CCNA Automation (Cisco, exam 200-901) — knowledge map
The 41 core concepts of CCNA Automation (Cisco, exam 200-901) and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (41)
NETCONF, RESTCONF, and YANG
YANG is a data-modeling language that defines a device's configuration and state as a hierarchy of leaves, lists, and containers. NETCONF is a protocol that runs over SSH using XML messages to push YANG-modeled configuration transactionally into datastores such as candidate and running. RESTCONF is a more approachable protocol that accesses the same YANG models over HTTP with JSON/XML, mapping GET/POST/PUT/PATCH/DELETE onto CRUD operations.
Prerequisites: CRUD operations、JSON
HTTP
The unencrypted application-layer protocol (port 80) that browsers and servers use to exchange pages and data. Because its traffic is plaintext and open to eavesdropping or tampering, using TLS-protected HTTPS is now the standard.
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Catalyst Center (formerly DNA Center)
Cisco's centralized management controller for enterprise networks. It unifies automated device discovery and bulk provisioning, SD-Access policy distribution, assurance (health visibility), and a REST API automation entry point into one dashboard. Formerly named DNA Center.
CRUD operations
An acronym for the basic operations on data or resources: Create, Read, Update, and Delete. In a RESTful API these commonly map to the HTTP methods POST, GET, PUT (or PATCH), and DELETE respectively.
Prerequisites: REST API (network automation)、HTTP
Ansible (network automation)
A configuration-management tool that declares desired configuration in YAML-formatted playbooks and applies it in bulk to many network devices over SSH or an API without requiring an agent on the device. Modules written in Python absorb per-vendor differences, and the design emphasizes idempotency — running the same playbook repeatedly produces the same result.
Prerequisites: Idempotency、YAML
REST API (network automation)
An API design style that operates on resources using HTTP methods (GET/POST/PUT/DELETE, etc.). It lets scripts query and change configuration on a controller such as Catalyst Center by exchanging JSON-formatted data, enabling bulk operations across many devices instead of logging into each device's CLI individually.
Prerequisites: Catalyst Center (formerly DNA Center)、HTTP、JSON
Cisco SDK
A family of developer libraries that let code call the APIs of Cisco platforms (Meraki, Catalyst Center, ACI, and others) without hand-assembling raw HTTP requests. It absorbs boilerplate such as authentication, pagination, and error handling so the developer can focus on business logic.
Prerequisites: Catalyst Center (formerly DNA Center)、API rate limiting and pagination、HTTP、Meraki and network management systems
XML
A markup language that expresses hierarchical structure with tags. It is the message format NETCONF uses, and device configuration is sometimes represented as an XML document too. It is more verbose than JSON, but differs in supporting strict validation via a schema (XSD) and inline comments.
Prerequisites: NETCONF, RESTCONF, and YANG、JSON
Bare metal and containers (deployment models)
Bare metal deploys a single OS that owns the hardware with no hypervisor; it assumes no sharing with other workloads and delivers the best performance (its "isolation" is not directly comparable on the same axis as VMs/containers). A virtual machine separates a whole guest OS via a hypervisor — strong isolation but heavy. A container isolates a process while sharing the host OS kernel — moderate isolation, lightweight, with fast startup and good portability. Choose based on the tradeoff among isolation strength, weight, and performance.
Prerequisites: Azure Virtual Machines (VM)
DevNet Sandbox
A free hands-on environment Cisco provides for developers. Always-on and reservable sandboxes let you try the APIs and NETCONF/RESTCONF of platforms like Meraki, Catalyst Center, and ACI without owning real hardware, and together with Code Exchange (shared sample code), Learning Labs, and the API docs they form the core of DevNet's resources.
Prerequisites: Catalyst Center (formerly DNA Center)、NETCONF, RESTCONF, and YANG、Meraki and network management systems
Management plane
The functional plane that carries the traffic an operator uses to manage the device itself — configuration, monitoring, software updates — via things like SSH, HTTPS, SNMP, and NETCONF. It plays a different role from the control plane (which decides forwarding rules) and the data plane (which forwards actual packets); because unauthorized access to the management plane hands over the whole device, restricting access to it is especially critical.
Prerequisites: NETCONF, RESTCONF, and YANG、Control Plane and Data Plane、SNMP
Unit testing and secret management
A unit test verifies the smallest unit of logic — a function or class — in isolation; in Python this typically means unittest or pytest, run automatically on every change as part of the CI/CD pipeline. Secret management is the practice of keeping secrets like API keys and passwords out of code as plaintext, externalizing them to environment variables or a vault (a dedicated secrets service) instead, to prevent them from accidentally being committed to a repository.
Prerequisites: Basic authentication, API keys, and bearer tokens、CI/CD
Meraki and network management systems
Meraki (Cisco Meraki) is Cisco's brand of network equipment managed centrally from the cloud, letting an administrator configure and monitor multiple sites from one dashboard. A network management system (NMS) is a general term for software that centrally monitors status, configures, and detects faults for such switches, routers, and access points.
CI/CD
CI (continuous integration) automatically builds and tests code on every change to catch defects early. CD has two meanings: continuous delivery automates everything up to a release-ready state but keeps a manual approval for the production release, while continuous deployment automates all the way to production.
Load balancer (L4/L7)
A device that distributes load across multiple servers. An L4 load balancer distributes based on IP address and port; an L7 load balancer can interpret application-layer information such as HTTP URL paths and cookies, enabling path-based routing and cookie-based session persistence. Health checks automatically remove failed servers from rotation.
Prerequisites: HTTP、Port number
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Basic authentication, API keys, and bearer tokens
Three common ways to authenticate an API call. Basic authentication Base64-encodes a username and password into a header — simple but weak. An API key sends a fixed, issued key string in a header or query parameter. A bearer token presents a temporary token issued after authentication (such as an OAuth access token) via an "Authorization: Bearer" header, and its expiry limits the damage if it leaks.
API rate limiting and pagination
API rate limiting caps the number of requests allowed per unit of time, rejecting excess requests with a 429 error, which requires the client to retry with backoff. Pagination avoids returning a large result set all at once by capping how many records one response holds and having the client fetch the rest page by page (or token by token). Both are constraints an API consumer must design around.
HTTP methods and HTTP status codes
An HTTP method expresses the intent of a request (GET to read, POST to create, PUT to replace wholesale, PATCH to update partially, DELETE to remove). An HTTP status code expresses the outcome of a response (2xx success, 3xx redirect, 401 unauthenticated, 403 forbidden, 404 not found, 429 rate limited, 5xx server error). Troubleshooting an API call means isolating the cause from the combination of the method you sent and the status code you got back.
Prerequisites: HTTP
pyATS and Cisco Modeling Labs (CML)
pyATS (Python Automated Test System) is a Cisco test framework that automates checking device state and running test scenarios in Python. Cisco Modeling Labs (CML) is an environment that simulates a network topology using virtual instances of routers, switches, and the like, letting configuration changes and automation scripts be validated ahead of time without real hardware.
Prerequisites: Network topology
Cisco Catalyst SD-WAN and NSO
Cisco Catalyst SD-WAN (formerly Viptela) is a controller-based SD-WAN solution that centrally manages WAN connectivity between sites, with configuration and monitoring automated through APIs such as Catalyst SD-WAN Manager (formerly vManage). NSO (Network Services Orchestrator) is a multi-vendor tool that declaratively orchestrates configuration across many devices at once using YANG service models and NETCONF.
Prerequisites: NETCONF, RESTCONF, and YANG
Unified diff
A standard text format for expressing the difference between two files (or the same file before and after a change). Removed lines are prefixed with "-", added lines with "+", and each changed region is introduced by a hunk header starting with "@@". It is the format behind Git diffs and is widely used in code review and configuration-change review.
Prerequisites: Code review (Pull Request)
Git
The most popular distributed version control tool; each person keeps a full local copy of the history.
Prerequisites: Version control system (VCS)
Infrastructure as Code (IaC)
Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.
Prerequisites: Version control system (VCS)
Idempotency
A property where repeating the same operation any number of times yields the same result. Distributed systems often duplicate requests via network retries; an idempotent design (e.g., using an idempotency key) lets duplicate delivery be handled safely.
SNMP
A protocol for monitoring and managing network devices. In addition to polling (GET) where the manager periodically queries agents, it has traps by which an agent proactively notifies on events. Management data is structured in a MIB (identified by OIDs). SNMPv3 adds authentication and encryption, resolving the plaintext-community weakness of v1/v2c.
Version control system (VCS)
A system that records the history of file changes, enabling revert, tracing who/why, and collaboration.
Azure Virtual Machines (VM)
IaaS virtual machines; the most flexible compute where you manage the OS and above.
Dockerfile
Docker is the leading platform for building and running containers. A Dockerfile is the text file describing how to build a container image, stacking instructions such as FROM (base image), RUN (commands executed at build time), COPY (place files), CMD (the startup command), and EXPOSE (the port to publish) to define the image, which docker build then turns into an image and docker run executes.
Prerequisites: Bare metal and containers (deployment models)
Model-driven programmability
The idea of operating a device's configuration and state through a common data model, such as YANG, rather than issuing device-specific CLI commands one by one. As long as the model is the same, the same code and process can drive devices from different models and even different vendors, which is what lets automation scale.
Prerequisites: NETCONF, RESTCONF, and YANG
OWASP
A nonprofit organization dedicated to improving web application security, and the collective term for the guidance it publishes. Its best-known deliverable, the OWASP Top 10, catalogs the vulnerability classes that occur most often in practice; in the 2021 edition the top entries include A01 Broken Access Control and A03 Injection (which subsumes SQL injection and cross-site scripting (XSS)) — XSS, formerly its own item, was merged into A03, and CSRF is no longer a standalone item; the list is revised periodically. It is widely used as a reference for what application developers should prioritize fixing.
Prerequisites: Cross-site request forgery (CSRF)
Python requests library
A popular third-party Python library (not part of the standard library — it must be pip-installed) for sending HTTP requests. A typical call looks like requests.get(url, headers=, auth=, params=); the response is checked via resp.status_code, and resp.json() converts the response body into a Python dict/list. It also supports POST/PUT and options like verify= for TLS verification, and is the go-to way to call a network device or controller's REST API from a script.
Network topology
The arrangement of network devices and cabling. Physical topology describes how cabling is actually laid out (star, bus, ring, mesh, and so on), while logical topology describes the path data actually follows. Most enterprise LANs today use a switch-centered physical star topology.
Webhook
Sends HTTP notifications to an external URL when repo/org events occur, used to automate CI integrations, SIEM, ticket creation, etc.
Prerequisites: HTTP
Control Plane and Data Plane
The control plane handles route computation and policy decisions that determine forwarding rules, while the data plane executes the actual packet forwarding according to those rules. SDN separates the two and centralizes the control plane, allowing flexible, network-wide programmatic control.
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: HTTP
Northbound API and southbound API
Names for the direction of an API relative to a controller. A northbound API is the interface a controller exposes upward to applications and automation tools (for example, a REST API), while a southbound API is the interface the controller uses downward to control the devices it manages (for example, NETCONF or OpenFlow).
Prerequisites: NETCONF, RESTCONF, and YANG
Cross-site request forgery (CSRF)
An attack that exploits a user's active login session on a legitimate site, tricking them via a malicious site into sending an unintended request (such as a transfer or post) to the legitimate site. It is prevented by verifying one-time tokens and similar measures.
Code review (Pull Request)
Commenting on a diff in a Pull Request and approving or requesting changes; required reviews and CODEOWNERS-required reviewers enforce quality before merge.
MAC Address
A MAC address is a 48-bit physical address that uniquely identifies a network interface at the data-link layer, composed of a 24-bit OUI (vendor identifier) and a 24-bit vendor-assigned serial number. Unlike an IP address, it is fixed to the device rather than changing with network topology, and is used to identify frame destinations within a single data-link (L2) segment.
Prerequisites: Network topology