Agentless Network Automation Tools: Ansible vs SaltStack

300-610 By islever Editorial Last updated

Evaluate options for network orchestration and automation

Short answer

AC Ansible and SaltStack are the two automation tools that satisfy the agentless requirement and secure communication mandate.

Question

A company must introduce a scalable network automation tool to deploy, configure, and manage thousands of network devices and servers. The company servers already have been security-hardened and must not have any additional software installed on them. The security policy mandates the use of a secure communication protocol that supports authentication and encryption for managing the servers.
Which two automation tools must be used to meet these requirements? (Choose two.)
  1. Ansible Correct Answer
  2. CFEngine
  3. SaltStack Correct Answer
  4. Chef
  5. Puppet

Key Takeaways

The trap is choosing popular tools like Chef or Puppet which require agents; the key is recognizing Ansible's native SSH-based agentless design and SaltStack's ability to operate without persistent agents.

Identify the correct agentless automation tools for securing hard servers. Ansible and SaltStack allow management without installing additional software agents.

Common mistake: Choosing Chef or Puppet because they are well-known configuration management tools, failing to realize they require agent installation which violates the security policy.

Expert Analysis

The scenario imposes a strict agentless constraint: servers are security-hardened and cannot have additional software installed. This immediately eliminates agent-based configuration management tools. Chef (Option D) requires the 'chef-client' agent, and Puppet (Option E) typically relies on the 'puppet-agent' daemon, even if it supports pull modes that reduce some overhead, they still require pre-installed packages. Therefore, options D and E are invalid.

This leaves Ansible (Option A), CFEngine (Option B), and SaltStack (Option C). Among these, Ansible is natively agentless, using SSH for communication, which perfectly satisfies the security and deployment constraints. It is widely recognized in Cisco curricula for its simplicity and scalability in network automation.

The second correct option must also be agentless or support an agentless mode compatible with the constraint. SaltStack (Option C) operates in a master-minion architecture but includes a 'salt-master' only mode or can function via SSH execution modules without installing persistent agents on managed nodes, making it a viable choice for agentless-like operations in many contexts, especially when compared to Chef/Puppet. While CFEngine has an agent, it is less commonly cited as a primary agentless alternative in modern networking automation contexts compared to Ansible and Salt's flexible execution models. However, in the context of Cisco exam objectives for Automation Design (4.1), Ansible and SaltStack are frequently paired as scalable orchestration tools where Salt can leverage SSH for agentless tasks. The comments highlight this distinction, noting that Ansible is agentless and SaltStack can operate without agents in specific configurations, whereas Chef and Puppet are fundamentally agent-centric.

Thus, the two tools that meet the agentless requirement and support secure, authenticated communication (SSH/HTTPS) are Ansible and SaltStack.

Exam Strategy

When faced with 'no additional software' or 'agentless' constraints in automation questions, instantly eliminate Chef and Puppet. Focus on tools that use standard protocols like SSH (Ansible) or support dynamic/minion-less execution (SaltStack). Memorize the architecture type (Agent-based vs Agentless) for each major tool.

Frequently Asked Questions

Why is Chef not suitable for this scenario?

Chef requires the chef-client agent to be installed on every managed node to communicate with the Chef Server. Since the scenario prohibits installing additional software, Chef cannot be used.

How does SaltStack work without an agent?

While SaltStack often uses minions, it supports agentless execution via SSH execution modules or can be configured to manage devices without persistent agents, fitting the scenario's constraints better than Chef or Puppet.

More 300-610 FAQ →

Community Votes

A
50%
C
25%
E
25%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Rick099 👍 3
    First of all Ansible has an Agentless architecture. They do not need any agent at the remote managed device. With this arhitecture, many Cisco devices support Ansible. Chef has an Agent Based Architecture while Puppet has both of them.
  2. f143c37 👍 3
    If no additional software can be installed, then A&C are the only possible options. SaltStack has a hybrid mode, where an agent isn't required.
  3. garza_javi 👍 1
    The key requirements are scalability, no additional software installed on the servers, and secure communication with authentication and encryption.
  4. Wasamela 👍 1
    Agree with Rick, both are agentless and use protocols such as SSH for secure communication

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cisco UCS Fabric Interconnect Storage Port Configuration

S-grade

Cisco UCS Director for Data Center Orchestration

S-grade

UCS Fabric Interconnect FC Storage Port Configuration

S-grade

FCoE Native VLAN Restriction and VSAN Configuration

S-grade

← Back to 300-610 Study Guide