CPNAE-101 Exam Guide: Python Network Automation with Netmiko, NETCONF, RESTCONF and Scapy

The CPNAE-101 exam leads to CWNP's Certified Python Network Administrator and Engineer (CPNAE) certification. It is a vendor-neutral Python certification for network engineers: 40 questions in 100 minutes, 70% to pass, USD 399. Many questions show a short Python snippet and ask what it does, so the fastest way to prepare is to write the same kind of scripts yourself. This guide goes through the blueprint domain by domain, with code that uses the libraries the exam names: Netmiko, ncclient, Requests, Scapy and pandas.

CPNAE-101 exam at a glance

Item	Detail
Exam code	CPNAE-101
Certification	CWNP Certified Python Network Administrator and Engineer (CPNAE)
Questions	40
Duration	100 minutes
Passing score	70%
Price	USD 399
Vendor focus	Vendor-neutral

With 100 minutes for 40 questions you get two and a half minutes per question. That is generous on purpose, because many questions include code you have to trace line by line. The official CPNAE certification page describes how the exam is delivered, and the CPNAE-101 exam objectives (PDF) list every sub-topic. For a one-page summary of the objectives alongside the exam facts, see this CPNAE-101 syllabus breakdown.

Domain weights

Domain	Weight
Python Programming Fundamentals	40%
Network Device Management	25%
Requirements and Systems Engineering	20%
Network Monitoring and Analysis	15%

Python fundamentals alone make up 40% of the exam. Network engineers who jump straight to Netmiko and skip the language basics lose most of their marks here.

Domain 1: Python programming fundamentals (40%)

The blueprint lists data types (None, int, bool, float, complex, str, list, tuple, dict, set), conditionals, loops, file I/O, built-in and custom functions, and libraries (standard, external and personal). Expect "what does this print?" questions built around the behaviours that catch people out:

interfaces = ["Gi0/1", "Gi0/2", "Gi0/1"]
print(len(set(interfaces)))           # 2 -> sets drop duplicates
print(7 / 2, 7 // 2, 7 % 2)           # 3.5 3 1
print(bool("False"), bool(""))        # True False -> any non-empty string is truthy
print(type(3 + 4j))                   # <class 'complex'>

vlan = {"id": 10, "name": "users"}
print(vlan.get("mtu", 1500))          # 1500 -> default when the key is missing

t = (1, 2, 3)
# t[0] = 9                            # TypeError: tuples are immutable

def add_vlan(v, vlans=[]):            # mutable default argument
    vlans.append(v)
    return vlans

print(add_vlan(10), add_vlan(20))     # [10, 20] [10, 20] -> the same list both times

File handling questions centre on the with statement and the open modes ("r", "w" truncates, "a" appends):

with open("devices.txt") as f:
    hosts = [line.strip() for line in f if line.strip() and not line.startswith("#")]

with open("report.txt", "a") as out:
    for h in hosts:
        out.write(f"{h},reachable\n")

Know the difference between the standard library (json, csv, re, ipaddress, socket, subprocess), external packages you install with pip (netmiko, requests, scapy), and personal modules you write and import yourself. ipaddress is worth extra time because it comes up often in network scripts:

import ipaddress

net = ipaddress.ip_network("10.1.0.0/22")
print(net.num_addresses, net.netmask)                  # 1024 255.255.252.0
print(ipaddress.ip_address("10.1.3.200") in net)       # True
print([str(s) for s in net.subnets(new_prefix=24)])    # four /24s

Domain 2: Network device management (25%)

The blueprint names many libraries: Nmap, Scapy, Paramiko/Netmiko, NAPALM, Nornir, ncclient, Genie, Requests, Impacket and PySNMP, plus Beautiful Soup, pandas, NumPy and Matplotlib for handling data. You don't need to know all of them deeply. You do need to know which library fits which job:

Task	Library	Protocol
Send CLI commands over SSH	Paramiko (low level), Netmiko (network-aware)	SSH
Multi-vendor getters and config replace	NAPALM	SSH, NETCONF or API, depending on the driver
Run tasks against an inventory in parallel	Nornir	Uses the libraries above
Model-driven configuration	ncclient	NETCONF (port 830)
HTTP APIs	Requests	RESTCONF and REST
Poll counters	PySNMP	SNMP (UDP 161)
Parse CLI output into structured data	Genie, or TextFSM through Netmiko	n/a

SSH with Netmiko

from netmiko import ConnectHandler

device = {
    "device_type": "cisco_ios",
    "host": "192.0.2.11",
    "username": "netops",
    "password": "********",
}

with ConnectHandler(**device) as conn:
    brief = conn.send_command("show ip interface brief", use_textfsm=True)
    down = [i["interface"] for i in brief if i["status"] != "up"]
    print("Down interfaces:", down)

    conn.send_config_set(["interface Loopback100", "description managed-by-python"])
    conn.save_config()

With use_textfsm=True, the command returns a list of dictionaries instead of raw text, which is why the list comprehension works.

NETCONF with ncclient and RESTCONF with Requests

from ncclient import manager

flt = '<interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"/>'

with manager.connect(host="192.0.2.11", port=830, username="netops",
                     password="********", hostkey_verify=False) as m:
    reply = m.get_config(source="running", filter=("subtree", flt))
    print(reply.data_xml[:300])

import requests

url = "https://192.0.2.11/restconf/data/ietf-interfaces:interfaces"
headers = {"Accept": "application/yang-data+json"}

r = requests.get(url, auth=("netops", "********"), headers=headers, verify=False, timeout=10)
r.raise_for_status()
for intf in r.json()["ietf-interfaces:interfaces"]["interface"]:
    print(intf["name"], intf.get("enabled"))

Know how these compare. Both are driven by YANG models. NETCONF runs over SSH, uses XML, and has operations such as get-config and edit-config with a candidate datastore. RESTCONF runs over HTTPS, uses JSON or XML, and maps operations to HTTP methods (GET, POST, PUT, PATCH, DELETE).

Data formats

The blueprint covers JSON, XML, YAML, YANG and CSV. Be able to say which Python module reads each one (json, xml.etree.ElementTree or lxml, yaml from PyYAML, csv), and remember that YANG is a modelling language that describes data. It is not a format you send over the wire.

Domain 3: Requirements and systems engineering (20%)

This domain surprises engineers who expected pure coding. It covers requirements engineering based on IEEE 29148-2018, systems concepts, and development models.

• A good requirement, under IEEE 29148, is necessary, unambiguous, complete, singular (one requirement per statement), feasible, verifiable and correct. For example, "The script shall report every interface with more than 100 input errors within five minutes of the error count crossing that limit" is verifiable. "The script should be fast" is not.
• Systems concepts: inputs, outputs, interfaces, boundaries and feedback loops. A monitoring script is a system with defined inputs (devices, credentials) and outputs (reports, alerts).
• Development models: waterfall (sequential), V-model (each stage paired with a test stage), iterative and agile (short cycles), and DevOps (continuous integration and delivery, automated testing, and shared ownership between development and operations).

Domain 4: Network monitoring and analysis (15%)

Process a PCAP with Scapy

from collections import Counter
from scapy.all import rdpcap, IP, TCP

packets = rdpcap("branch-uplink.pcap")

talkers = Counter(p[IP].src for p in packets if IP in p)
print("Top talkers:", talkers.most_common(5))

syns = [p for p in packets if TCP in p and p[TCP].flags == "S"]
targets = Counter((p[IP].dst, p[TCP].dport) for p in syns if IP in p)
print("Most SYN-ed destinations:", targets.most_common(5))

sniff() captures live traffic (with a count, filter or prn callback) and rdpcap() reads a saved capture. Exam questions often turn on that difference, or on the layer check (IP in p) that stops non-IP packets from raising errors.

Gather metrics and validate policy

import pandas as pd

df = pd.read_csv("interface_counters.csv")   # device, interface, in_errors, util_pct
hot = df[(df.in_errors > 100) | (df.util_pct > 85)]
print(hot.sort_values("util_pct", ascending=False).to_string(index=False))

REQUIRED = ["service password-encryption", "no ip http server", "ip ssh version 2"]

def audit(config_text: str) -> list[str]:
    """Return the required lines that are missing from a running config."""
    lines = {l.strip() for l in config_text.splitlines()}
    return [rule for rule in REQUIRED if rule not in lines]

Combined with the Netmiko example above (conn.send_command("show running-config")), these few lines are a working configuration-compliance check. That is the "validate network security configuration based on policies" objective in miniature.

A five-week CPNAE-101 study plan

Week	Focus	Practical goal
1	Python data types, conditionals, loops	Predict the output of 30 short snippets before running them
2	Files, functions, modules, ipaddress	Build an inventory reader and a subnet calculator
3	Netmiko, ncclient, Requests	Pull interface state three ways from a lab device
4	Scapy, pandas, policy checks, requirements engineering	Analyse a PCAP; rewrite five vague requirements as verifiable ones
5	Review and timed practice	40 questions in 100 minutes, then review every wrong answer

For week 5, the free CPNAE-101 sample questions from NWExam use the same read-the-code style, so they make good timed practice.

FAQ

How many questions are on the CPNAE-101 exam?

40 questions in 100 minutes, with a passing score of 70%.

Is the CPNAE-101 exam vendor-specific?

No. CPNAE is vendor-neutral. Unlike Cisco DevNet exams, it tests Python and standard protocols (SSH, NETCONF, RESTCONF, SNMP) rather than one vendor's platform.

Which domain has the most weight in CPNAE-101?

Python Programming Fundamentals, at 40%, followed by Network Device Management at 25%.

Do I need lab equipment for CPNAE-101 preparation?

It helps but isn't essential. Most Python fundamentals and Scapy PCAP work run on a laptop, and a single virtual router is enough for Netmiko, NETCONF and RESTCONF practice.

What is the difference between Paramiko and Netmiko?

Paramiko is a general SSH library. Netmiko is built on Paramiko and adds network-device handling such as prompts, paging, configuration mode and TextFSM parsing.

Exam-day checklist

• Sets remove duplicates, tuples are immutable, and non-empty strings are always truthy.
• Watch for mutable default arguments in function questions.
• Netmiko is for SSH CLI, ncclient for NETCONF on port 830, Requests for RESTCONF over HTTPS, and PySNMP for SNMP.
• rdpcap() reads a file and sniff() captures live traffic. Check IP in p before reading layers.
• IEEE 29148 requirements must be verifiable, singular and unambiguous.
• Use the 2.5 minutes per question to trace code line by line rather than guess.

If you can predict the output of every snippet in this guide without running it, you are ready for the CPNAE-101 exam.