200-901 Practice Test 13 — 15 Questions

Question 1

A developer creates a Dockerfile for a Python web application. Which instruction should be used to define the working directory inside the container for subsequent commands?

Accepted Answer

WORKDIR. The WORKDIR instruction in a Dockerfile sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Dockerfile. For a Python web application, using WORKDIR /app ensures that subsequent commands like COPY and RUN operate inside the /app directory, keeping the container filesystem organized and avoiding path errors.

Answer

ENV

Answer

RUN

Answer

COPY

Question 2

A large enterprise uses Cisco Meraki for their wireless and switching infrastructure. The network team has developed a Python script that uses the Meraki API to automatically update SSID configurations across all networks. The script has been running successfully for months, performing daily updates to SSID settings such as names, passwords, and VLAN assignments. Recently, the script started failing with the following error message: '{"errors":["This operation is not allowed for this network"]}'. The team has verified the following: the API key is still valid and has access to the full organization, the network IDs used in the script are correct and the networks are active, and no changes have been made to the script code. The script uses the PUT endpoint '/networks/{networkId}/wireless/ssids/{number}' to update SSIDs. What is the most likely cause of the failure?

Accepted Answer

The network(s) have been moved to a different organization in the Meraki dashboard.. The error 'This operation is not allowed for this network' indicates that the API key's scope no longer includes the target network. Since the script uses the PUT endpoint to update SSID configurations, the most likely cause is that the network(s) have been moved to a different organization in the Meraki dashboard. The API key is tied to the original organization, and after the move, the key no longer has permission to modify the network, even though the network ID remains valid and the key itself is still active.

Answer

The Meraki API rate limit has been exceeded, and the request is being rejected.

Answer

The API key has been downgraded to read-only access due to a security compliance audit.

Answer

The SSID number used in the request does not exist on the target network.

Question 3

A developer wants to get the current user's information from the Webex API. Which endpoint should they use?

Accepted Answer

GET /v1/people/me. The GET /v1/people/me endpoint returns the authenticated user's details.

Answer

POST /v1/messages

Answer

GET /v1/webhooks

Answer

GET /v1/rooms

Question 4

A network engineer is using the Cisco DNA Center API to get site health. The API endpoint returns a large dataset with pagination. The response includes the header 'X-Page-Total-Count'. To retrieve all pages efficiently, what should the engineer implement?

Accepted Answer

A loop that increments the page parameter until the response is empty, using the total count header.. The Cisco DNA Center API uses pagination with a page parameter and returns a 'X-Page-Total-Count' header indicating the total number of pages. By implementing a loop that increments the page parameter until all pages are retrieved, the engineer can efficiently fetch all data without overwhelming the API or missing records, using the total count to know when to stop.

Answer

A single request with a high limit parameter to fetch all data at once.

Answer

A recursive function that follows 'next' links in the response body.

Answer

Polling the endpoint at regular intervals to gather data over time.

Question 5

A CI/CD pipeline includes stages for security scanning. Which TWO tools or services are specifically designed for dependency vulnerability scanning?

Accepted Answer

Snyk. Snyk is a dedicated security tool that integrates into CI/CD pipelines to scan dependencies for known vulnerabilities using databases like the National Vulnerability Database (NVD) and its own proprietary intelligence. It continuously monitors open-source libraries and container images, providing automated fix pull requests and blocking builds when critical vulnerabilities are found.

Answer

Kubernetes

Answer

Jenkins

Answer

Docker

Question 6

Which TWO of the following are best practices for securely managing API tokens in a CI/CD pipeline?

Accepted Answer

Use environment variables injected by the CI/CD system (e.g., Jenkins secrets).. CI/CD systems like Jenkins provide built-in secret management features (e.g., Jenkins Credentials Binding plugin) that inject API tokens as environment variables at runtime, keeping them out of source code and build artifacts. This approach ensures tokens are never stored in plain text or committed to version control, aligning with the principle of least privilege and secure pipeline design.

Answer

Store tokens as plain text in the source code repository for easy access.

Answer

Hardcode tokens into the Docker image during build.

Answer

Encrypt tokens with a static key stored in the repository.

Question 7

A developer is implementing secure coding practices to prevent SQL injection. Which approach is most effective when building a SQL query with user input?

Accepted Answer

Using parameterized queries with prepared statements. Parameterized queries separate SQL code from data, preventing injection. Input validation helps but not sufficient alone. Stored procedures can help but parameterized queries are standard. Escaping is error-prone.

Answer

Validating user input to allow only alphanumeric characters

Answer

Storing user input in a database before using it in a query

Answer

Escaping all user input with a function like mysqli_real_escape_string

Question 8

A network developer is using Cisco NSO to manage multi-vendor devices. Which three are valid approaches to handle device-specific differences? (Choose three.)

Accepted Answer

Write custom Python code in the service model. Cisco NSO allows developers to write custom Python code within the service model to handle device-specific logic, such as translating abstract service parameters into vendor-specific CLI or NETCONF commands. This approach provides flexibility to accommodate non-standard configurations that cannot be expressed purely through YANG models or NEDs.

Answer

Use SNMP MIBs for all configurations

Answer

Configure each device manually through CLI

Question 9

Refer to the exhibit. An engineer uses NETCONF to configure an interface. After applying this configuration, the interface is administratively up. However, the interface does not pass traffic. What is the most likely cause?

Accepted Answer

The IP address configuration uses 'netmask' instead of 'prefix-length'. NETCONF uses YANG models that define IP address configuration with the leaf 'prefix-length' (an integer), not 'netmask'. The 'netmask' field is not a valid leaf in the standard ietf-interfaces or ietf-ip YANG model for IPv4 addresses, so the NETCONF server will either reject the configuration or apply it incorrectly, leaving the interface without a proper IP address and unable to pass traffic.

Answer

The interface type is misspelled

Answer

The 'enabled' field should be a string instead of a boolean

Answer

The interface name is invalid

Question 10

A company uses Cisco Meraki APs and an internal web application hosted on AWS. The application store customer payment data. The security team discovers that sensitive application logs are being transmitted in plaintext over the network to the SIEM. The DevOps team wants to improve security without changing the application code because it is proprietary and cannot be modified. Which solution should be recommended?

Accepted Answer

Set up a site-to-site VPN between the Meraki network and AWS to encrypt all traffic, including logs. A site-to-site VPN between the Meraki network and AWS encrypts all traffic traversing the link, including the sensitive application logs sent to the SIEM, without requiring any changes to the proprietary application code. This solution operates at the network layer, ensuring that even if the application transmits logs in plaintext, the entire payload is encrypted by the VPN tunnel. Meraki Auto VPN and AWS VPN Gateway can establish an IPsec tunnel, providing confidentiality for all data in transit between the on-premises network and the AWS VPC.

Answer

Modify the application to send logs via syslog over TLS

Answer

Enable HTTPS on the SIEM receiver to ensure logs are encrypted during transmission

Answer

Enable TLS on the web application to encrypt data in transit

Question 11

Which TWO are benefits of using model-driven programmability (e.g., NETCONF/RESTCONF) over traditional CLI scripting for network automation?

Accepted Answer

Data is structured and machine-readable (e.g., XML/JSON).. Model-driven programmability with NETCONF/RESTCONF uses structured data formats like XML or JSON, which are machine-readable. This eliminates the need for screen-scraping or parsing CLI output, making automation scripts more reliable and easier to maintain. Structured data also enables consistent validation and integration with other systems.

Answer

Reduces network latency because it uses a lighter protocol.

Answer

Requires no additional learning beyond CLI commands.

Answer

Easier to debug because it uses the same syntax as CLI.

Question 12

A developer has created a Webex Teams bot that listens for messages in a specific room and responds with information from an external database. The bot uses the Webex API's 'messages.create' method to post replies. During testing, the bot sometimes fails to respond, but no errors are logged. The developer checks the Webex Developer Portal and sees that the bot's rate limit is set to 10 requests per second. The bot's average load is 5 requests per second, but occasionally spikes to 15 requests per second for a few seconds. The developer wants to ensure the bot functions reliably without exceeding rate limits. Which approach should the developer implement?

Accepted Answer

Implement a request queue that limits outgoing requests to 10 per second and uses exponential backoff on failure.. Implementing a request queue that limits outgoing requests to 10 per second and uses exponential backoff on failure ensures the bot respects the Webex API rate limit of 10 requests per second. The queue smooths out spikes (e.g., 15 req/s) by buffering excess requests, while exponential backoff handles any HTTP 429 responses gracefully by retrying after increasing delays, preventing further rate limit violations. This approach directly addresses the bot's intermittent failure without relying on external support or sacrificing functionality.

Answer

Request a higher rate limit from the Webex API support team.

Answer

Catch HTTP 429 (Too Many Requests) errors and immediately retry the request.

Answer

Reduce the bot's overall request rate to 5 per second to stay well within the limit.

Question 13

A developer needs to securely store API keys for use in a CI/CD pipeline. Which best practice should be followed?

Accepted Answer

Use built-in pipeline secrets or environment variables.. CI/CD platforms (e.g., Jenkins, GitLab CI, GitHub Actions) provide built-in mechanisms to store secrets as encrypted environment variables or pipeline secrets. These values are masked in logs and never exposed in source code, ensuring API keys remain confidential throughout the pipeline execution.

Answer

Share the keys via email to the team.

Answer

Hardcode the keys in the source code.

Answer

Store the keys in a JSON file committed to the repository.

Question 14

Which TWO practices help prevent hardcoded credentials in application code? (Choose TWO.)

Accepted Answer

Use a secrets management tool like HashiCorp Vault to retrieve credentials at runtime. Using environment variables (from .env or secret managers) and using a dedicated secrets management tool like Vault are best practices. Committing .env files exposes secrets.

Answer

Share secrets via email and paste them into the code during deployment

Answer

Commit a .env file with placeholder values to the repository

Answer

Embed secrets directly in the source code with comments

Question 15

A CI/CD pipeline has a stage that runs security vulnerability scans on dependencies. Which tool is specifically designed to scan Python packages for known vulnerabilities?

Accepted Answer

pip audit. pip audit checks Python packages for vulnerabilities. npm audit is for Node.js, Snyk is a third-party tool, Dependabot automates dependency updates.

Answer

Snyk

Answer

Dependabot

Answer

npm audit