CCNA Automation (200-901 CCNAAUTO) Study Guide¶

Independent AI-assisted resource — SOURCES + OBJECTIVES CHECKED; HUMAN REVIEW PENDING. All 61 numbered objectives and supporting bullets from the actual three-page v1.1 PDF were mapped on September 29, 2026. The exact public workbook passed 67 local checks; eight infrastructure labs and independent human review remain pending. See the deep-review evidence. See the coverage record. Cisco's exam page and detailed v1.1 blueprint are authoritative.

Study guide at a glance

Start here

Report an issue with 200-901

Blueprint checked2026-10-28

Review stateSources + objectives checked — human review pending

Guide-only active reading1 hr–1 hr 30 min

Prerequisites: No formal exam prerequisite. Build basic networking and hands-on Python first, then parse XML/JSON/YAML, use Git and tests, construct and diagnose authenticated REST/Python calls, select Cisco platform APIs/SDKs, interpret YANG/NETCONF/RESTCONF, operate local Docker/Bash workflows, secure data and secrets, and review/test/idempotently execute Python/Ansible/IaC automation in authorized sandboxes.

Exam essentialsRead the objective map, key distinctions, and readiness checklist.

Deep understandingWork through every domain, including decisions, failure modes, and related items.

Hands-on labsBegin with Use the first hands-on exercise in the guide, then use the remaining labs to produce evidence you can inspect and explain.

Official objective domains

See the objective map in this guide

The active-reading range uses 90–130 words per minute for technical material. Labs, troubleshooting, note-taking, spaced review, and prerequisite gaps add time; it is not a total preparation promise.

Current baseline: 200-901 CCNAAUTO v1.1, six domains weighted 15/20/15/15/20/15
Upcoming change: No replacement or retirement announcement found as of September 29, 2026
First-party inconsistency: The detailed blueprint and 2026 training overview say v1.1, but the exam landing page still renders v1.0; the exam page/list includes English and Japanese while the certification page lists English only. Use v1.1 for scope and verify language in the scheduling interface.
Logistics — VERIFY CURRENT: 120 minutes, USD300 before applicable taxes, no formal prerequisites and three-year credential validity. The credential page and exam page agree on price/duration but disagree on languages. Complete a qualifying recertification route before expiry; Associate policy currently permits 30 CE credits. Verify scheduling and your own eligibility.
Credential history: Cisco renamed DevNet Associate to CCNA Automation on February 3, 2026. Older v1.1 learning material may still use DEVASC or “DevNet Associate”; validate its objectives and product names rather than rejecting it solely for the former brand.

The May 27, 2025 announcement and August transition explanation distinguish the Associate rename from the Professional redesign. The current detailed PDF and 2026 training overview establish v1.1 scope; broad portfolio announcements do not add Professional objectives here. The monitor extraction gained leading title/navigation text while its previous exam-content block remained identical; that difference alone does not establish an exam change.

Current guide watch — October 28, 2026¶

Cisco now brands 200-901 as CCNA Automation (formerly DevNet Associate); the official v1.1 blueprint remains the measured scope. The monitored exam page removed the explicit v1.0 string from its description, but its objective list did not change. Continue to use the full v1.1 blueprint and refreshed Cisco automation learning path. Cisco 200-901 exam page and current v1.1 blueprint

How to use this guide¶

Study every automation workflow as intent → data/API contract → authentication and authorization → code/configuration → test → review → controlled execution → evidence → rollback. Do not stop at recognizing syntax: construct small requests and scripts, interpret responses, explain failure behavior, and make unsafe actions fail closed.

Build a disposable local environment with Git, Python, a virtual environment, requests, a YAML library, a test runner, Bash or an equivalent shell, a REST client, and Docker where permitted. Use mocks first, then Cisco's authorized sandboxes. Never put a production token in source code, logs, screenshots, shell history, or a shared collection.

About related items: A Related item: callout adds prerequisite, operational, architectural, or adjacent context. It is supporting knowledge, not a claim that the item appears verbatim in the published objectives.

CURRENT BLUEPRINT labels the six exam domains below. PRACTICAL DEPTH labels implementation exercises that help demonstrate those objectives without claiming every defensive technique is named in the exam. VERIFY CURRENT applies to product versions, API contracts, prices, languages and course access.

Objective map¶

Domain	Weight	Proof to produce
Software Development and Design, 1.1–1.8	15%	Convert XML/JSON/YAML to Python structures; explain TDD, methods, patterns and Git; resolve a simple merge conflict
Understanding and Using APIs, 2.1–2.9	20%	Build and troubleshoot documented HTTP requests, authentication and Python `requests` calls; distinguish REST/RPC and sync/async behavior
Cisco Platforms and Development, 3.1–3.9	15%	Select platform/resource/API, use an SDK or reference to construct code, and reason about YANG/NETCONF/RESTCONF
Application Deployment and Security, 4.1–4.12	15%	Explain deployment choices and CI/CD; test Python, interpret Dockerfiles, operate local containers, protect secrets/data, identify common web risks
Infrastructure and Automation, 5.1–5.14	20%	Interpret Python/Ansible/Bash/YANG/diff/sequence artifacts and design a reviewed, testable, idempotent infrastructure workflow
Network Fundamentals, 6.1–6.9	15%	Read a topology and explain MAC/VLAN/IP/routes/gateways, planes, services/ports, connectivity faults and application-facing constraints

1. Software Development and Design — 15%¶

Data representations and parsing¶

JSON maps naturally to Python dictionaries, lists, strings, numbers, booleans and None. YAML adds human-friendly features but indentation and implicit types can surprise; use a safe loader for untrusted input. XML represents elements, attributes and text in a tree and commonly uses namespaces. Compare them by structure, schema/tooling, readability, comments, ordering expectations and API contract—not by a blanket “best” format.

Parsing is a boundary. Decode transport bytes correctly, validate content type, parse, validate required fields and types, normalize into an internal model, and handle missing/null/empty/extra values deliberately. Serialization reverses the process but does not prove that the receiver accepts your schema. Keep samples that test valid, incomplete, malformed and unexpected payloads.

PRACTICAL DEPTH — reject ambiguous input. bool("false") is True in Python because a nonempty string is truthy. A JSON boolean contract requires an actual bool; silently converting missing, null, numeric or string values can create false reachability evidence. The executed workbook validates the object root, exact fields, nonblank ID and Boolean type before constructing Device.

Python's JSON documentation explains that its default decoder accepts duplicate names and non-finite constants. The workbook rejects both deliberately using object_pairs_hook and parse_constant. Rejecting extra fields is this fictional API's choice; a real evolving API may deliberately permit them. XML namespace selection and safe YAML loading need separate tests; this JSON exercise does not validate either parser.

Development method, structure and tests¶

Waterfall emphasizes planned sequential phases; agile uses short feedback cycles; lean reduces waste and optimizes flow. A team can combine practices. Pick based on uncertainty, risk, feedback cost, regulation and deployment constraints, then explain how requirements and evidence remain traceable.

Test-driven development is the red → green → refactor loop: express a failing behavior, implement the smallest passing change, then improve structure without changing behavior. Unit tests isolate a function; integration tests exercise boundaries; end-to-end tests validate a workflow. For network automation, also test idempotency, dry-run/diff, partial failure, retry limits, timeout, authorization denial and rollback.

Functions isolate reusable behavior; classes bind state and behavior where that model helps; modules/packages create ownership and dependency boundaries. MVC separates model, view and controller responsibilities. Observer allows subscribers to react to events without the producer knowing their concrete behavior. Patterns are tradeoffs, not requirements to force onto small scripts.

Git as the change record¶

Know clone, stage/add/remove, commit, push, pull, branch, merge, conflict resolution and diff. A safe infrastructure change is a small branch with an issue/intent, tests, generated diff, peer review and traceable commit. Resolve conflicts by understanding both intents and retesting—not by choosing “ours” or “theirs” blindly. Do not commit credentials, generated secrets or large captured responses.

Related item: A commit records content and ancestry; a branch is a movable name; a remote-tracking reference reflects the last fetched remote state. This distinction makes divergence and merge failures easier to explain.

2. Understanding and Using APIs — 20%¶

Construct a request from documentation¶

Start with base URL/version and resource path. Select method and encode path/query parameters, headers and body exactly as documented. Add authentication without exposing it. Set Accept and, when sending a body, Content-Type. Define timeout, pagination, rate-limit and retry behavior. Validate TLS; do not “fix” certificate errors by globally disabling verification.

HTTP methods commonly express read (GET), create/action (POST), replace (PUT), partial update (PATCH) and delete (DELETE). Idempotency means repeating the same request has the same intended effect, not that every response is byte-identical. Never infer safety solely from the verb; follow the specific contract.

Interpret the full response: status describes the outcome class, headers carry metadata such as content type, pagination, location, caching and rate limits, and the body carries representation or structured error. Common classes are 2xx success, 3xx redirection, 4xx request/auth/resource/rate problems and 5xx provider faults. Distinguish malformed/authentication/authorization/not-found/conflict/rate/timeout problems using the documentation and error body.

The executed workbook uses a real Requests session with an offline transport adapter. Its invented /devices response is an array, not a claim about any Cisco endpoint. It follows tested Link next-page fixtures, rejects off-contract destinations and conflicting duplicates, and returns inventory only after every page succeeds. A later 403 makes the entire collection fail; a successful first page cannot prove completeness.

PRACTICAL DEPTH — failure decisions:

Observation	Decision and evidence
200 with wrong content type/schema	Reject the representation; status alone is insufficient.
204	Respect the endpoint's no-content contract; do not unconditionally decode JSON. The workbook expects 200 and rejects 204.
3xx	Investigate the destination; the workbook disables redirects and rejects them before forwarding its fixture authorization.
400 / 401 / 403 / 404	Inspect request, authentication, permission and resource documentation respectively; do not repeatedly retry unchanged credentials.
409 / 412	Reconcile a conflict or failed precondition with fresh state; do not blindly overwrite.
429	Honor the documented `Retry-After`; abort if the delay exceeds the remaining wait budget.
Selected transient 5xx / connection timeout	Retry only an operation whose contract permits it, with bounded attempts/backoff/jitter.
TLS validation error	Investigate certificates and trust; do not suppress verification or retry as a routine transient failure.

A timeout after a write is ambiguous: the server may have committed it before the response was lost. Reconcile by operation identity or documented idempotency support. The workbook performs GET only and supplies no general write-retry solution. Requests timeouts limit connection/read waiting, not an entire operation deadline. Its JSON decoder succeeding also does not establish HTTP success.

This example still needs pagination, bounded retry, logging with redaction and tests before production. Retry only transient and safe/idempotent operations unless the API supplies an idempotency mechanism. Add exponential backoff and jitter, honor Retry-After, and cap total attempts.

Authentication and API styles¶

Basic authentication sends a reusable credential encoding, not encryption; require TLS. API keys identify/cap an integration but need least privilege, secure storage, rotation and revocation. Custom/bearer tokens often expire and may encode scopes. Keep authentication (who/what) distinct from authorization (allowed action) and audit attribution.

REST commonly manipulates resources through uniform HTTP semantics. RPC expresses operations/functions. Synchronous interaction waits for completion; asynchronous interaction returns an acknowledgement/job/event and requires status, callback or subscription handling. These axes can combine.

Webhooks deliver events to a registered endpoint. Verify the provider-defined signature over the original bytes before trusting decoded fields. Use the documented algorithm and header with constant-time comparison; require a signed freshness value only where the provider contract supplies one. A valid signature alone does not prevent replay. Maintain event deduplication and delivery-state evidence, acknowledge within the provider's window, queue work, make processing idempotent, deduplicate event IDs, handle out-of-order delivery and monitor dead letters. Never treat an inbound JSON body as trustworthy because it arrived at the expected URL.

Related item: Polling controls cadence but costs repeated requests and adds latency; webhooks reduce polling but introduce endpoint availability, authenticity, replay and delivery-order responsibilities.

3. Cisco Platforms and Development — 15%¶

Select platform, interface and resource¶

Know the purpose rather than memorizing every endpoint:

Meraki Dashboard manages cloud-controlled organizations, networks, devices and clients.
Cisco Catalyst Center provides campus inventory, assurance, intent and automation APIs.
ACI exposes data-center fabric policy and operational objects through APIC.
Cisco Catalyst SD-WAN provides controller-based WAN policy, inventory and operations.
NSO models and orchestrates multi-vendor services with transactional behavior.
UCS Manager and Intersight manage compute/infrastructure domains.
Webex covers spaces, participants, messages and devices; Unified CM integrations include AXL configuration and UDS user-facing services.
Security surfaces include XDR, Secure Firewall/Firepower, Secure Connect, Secure Endpoint, ISE and Secure Malware Analytics.
IOS XE and NX-OS offer device-level interfaces whose supported RESTCONF/NETCONF/REST/CLI details depend on platform and release.

Select an API/SDK from requirement, source of truth, desired scope, supported version, authorization model, rate/scale constraint and rollback behavior. Given SDK documentation, construct client initialization, authentication, arguments, call, response validation, exceptions and cleanup. Do not guess a method name from another SDK version.

Cisco DevNet documentation gives API references; Sandbox gives authorized environments; Learning Labs teach focused workflows; Code Exchange offers sample projects; support/forums help diagnose; choose the resource that matches the task. Treat samples as starting points and inspect licenses, dependencies, secrets, versions and destructive behavior.

PRACTICAL DEPTH — documented Meraki behavior. The pagination guide defines link relations and operation-specific cursor behavior; use its returned next link rather than inventing a page offset. Current rate-limit documentation describes a shared organization budget of 10 requests/second, with an extra 10-request burst allowance, plus a 100 requests/second source-IP limit. These are provider-specific observations to recheck, not universal REST limits. The error reference distinguishes request/auth/permission failures from rate and server failures.

The Meraki Python library overview advertises automatic pagination and Retry-After handling. Read the exact version's operation and pagination options, configure total-page/retry limits deliberately, and review logging output for sensitive data. An SDK does not prove your inventory was complete or your policy safe. No Cisco SDK was installed or authenticated in this review.

Model-driven programmability¶

YANG defines hierarchical configuration/state data, types, constraints and operations. NETCONF exchanges XML-encoded RPCs and can work with datastores, filters, validation, locking and commit behavior. RESTCONF exposes YANG-modeled data using HTTP and commonly XML or JSON encodings. A path is meaningful only with the correct module, namespace, datastore and platform implementation.

Interpret a basic YANG tree by separating containers/lists/leaves, keys, type/range, config versus operational state and module prefix. For a NETCONF or RESTCONF result, match returned hierarchy to the model; absence can mean unsupported, filtered, unauthorized, empty or wrong path. Capture error tags/status/body rather than retrying blindly.

PRACTICAL DEPTH — capabilities before changes. NETCONF RFC 6241, sections 8.3–8.5, makes candidate configuration, confirmed commit and rollback-on-error capability-dependent. Read the server's capabilities; do not assume every NETCONF server offers all of them. A candidate datastore can be shared across sessions, so coordinate locking and ownership. With supported confirmed commit, verify the service before confirmation; an unconfirmed change reverts after its timer. Reaching running configuration does not automatically prove startup persistence or application health.

RESTCONF RFC 8040, sections 3.4.1.2 and 3.5.2, describes entity tags and conditional edits. Retrieve the applicable ETag, send If-Match when the contract supports the edit, and treat 412 as a reason to refetch/reconcile. The tag may represent the datastore if a resource-specific tag is not maintained; do not assume an unrelated change can never invalidate it. These are explanations, not executed device transactions.

The blueprint may provide documentation and ask you to construct code that lists devices or clients/hosts, or manages Webex spaces/participants/messages. The transferable method is documentation → required auth → endpoint/SDK method → parameters/pagination → schema → error handling → minimal test → redacted evidence.

Related item: Controller-level management expresses broader intent and inventory context; device-level management can expose precise features. Choose deliberately, and avoid two authorities fighting over the same configuration.

4. Application Deployment and Security — 15%¶

Deployment and delivery choices¶

Private, public and hybrid cloud differ in ownership, control, elasticity, connectivity, data location and operating responsibility. Edge computing places compute near devices/users/data to reduce latency or tolerate intermittent upstream connectivity, but distributes security, patching and observability.

Bare metal provides direct hardware control; virtual machines isolate complete guest operating systems; containers package processes while sharing a host kernel. Pick based on isolation, startup/density, hardware access, portability, operational tooling and risk. A container image is immutable input; a running container adds writable/runtime state.

A CI/CD pipeline commonly includes source, build, dependency and secret scanning, unit/integration tests, artifact/image production, signed provenance, registry, deployment, post-deployment validation and rollback/promotion. Separate build from deploy identity. Promote the same tested artifact rather than rebuilding per environment.

Be able to interpret a Dockerfile: base image, working directory, copied files, package install, user, environment, exposed port, entrypoint and command. Pin trusted dependencies/images, minimize layers and contents, run as non-root when possible, exclude secrets/build clutter, scan the result, and keep runtime configuration outside the image. Locally know pull/build/list/run/inspect/logs/stop/remove operations and port/volume/environment mapping.

PRACTICAL DEPTH — build secrets. Docker's build check warns against putting secrets in ARG or ENV. A later deletion does not reliably remove earlier image/history/metadata exposure. Use the build system's supported secret mounts for build access and separate protected runtime injection. ARG and ENV have different lifetimes, but neither is a secret store. No Docker build was run for this review.

Test and secure the application¶

Construct a focused Python unit test using known input and an explicit expected result. Mock the network boundary, not the logic under test. Assert outgoing method/path/header/body and handling of success, schema error, 401/403, 404/409, 429 and transient 5xx/timeout. A test that only checks “no exception” is weak evidence.

Protect secrets using a secret manager or appropriately protected runtime injection, not source or image layers. Encrypt data in transit and at rest, restrict data collection/retention, redact logs, validate inputs and authorize every sensitive operation. Firewall rules constrain flows; DNS resolves names; load balancers distribute/health-check traffic; reverse proxies terminate/front applications and can enforce routing/security controls. A failure at any layer can resemble an application fault.

Understand examples from the OWASP web-risk set: injection mixes untrusted data with commands/queries; XSS executes attacker-controlled content in a user's browser; CSRF induces an authenticated browser to send an unwanted request. Use parameterization, contextual output encoding, content/security controls, anti-CSRF design and SameSite/session protections as appropriate. Never practice exploitation outside a deliberately vulnerable, isolated, authorized lab.

Bash scope includes navigation and file operations plus environment variables. Quote variables, check exit status, enable safe failure behavior deliberately, avoid printing secrets and test paths. DevOps joins development and operations through shared ownership, feedback, automation, observability and incremental, reversible change; it is not a synonym for a toolchain.

Related item: A healthy service process does not prove a reachable application. Validate DNS, route, NAT/VPN/proxy, firewall, listener, TLS, reverse proxy/load balancer and application dependency layers independently.

5. Infrastructure and Automation — 20%¶

A controlled workflow¶

Model-driven automation separates declared intent/data from imperative screen scraping and supports validation/reuse. Infrastructure as code makes desired state reviewable, versioned, testable and repeatable. Declarative tools describe outcome; imperative code describes steps. Idempotency means convergence without repeated unintended change.

Ansible commonly runs ordered YAML tasks against inventory using modules; interpret hosts, variables, privilege, tasks, handlers, conditionals and reported changed/failed state. Terraform builds a dependency graph from declarative configuration and tracks managed state; protect and coordinate that state. Cisco NSO models services and can coordinate transactional multi-device changes. Tool capability does not replace ownership, policy, tests or rollback.

A safe infrastructure pipeline validates syntax/schema, lints, tests code, renders proposed changes, uses authorized simulation, requires review/approval based on risk, executes in a bounded canary, verifies service/telemetry, and stops or rolls back on failed gates. Separate read/test/deploy credentials and preserve evidence.

Cisco Modeling Labs emulates network topologies; pyATS provides Python-based test/validation and parsers. Use simulation to test logic and failure paths, but account for differences from hardware/software releases and external dependencies.

Interpret automation artifacts¶

For Python using ACI, Meraki, Catalyst Center or RESTCONF, trace inputs/authentication → request → pagination/transformation → decision → write → verification → exception. For Bash, trace quoting, variables, command exit behavior and file/user/package effects. For an Ansible playbook, identify inventory target, module, variables, desired state, privilege, handler and idempotency.

NETCONF/RESTCONF output must be related to the YANG model and requested path/filter. A unified diff uses context plus removed (-) and added (+) lines; determine the effective change and whether order/indentation is semantic. A sequence diagram orders actors and calls over time; identify synchronous/asynchronous behavior, authentication, retry, callback and failure gaps.

Code review should verify intent, scope, readability, tests, secrets/dependencies, error and retry behavior, concurrency, least privilege, blast radius, observability, idempotency and rollback. Review the generated infrastructure diff as well as the source diff.

PRACTICAL DEPTH — check mode has exceptions. The Ansible check/diff guide says unsupported modules may do nothing, conditionals based on registered prior results may not produce useful predictions, and a task with check_mode: false executes normally even under --check. Inspect task behavior before treating a dry run as read-only. Diff output can expose secrets; use appropriate redaction and diff: false for sensitive tasks. No Ansible playbook was executed here.

6. Network Fundamentals — 15%¶

Read the path before automating it¶

A switch forwards frames within a VLAN using MAC learning. A router forwards packets between IP networks using the routing table. A firewall enforces flows; a load balancer presents a service and distributes requests. A host decides whether a destination is local from address/prefix and otherwise sends to its gateway. VLAN tags separate Layer 2 broadcast domains; routes and gateways connect Layer 3 networks.

Given a topology, annotate source/destination addresses and ports, VLANs, gateways, routes, NAT, firewall/proxy/VPN and service/listener. Management plane handles administration, control plane learns/decides topology or policy, and data plane forwards traffic. Controller-based systems may centralize control intent while distributed devices still forward.

DHCP supplies addressing parameters; DNS maps names and records; NAT translates address/port information; SNMP supports monitoring/management; NTP synchronizes time. Recognize SSH 22, Telnet 23, HTTP 80, HTTPS 443 and NETCONF-over-SSH 830 as common defaults, while remembering services can use different ports.

Application connectivity diagnosis follows evidence: name resolution → local address/route → path/VPN/proxy → NAT/firewall → listener/TLS → authentication/API → dependency. A 200 HTTP response from the wrong endpoint is not success; a TCP timeout differs from connection refused, TLS failure or HTTP denial.

Network constraints shape applications: latency affects round trips and synchronous chains; jitter affects real-time traffic; loss triggers retransmission; bandwidth limits throughput; MTU/fragmentation breaks particular payloads; intermittent paths require queueing/retry; NAT/proxy/firewall changes reachability; asymmetric paths complicate stateful inspection. Design timeouts, pooling, backoff, batching, compression and observability from measured behavior.

Related item: Automation can repeat a mistake faster. Preserve a known-good state, bound targets/concurrency, test negative paths, require review, observe during rollout and prove restoration.

Integrated scenarios¶

Scenario 1: Read-only inventory collector¶

Requirement: collect device identity from two Cisco platforms without configuration access. Define a normalized schema, least-privilege tokens, platform adapters, pagination, timeouts and redacted logs. Unit-test fixture parsing; run read-only against an authorized sandbox; compare counts and rejected records; store evidence without credentials. Explain how one platform's 429 and another's malformed record remain isolated.

Scenario 2: Reviewed VLAN workflow¶

Requirement: add a VLAN consistently to a lab. Put intent in Git, validate inputs, render a change, test in CML, inspect unified/configuration diff, require approval, canary one device, verify VLAN/path/service and then expand. Define wrong-interface, lost-management and partial-failure stops plus rollback. Explain controller- versus device-level ownership.

Scenario 3: Webhook-driven incident notification¶

Requirement: transform an authenticated network event into a Webex notification. Verify the documented signature over original bytes, enforce provider-supported signed freshness, deduplicate event ID, enqueue, redact sensitive fields, map severity, call Webex with scoped identity, retry bounded transient failures, dead-letter permanent errors and audit correlation IDs. Test replay, out-of-order, 429, expired token and Webex outage.

Hands-on evidence labs¶

These eight labs are proposed; none was executed against infrastructure during this review. Save sanitized inputs, expected/actual outcomes, failures, versions and cleanup evidence with a Git commit. Use only explicitly permitted targets and permissions. The offline workbook below is separate executed evidence.

Formats and Git: Create equivalent XML, JSON and YAML device fixtures, including an XML namespace and Boolean false. Normalize to one schema; reject malformed/missing/type-confused inputs. Save parser tests. On a disposable branch, introduce a deliberate conflicting schema edit, resolve intent, rerun tests and retain the meaningful diff. Do not count marker removal as success.
HTTP contract: Build a local mock service with a documented paginated inventory plus a separate write operation. Capture prepared requests and force malformed JSON, 204, redirects, 401/403, 409/412, 429, timeout and later-page failure. Require complete collection or explicit failure, bounded calls, and no auth forwarding to another origin. Demonstrate ambiguous-write reconciliation separately from GET retry.
Cisco read-only API: Select a currently available, authorized sandbox and its versioned operation. Record required scopes, pagination contract and permitted use; list devices/clients, reconcile counts, test a documented denied request where allowed, and redact evidence. Always-On environments are shared/nonadministrative; reserved environments have their own VPN, setup, expiry and reset constraints. A successful public documentation fetch is not sandbox access.
YANG and model-driven query: Obtain server capabilities and supported modules, identify a list key and configurable/operational nodes, and map an authorized NETCONF or RESTCONF read back to the model. In a private permitted write lab only, demonstrate supported locking/conditional edit and conflicting-state handling. Do not attempt confirmed commit or rollback-on-error without advertised support and a recovery path.
Containerized collector: Create a minimal image with pinned inputs and a non-root user where supported; inspect the Dockerfile, image configuration/history and mounted runtime settings for leaks. Build/run, map the intended port if needed, inspect logs, verify behavior, stop and remove the disposable container. Record which checks actually ran; scan output alone is not a proof of no secrets.
Infrastructure review: Trace one Python workflow, Ansible playbook, Bash script, modeled result, unified diff and sequence diagram. For Ansible include a condition using a registered result and a check_mode: false task; predict their behavior before a disposable local run. Record hosts, privilege, writes, handlers, sensitive diffs, idempotency and restoration for every artifact.
Network-aware failure: In an isolated topology, introduce DNS, route, blocked-port and proxy/VPN faults one at a time. Capture name resolution, route/connection/TLS/HTTP evidence before and after repair. Require the diagnosis to identify the failing layer; repeat application retries must not count as repairing a missing route or denied permission.
Mini delivery pipeline: Tie lint/tests, dependency/secret checks, artifact digest, proposed diff, review, canary, post-check and rollback to a commit. Inject a failed post-check and stop expansion. Restore known-good state and verify the application path, not just a running process. Keep deploy credentials separate and clean up only the disposable resources created for the lab.

Executed local API workbook¶

PRACTICAL DEPTH — 67 local checks passed on September 29, 2026, using Python 3.13.14 and the already-installed Requests 2.34.2. Copy the entire block to a file and run normally with Python in an environment containing Requests. Do not use python -O, which disables these teaching assertions. The fictional inventory.invalid contract returns JSON arrays of exact id/reachable records. It is not a Cisco endpoint or SDK example.

Both HTTP schemes are mounted to an offline BaseAdapter; unknown requests fail against fixtures. Real request preparation, response objects and Requests link parsing run, but no DNS lookup, socket, authenticated API, real token or sleeping occurs. Bearer fixture-only is inert fixture text, environment-derived settings are disabled, and waits are collected as numbers. See Requests transport adapters for the boundary being replaced.

The checks cover strict JSON/object types, duplicate keys, malformed bytes, body cap, exact request metadata, two-page collection and deduplication, conflicting records, cycles and page/record/request budgets, destination restrictions, selected status/content failures, retry delays/date parsing, TLS rejection and all-or-nothing completion. The two-page result contains a and b; the printed final retry fixture contains only a with reachable: false, two requests and a virtual two-second wait.

Limits: the 8,192-byte check happens after the fixture body is buffered; it is not a streaming memory bound. The eight-second budget limits deliberate retry waits, not total wall-clock execution. Requests' connect/read timeouts are not an operation deadline. Link handling covers selected well-formed relations and tested malformed cases, not every RFC ambiguity or duplicate relation. There is no cross-page snapshot guarantee, durable cache, write retry, webhook receiver, comprehensive SSRF defense or proof of production correctness. The adapter uses private response-buffer attributes only to construct test fixtures.

"""Fictional inventory API exercise. All requests use an offline adapter."""
import json
import math
from dataclasses import dataclass
from datetime import datetime, timezone
from email.utils import parsedate_to_datetime
from urllib.parse import urljoin, urlsplit
import requests
from requests.adapters import BaseAdapter

START = 'https://inventory.invalid/devices'


def unique_keys(pairs):
    result = {}
    for key, value in pairs:
        if key in result:
            raise ValueError('Duplicate JSON key')
        result[key] = value
    return result


def reject_constant(value):
    raise ValueError('Non-finite JSON constant')


def strict_json(body):
    if len(body) > 8192:
        raise ValueError('Buffered fixture body too large')
    return json.loads(body.decode('utf-8'), object_pairs_hook=unique_keys,
                      parse_constant=reject_constant)


@dataclass(frozen=True)
class Device:
    device_id: str
    reachable: bool


def device_from_object(raw):
    if not isinstance(raw, dict) or set(raw) != {'id', 'reachable'}:
        raise ValueError('Unexpected device fields')
    if not isinstance(raw['id'], str) or not raw['id'].strip():
        raise ValueError('Nonblank string ID required')
    if type(raw['reachable']) is not bool:
        raise ValueError('A JSON boolean is required')
    return Device(raw['id'], raw['reachable'])


def parse_device(text):
    return device_from_object(strict_json(text.encode('utf-8')))


def allowed_url(url):
    p = urlsplit(url)
    if (p.scheme != 'https' or p.hostname != 'inventory.invalid'
            or p.port not in (None, 443) or p.username is not None
            or p.password is not None or p.fragment or p.path != '/devices'):
        raise ValueError('URL outside the fictional API contract')
    return url


def retry_delay(header, attempt, now, jitter):
    if header is None:
        return 2 ** attempt + jitter()
    value = header.strip()
    if len(value) > 64:
        raise ValueError('Invalid Retry-After')
    if value.isascii() and value.isdecimal():
        return int(value)
    try:
        stamp = parsedate_to_datetime(value)
        if stamp.tzinfo is None:
            raise ValueError('Timezone required')
        return max(0.0, (stamp - now()).total_seconds())
    except (TypeError, ValueError, OverflowError) as error:
        raise ValueError('Invalid Retry-After') from error


def collect(session, start=START, *, sleep, now, jitter,
            max_pages=3, max_records=10, max_requests=6, wait_budget=8):
    if any(type(n) is not int or n < 1 for n in
           (max_pages, max_records, max_requests, wait_budget)):
        raise ValueError('Positive integer limits required')
    url = allowed_url(start)
    visited, devices = set(), {}
    requests_used, waited = 0, 0.0
    while url is not None:
        url = allowed_url(url)
        if url in visited or len(visited) >= max_pages:
            raise ValueError('Pagination cycle or page limit')
        visited.add(url)
        for attempt in range(3):
            if requests_used >= max_requests:
                raise ValueError('Request budget exhausted')
            requests_used += 1
            retry_after = None
            try:
                response = session.get(url,
                    headers={'Authorization': 'Bearer fixture-only',
                             'Accept': 'application/json'},
                    timeout=(2, 3), allow_redirects=False, verify=True)
            except requests.exceptions.SSLError as error:
                raise ValueError("TLS failure requires investigation") from error
            except (requests.Timeout, requests.ConnectionError):
                retryable = True
            else:
                retryable = response.status_code in {429, 500, 502, 503, 504}
                if retryable:
                    retry_after = response.headers.get('Retry-After')
                    response.close()
                else:
                    break
            if attempt == 2 or requests_used >= max_requests:
                raise ValueError('Retry attempts exhausted')
            delay = retry_delay(retry_after, attempt, now, jitter)
            if not math.isfinite(delay) or delay < 0 or delay > wait_budget - waited:
                raise ValueError('Server delay exceeds remaining wait budget')
            # Abort instead of shortening a server-requested delay.
            sleep(delay)
            waited += delay
        else:
            raise AssertionError('Unreachable retry state')
        with response:
            if response.status_code != 200:
                raise ValueError(f'Unexpected HTTP status {response.status_code}')
            media = response.headers.get('Content-Type', '').split(';')[0].strip().lower()
            if media != 'application/json':
                raise ValueError('Unexpected content type')
            payload = strict_json(response.content)
            if not isinstance(payload, list):
                raise ValueError('Array response required')
            for raw in payload:
                device = device_from_object(raw)
                prior = devices.get(device.device_id)
                if prior is not None and prior != device:
                    raise ValueError('Conflicting duplicate device')
                devices[device.device_id] = device
                if len(devices) > max_records:
                    raise ValueError('Record limit exceeded')
            links = response.links
            if response.headers.get('Link') and (
                not links or any(key not in {'first', 'prev', 'next', 'last'} for key in links)
            ):
                raise ValueError('Unsupported pagination Link header')
            next_link = links.get('next', {}).get('url')
            url = allowed_url(urljoin(url, next_link)) if next_link is not None else None
    # Return only after all pages succeed; never return a partial inventory.
    return tuple(devices[key] for key in sorted(devices))


class FixtureAdapter(BaseAdapter):
    def __init__(self, script):
        self.script = list(script)
        self.calls = []

    def send(self, request, **kwargs):
        self.calls.append((request.method, request.url))
        assert request.method == 'GET'
        assert request.headers['Authorization'] == 'Bearer fixture-only'
        assert kwargs['verify'] is True and kwargs['timeout'] == (2, 3)
        assert request.body is None
        if not self.script:
            raise AssertionError('Unexpected request: no fixture remains')
        expected, result = self.script.pop(0)
        assert request.url == expected, (request.url, expected)
        if isinstance(result, Exception):
            raise result
        status, body, headers = result
        response = requests.Response()
        response.status_code = status
        response._content = body
        response._content_consumed = True
        response.headers.update(headers)
        response.request = request
        response.url = request.url
        return response

    def close(self):
        pass


def reply(body, status=200, **headers):
    return status, body.encode('utf-8'), {'Content-Type': 'application/json', **headers}


NOW = datetime(2026, 9, 29, 10, 0, tzinfo=timezone.utc)
A = '{"id":"a","reachable":false}'
B = '{"id":"b","reachable":true}'
NEXT = START + '?cursor=2'
checks = 0


def check(actual, expected):
    global checks
    assert actual == expected, (actual, expected)
    checks += 1


def rejects(fn):
    global checks
    try:
        fn()
    except (ValueError, UnicodeError):
        checks += 1
    else:
        raise AssertionError('Expected rejection')


def run(script, **options):
    adapter, sleeps = FixtureAdapter(script), []
    with requests.Session() as session:
        session.trust_env = False
        session.mount('https://', adapter)
        session.mount('http://', adapter)
        result = collect(session, sleep=sleeps.append, now=lambda: NOW,
                         jitter=lambda: 0.0, **options)
    return result, adapter.calls, sleeps


check(parse_device(A), Device('a', False))
check(parse_device(B), Device('b', True))
for bad in ['[]', 'null', 'true', '{}', '{"id":"a"}',
            '{"id":"a","reachable":"false"}', '{"id":"a","reachable":0}',
            '{"id":"a","reachable":null}', '{"id":" ","reachable":true}',
            '{"id":1,"reachable":true}', '{"id":"a","reachable":true,"extra":1}',
            '{"id":"a","id":"b","reachable":true}',
            '{"id":"a","reachable":NaN}', '{"id":"a","reachable":Infinity}', '{']:
    rejects(lambda bad=bad: parse_device(bad))
rejects(lambda: strict_json(b'\xff'))
rejects(lambda: strict_json(b' ' * 8193))
result, calls, sleeps = run([(START, reply('[' + A + ']'))])
check(result, (Device('a', False),))
check(calls, [('GET', START)])
check(sleeps, [])
result, calls, sleeps = run([
    (START, reply('[' + A + ']', Link='<?cursor=2>; rel="next"')),
    (NEXT, reply('[' + A + ',' + B + ']'))])
check(result, (Device('a', False), Device('b', True)))
check(len(calls), 2)
check(run([(START, reply('[]'))])[0], ())
rejects(lambda: run([(START, reply('[' + A + ']', Link='<?cursor=2>; rel="next"')),
                      (NEXT, reply('[{"id":"a","reachable":true}]'))]))
rejects(lambda: run([(START, reply('[]', Link='</devices>; rel="next"'))]))
for url in ['http://inventory.invalid/devices', 'https://other.invalid/devices',
            'https://user@inventory.invalid/devices', 'https://inventory.invalid:444/devices',
            'https://inventory.invalid/other', 'https://inventory.invalid/devices#fragment']:
    rejects(lambda url=url: allowed_url(url))
rejects(lambda: run([(START, reply('[]', Link='<https://other.invalid/devices>; rel="next"'))]))
rejects(lambda: run([(START, reply('[]', Link='<?cursor=2>; rel="next"'))], max_pages=1))
rejects(lambda: run([(START, reply('[' + A + ',' + B + ']'))], max_records=1))
rejects(lambda: run([], max_pages=0))
for status in [204, 301, 302, 400, 401, 403, 404, 409, 412, 501]:
    rejects(lambda status=status: run([(START, reply('', status=status))]))
rejects(lambda: run([(START, reply('[]', **{'Content-Type': 'text/html'}))]))
rejects(lambda: run([(START, reply('{}'))]))
rejects(lambda: run([(START, reply('['))]))
result, calls, sleeps = run([(START, reply('', status=429, **{'Retry-After': '2'})),
                            (START, reply('[' + A + ']'))])
check(sleeps, [2])
check(len(calls), 2)
check(result, (Device('a', False),))
check(run([(START, requests.Timeout()), (START, reply('[]'))])[2], [1.0])
check(run([(START, requests.ConnectionError()), (START, reply('[]'))])[2], [1.0])
check(run([(START, reply('', status=503)), (START, reply('', status=502)),
           (START, reply('[]'))])[2], [1.0, 2.0])
rejects(lambda: run([(START, reply('', status=429, **{'Retry-After': '99'}))]))
rejects(lambda: run([(START, reply('', status=429, **{'Retry-After': 'garbage'}))]))
rejects(lambda: run([(START, reply('', status=500))] * 3))
rejects(lambda: run([(START, reply('', status=500))], max_requests=1))
check(retry_delay('Tue, 29 Sep 2026 10:00:03 GMT', 0, lambda: NOW, lambda: 0), 3.0)
check(retry_delay('Tue, 29 Sep 2026 09:59:00 GMT', 0, lambda: NOW, lambda: 0), 0.0)
check(retry_delay(None, 1, lambda: NOW, lambda: 0.25), 2.25)
rejects(lambda: retry_delay('-2', 0, lambda: NOW, lambda: 0))
rejects(lambda: run([(START, requests.exceptions.SSLError('fixture TLS failure'))]))
rejects(lambda: run([(START, reply('[]', Link='not-a-link'))]))
# A bad later page fails the whole collection; the first page is not returned.
rejects(lambda: run([(START, reply('[' + A + ']', Link='<?cursor=2>; rel="next"')),
                      (NEXT, reply('', status=403))]))
print(json.dumps(dict(devices=[d.device_id for d in result], first_reachable=result[0].reachable,
                      retry_requests=len(calls), virtual_waits=sleeps,
                      requests_version=requests.__version__, live_requests=0)))
print(f'{checks} local checks passed')

Readiness checks¶

Cover each answer and explain the reasoning before checking it. These are original teaching prompts, not exam questions.

How do JSON, YAML and XML differ? JSON fits interoperable typed trees; YAML favors readable configuration but has indentation/implicit-type risks; XML adds elements, attributes and namespaces. Choose the receiver’s schema and safe parser, not a preferred syntax alone.
What are the parsing stages? Decode bytes, parse syntax, validate root/fields/types, then normalize. A syntactically valid array is still wrong where a device object is required.
What is red–green–refactor? First observe the intended behavioral test fail, implement the smallest correction, then improve structure while that behavior remains tested. Merely adding a passing test afterward is not the complete cycle.
Which tests support safe repetition? Repeat the same intent and inspect effects, including counters/external writes. Add partial-failure and reconciliation cases; equal output alone does not prove idempotency.
How do functions, classes and modules help? Functions isolate transformations; classes bind related state/behavior; modules establish cohesive interfaces and dependencies. Keep HTTP transport separate from schema and decision logic.
What do MVC and Observer separate? MVC separates model, presentation and input/control responsibilities. Observer decouples an event producer from subscribers. A training lab about Singleton is supplementary, not a replacement for these two named patterns.
What is the Git change sequence? Clone/fetch, branch, edit, inspect diff, stage intentional files, commit, synchronize/resolve divergence, retest, then push the intended branch. A local commit is not evidence that a remote received it.
What makes conflict resolution correct? Preserving both intended behaviors where compatible, choosing deliberately where they conflict, and retesting the merged result. Removing markers alone proves nothing about behavior.
How do you derive an HTTP request? Read the versioned method/path, parameters, content type, body schema, auth scopes, pagination and error contract. Assert the prepared request against those requirements before a sandbox call.
How do safety and idempotency differ? A safe operation is intended for retrieval; an idempotent operation has the same intended effect when repeated. A repeated DELETE may change response codes while remaining idempotent; a timeout does not reveal whether a write committed.
What evidence comes from status, headers and body? Status classifies the outcome; headers carry representation, continuation or retry metadata; the body carries data/errors. Validate all applicable parts, not only a 200 or successful JSON decode.
How should common failure codes change behavior? 400: correct the request; 401: investigate auth; 403: inspect permissions; 404: verify scope/path/resource; 409/412: reconcile state; 429: honor rate guidance; selected 5xx: bounded contract-safe retry.
What bounds belong on retries? Per-page attempts, total requests, delay budget, backoff/jitter, retryable failure classes and operation safety. A 99-second server delay with eight seconds left means abort, not shorten the requested delay.
How do Basic, key and token authentication differ? Basic carries encoded reusable credentials and needs TLS; keys are integration credentials with provider-defined scope; tokens may be short-lived and scoped. All require protected storage, least privilege and controlled rotation.
When is RPC a useful description? When an interface expresses named operations rather than primarily resource manipulation. REST/RPC and synchronous/asynchronous are separate design axes.
What does an asynchronous acknowledgement prove? That a request was accepted under the documented contract, not that work finished. Track operation state, completion/error evidence, expiry, cancellation and duplicate handling.
How do you protect a webhook? Verify the provider-defined signature over original bytes, authorize the resulting action, enforce signed freshness when available, deduplicate documented event identities and record delivery state. Do not invent a universal signed timestamp.
What does the Requests workbook actually verify? Prepared GET requests, fixture authorization, TLS option, timeout settings, response parsing, continuation and failures through an offline adapter. It sends no packet and verifies no live Cisco endpoint, token or entitlement.
How do you select a Cisco platform? Match ownership and scope: Meraki cloud network inventory, Catalyst Center campus intent, APIC fabric policy, SD-WAN WAN control, NSO services, Intersight/UCS compute, Webex collaboration or the appropriate security/device API.
Which DevNet resource fits which need? Use API documentation for a contract, Learning Labs for instruction, Sandbox for permitted practice, Code Exchange for inspectable samples, and support/forums for diagnosis. Availability and sample trust are separate checks.
How do you construct an SDK call? Use the supplied version’s initialization/auth rules and exact method signature, set documented options, validate results and handle exceptions. Account for built-in retries/pagination so nested retries do not multiply unexpectedly.
How do YANG, NETCONF and RESTCONF relate? YANG models data/constraints; NETCONF carries modeled operations/data through its protocol; RESTCONF exposes modeled resources through HTTP. Supported modules, datastores and capabilities determine what a particular server can do.
How do you interpret a YANG list? Its key identifies an entry; child leaves carry typed values and constraints. Distinguish configurable nodes from operational state and use the module namespace/prefix required by the encoding.
Why can a modeled query be empty? Wrong path/filter/namespace, unsupported model, missing permission, no matching instances or genuinely empty state. Inspect capabilities, request and structured error before assuming device failure.
Why select edge or a cloud model? Balance latency/connectivity, ownership, data location, scaling and operational responsibility. Edge can reduce round trips while increasing distributed patching and recovery work.
What separates VM, container and bare metal? A VM has a guest OS boundary; containers share a host kernel; bare metal exposes hardware directly. Match isolation, portability, start time, hardware and operating requirements.
How should a delivery pipeline handle identity? Use scoped build/test/deploy identities, reviewed artifacts, checks and promotion gates. Tie deployment and rollback evidence to the tested artifact rather than rebuilding an unverified equivalent.
What matters in a Dockerfile? Base image, workdir, copies, dependencies, user, startup and ports define build/runtime behavior. Keep build secrets out of ARG/ENV and layers; EXPOSE metadata alone does not publish a host port.
What makes the mock boundary useful? Mock transport while exercising request preparation and real response parsing. Assert method/URL/header/body and deliberate failure results; a function that simply returns a fixed answer misses the integration contract.
Which controls protect secrets and data? Scoped access, protected secret injection, TLS, appropriate at-rest encryption, minimal retention and redacted telemetry. A private repository or base64 string is not a secret-management control.
How do injection, XSS and CSRF differ? Injection changes a command/query; XSS runs untrusted browser content; CSRF induces an unwanted authenticated browser request. Use parameterization, context-aware encoding and request/session protections respectively.
What do deployment network components do? DNS resolves records, firewalls permit/deny flows, load balancers select backends and reverse proxies front applications. Healthy TCP to a proxy does not prove its backend is healthy.
What makes Bash handling deliberate? Quote expansions, validate paths/inputs, check relevant exit statuses and preserve errors. Avoid echoing credentials and understand the exact shell’s failure behavior rather than assuming one option handles every pipeline.
How do modeling, IaC and idempotency connect? A model constrains intent/data; IaC records desired changes for review; idempotent application converges without repeating unintended effects. Each still needs current-state and service verification.
How do Ansible, Terraform and NSO differ operationally? Ansible runs module tasks against inventory; Terraform plans dependencies and manages state; NSO models services and coordinates supported transactions. Inspect each tool’s ownership, state and failure semantics.
How do you interpret six automation artifacts? Trace Python calls, Bash effects, Ansible inventory/tasks, YANG hierarchy, diff additions/removals and sequence ordering. Identify auth, writes, asynchronous completion, retries and rollback gaps in each.
What must review establish before execution? The intended target/change, supporting tests, least privilege, generated diff, bounded rollout, failure stops, observations and restoration path. Approval of source alone may miss a surprising rendered change.
What do simulation and pyATS establish? They can test supported topologies, parsing and expected states. They do not automatically reproduce hardware behavior, every software release, provider outages or real production scale.
How do you annotate a topology? Trace source/destination MAC/IP, VLAN, prefix/gateway, next hops, NAT, relevant ports and policy at each boundary. Link-layer destination changes at routing boundaries; end-to-end addressing may change under NAT.
What do the three planes do? Management administers the device; control computes routing/policy/topology; data forwards packets according to installed decisions. Controller intent does not eliminate distributed forwarding.
What are DHCP, DNS, NAT, SNMP and NTP for? Address configuration, name/record resolution, address/port translation, monitoring/management and time synchronization respectively. Diagnose the specific service evidence rather than treating all as generic connectivity.
What default ports should you recognize? SSH 22, Telnet 23, HTTP 80, HTTPS 443 and NETCONF over SSH 830. Confirm the deployed listener and transport; configured ports can differ.
How do you isolate connectivity failures? Check resolution, local prefix/route, VPN/proxy, NAT/firewall, listener, TLS, HTTP authorization and dependencies. An HTTP denial proves a different stage was reached from a TCP timeout or refused connection.
How do network constraints affect design? Latency makes repeated round trips expensive; jitter/loss disrupt time-sensitive work; bandwidth bounds transfer; MTU can break particular payloads. Measure, then tune batching, queues, pooling and bounded retries.
How should old DEVASC material be assessed? The Associate rename took effect February 3, 2026, while current scope remains the detailed v1.1 PDF. Compare objective coverage and product names; the Professional redesign is not an Associate scope announcement.
What remains a scheduling verification? Version, language, price/taxes, delivery and eligibility. The landing page’s v1.0 label and English/Japanese differ from the v1.1 PDF and English-only credential listing; keep that conflict visible.
Why does the old Boolean parser fail? bool("false") is True, and calling .get on a list raises AttributeError. Check object shape and exact Boolean type first; the new workbook rejects both invalid inputs.
What does completing all pages fail to prove? Snapshot consistency when data changes between requests, correctness of provider data and absence of duplicate/ambiguous link relations beyond tested fixtures. The workbook fails on selected conflicts but is not a complete production client.

Check key: Ready means you can explain the answer and produce the applicable evidence; recognition alone calls for more practice. Pending infrastructure labs cannot be counted as executed evidence.

Places to learn¶

Start with the official objectives; add a course to address a measured gap. This is not a complete list. Public metadata was rechecked September 29, 2026; course availability and access can change. Study budgets below are estimates, not provider runtime claims.

Resource	Access	Estimated time
Cisco exam page and detailed v1.1 PDF, linked above	Public; all 61 numbered objectives/supporting bullets mapped	2–4h initial map; 30–60m periodic review, study estimates
Cisco CCNAAUTO training	Public overview; paid/subscription delivery; four-page training PDF reviewed	32h30m in the April 13, 2026 roundup; verify selected current delivery
Cisco DevNet Sandbox	Free account; shared Always-On or private reservation with environment-specific permissions	12–25h practice budget; setup/availability not verified
Learn with Cisco prep series	Public listing returned a title/footer shell; no video, transcript or complete playlist reviewed	Current runtime and completeness unverified; former 12–24h was a study estimate
Pearson second-edition listing	Paid listing link redirected to an empty search response; edition, publication and current availability unverified	25–40h reading/practice budget only; earlier forthcoming September 15 claim withdrawn
LinkedIn Learning DEVASC 1.1 cert prep	Paid/trial; public metadata and selected outline reviewed; Kevin Wallace/Charles Judd, released March 22, 2024	13h02m displayed; add 10–20h practice estimate
O’Reilly DevNet Associate video	Paid; current request blocked with HTTP403; no interior reviewed	Earlier 15h44m/January 2024 metadata unverified; 12–20h extra practice estimate
Udemy CCNA Network Automation	Paid; current request blocked with HTTP403; no lessons reviewed	Earlier 10h06m/April 2026 update unverified; 12–20h extra practice estimate
Cisco U. practice material linked from the exam page	Subscription/access depends on selected product; question content not reviewed	2h practice plus 3–6h review, study estimates

The Cisco training overview advertises 48 CE credits and recommended Python/basic computer/OS/Internet knowledge, while its training prerequisites are not formal exam prerequisites. Its Singleton lab does not replace MVC and Observer in the exam PDF. The dated 32h30m article is not a fresh sum of an authenticated learning path. LinkedIn’s old brand and release date require an objective/platform gap check; public metadata or ratings cannot establish lesson quality. No paid chapters, videos, transcripts, exercise files or practice questions were accessed in this review.

For Webex, use the current webhook guide for the selected resource and signature format. That page returned a minimal shell to the direct fetch and the browser extraction failed on its size, so this review does not claim full current delivery/security documentation coverage. The general signature/freshness guidance above is a design checklist, not a verified runnable Webex receiver.

Verify edition, revision, access, lab availability and detailed objective coverage before purchase. Avoid providers advertising live questions, guaranteed passes or unexplained answer banks.