An automation team must push configuration to IOS XE devices using YANG models. They want a protocol that runs over SSH, exchanges XML-encoded RPCs, and supports candidate datastores and network-wide transactions. Which protocol fits?

NETCONF is an IETF protocol that manages devices through remote procedure calls encoded in XML, transported over a secure session that is SSH in standard deployments. It defines datastores such as running and, where supported, candidate, and its operations allow locking, editing, validating and committing configuration, which enables transactional, all-or-nothing changes across devices. YANG models describe the data it manipulates. RESTCONF also uses YANG models, but it maps them to HTTP methods such as GET, POST, PUT, PATCH and DELETE over HTTPS, with JSON or XML encoding; it does not run over SSH and is less suited to multi-step transactional workflows, so describing it with SSH and RPCs is incorrect. SNMPv3 secures polling and traps and can set individual MIB objects, but it does not use YANG models or offer datastore transactions, which is why programmable management moved away from it. Dial-out telemetry streams operational data from the device to a collector; it is a monitoring channel, not a mechanism for pushing configuration to devices. Exam caveat: both model-driven protocols should be restricted to management networks and authenticated users, because either can change the entire configuration. Operational check: enable the NETCONF agent, connect from a client to the NETCONF SSH port, confirm the capabilities exchange lists the expected YANG models, and test a lock, edit and commit sequence.