Question 920
After Starlight IP Services deploys Ansible declarative desired configuration to apply a repeated standardized configuration across a provider router fleet, the primary acceptance check passes (a second run makes no unexpected configuration change after convergence). What remaining operational risk should still be part of the design review?
- External drift can invalidate an earlier saved plan.
- Not every model path supports ON_CHANGE semantics.
- Template refresh and collector restart handling must be planned.
- Module coverage and network access permissions vary by router OS.
Explanation
Correct Answer
D:The relevant boundary of Ansible declarative desired configuration is that module coverage and network access permissions vary by router OS. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to Terraform plan before apply in a different scenario where operators need to review configuration impact before making a broad service-provider change. For the deployed Ansible declarative desired configuration approach, the relevant caution is instead that module coverage and network access permissions vary by router OS.
B:This concern applies to gNMI ON_CHANGE subscription in a different scenario where operators need to receive notifications only when eligible operational state leaves change. For the deployed Ansible declarative desired configuration approach, the relevant caution is instead that module coverage and network access permissions vary by router OS.
C:This concern applies to IPFIX template metadata in a different scenario where operators need to allow collectors to interpret variable flow record fields correctly. For the deployed Ansible declarative desired configuration approach, the relevant caution is instead that module coverage and network access permissions vary by router OS.
Question 921
Northstar Carrier must track provisioned infrastructure objects and detect changes against code. The operator is comparing several service-provider methods. Which design or control directly addresses that stated requirement?
- Terraform state consistency
- Ansible declarative desired configuration
- gNMI mutual TLS authentication
- API POST creation workflow
Explanation
Correct Answer
A:Terraform state consistency matches this requirement: the team should use controlled Terraform state with secure remote locking and versioning. A relevant outcome would be that plans reference the current managed object identities without conflicting state writes.
Incorrect Answers
B:Ansible declarative desired configuration instead addresses a different condition: apply a repeated standardized configuration across a provider router fleet. It would instead require you to use an idempotent Ansible playbook with platform-appropriate modules and diff checks, not the stated goal to track provisioned infrastructure objects and detect changes against code.
C:gNMI mutual TLS authentication instead addresses a different condition: restrict streaming telemetry to approved mutually authenticated collectors. It would instead require you to configure TLS certificates with compatible peer verification for gRPC management, not the stated goal to track provisioned infrastructure objects and detect changes against code.
D:API POST creation workflow instead addresses a different condition: create a service resource using the documented REST API method. It would instead require you to send a validated POST payload with correct media type and authorization, not the stated goal to track provisioned infrastructure objects and detect changes against code.
Question 922
At Orion Transit, the engineering change is approved for Terraform state consistency. The specific goal is to track provisioned infrastructure objects and detect changes against code. Which implementation step belongs in this change plan?
- Use an idempotent Ansible playbook with platform-appropriate modules and diff checks.
- Use controlled Terraform state with secure remote locking and versioning.
- Configure TLS certificates with compatible peer verification for gRPC management.
- Send a validated POST payload with correct media type and authorization.
Explanation
Correct Answer
B:Implementing Terraform state consistency requires the operator to use controlled Terraform state with secure remote locking and versioning. This makes the required goal testable using evidence that plans reference the current managed object identities without conflicting state writes.
Incorrect Answers
A:The proposed step is for Ansible declarative desired configuration, whose purpose is to apply a repeated standardized configuration across a provider router fleet. It would not perform the necessary Terraform state consistency operation: use controlled Terraform state with secure remote locking and versioning.
C:The proposed step is for gNMI mutual TLS authentication, whose purpose is to restrict streaming telemetry to approved mutually authenticated collectors. It would not perform the necessary Terraform state consistency operation: use controlled Terraform state with secure remote locking and versioning.
D:The proposed step is for API POST creation workflow, whose purpose is to create a service resource using the documented REST API method. It would not perform the necessary Terraform state consistency operation: use controlled Terraform state with secure remote locking and versioning.
Question 923
Meridian Networks has deployed Terraform state consistency to track provisioned infrastructure objects and detect changes against code. The implementation step was to use controlled Terraform state with secure remote locking and versioning. Which observation demonstrates that the requested service is working?
- A second run makes no unexpected configuration change after convergence.
- An authorized collector completes mTLS and an untrusted peer is rejected.
- Plans reference the current managed object identities without conflicting state writes.
- The API returns the documented creation status and resource identity.
Explanation
Correct Answer
C:For Terraform state consistency, successful verification means that plans reference the current managed object identities without conflicting state writes. That evidence directly tests whether the provider can track provisioned infrastructure objects and detect changes against code after deployment.
Incorrect Answers
A:The observation would verify Ansible declarative desired configuration under the separate requirement to apply a repeated standardized configuration across a provider router fleet. It does not demonstrate the needed Terraform state consistency result: plans reference the current managed object identities without conflicting state writes.
B:The observation would verify gNMI mutual TLS authentication under the separate requirement to restrict streaming telemetry to approved mutually authenticated collectors. It does not demonstrate the needed Terraform state consistency result: plans reference the current managed object identities without conflicting state writes.
D:The observation would verify API POST creation workflow under the separate requirement to create a service resource using the documented REST API method. It does not demonstrate the needed Terraform state consistency result: plans reference the current managed object identities without conflicting state writes.
Question 924
While troubleshooting Terraform state consistency at Kestrel Broadband, the intended acceptance outcome is still missing: plans reference the current managed object identities without conflicting state writes. Which fault condition should be investigated first for this particular design?
- A nonidempotent shell command appends duplicate configuration every run.
- The management service accepts any certificate with verification disabled.
- A GET request is sent expecting it to create a new network object.
- Two concurrent runners modify the same unsecured state file.
Explanation
Correct Answer
D:The suspected defect directly frustrates Terraform state consistency: two concurrent runners modify the same unsecured state file. Correcting it should allow verification that plans reference the current managed object identities without conflicting state writes.
Incorrect Answers
A:This defect belongs to Ansible declarative desired configuration, where the affected outcome is to apply a repeated standardized configuration across a provider router fleet. It is not the direct failure mode identified for the Terraform state consistency design in this case: two concurrent runners modify the same unsecured state file.
B:This defect belongs to gNMI mutual TLS authentication, where the affected outcome is to restrict streaming telemetry to approved mutually authenticated collectors. It is not the direct failure mode identified for the Terraform state consistency design in this case: two concurrent runners modify the same unsecured state file.
C:This defect belongs to API POST creation workflow, where the affected outcome is to create a service resource using the documented REST API method. It is not the direct failure mode identified for the Terraform state consistency design in this case: two concurrent runners modify the same unsecured state file.
Question 925
After Harbor Metro deploys Terraform state consistency to track provisioned infrastructure objects and detect changes against code, the primary acceptance check passes (plans reference the current managed object identities without conflicting state writes). What remaining operational risk should still be part of the design review?
- State may contain sensitive data requiring encryption and access policy.
- Module coverage and network access permissions vary by router OS.
- Certificate expiration can interrupt subscription delivery.
- Repeating a nonidempotent POST can create unintended duplicate objects.
Explanation
Correct Answer
A:The relevant boundary of Terraform state consistency is that state may contain sensitive data requiring encryption and access policy. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
B:This concern applies to Ansible declarative desired configuration in a different scenario where operators need to apply a repeated standardized configuration across a provider router fleet. For the deployed Terraform state consistency approach, the relevant caution is instead that state may contain sensitive data requiring encryption and access policy.
C:This concern applies to gNMI mutual TLS authentication in a different scenario where operators need to restrict streaming telemetry to approved mutually authenticated collectors. For the deployed Terraform state consistency approach, the relevant caution is instead that state may contain sensitive data requiring encryption and access policy.
D:This concern applies to API POST creation workflow in a different scenario where operators need to create a service resource using the documented REST API method. For the deployed Terraform state consistency approach, the relevant caution is instead that state may contain sensitive data requiring encryption and access policy.
Question 926
Summit Service Provider must review configuration impact before making a broad service-provider change. The operator is comparing several service-provider methods. Which design or control directly addresses that stated requirement?
- Ansible declarative desired configuration
- Terraform plan before apply
- SNMP community versus user model
- secure ZTP device identity validation
Explanation
Correct Answer
B:Terraform plan before apply matches this requirement: the team should generate and approve the infrastructure plan prior to applying. A relevant outcome would be that the reviewed plan enumerates proposed create update and delete operations.
Incorrect Answers
A:Ansible declarative desired configuration instead addresses a different condition: apply a repeated standardized configuration across a provider router fleet. It would instead require you to use an idempotent Ansible playbook with platform-appropriate modules and diff checks, not the stated goal to review configuration impact before making a broad service-provider change.
C:SNMP community versus user model instead addresses a different condition: remove shared plaintext-community access from a sensitive provider management network. It would instead require you to migrate monitoring to per-user SNMPv3 authentication and appropriate views, not the stated goal to review configuration impact before making a broad service-provider change.
D:secure ZTP device identity validation instead addresses a different condition: onboard an unconfigured provider router across an untrusted initial management network. It would instead require you to validate the router's manufacturer identity and permitted ownership voucher, not the stated goal to review configuration impact before making a broad service-provider change.
Question 927
At Ridgeway Networks, the engineering change is approved for Terraform plan before apply. The specific goal is to review configuration impact before making a broad service-provider change. Which implementation step belongs in this change plan?
- Use an idempotent Ansible playbook with platform-appropriate modules and diff checks.
- Migrate monitoring to per-user SNMPv3 authentication and appropriate views.
- Generate and approve the infrastructure plan prior to applying.
- Validate the router's manufacturer identity and permitted ownership voucher.
Explanation
Correct Answer
C:Implementing Terraform plan before apply requires the operator to generate and approve the infrastructure plan prior to applying. This makes the required goal testable using evidence that the reviewed plan enumerates proposed create update and delete operations.
Incorrect Answers
A:The proposed step is for Ansible declarative desired configuration, whose purpose is to apply a repeated standardized configuration across a provider router fleet. It would not perform the necessary Terraform plan before apply operation: generate and approve the infrastructure plan prior to applying.
B:The proposed step is for SNMP community versus user model, whose purpose is to remove shared plaintext-community access from a sensitive provider management network. It would not perform the necessary Terraform plan before apply operation: generate and approve the infrastructure plan prior to applying.
D:The proposed step is for secure ZTP device identity validation, whose purpose is to onboard an unconfigured provider router across an untrusted initial management network. It would not perform the necessary Terraform plan before apply operation: generate and approve the infrastructure plan prior to applying.
Question 928
Lakeside Transport has deployed Terraform plan before apply to review configuration impact before making a broad service-provider change. The implementation step was to generate and approve the infrastructure plan prior to applying. Which observation demonstrates that the requested service is working?
- A second run makes no unexpected configuration change after convergence.
- Each NMS identity has individually limited and auditable access.
- Only an authenticated owned router accepts the intended onboarding process.
- The reviewed plan enumerates proposed create update and delete operations.
Explanation
Correct Answer
D:For Terraform plan before apply, successful verification means that the reviewed plan enumerates proposed create update and delete operations. That evidence directly tests whether the provider can review configuration impact before making a broad service-provider change after deployment.
Incorrect Answers
A:The observation would verify Ansible declarative desired configuration under the separate requirement to apply a repeated standardized configuration across a provider router fleet. It does not demonstrate the needed Terraform plan before apply result: the reviewed plan enumerates proposed create update and delete operations.
B:The observation would verify SNMP community versus user model under the separate requirement to remove shared plaintext-community access from a sensitive provider management network. It does not demonstrate the needed Terraform plan before apply result: the reviewed plan enumerates proposed create update and delete operations.
C:The observation would verify secure ZTP device identity validation under the separate requirement to onboard an unconfigured provider router across an untrusted initial management network. It does not demonstrate the needed Terraform plan before apply result: the reviewed plan enumerates proposed create update and delete operations.
Question 929
While troubleshooting Terraform plan before apply at Coastal Communications, the intended acceptance outcome is still missing: the reviewed plan enumerates proposed create update and delete operations. Which fault condition should be investigated first for this particular design?
- An unreviewed apply destroys a shared routing resource.
- A nonidempotent shell command appends duplicate configuration every run.
- All monitoring stations continue to share one community string as the only control.
- Any device claiming the target IP address is blindly granted bootstrap credentials.
Explanation
Correct Answer
A:The suspected defect directly frustrates Terraform plan before apply: an unreviewed apply destroys a shared routing resource. Correcting it should allow verification that the reviewed plan enumerates proposed create update and delete operations.
Incorrect Answers
B:This defect belongs to Ansible declarative desired configuration, where the affected outcome is to apply a repeated standardized configuration across a provider router fleet. It is not the direct failure mode identified for the Terraform plan before apply design in this case: an unreviewed apply destroys a shared routing resource.
C:This defect belongs to SNMP community versus user model, where the affected outcome is to remove shared plaintext-community access from a sensitive provider management network. It is not the direct failure mode identified for the Terraform plan before apply design in this case: an unreviewed apply destroys a shared routing resource.
D:This defect belongs to secure ZTP device identity validation, where the affected outcome is to onboard an unconfigured provider router across an untrusted initial management network. It is not the direct failure mode identified for the Terraform plan before apply design in this case: an unreviewed apply destroys a shared routing resource.
Question 930
After Bluebird Infrastructure deploys Terraform plan before apply to review configuration impact before making a broad service-provider change, the primary acceptance check passes (the reviewed plan enumerates proposed create update and delete operations). What remaining operational risk should still be part of the design review?
- Module coverage and network access permissions vary by router OS.
- External drift can invalidate an earlier saved plan.
- Operational cutover must preserve critical fault monitoring continuity.
- Ownership voucher trust anchors must remain current and protected.
Explanation
Correct Answer
B:The relevant boundary of Terraform plan before apply is that external drift can invalidate an earlier saved plan. Passing the acceptance test does not eliminate this residual operational risk.
Incorrect Answers
A:This concern applies to Ansible declarative desired configuration in a different scenario where operators need to apply a repeated standardized configuration across a provider router fleet. For the deployed Terraform plan before apply approach, the relevant caution is instead that external drift can invalidate an earlier saved plan.
C:This concern applies to SNMP community versus user model in a different scenario where operators need to remove shared plaintext-community access from a sensitive provider management network. For the deployed Terraform plan before apply approach, the relevant caution is instead that external drift can invalidate an earlier saved plan.
D:This concern applies to secure ZTP device identity validation in a different scenario where operators need to onboard an unconfigured provider router across an untrusted initial management network. For the deployed Terraform plan before apply approach, the relevant caution is instead that external drift can invalidate an earlier saved plan.
Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) (350-501) Practice Tests