Overview
Automation and Artificial Intelligence is 15% of ENCOR and has seven exam topics, the most of any domain: interpreting basic Python components and scripts, constructing valid JSON-encoded files, describing YANG and the benefits of data modeling, describing the APIs for Cisco Catalyst Center and SD-WAN Manager, interpreting REST API response codes and payloads from Catalyst Center and RESTCONF, constructing an EEM applet, and comparing agent and agentless orchestration tools.
The verbs set the depth: you interpret Python rather than write programs, but you must construct JSON and EEM applets correctly. The domain builds on Network Assurance, where NETCONF and RESTCONF are enabled, and on Security, where API access is protected. Despite the domain name, the listed topics focus on automation; AI appears in the Catalyst Center workflows covered under Network Assurance.
How it's tested
Expect code and data reading. Exhibits show Python snippets, JSON documents, YANG fragments, API responses or EEM configurations, and ask for the output, the error, the missing line or the correct choice. Conceptual items compare orchestration tools or API types. Read exhibits literally; syntax errors and data-structure paths are deliberate.
-
Predict the script output
A Python snippet parses a JSON API response, and you determine what it prints or which key path extracts a value.
-
Spot the invalid structure
A JSON body or EEM applet is shown with a subtle error, and you identify why it fails or which version is valid.
-
Interpret the API exchange
A REST request and response code are shown, and you explain what happened or which header, method or endpoint is needed.
An exhibit shows Python calling a Catalyst Center endpoint, then printing data['response'][1]['hostname']. The returned JSON has a response list with three device objects. Python lists start at index 0, so index 1 selects the second device. The question asks which hostname prints; you choose the second object's hostname, not the first.
Exam topics 7
Official exam topics from the Cisco outline, in outline order.
6.1 Interpret basic Python components and scriptsReading variables, data types, loops, conditionals, functions and API calls in Python.
- What it means
- This topic covers reading short Python scripts used for network automation: strings, integers, lists, dictionaries and booleans, for loops and if statements, functions, imports such as requests and json, and how a script sends an API call and processes the response.
- What to understand
- Indentation defines blocks, lists are indexed from 0, and dictionaries are accessed by key, so nested API data is read with chains such as resp['response'][0]['managementIpAddress']. json.loads turns a JSON string into Python objects and json.dumps does the reverse, while requests returns a response object whose status_code and json() method are used to check and parse results.
- How it shows up
- A script loops through a device list from an API and prints selected fields, and you predict the output or find the line that raises an error.
- Common confusion
- Treating a JSON array like a dictionary, or forgetting that the first list element is index 0.
6.2 Construct valid JSON-encoded filesBuilding syntactically correct JSON objects, arrays and values.
- What it means
- This topic covers JSON syntax: objects in braces with key and value pairs, arrays in brackets, and values that are strings, numbers, true, false, null, objects or arrays.
- What to understand
- Keys and string values must use double quotes, items are separated by commas with no trailing comma after the last one, and JSON allows no comments. Booleans and null are lowercase and unquoted, and numbers are unquoted unless the receiving model expects a string.
- How it shows up
- Several JSON bodies for a RESTCONF or controller request are shown and you pick the valid one, or you identify why a payload is rejected.
- Common confusion
- Accepting single quotes or Python-style True and None, which are valid Python but invalid JSON.
6.3 Describe the high-level principles and benefits of a data modeling language, such as YANGHow YANG structures configuration and state data and why that helps automation.
- What it means
- This topic covers YANG (RFC 7950), the modeling language that defines the structure, data types and constraints of configuration and operational data, which NETCONF and RESTCONF then carry as XML or JSON.
- What to understand
- YANG modules are built from containers (groupings of nodes), lists (repeated entries identified by a key), leaves (single values) and leaf-lists (sets of values), with typedefs and groupings for reuse. Standard models from the IETF and OpenConfig give vendor-neutral structure, while native models expose platform-specific features, and a client can validate data against the model before it reaches the device.
- How it shows up
- A YANG fragment or tree is shown and you identify whether a node is a container, list or leaf, or a question asks what benefit a data model provides over screen-scraping CLI output.
- Common confusion
- Treating YANG as a transport protocol; it only describes data, and NETCONF or RESTCONF move that data.
6.4 Describe APIs for Cisco Catalyst Center and SD-WAN ManagerController API types, authentication flows and typical uses.
- What it means
- This topic covers the northbound REST APIs of Catalyst Center (Intent API, with integration, multivendor and events and notifications interfaces alongside it) and SD-WAN Manager, including how clients authenticate and what tasks the APIs automate.
- What to understand
- Catalyst Center clients POST basic credentials to the token endpoint and then send the token in the X-Auth-Token header to Intent API endpoints such as the network device list; long operations return a task ID to poll. SD-WAN Manager clients authenticate to j_security_check to receive a session cookie, then request an XSRF token for state-changing calls, and use /dataservice endpoints for devices, templates and statistics.
- How it shows up
- A scenario asks which API direction or interface sends events to an external system, or which header or authentication step a script is missing.
- Common confusion
- Mixing the authentication flows: Catalyst Center uses an X-Auth-Token header, while SD-WAN Manager uses a session cookie plus an XSRF token for write operations.
6.5 Interpret REST API response codes and results in payload using Cisco Catalyst Center and RESTCONFReading HTTP status codes and JSON or XML payloads.
- What it means
- This topic covers interpreting HTTP status codes and response bodies returned by Catalyst Center and by RESTCONF on IOS XE devices, including success, client error and server error codes.
- What to understand
- 200 OK returns data, 201 Created confirms a new resource, 202 Accepted means an asynchronous task was queued, and 204 No Content means success with no body, common for RESTCONF PUT, PATCH and DELETE. 400 is a malformed request, 401 failed authentication, 403 insufficient permission, 404 an unknown resource, 405 an unsupported method, 409 a conflict such as POST to an existing resource, 415 an unsupported media type and 5xx a server-side failure.
- How it shows up
- A request and its status code or payload are shown, and you explain what happened and the next step, such as polling a task ID after a 202.
- Common confusion
- Treating 202 as completed work; it means the controller accepted the request and the task may still fail.
6.6 Construct an EEM applet to automate configuration, troubleshooting, or data collectionBuilding Embedded Event Manager applets with events and ordered actions.
- What it means
- This topic covers writing an EEM applet on IOS XE: event manager applet NAME, one event detector such as syslog pattern, cli pattern, timer, track or none, and numbered actions such as cli command, syslog msg and mail.
- What to understand
- Actions run in the sort order of their labels, which are compared as strings, so 1.0, 2.0 and 10.0 sort as 1.0, 10.0, 2.0 unless labels are padded or numbered consistently. Applets that run CLI commands usually start with action cli command "enable", and event none lets you trigger the applet manually with event manager run.
- How it shows up
- An applet is shown with a syslog pattern event and actions, and you predict what it does, or you choose the missing line that makes it collect show output when an interface goes down.
- Common confusion
- Assuming action labels run in numeric order; they are sorted as text.
6.7 Compare agent vs. agentless orchestration toolsHow orchestration tools reach devices with or without installed agents.
- What it means
- This topic covers the difference between agent-based orchestration, where software installed on each managed node communicates with a central server, and agentless orchestration, where the controller connects to devices using existing protocols such as SSH, NETCONF or APIs.
- What to understand
- Agent-based tools such as Puppet and Chef typically use a pull model in which agents check in periodically, which needs a supported agent on every node. Agentless tools such as Ansible push changes over SSH or APIs, which suits network devices where installing third-party agents is impractical. SaltStack normally uses minion agents but also offers an agentless SSH mode.
- How it shows up
- A scenario describes managing routers and switches that cannot run third-party software and asks which orchestration approach fits.
- Common confusion
- Assuming agentless means no credentials or connectivity are needed; the controller still needs network reachability and authenticated access to each device.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Python lists and dictionaries
A list is an ordered sequence indexed from 0, and a dictionary maps keys to values, which is how parsed JSON objects appear in Python.
- Remember
- JSON arrays become Python lists, JSON objects become dictionaries, and nested data is read by chaining index and key lookups.
- Tested as
- Almost every Python exhibit in topic 6.1 depends on reading these structures.
- Trap
- Using index 1 for the first element.
-
requests response handling
The requests library returns a response object; status_code gives the HTTP code and json() parses the body into Python objects.
- Remember
- Check status_code before using the body, and pass headers such as X-Auth-Token and Content-Type in a dictionary.
- Tested as
- Script snippets calling Catalyst Center or RESTCONF use this pattern.
- Trap
- Treating response.text as a dictionary without parsing it.
-
json.loads vs. json.dumps
json.loads converts a JSON string into Python objects, and json.dumps converts Python objects into a JSON string.
- Remember
- The trailing s stands for string; json.load and json.dump work with files.
- Tested as
- Asked when a script reads or builds a payload.
- Trap
- Swapping the two functions when predicting script output.
-
JSON syntax rules
JSON uses double-quoted keys and strings, comma-separated items, lowercase true, false and null, and no comments.
- Remember
- A trailing comma after the last item makes the whole document invalid.
- Tested as
- Topic 6.2 asks you to construct or choose valid JSON.
- Trap
- Accepting single quotes or Python True, False and None as JSON.
-
YANG node types
A container groups related nodes, a list holds repeated entries identified by a key, a leaf holds one value, and a leaf-list holds several values of one type.
- Remember
- Every YANG list needs a key for configuration data, such as an interface name.
- Tested as
- Topic 6.3 exhibits show YANG trees or modules.
- Trap
- Calling a list a container because both hold child nodes.
-
IETF, OpenConfig and native models
IETF and OpenConfig models are vendor-neutral, while native models expose the full feature set of a specific platform such as IOS XE.
- Remember
- Standard models improve portability; native models cover features the standards do not.
- Tested as
- Benefit questions ask why an organization would use standard models.
- Trap
- Assuming standard models cover every platform feature.
-
Catalyst Center Intent API
The northbound REST API for Catalyst Center, used to read inventory, topology and assurance data and to trigger provisioning and template actions.
- Remember
- Authenticate once for a token, send it as X-Auth-Token, and poll the returned task ID for long-running operations.
- Tested as
- Topic 6.4 and payload interpretation in 6.5.
- Trap
- Expecting immediate results from operations that return a task ID.
-
Catalyst Center API directions
Northbound is the Intent API used by applications, westbound covers integration with IT systems such as ITSM, southbound is the multivendor SDK for device support, and eastbound is events and notifications pushed to external systems.
- Remember
- Events and notifications, such as webhooks to an external platform, are the eastbound interface.
- Tested as
- Describe-level API questions often use these direction labels.
- Trap
- Labeling the Intent API as southbound because it changes devices.
-
SD-WAN Manager API authentication
Clients POST credentials to j_security_check to get a session cookie, then GET a token from the client token endpoint for the X-XSRF-TOKEN header on state-changing requests.
- Remember
- Read requests need the session cookie; POST, PUT and DELETE also need the XSRF token.
- Tested as
- Topic 6.4 compares the SD-WAN Manager and Catalyst Center API flows.
- Trap
- Sending an X-Auth-Token header to SD-WAN Manager.
-
HTTP status code families
2xx codes mean success, 4xx codes mean the client request was wrong, and 5xx codes mean the server failed to process a valid request.
- Remember
- 201 created, 202 accepted for later processing, 204 success with no body, 401 not authenticated, 403 not authorized, 409 conflict, 415 wrong media type.
- Tested as
- Topic 6.5 questions always require mapping a code to its meaning and next step.
- Trap
- Retrying a 4xx request unchanged as if it were a temporary server problem.
-
RESTCONF methods and codes
RESTCONF maps GET to read, POST to create a child resource, PUT to create or replace, PATCH to merge and DELETE to remove.
- Remember
- POST to a resource that already exists returns 409 Conflict, while successful PUT, PATCH and DELETE commonly return 204 No Content.
- Tested as
- Payload and response interpretation for IOS XE devices.
- Trap
- Using POST to update an existing interface instead of PATCH or PUT.
-
EEM action label ordering
EEM executes actions in the lexical sort order of their labels, not in numeric order or in the order typed.
- Remember
- Use consistent labels such as 010, 020 and 100, or 1.0 to 9.0, so text sorting matches the intended order.
- Tested as
- Topic 6.6 applets frequently test this with labels like 1, 2 and 10.
- Trap
- Expecting action 10 to run after action 9.
-
EEM event detectors
An applet has one event, such as event syslog pattern, event cli pattern, event timer watchdog or cron, event track or event none.
- Remember
- event none applets run only when triggered manually with event manager run; cli actions usually begin with enable.
- Tested as
- Constructing an applet for data collection on a syslog trigger is a typical item.
- Trap
- Forgetting to enter privileged mode before a show command that requires it.
-
Agent vs. agentless orchestration
Agent-based tools install software on each managed node that pulls configuration from a server, while agentless tools connect from a control node using SSH or APIs and push changes.
- Remember
- Puppet and Chef are classic agent-based tools, Ansible is agentless, and SaltStack uses minions but can run agentless over SSH.
- Tested as
- Topic 6.7 asks you to compare the approaches and fit them to device types.
- Trap
- Choosing an agent-based tool for network devices that cannot host third-party agents.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Agent-based vs. agentless orchestration
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Agent-based (for example Puppet, Chef) | Managed nodes run an agent that communicates with a central server | Usually pull model on a schedule; requires installing and maintaining agents | Assuming every router or switch can run the agent |
| Agentless (for example Ansible) | A control node connects to devices with SSH, NETCONF or APIs | Push model; nothing extra installed on managed devices | Assuming agentless means no credentials or reachability are required |
Catalyst Center API vs. SD-WAN Manager API
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Catalyst Center Intent API | Northbound REST API for campus inventory, assurance and provisioning | Token from the auth endpoint sent in X-Auth-Token; long tasks return a task ID | Using session cookies as with SD-WAN Manager |
| SD-WAN Manager API | REST API under /dataservice for SD-WAN devices, templates and statistics | Session cookie from j_security_check plus X-XSRF-TOKEN for changes | Omitting the XSRF token on POST requests |
200 vs. 201 vs. 202 vs. 204
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| 200 OK | Request succeeded and the body contains the result | Typical for GET | Expecting it for every successful change |
| 201 Created | A new resource was created | Typical for RESTCONF POST that creates data | Confusing it with an accepted but unfinished task |
| 202 Accepted | Request accepted for asynchronous processing | Work may still fail; poll the returned task | Reporting the change as complete |
| 204 No Content | Request succeeded and there is no body | Typical for RESTCONF PUT, PATCH and DELETE | Reading an empty body as a failure |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Python booleans in JSON
- What candidates pick
- A payload with "enabled": True is valid JSON.
- Why it looks right
- It is valid Python and looks correct to people who script.
- Why it's wrong
- JSON literals are lowercase: true, false and null; True and None are Python, not JSON.
Clue to watch for The answer choices differ only in capitalization or quoting of values.
-
Trailing comma
- What candidates pick
- The payload is valid because every key and value is correctly quoted.
- Why it looks right
- Many languages, including Python, accept trailing commas.
- Why it's wrong
- JSON does not allow a comma after the last item in an object or array, so parsers reject the document.
Clue to watch for Look at the final line before a closing brace or bracket.
-
202 means done
- What candidates pick
- The device was provisioned because Catalyst Center returned 202.
- Why it looks right
- 2xx codes indicate success.
- Why it's wrong
- 202 means the request was accepted for asynchronous processing; the task ID must be polled to learn whether it succeeded.
Clue to watch for The response body contains a taskId and an executionStatusUrl or similar reference.
-
EEM label order
- What candidates pick
- An applet with actions 1, 2 and 10 runs them in that order.
- Why it looks right
- Humans read the labels numerically.
- Why it's wrong
- EEM sorts labels as text, so 10 runs before 2, which can run a command before entering enable or configuration mode.
Clue to watch for Action labels have different numbers of digits.
-
YANG as a protocol
- What candidates pick
- Use YANG to send configuration to the router.
- Why it looks right
- YANG appears in every model-driven programmability discussion.
- Why it's wrong
- YANG defines the data structure; NETCONF or RESTCONF transport the data encoded in XML or JSON.
Clue to watch for The question asks how data is carried, not how it is structured.
-
Agent-based tool for switches
- What candidates pick
- Deploy an agent-based orchestration tool to manage a fleet of IOS XE switches.
- Why it looks right
- Agent-based tools are mature and popular for servers.
- Why it's wrong
- Network devices often cannot host third-party agents, so an agentless tool that connects over SSH, NETCONF or APIs fits better.
Clue to watch for The scenario stresses that no software may be installed on the managed devices.
-
POST to update
- What candidates pick
- Use RESTCONF POST to change the description of an existing interface.
- Why it looks right
- POST is the most familiar write method.
- Why it's wrong
- POST creates a new child resource and returns 409 if the target exists; PATCH merges changes and PUT replaces the resource.
Clue to watch for The resource already exists and the response shown is 409 Conflict.
Answer framework
Use this sequence for Automation and Artificial Intelligence exhibits, where literal reading of code and data decides the answer.
- Identify the artifact type, Python, JSON, YANG, API exchange or EEM applet, and recall its exact syntax rules before reading the choices.
- Trace data structure paths step by step, noting each list index from 0 and each dictionary key exactly as written.
- Check syntax hot spots: quotes, commas, capitalization of literals, indentation and EEM action label order.
- For API exchanges, confirm the authentication header or cookie, the HTTP method, the media type and what the status code says about the next step.
- For design comparisons, match the constraint in the scenario, such as no installable agents or a need for validated vendor-neutral data, to the right tool or model.
Practice question
Want more like this? The CCNP ENCOR practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with Python and JSON together, because every later topic uses them. Write a small script that requests a token from a Catalyst Center sandbox or lab, lists devices and prints selected fields; reading code you have run is much faster than reading code cold. Practise writing JSON by hand and validating it so quoting, commas and lowercase literals become automatic.
Next, cover YANG and RESTCONF as one block: browse a model such as ietf-interfaces, then send GET, POST, PATCH and DELETE requests to a lab router and note each status code. This turns topic 6.5 into recall of what you saw. Compare the Catalyst Center and SD-WAN Manager authentication flows in a two-column note.
Candidates underestimate EEM, which is a construct item and needs a working applet with correct action ordering, so build two or three applets that collect show output on a syslog event. Finish with the agent versus agentless comparison, which needs only a short table. Afterwards, practise timed exhibit questions mixing code, payloads and response codes.
FAQ
How much is Automation and Artificial Intelligence worth?
Cisco weights it at 15% of the ENCOR v1.2 exam, the same as Architecture. It has seven exam topics, the most of any domain.
Do I need to write Python programs for ENCOR?
Topic 6.1 says interpret basic Python components and scripts, so the focus is reading and predicting what scripts do. Writing small scripts while studying is still the fastest way to learn to read them.
Which parts of this domain require construction?
Topic 6.2 asks you to construct valid JSON and topic 6.6 asks you to construct an EEM applet. Expect to choose or complete correct syntax for both.
Are Ansible, Puppet and Chef named on the v1.2 blueprint?
No. The v1.2 topic is worded as comparing agent versus agentless orchestration tools without naming products. Product examples help you recognize scenarios, but the concept is what is tested.
Where is the artificial intelligence content?
The listed topics in this domain cover automation skills. AI is referenced in the outline under Network Assurance topic 4.5, which covers Catalyst Center's AI-powered workflows.
How is this domain related to Network Assurance?
Network Assurance covers enabling and verifying NETCONF and RESTCONF on devices. This domain covers using them from scripts, including YANG models, payloads and response codes.
Which HTTP codes should I memorize?
Know 200, 201, 202 and 204 for success, 400, 401, 403, 404, 405, 409 and 415 for client errors, and the meaning of the 5xx family. Each one points to a different next step.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
You have practised reading Python and JSON, matched REST codes to their next steps, and built EEM applets with correct label order. Test those skills on timed exhibits.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNP ENCOR AI tutor Get any concept explained your way