6.3 AI and Machine Learning in Network Operations

A New v1.1 Topic

Artificial Intelligence (AI) and Machine Learning (ML) in network operations were added to the CCNA in the v1.1 blueprint of August 2024, alongside generative AI and cloud network management. The questions are purely conceptual — you will never configure an AI model. You must distinguish three terms and recognize their networking use cases.

The Three Terms You Must Separate

Note that ML is the engine underneath both predictive and generative AI, but the exam treats the three labels as distinct answer choices.

Predictive AI in Operations

Predictive AI turns months of telemetry into a forecast so engineers act before an outage.

Worked Example

A core switch's Gi1/0/24 shows CRC errors climbing from 5/day to 400/day over 30 days. Predictive AI: (1) detects the upward trend, (2) matches it against historical cable-failure signatures, (3) alerts "Gi1/0/24 likely to fail within 7 days," and (4) recommends replacing the cable during the next maintenance window. The outage is prevented, not just diagnosed afterward.

Generative AI in Operations

Generative AI produces new artifacts from natural-language input, cutting the manual effort of writing configs and docs.

The key exam distinction: generative AI creates something new; predictive AI forecasts a future event. If the stem says "generate," "create," or "write," the answer is generative.

Machine Learning for Security and Assurance

ML shines where static, rule-based (signature) systems fail because it does not need a pre-written signature for every threat.

Baselining and Anomaly Detection

ML learns a baseline of normal behavior — typical traffic volumes, who-talks-to-whom, usual protocols and ports — then alerts on deviations such as:

• A spike in traffic at 3 a.m. when the segment is normally idle.
• A workstation suddenly talking to a server it never contacted before.
• An unexpected protocol or port appearing on a segment.
• A login from an unusual geographic location.

Cisco AI Network Analytics

Cisco bakes AI/ML into Catalyst Center (formerly DNA Center) under the Assurance umbrella:

• AI-driven insights — proactive issue identification.
• Baseline comparison — ML learns each network's normal and alerts on drift.
• Root-cause analysis — correlates many symptoms into one underlying cause.
• Suggested remediation — proposes or auto-applies fixes.

Worked Example: AI-Driven Troubleshooting

1. Detect: ML baseline says Wi-Fi onboarding takes ~2 s; it is now averaging 8 s.
2. Correlate: AI links the slowdown to a recent RADIUS server change.
3. Root cause: the RADIUS server is timing out 802.1X authentication.
4. Recommend: "Revert the RADIUS change or raise the auth timeout."

Common Trap

Distractors claim AI "encrypts all traffic automatically," "generates stronger passwords," or "replaces all firewalls." None describe how ML aids security — the correct mechanism is baseline-and-detect-anomalies.

On the Exam: Memorize predictive (forecast from history), generative (create from a prompt), and ML (baseline + anomaly detection), and know Cisco embeds them in Catalyst Center. You will not configure anything here.

From Reactive to Proactive Operations

The deeper theme behind this entire section is a shift in operating posture. Traditional network operations are reactive: an alarm fires, a ticket opens, an engineer logs in, runs show commands, forms a hypothesis, and fixes whatever broke — all after users are already affected. AI and ML invert that sequence. Predictive AI surfaces the problem days before users feel it, generative AI drafts the remediation in seconds instead of an engineer hand-writing it, and ML-driven baselining catches the subtle anomalies a human staring at dashboards would never spot.

The net effect is fewer outages, shorter mean-time-to-resolution, and engineers freed from repetitive triage to do design work.

Where AI Helps and Where It Does Not

A balanced view is worth carrying into the exam. AI/ML genuinely excels at pattern recognition across huge telemetry sets, at correlating dozens of weak signals into one root cause, and at generating boilerplate configuration that a human then reviews. It does not, however, replace networking fundamentals — a generated OSPF config is only as correct as the intent behind the prompt, and a human still owns the decision to apply it. ML anomaly detection can also raise false positives if its baseline was learned during an abnormal period, which is why these tools augment rather than replace engineers.

For the CCNA you should be able to read a scenario and classify it: "the system warned a power supply would fail next week" is predictive; "the system wrote the ACL from my plain-English request" is generative; "the system flagged a host suddenly scanning the subnet at midnight" is machine learning anomaly detection. Mapping the verb in the stem — forecast, create, or detect-anomaly — to the right category is the single most reliable way to answer these questions correctly under time pressure.