A security team wants to ensure that network devices are always in a known, secure state. They are considering an immutable infrastructure approach. Which practice best exemplifies this principle?

Allowing in-place configuration changes and then running a drift detection script.

Using a configuration management tool to push updates to existing devices.

Creating a golden image and using it to reimage devices periodically.

Deploying a new device with the desired configuration and decommissioning the old one when changes are needed.

What does idempotency mean in the context of Infrastructure as Code?

The configuration can only be applied once and then must be rewritten

Running the same configuration multiple times produces the same result without unintended changes

The configuration automatically adjusts to changing business requirements

The configuration is stored in a version control system

Which statement accurately contrasts declarative and imperative Infrastructure as Code?

Imperative is used only for cloud infrastructure, while declarative is used only for on-premises

Declarative focuses on 'how' to configure, while imperative focuses on 'what' to configure

Declarative is always more secure than imperative

Declarative specifies the desired end state, while imperative specifies the exact steps to reach it

A company's network team is adopting IaC to manage firewall rules. They need to ensure that any change is reviewed by a senior engineer before being applied and that the team can revert to a previous configuration if a change causes an outage. Which practice is most directly required?

Scheduling regular backups of the firewall configurations.

Using a configuration management tool that automatically pushes changes to all devices.

Creating a detailed runbook that documents every firewall rule change.

Storing the IaC definitions in a version control system with a pull-request review process.

Which method is commonly used to remediate configuration drift using Infrastructure as Code principles?

Manually editing configuration files on each server

Deleting the infrastructure and recreating it from scratch

Reapplying the IaC code to bring the infrastructure back to the desired state

Ignoring the drift until the next scheduled maintenance window

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 4Objective 13

4.13 Describe the Principles of Infrastructure as Code 350-201 Practice Questions (Page 2)

Part of the Automation domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

20%of the exam

Questions 6–10

6application · medium
A security team wants to ensure that network devices are always in a known, secure state. They are considering an immutable infrastructure approach. Which practice best exemplifies this principle?
Select an answer first
7foundation · easy
What does idempotency mean in the context of Infrastructure as Code?
Select an answer first
8foundation · easy
Which statement accurately contrasts declarative and imperative Infrastructure as Code?
Select an answer first
9application · medium
A company's network team is adopting IaC to manage firewall rules. They need to ensure that any change is reviewed by a senior engineer before being applied and that the team can revert to a previous configuration if a change causes an outage. Which practice is most directly required?
Select an answer first
10foundation · easy
Which method is commonly used to remediate configuration drift using Infrastructure as Code principles?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.