocols built on YANG data models (YANG defines the structure of config and operational data), and both are favorites for tricky exam questions.

Attribute NETCONF RESTCONF
Encoding XML only JSON or XML
Transport SSH HTTPS
Port TCP 830 TCP 443
Style RPC-based operations REST API over YANG
Data model YANG YANG

Mnemonic: NET CONF → N ative XML over SSH (830); REST CONF → R EST/JSON over HTTPS (443).

AAA Protocols (appears alongside automation/security)

Feature TACACS+ RADIUS
Transport/port TCP 49 UDP 1812/1813
Encryption Encrypts the entire packet Encrypts the password only
AAA separation Yes (independent A/A/A) No (auth + authz combined)
Best for Device administration Network access / 802.1X
AI/ML One-Liners

Predictive AI — forecasts a future event (failure, saturation) from historical data.

Generative AI — creates new content (configs, docs) from a natural-language prompt.

Machine learning — baselines normal behavior and flags anomalies; powers Cisco Catalyst Center Assurance.

High-Yield Traps to Avoid

Direction mix-up — northbound is apps↔controller (REST); southbound is controller↔devices (NETCONF/RESTCONF/OpenFlow).

NETCONF port — it is 830 over SSH, not 443; 443 is RESTCONF.

Agent question — Ansible and Terraform are agentless; Puppet and Chef need agents.

POST vs PUT — POST creates , PUT replaces ; do not swap them.

401 vs 403 — 401 = not authenticated, 403 = authenticated but forbidden.

JSON comments — JSON allows none; that distractor is always wrong.

DNA Center = Catalyst Center — same product, either name may appear.

On the Exam: Memorize the SDN layer/API map, the REST verb→CRUD table, the NETCONF (XML/SSH/830) vs RESTCONF (JSON-or-XML/HTTPS/443) split, the three AI/ML definitions, and the Ansible-vs-Terraform comparison. These five tables cover the vast majority of the 10% automation domain.

How the Pieces Fit Into One Workflow

It is worth stitching the chapter into a single mental picture, because the exam sometimes describes an end-to-end flow and asks you to name a component. Picture an engineer who wants to push a new security policy. They write the intent in a tool such as Ansible using a YAML playbook stored in Git. That playbook calls the controller's northbound REST API , sending an HTTP POST with a JSON body and a bearer token.

Catalyst Center — the intent-based controller — receives the request, translates the intent into device configuration, and pushes it down to the switches over a southbound protocol such as NETCONF (XML over SSH on 830) or RESTCONF (JSON over HTTPS on 443). Meanwhile the controller's AI/ML assurance engine watches the result against its learned baseline and flags any anomaly. Every term in this chapter has a slot in that one sentence.

Final Pre-Exam Checklist

Before test day, be able to answer these from memory without notes: Which API direction is REST and connects apps to the controller? (Northbound.) Which protocols are southbound? (NETCONF, RESTCONF, OpenFlow.) Which tool is agentless and YAML-based for device config? (Ansible.) Which is declarative with a state file for provisioning? (Terraform.) What do POST, GET, PUT, and DELETE map to? (Create, Read, Update, Delete.) What do 401 and 403 mean? (Not authenticated; authenticated but forbidden.) What encloses a JSON object versus an array?

(Curly braces versus square brackets.) Which AI type forecasts, which creates, and which detects anomalies? (Predictive, generative, machine learning.)

Time Strategy

Because automation is only about 10% of the blueprint and the questions are conceptual rather than calculation-heavy, treat them as quick points: read the verb in the stem, map it to the correct table, and move on. Do not over-think — there are no subnetting calculations or multi-step configurations hiding here, just recognition of definitions and directions. Banking these fast, confident answers leaves you more of your 120 minutes for the heavier IP connectivity and security domains that carry larger weight on the exam.