The automation team must push a VLAN and an interface description to 40 IOS XE switches that are reachable over SSH, with NETCONF and RESTCONF listeners turned off. The devices need enable-mode credentials, and the change must be previewed with a diff before anything is applied. Which Ansible connection and module pairing should the playbook use to push this VLAN change?
Select an answer to reveal the explanation.
Short Explanation
The network_cli connection gives Ansible an SSH channel to the switch, and cisco.ios.ios_config is the module built for writing config lines there. Because NETCONF and RESTCONF are off, those connections cannot reach the device. With become: true and configured enable credentials, Ansible can enter enable mode, and check mode with diff previews the changes before you apply them.
Full Explanation
The network_cli connection opens a persistent SSH session in Ansible's command pipeline, and cisco.ios.ios_config is written for that channel: it sends configuration lines, reports a diff, and honors check mode, so a dry run shows what each switch would receive. With become: true and configured enable credentials, Ansible can reach privileged EXEC before it writes the VLAN. The httpapi connection paired with ansible.netcommon.restconf_config depends on the device's RESTCONF listener, which is unavailable here. The netconf connection needs the NETCONF agent, which is also unavailable. A network_cli play that applies changes immediately satisfies the push but skips the previewed diff the change window requires. Exam caveat: connection and module support can vary between collection releases, so confirm the pairing in current cisco.ios documentation. Practical check: run the play with --check --diff against one lab switch and compare the reported diff with the intended VLAN lines.