CCNA Automation Domain 3: Cisco Platforms and Development (15%)

Overview

Cisco Platforms and Development accounts for 15% of the 200-901 exam and has nine objectives. Objective 3.1 asks you to build a Python script with a Cisco SDK. Objectives 3.2 to 3.5 describe the capabilities and APIs of network management platforms (Meraki, Catalyst Center, ACI, Catalyst SD-WAN and NSO), compute platforms (UCS Manager and Intersight), collaboration platforms (Webex, Webex devices and Unified Communications Manager with AXL and UDS) and security platforms (XDR, Firepower, Secure Connect, Secure Endpoint, ISE and Secure Malware Analytics).

Objective 3.6 covers device-level APIs on IOS XE and NX-OS, 3.7 asks which DevNet resource fits a scenario, and 3.8 applies YANG, NETCONF and RESTCONF. Objective 3.9 asks you to write code that lists network devices, manages Webex spaces, members and messages, or lists clients from Meraki or Catalyst Center.

Why it matters on the exam

This is the domain that makes the exam a Cisco exam. Generic API knowledge from Domain 2 gets you a working request, but here you must know which platform solves a given problem, how it authenticates, and what its API looks like. The product list is long and the blueprint uses current names such as Catalyst Center (formerly DNA Center) and Catalyst SD-WAN (formerly vManage-based Viptela), so study material written for DEVASC v1.0 may use older terms. Model-driven programmability also appears here and again in Domain 5, which makes YANG, NETCONF and RESTCONF some of the most frequently examined ideas overall. Candidates who memorise product names without trying the APIs tend to struggle with objective 3.9, which expects working code against documentation.

How it's tested

Questions describe an operational need and ask which platform or API addresses it, or show a code fragment calling a Cisco API or SDK and ask for the missing piece. Others compare NETCONF and RESTCONF ports, encodings and operations. Some items ask which DevNet resource suits a developer's situation.

Platform selection

A task such as managing cloud-hosted branch Wi-Fi or server firmware is described, and you choose the Cisco platform and API that fits.
Code against documentation

A partial script for Meraki, Catalyst Center or Webex is shown with an API reference excerpt, and you complete the endpoint, header or loop.
Protocol details

A model-driven management scenario asks for the right protocol, transport port, encoding or operation such as get-config or edit-config.

Reasoning it through

A team must update configuration on IOS XE routers using a standards-based API over HTTPS with JSON payloads defined by YANG models. NETCONF uses SSH on port 830 with XML encoding, so it does not match the HTTPS and JSON requirement. RESTCONF runs over HTTPS, supports JSON or XML, and maps YANG data to URIs, so RESTCONF is the answer.

Objectives 9

Official objectives from the Cisco outline, in outline order.

3.1 Construct a Python script that uses a Cisco SDK given SDK documentationUsing a vendor Python library instead of raw HTTP calls.

What it means: An SDK wraps a platform's REST API in Python classes and methods, handling authentication, base URLs, pagination and error handling. Examples include the Meraki Python library (meraki), dnacentersdk for Catalyst Center, webexteamssdk or webexpythonsdk for Webex, and the Cobra SDK for ACI.
What to understand: You install the package with pip, create an API object with credentials or a key, and call methods named after API operations, such as dashboard.organizations.getOrganizations() in the Meraki library. SDK documentation tells you the method name and parameters. The benefit is less boilerplate and consistent behaviour; the cost is a dependency and a layer of abstraction that can lag the raw API.
How it shows up: Complete an SDK call or choose the correct method name from documentation.
Common confusion: Thinking an SDK uses a different protocol; it still makes the same REST calls underneath.

3.2 Describe the capabilities of Cisco network management platforms and APIs (Meraki, Cisco Catalyst Center, ACI, Cisco Catalyst SD-WAN, and NSO)What each controller manages and how its API is accessed.

What it means: Meraki is cloud-managed networking with a Dashboard REST API using an API key. Catalyst Center is the on-premises controller for campus and branch, with intent APIs authenticated by a token. ACI is the data centre fabric managed by the APIC, whose REST API exposes the managed object model. Catalyst SD-WAN Manager controls the WAN overlay. NSO is a multivendor orchestration platform built on YANG models.
What to understand: Match platform to domain: Meraki for simple cloud-managed sites, Catalyst Center for enterprise campus assurance and provisioning, ACI for data centre policy, Catalyst SD-WAN for WAN overlays, and NSO for service orchestration across vendors and device types. Meraki also offers webhooks, and Catalyst Center provides event notifications and returns task IDs for asynchronous changes.
How it shows up: Pick the platform for a scenario or the authentication model for its API.
Common confusion: Assigning data centre fabric policy to Catalyst Center instead of ACI.

3.3 Describe the capabilities of Cisco compute management platforms and APIs (UCS Manager and Intersight)Server management APIs on premises and in the cloud.

What it means: UCS Manager manages UCS servers within a domain through an XML API based on a managed object model and offers a Python SDK (ucsmsdk) and PowerTool. Intersight is a SaaS platform that manages UCS and HyperFlex infrastructure across sites through a REST API using API keys and request signing.
What to understand: UCS Manager is local to one UCS domain and uses XML; Intersight is cloud-based, manages many domains and uses OpenAPI-described REST endpoints with SDKs in several languages. Both support policy-based management through service profiles or server profiles, which is what makes compute programmable.
How it shows up: Choose between UCS Manager and Intersight for a single-site or multisite requirement.
Common confusion: Assuming UCS Manager's API is JSON REST like Intersight's.

3.4 Describe the capabilities of Cisco collaboration platforms and APIs (Webex, Webex devices, Cisco Unified Communications Manager including AXL and UDS interfaces)Messaging, meetings, devices and call control APIs.

What it means: The Webex REST API manages spaces (rooms), memberships, messages, people, meetings and webhooks using a bearer token, and supports bots. Webex devices expose xAPI for commands, configuration and status. Unified Communications Manager offers AXL, a SOAP-based provisioning API, and UDS, a REST-based user data service for directory and end-user information.
What to understand: Use AXL to add phones, users or lines in bulk on CUCM, and UDS for lightweight user lookups. Use the Webex REST API to automate messaging and meetings, and xAPI to control room devices. Bots act through a bot token and typically receive events through webhooks.
How it shows up: Choose AXL, UDS, xAPI or the Webex REST API for a described collaboration task.
Common confusion: Treating AXL as REST; it is SOAP with XML envelopes.

3.5 Describe the capabilities of Cisco security platforms and APIs (XDR, Firepower, Secure Connect, Secure Endpoint, ISE, and Secure Malware Analytics)Security products and what automating them achieves.

What it means: Cisco XDR correlates telemetry across products for detection and response. Firepower (Secure Firewall) appliances are managed through the Firewall Management Center REST API. Secure Connect is a cloud-delivered SASE offering. Secure Endpoint protects hosts and offers an API for computers and events. ISE controls network access, with ERS and pxGrid APIs. Secure Malware Analytics (formerly Threat Grid) runs sandbox analysis.
What to understand: Security APIs let teams automate investigation and response: query XDR for observables, isolate a host with Secure Endpoint, update firewall objects through the management center, submit a file for sandboxing, or create endpoint and identity records in ISE. Matching the action to the product is the main exam skill.
How it shows up: A security task is described, and you pick the product whose API performs it.
Common confusion: Confusing Secure Endpoint host isolation with ISE network access control.

3.6 Describe the device level APIs and dynamic interfaces for IOS XE and NX-OSProgrammatic access built into the switch and router OS.

What it means: IOS XE supports NETCONF, RESTCONF and gNMI driven by YANG models, plus model-driven telemetry, guest shell for on-box Python, and EEM. NX-OS offers NX-API CLI, which sends CLI commands over HTTP and returns JSON or XML, NX-API REST based on the DME object model, NETCONF, RESTCONF and gRPC, plus on-box Python and Bash.
What to understand: Device-level interfaces let scripts manage individual boxes without a controller. NX-API CLI is convenient for wrapping existing show commands, while model-driven options return structured data defined by YANG. Telemetry streams data from the device instead of relying on polling, which suits monitoring at scale.
How it shows up: Choose the device API that fits a stated requirement on IOS XE or NX-OS.
Common confusion: Thinking NX-API CLI is model-driven; it wraps CLI commands.

3.7 Describe the appropriate DevNet resource for a given scenario (Sandbox, Code Exchange, support, forums, Learning Labs, and API documentation)Where developers find labs, code, help and reference material.

What it means: DevNet Sandbox provides free always-on or reservable lab environments with Cisco platforms. Code Exchange is a catalogue of community and Cisco code repositories. Learning Labs are guided tutorials. API documentation gives endpoint references. Forums and developer support help with questions and problems.
What to understand: Match the need: test code against a real Catalyst Center without owning one, use Sandbox; find a sample script, use Code Exchange; learn a new API step by step, use Learning Labs; check a parameter, use the API documentation; get help with an error, use forums or support.
How it shows up: A developer's need is described, and you choose the DevNet resource.
Common confusion: Choosing Learning Labs when the developer needs a live environment to test their own code.

3.8 Apply concepts of model driven programmability (YANG, RESTCONF, and NETCONF) in a Cisco environmentUsing YANG-defined data with NETCONF and RESTCONF on Cisco devices.

What it means: YANG is a data modelling language describing configuration and operational data as containers, lists and leaves. NETCONF uses SSH on TCP 830 with XML-encoded RPCs such as get, get-config, edit-config, lock and commit against datastores like running and candidate. RESTCONF uses HTTPS to expose YANG data as URIs, with JSON or XML.
What to understand: On IOS XE you enable netconf-yang or restconf, then query paths such as /restconf/data/ietf-interfaces:interfaces with Accept: application/yang-data+json. Models come from IETF, OpenConfig and Cisco native modules. NETCONF supports transactions and candidate datastores; RESTCONF maps operations to HTTP methods for simpler use.
How it shows up: Choose NETCONF or RESTCONF for a requirement, or build a RESTCONF URI from a YANG model.
Common confusion: Using application/json instead of the yang-data media types RESTCONF expects.

3.9 Construct code to perform a specific operation based on a set of requirements and given API reference documentation such as these: a. Obtain a list of network devices by using Meraki, Cisco Catalyst Center, ACI, Cisco Catalyst SD-WAN, or NSO; b. Manage spaces, participants, and messages in Webex; c. Obtain a list of clients / hosts seen on a network using Meraki or Cisco Catalyst CenterWriting real calls for common platform tasks.

What it means: This objective joins request construction with platform knowledge: authenticate to the platform, call the documented endpoint for devices, rooms, memberships, messages or clients, then loop over the JSON result to extract fields.
What to understand: Typical flows: Meraki uses an organisation ID to list devices or a network ID to list clients; Catalyst Center needs a token, then GET /dna/intent/api/v1/network-device; Webex uses POST /v1/rooms, /v1/memberships and /v1/messages with a bearer token. The exam supplies documentation, so focus on following it accurately and handling the response structure.
How it shows up: Complete a script that lists devices or clients, or creates a Webex space and posts a message.
Common confusion: Forgetting that Meraki calls usually need an organisation or network ID obtained from an earlier call.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Meraki Dashboard API

Cloud REST API authenticated with an API key.

Remember
Organisation, then network, then device hierarchy.

Tested as
Device and client listing code.

Trap
Calling the device endpoint without an organisation ID.
Catalyst Center intent API

Northbound REST API of the campus controller.

Remember
Token from /dna/system/api/v1/auth/token, then X-Auth-Token.

Tested as
Authentication and inventory questions.

Trap
Using the old DNA Center name as a different product.
APIC REST API

ACI's interface to its managed object tree.

Remember
Everything is an object with a distinguished name.

Tested as
Data centre scenarios.

Trap
Choosing Catalyst Center for fabric policy.
NSO

Multivendor service orchestration using YANG models and NEDs.

Remember
Abstracts device differences behind services.

Tested as
Platform matching.

Trap
Treating it as a monitoring tool.
AXL vs UDS

SOAP provisioning API versus REST user data service on CUCM.

Remember
AXL writes configuration; UDS reads user data.

Tested as
Collaboration API selection.

Trap
Calling AXL RESTful.
NETCONF

XML RPCs over SSH port 830 against datastores.

Remember
Supports candidate datastore and commit.

Tested as
Protocol comparison items.

Trap
Saying it runs over HTTPS.
RESTCONF

HTTPS access to YANG data via URIs.

Remember
Media type application/yang-data+json or +xml.

Tested as
URI and header completion.

Trap
Using plain application/json.
YANG

Modelling language with containers, lists and leaves.

Remember
Defines structure, not transport.

Tested as
Model interpretation.

Trap
Confusing YANG with an encoding like XML.
NX-API CLI

CLI commands over HTTP with structured output.

Remember
Not model-driven.

Tested as
NX-OS interface selection.

Trap
Calling it RESTCONF.
DevNet Sandbox

Free lab environments with Cisco platforms.

Remember
Use it to test code without owning hardware.

Tested as
Resource selection items.

Trap
Picking Code Exchange for a lab.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

NETCONF vs RESTCONF

Concept	Meaning	Key difference	Common trap
Transport	NETCONF uses SSH; RESTCONF uses HTTPS	Port 830 versus 443	Assuming both use HTTPS
Encoding	NETCONF XML; RESTCONF JSON or XML	Only RESTCONF offers JSON	Expecting JSON from NETCONF
Operations	NETCONF RPCs; RESTCONF HTTP methods	edit-config versus PUT or PATCH	Mapping get-config to POST
Datastores	NETCONF supports candidate and commit	Transactional changes	Assuming RESTCONF has candidate commit by default

Network management platforms

Concept	Meaning	Key difference	Common trap
Meraki	Cloud-managed networking	SaaS dashboard, API key	Expecting an on-premises controller
Catalyst Center	Campus and branch controller	On-premises, token auth, assurance	Choosing it for data centre fabrics
ACI	Data centre policy fabric	APIC object model	Using it for branch Wi-Fi
NSO	Multivendor orchestration	YANG services across vendors	Treating it as single-vendor

Compute platforms

Concept	Meaning	Key difference	Common trap
UCS Manager	Single UCS domain management	On-premises XML API	Expecting JSON REST
Intersight	Cloud-based multisite management	REST with API key signing	Assuming it manages one domain only

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Model-driven protocol

What candidates pick
NETCONF for a JSON over HTTPS need

Why it looks right
NETCONF is the best-known YANG protocol

Why it's wrong
NETCONF runs over SSH with XML, so a JSON over HTTPS requirement points to RESTCONF.

Clue to watch for The stem specifies HTTPS or JSON.
CUCM provisioning

What candidates pick
UDS to add phones in bulk

Why it looks right
UDS sounds like the user-focused API

Why it's wrong
UDS is mainly read-oriented user data; bulk configuration is done with AXL.

Clue to watch for Verbs like add, provision or update on CUCM.
Host isolation

What candidates pick
ISE to isolate an infected laptop's processes

Why it looks right
ISE controls endpoint access

Why it's wrong
Isolating a host at the endpoint agent is a Secure Endpoint capability; ISE controls network admission.

Clue to watch for Malware or endpoint agent wording.
DevNet resource

What candidates pick
Learning Labs to test custom code against a controller

Why it looks right
Labs sound hands-on

Why it's wrong
Learning Labs are tutorials; a reservable live controller comes from DevNet Sandbox.

Clue to watch for The developer has their own code to test.
NX-OS interface

What candidates pick
RESTCONF to send existing show commands

Why it looks right
RESTCONF is a modern API

Why it's wrong
Sending CLI commands over HTTP and getting JSON back is NX-API CLI.

Clue to watch for The stem mentions existing CLI commands.

Answer framework

Use this sequence when a scenario asks which Cisco platform, API or protocol fits, or asks you to complete platform code.

Classify the environment in the stem: cloud-managed sites, campus, data centre, WAN, compute, collaboration or security, and list the candidate platforms.
Decide whether the task is controller-level across many devices or device-level on one box, which separates platform APIs from IOS XE and NX-OS interfaces.
Check stated constraints such as transport, encoding, port or multivendor support, which usually rule out all but one protocol or platform.
Identify the authentication pattern for the chosen platform, such as an API key, bearer token or token obtained through basic authentication.
For code items, follow the documentation exactly, including prerequisite IDs, the endpoint path and how the JSON response is looped and printed.

Practice question

A developer must list every client seen in the last day on one site that is managed through a cloud dashboard. Documentation gives GET /networks/{networkId}/clients?timespan=86400 and requires an API key header. The developer knows only the organisation name. What should the script do first?

Call the Catalyst Center token endpoint to obtain an X-Auth-Token Send a NETCONF get request to the site's switches on port 830 Call the clients endpoint with the organisation name as networkId Retrieve the organisation and network IDs from the organisations and networks endpoints

Show the answer

Answer D. The cloud dashboard here is Meraki, whose resources are nested: organisation, then network, then clients. The clients endpoint needs a network ID, so the script must first look up the organisation ID and then that organisation's networks to find the right ID. A name is not an ID. Catalyst Center tokens and NETCONF apply to different platforms and transports, not to the Meraki Dashboard API.

Want more like this? The CCNA Automation practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split the domain into two halves. The first half is product knowledge for objectives 3.2 to 3.7. Build a table with one row per platform listing what it manages, where it runs, its API style and how it authenticates, and quiz yourself from scenario to platform rather than from name to definition. Pay attention to the current names Cisco uses in the v1.1 blueprint so older study material does not confuse you.

The second half is hands-on. Reserve a DevNet Sandbox for Catalyst Center and use the always-on Meraki and IOS XE sandboxes. Write scripts that list devices and clients, then repeat the same task with the vendor SDK to see what the library hides. Create a Webex bot, a space and a message through the API. Finally, query an IOS XE device with both RESTCONF and NETCONF, using ncclient for the latter, and compare the output. That direct comparison makes the protocol questions far easier than memorising a table alone.

FAQ

How much of the exam does Cisco Platforms and Development cover?

Cisco Platforms and Development is 15% of the 200-901 CCNA Automation exam, with nine official objectives across SDKs, platform APIs, device interfaces, DevNet resources and model-driven programmability.

Which platforms are named in this domain?

Meraki, Catalyst Center, ACI, Catalyst SD-WAN, NSO, UCS Manager, Intersight, Webex, Webex devices, Unified Communications Manager, XDR, Firepower, Secure Connect, Secure Endpoint, ISE and Secure Malware Analytics.

Is Catalyst Center the same as DNA Center?

Yes. Cisco renamed DNA Center to Catalyst Center, and the v1.1 exam topics use the new name. Older study material and some API paths still show dna.

Do I need hardware to practise?

No. DevNet Sandbox provides free always-on and reservable labs for most platforms in this domain, including IOS XE, Meraki and Catalyst Center.

How does this domain differ from Domain 5 on model-driven programmability?

Domain 3 applies YANG, NETCONF and RESTCONF on Cisco devices, while Domain 5 focuses on their value for automation and interpreting query results and YANG models.

Will I have to memorise API endpoint paths?

Objective 3.9 provides API reference documentation, so you mainly need to follow it accurately. Knowing common paths for Meraki, Catalyst Center and Webex still speeds you up.

Related domains

Other Networking certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

CCNA Automation Domain 3: Cisco Platforms and Development

Overview

How it's tested

Platform selection

Code against documentation

Protocol details

Objectives 9

High-yield concepts

Meraki Dashboard API

Catalyst Center intent API

APIC REST API

NSO

AXL vs UDS

NETCONF

RESTCONF

YANG

NX-API CLI

DevNet Sandbox

Side by side

NETCONF vs RESTCONF

Network management platforms

Compute platforms

Exam traps

Model-driven protocol

CUCM provisioning

Host isolation

DevNet resource

NX-OS interface

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Networking certifications

Test your Domain 3 knowledge

Keep going