N10-009 Question 133
Single answerInfrastructure as code (IaC) Automation: Playbooks/templates/reusable tasks, Configuration drift/compliance, Upgrades, Dynamic inventoriesA network team manages switch and router configurations across multiple branch offices using infrastructure as code. Devices are grouped by site and model, and the automation system pulls the device list from the source-of-truth platform each time a job runs. Recently, several branches failed a compliance audit because local admins made manual changes that were not reflected in the approved templates. The team also wants future OS upgrades to target only devices that meet a required hardware and software profile without maintaining static host lists. Which approach BEST addresses both the compliance drift issue and the upgrade targeting requirement?
- A
Use reusable playbooks with standardized templates to enforce the approved configuration state, and use a dynamic inventory to select eligible devices for upgrades at runtime
- B
Export the current running configurations from all devices into static inventory files before each upgrade so the inventory reflects the latest device state
- C
Schedule nightly manual reviews of device configurations and maintain separate upgrade spreadsheets for each branch office
- D
Create one large monolithic playbook per branch that hard-codes device IP addresses and skips template validation to avoid overwriting local changes
Show answer and explanation
Correct answer: A
Explanation
The best answer is to combine declarative, reusable automation artifacts with dynamic inventory. In IaC workflows, templates and reusable tasks or playbooks help enforce a known-good configuration baseline and correct configuration drift when unauthorized manual changes occur. Dynamic inventory improves operational accuracy by querying a source of truth or inventory system at job runtime, allowing upgrades to target devices that match current facts such as model, location, memory, or software version rather than relying on static lists. This aligns with common automation best practices used in tools such as Ansible, where inventories can be dynamically generated and templates can render standardized device configurations. It also supports compliance efforts by making the approved configuration repeatable, auditable, and easier to validate before and after change windows.
- A. Correct.
Correct. Reusable playbooks and templates are a core IaC practice for standardizing network configurations and remediating configuration drift by continuously enforcing the intended state. A dynamic inventory is also the best fit for upgrade targeting when device membership should be determined at runtime from a source of truth, such as device attributes, site, platform, or software version. This reduces errors from stale host lists and supports compliance-driven automation.
- B. Incorrect.
Incorrect. Exporting running configurations into static inventory files mixes operational state with inventory management and does not solve drift. Static inventories become outdated quickly and are not ideal for selecting upgrade candidates based on changing device facts. Inventory should identify managed nodes, while configuration templates and validation logic should enforce approved state.
- C. Incorrect.
Incorrect. Manual reviews and spreadsheets do not scale well and are contrary to IaC automation goals. They may help discover problems, but they do not automatically remediate drift or reliably target upgrades based on real-time device attributes. This approach increases operational overhead and the risk of human error.
- D. Incorrect.
Incorrect. A monolithic playbook with hard-coded IP addresses is difficult to maintain, reuse, and audit. Skipping template validation undermines configuration compliance and allows drift to persist. Hard-coded host lists also make selective upgrades harder as environments change.