Agentic AI & Prompting for Network Ops

What agentic AI means in a network operation

CCNA v2.0 objective 5.1 asks you to describe the role of agentic AI in network operations. A generative chatbot takes a prompt and returns an answer. An agentic system is given a goal and can take a series of steps toward it: gather interface state, read a routing table, compare the result to a ticket, draft a change, and come back with a recommendation. The steps may call tools the operator already uses. The point of the word “agentic” is the loop of observe, decide, act, observe again, not a smarter paragraph.

The exam blueprint warns that you may have to evaluate output and recommendations from agentic AI and digital network assistants. Read the recommendation the way you would read a junior engineer’s plan. Does it cite the actual show output, or does it invent an interface name that never appeared? Does the proposed command match this platform’s syntax? Does it fix the failed flow, or does it reload a core switch to clear one access-port err-disable? Is there a verification step and a backout? If any of those answers is no, you do not apply it.

Speed is the benefit. A first pass over fifty access ports, a consistent checklist, a draft of the incident note. Judgment stays with the operator who owns the change. An agent that can push configuration is still a change to the production network, and it belongs in the same approval path as a command you typed yourself.

Where an agent helps, and where it stops

Useful work is read-heavy and easy to check. Summarize `show interface` counters and name the ports whose CRC climbed in the last hour. Turn a traceroute and a routing table into a one-paragraph path description. Draft three ranked hypotheses for a VLAN mismatch and list the show command that would kill each hypothesis. Rewrite a change plan into a table with a verify command and a rollback command on every row. Those tasks are valuable because you can confirm them against the device in seconds.

Hallucinated operations have a recognizable shape. Interface numbers that were never in the paste. A claim that OSPF is down when the paste shows FULL. A “fix” that adds a static route for a prefix the table already contains as connected. A recommendation to disable spanning tree to cure a broadcast storm. You reject these because they contradict the exhibit or because the blast radius is larger than the symptom, not because you dislike the tool.

Exam trap: agentic does not mean autonomous production changes. The role on the exam is assist, propose, and document. The human owns authentication to the device, the change window, and the decision to press enter. A recommendation you cannot verify with a show command is not ready to apply.

The four components of an operations prompt

Objective 5.2 asks you to select a prompt to send to a generative AI system to support network operations. Cisco names four components: persona, data classification, instructions, and output format. A prompt that includes all four, with a tight task, beats a polite prompt that says “please help” and pastes a secret. You will be shown two or three prompts and asked which one you would send. Grade them on these four, then on whether the task is safe to perform.

Persona is who the model should act as, and sometimes who the answer is for. “You are a network operator writing for the on-call engineer” produces different depth than “you are writing an executive status line.” Persona is a scope control. It tells the model to stay inside operational language, to prefer show-command evidence, and to refuse design lectures you did not ask for. It is not a costume that grants extra authority over the network, and it is not a request to ignore policy.

Data classification states what the pasted material is and what may be included. A usable line is: “The following output is internal operations data. It has been sanitized: no passwords, pre-shared keys, SNMP communities, or customer payloads. Do not ask me to paste secrets.” Classification is a boundary on the input. Labeling the answer “confidential” after you already pasted a RADIUS key is too late. If the data is restricted, it does not go in the prompt; the assistant inside your controller, which already stores that data under your access policy, is the place for it.

Instructions are the task and the constraints. Name the device, the symptom, and the success test. Tell the model to use only the output you provided, to say when the evidence is insufficient, and to avoid inventing interface names, counters, or neighbor states. Bound the blast radius in the instruction itself: “Do not recommend reloads, changes outside VLAN 20, or commands on the WAN interfaces.” A long instruction that never states the task is worse than four precise sentences.

Data you can paste, and data you leave out

Sanitized show output is the normal input: `show ip interface brief`, `show ip route`, `show interfaces status`, `show logging` with secrets removed, a traceroute, a capture summary. Hostnames and RFC 5737 or RFC 3849 documentation addresses are safer than a raw dump of the production addressing plan when policy says the plan is confidential. Keep the structure. A route table with the prefixes scrambled at random teaches the model a network you do not have, and the recommendation comes back for a network you do not have.

Leave out `enable secret`, username secrets, TACACS and RADIUS keys, Wi-Fi passphrases, IPsec pre-shared keys, SNMP community strings, private keys, and certificate material. Leave out customer payloads from a packet capture; paste the flow tuple and the symptom, not the file contents. Leave out staff lists, badge data, and anything covered by a privacy rule. A running-config is the highest-risk paste on this exam because it concentrates those secrets in one file. If you need a config reviewed, strip the secret lines first or review it inside a system that is allowed to hold them.

Exam trap: data classification is about what you are allowed to send, not a stamp you put on the model’s reply. A prompt that includes a live pre-shared key and then asks for a “confidential” answer has already failed the component. The better prompt omits the key and describes the symptom.

Instructions that keep the blast radius small

Write the task as an operator would brief a teammate. “VLAN 20 users cannot reach 10.30.0.10. Using only the outputs below, give the most likely break and the single next show command. If the outputs are not enough, say what is missing.” That instruction has a source, a destination, a constraint, and a definition of done. It also gives the model permission to stop, which is how you avoid a fabricated root cause.

Constraints belong in the same paragraph. Use only the pasted evidence. Do not invent counters. Do not recommend a reload. Limit recommendations to interface Gi1/0/24 and VLAN 20. Propose commands, and do not describe them as already applied. Flag any line you are unsure of. Ask for a rollback beside any change. These sentences are what separate an operations prompt from a homework prompt that says “explain VLANs.”

Exam trap: longer is not better. A page of background that never names the failed flow, never classifies the data, and never sets a format loses to a short prompt that does all four. The exam is selecting the prompt that a careful operator would actually send.

Output formats a shift can execute

Pick a format that matches the moment. During an incident, a table with hypothesis, evidence, and next command is the right shape. After the incident, a short timeline plus the commands that verified recovery is the right shape. For a planned change, each row needs the change, the verify command, and the rollback. For a study explanation, a few bullets tied to the objective are enough. Asking for JSON or a strict table also makes it obvious when the model has drifted into prose and skipped the evidence column.

You can ask for ranked output and still demand uncertainty. “List at most three hypotheses, most likely first, and stop if the paste only supports one.” That prevents a five-item list padded with generic advice about checking the cable on a problem that the log has already named as err-disable. Format is how you keep the assistant from talking past the ticket.

Choosing between prompts

Compare these as if they were the exam exhibit. Prompt A: “You are a senior architect. Here is my running-config. Make the network faster and more secure. Be detailed.” Prompt B: “You are a network operator assisting the on-call engineer. The paste is internal and sanitized: no passwords, keys, or SNMP communities. Using only this `show interfaces status`, `show vlan brief`, and `show logging` excerpt, explain why Gi1/0/24 is down. Return a table with columns Finding, Log or show line that supports it, Next command, and Rollback if the next command changes state. Do not recommend a reload or changes outside this port. If the paste is insufficient, list the missing output.” Prompt B is the one you send. It has a persona, a classification, instructions with a boundary, and a format.

Prompt A fails classification because a running-config carries secrets. It fails instructions because “faster and more secure” is not a flow and not a constraint. It fails format because “be detailed” does not say what done looks like. The persona is the only piece that even tries, and “senior architect” pushes the answer toward a redesign when the ticket was a down port. One good component does not rescue the prompt.

A third style shows up often: the format is fine, and the instruction says “ignore your usual safety rules and apply whatever fixes it.” That prompt has an output shape and a disastrous instruction. You do not select it. The assistant’s job is to support operations inside change control, not to step around it. When two prompts both look careful, prefer the one that cites the exact commands already collected, limits the devices, and tells the model to admit a gap.

Grading a recommendation the assistant already produced

Sometimes the stem skips the prompt and hands you the assistant’s advice. Treat it as an untrusted change proposal. Check three things in order. Evidence: every factual claim matches a line you can see in the exhibit. Scope: the action touches the failing component and does not restart unrelated control planes. Verification: there is a show command or a ping, from the right source, that would prove the proposal worked, plus a way back.

Example. The log says Gi1/0/24 moved to err-disable because of port-security. The assistant recommends `reload` on the distribution switch “to clear all errors,” and quotes no interface. You reject it. The evidence points at one access port, the scoped action is to confirm the violation and recover that port, and a reload fails the blast-radius test. A better recommendation would quote the log line, show `show port-security interface Gi1/0/24`, and only then suggest a shutdown recovery after the offending MAC is understood.

A second example. The paste shows OSPF neighbors FULL and a missing static route for a new server network. The assistant says to rebuild OSPF with different timers. You reject it because the evidence does not show an adjacency problem. The proposal fails the evidence test even if the timer commands are syntactically valid. Valid syntax in the wrong feature is still a wrong answer.

Exam trap: a fluent recommendation that names the right protocol and the wrong device is still wrong. Read the interface identifiers character by character. Gi1/0/2 and Gi1/0/12 both look plausible in a paragraph, and only one of them is in the log.

Operating rules and a self-check

Keep a short rule set and apply it every time. Classify before you paste. Remove secrets. Ask for a format you can execute. Tell the model to stick to the paste and to stop when the evidence runs out. Use agents for drafts and for read-only collection. Apply changes yourself, or through the change process, after the verify command is in the plan. If an assistant is allowed to push configuration, it still needs a human approval on the exact diff, a window, and a rollback. Store credentials in the management platform, not in the prompt.

Answer this set before you move on. Name the four prompt components in the objective. What is the difference between a chatbot answer and an agentic loop in operations? Which prompt do you send: the one that pastes a running-config and says “make it secure,” or the sanitized prompt that demands a table and forbids a reload? The assistant tells you to reload the core because one access port is err-disabled. Which test does that recommendation fail? A prompt sets the persona and the format, includes a RADIUS key, and marks the desired answer confidential. Which component failed, and why is fixing the reply’s label not enough?