N10-009 Question 132
Single answerInfrastructure as code (IaC) Automation: Playbooks/templates/reusable tasks, Configuration drift/compliance, Upgrades, Dynamic inventoriesA network operations team uses infrastructure as code to manage configurations on hundreds of branch routers and switches across multiple cloud and on-premises environments. New devices are added weekly, and auditors recently found that several branch devices had manual VLAN and NTP changes that no longer matched the approved baseline. The team also needs a safer way to roll out OS upgrades in phases without maintaining separate static host lists. Which solution BEST addresses these requirements while reducing ongoing administrative effort?
- A
Use a dynamic inventory to automatically discover current devices, apply standardized playbooks with reusable tasks and templates to enforce the approved configuration, and execute phased upgrades by targeting inventory groups.
- B
Export the current running configuration from each device, save the files in a shared folder, and have engineers manually compare them before performing upgrades one device at a time.
- C
Create a separate static inventory file for each site and duplicate the full configuration commands in every playbook so that upgrades can be run independently per location.
- D
Disable configuration management during upgrade windows so devices can complete the upgrade without compliance checks, then rebuild the inventory manually after the maintenance window.
Show answer and explanation
Correct answer: A
Explanation
The best answer is the one that combines dynamic inventories, reusable automation components, drift remediation, and controlled upgrades into a single operational model. In infrastructure as code workflows, templates and reusable tasks support standardization and reduce copy-and-paste errors. Dynamic inventory is a best practice when devices or instances change frequently because it avoids stale host lists and improves targeting accuracy. Reapplying approved configurations through automation is a common way to detect and correct configuration drift, supporting compliance objectives. For upgrades, phased deployment by inventory group is safer than broad, unstructured rollouts because it allows validation on a smaller subset before expanding. These practices align with common automation guidance from tools such as Ansible, where inventories, playbooks, roles, and templates are used together to manage configuration state consistently across changing environments.
- A. Correct.
Correct. This approach directly addresses all of the stated requirements. A dynamic inventory helps automatically track devices as environments change, which is especially useful when new branch devices are added regularly. Using playbooks with reusable tasks and templates promotes consistency and reduces duplication, making it easier to enforce baseline settings such as VLAN and NTP configuration. Applying those playbooks repeatedly helps identify and remediate configuration drift. For upgrades, targeting groups from the inventory supports staged rollouts, such as upgrading one region or device class at a time, which reduces operational risk.
- B. Incorrect.
Incorrect. Backing up running configurations is useful, but this process is largely manual and does not scale well to hundreds of devices. It also does not provide an automated way to detect and correct configuration drift or to consistently enforce compliance against an approved baseline. Performing upgrades one device at a time may reduce risk in very small environments, but it increases administrative effort and does not meet the requirement to reduce ongoing overhead.
- C. Incorrect.
Incorrect. Static inventories can work in small, stable environments, but they create extra maintenance when devices are added frequently. Duplicating full command sets in every playbook is also a poor IaC practice because it increases the chance of inconsistency and makes updates harder. Reusable tasks and templates are specifically intended to avoid this type of duplication and improve standardization.
- D. Incorrect.
Incorrect. Disabling configuration management during upgrades undermines compliance and increases the likelihood that drift will go unnoticed or unresolved. Manually rebuilding inventory after maintenance also adds unnecessary work and introduces opportunities for error. Best practice is to keep inventory and automation aligned with the live environment, not suspend them during a critical operational change.