200-901 Practice Test 17 — 15 Questions

Question 1

A web application uses HTTPS to secure communications between client and server. What does HTTPS add on top of HTTP to provide encryption and authentication?

Accepted Answer

SSL/TLS. HTTPS is HTTP layered over SSL/TLS, which provides encryption (confidentiality), integrity, and server authentication via X.509 certificates. TLS negotiates a session key using asymmetric cryptography, then encrypts the HTTP payload with symmetric ciphers. This is what distinguishes HTTPS from plain HTTP.

Answer

SSH

Answer

IPsec

Answer

VPN

Question 2

A developer wants to use Postman to test a REST API that requires a Bearer token. Where should the token be placed in the request?

Accepted Answer

In the Authorization header. The Bearer token is placed in the Authorization header using the format 'Bearer <token>'. The request body is used for data, not authentication.

Answer

As a query parameter

Answer

In a custom header like X-Auth-Token

Answer

In the request body

Question 3

An application requires reliable, ordered delivery of data. Which transport protocol should be used?

Accepted Answer

TCP. TCP is the correct choice because it is a connection-oriented transport-layer protocol that guarantees reliable, ordered delivery of data through mechanisms such as sequence numbers, acknowledgments, and retransmissions. UDP does not provide reliability or ordering, HTTP is an application-layer protocol that itself relies on TCP for reliability, and IP is a network-layer protocol that offers best-effort delivery with no guarantees.

Answer

UDP

Answer

HTTP

Answer

IP

Question 4

In the OAuth 2.0 authorization code flow, what does the client receive after the user grants authorization?

Accepted Answer

An authorization code. In the OAuth 2.0 authorization code flow, after the user grants authorization, the authorization server redirects the client with an authorization code in the query string. This code is a temporary credential that the client must exchange for an access token by sending it along with its client credentials to the token endpoint. The authorization code itself is not the final token; it is a one-time-use intermediary that prevents the access token from being exposed to the user agent.

Answer

A client secret

Answer

A refresh token

Answer

An access token

Question 5

An application requires reliable, ordered delivery of data with flow control and retransmission of lost segments. Which transport layer protocol should the developer choose and what is a key characteristic of this protocol?

Accepted Answer

TCP; it uses a three-way handshake for connection establishment. TCP is the correct transport protocol because it provides reliable, ordered delivery with flow control and retransmission of lost segments, and a defining characteristic is that it establishes connections via the three-way handshake (SYN, SYN-ACK, ACK). UDP provides none of these guarantees, and TCP actually has higher overhead than UDP, not lower.

Answer

UDP; it provides ordered delivery through sequence numbers

Answer

TCP; it has lower overhead than UDP

Answer

UDP; it uses a three-way handshake for connection establishment

Question 6

Which THREE factors influence the convergence time of OSPF in a large enterprise network? (Choose three.)

Accepted Answer

CPU processing power for SPF calculations. CPU processing power for SPF calculations directly affects convergence time because OSPF must run the Dijkstra algorithm to compute the shortest path tree after a topology change. In large networks with many routers and LSAs, a slower CPU increases the time to complete SPF, delaying route convergence.

Answer

Bidirectional Forwarding Detection (BFD) implementation

Answer

DUAL algorithm processing time

Question 7

Which TWO are benefits of using VLANs in a network? (Choose two.)

Accepted Answer

Reducing the size of broadcast domains. VLANs segment a Layer 2 network into isolated broadcast domains. By default, all ports on a switch belong to a single broadcast domain; VLANs restrict broadcast frames (e.g., ARP requests) to only those ports within the same VLAN, reducing unnecessary traffic and improving network performance.

Answer

Simplifying Layer 3 routing

Answer

Reducing the number of collision domains

Answer

Guaranteeing faster routing performance

Question 8

A developer is designing a REST API that will be used by multiple client applications. The API must support versioning to ensure backward compatibility. Which approach should the developer use to implement API versioning?

Accepted Answer

Embed the version in the URI, e.g., /v1/resource. Embedding the version in the URI (e.g., /v1/resource) is the most common and straightforward approach for REST API versioning. It makes the version explicit in the URL, allowing clients to directly target a specific version without requiring special header handling or query parameter parsing. This method is widely adopted in industry APIs (e.g., GitHub, Twilio) and ensures backward compatibility by keeping older endpoints accessible under their original URI path.

Answer

Use different HTTP methods for different versions

Answer

Pass the version as a query parameter, e.g., ?version=1

Answer

Use a custom HTTP header to specify the version

Question 9

Which TWO of the following are characteristics of a declarative automation model? (Select exactly 2.)

Accepted Answer

You specify the desired end state. Option B is correct because a declarative automation model is defined by describing the desired end state (for example, a Terraform HCL resource block or an Ansible task declaring 'state: present'), and the tool then works out how to reach that state. Option D is correct because in declarative tools the engine itself determines execution order and resolves dependencies, such as Terraform building a dependency graph from resource references or Ansible handling task ordering and handlers. Option A is incorrect because procedural scripts are the hallmark of imperative, not declarative, automation. Option C is incorrect because idempotency is a core concern and benefit of declarative models, ensuring repeated runs converge to the same state without unwanted changes. Option E is incorrect because specifying exact steps is the defining trait of an imperative model, whereas declarative models specify the outcome, not the steps.

Answer

It requires procedural scripts

Answer

Idempotency is not a concern

Answer

You specify the exact steps to achieve the state

Question 10

Which HTTP method is idempotent and used to update a resource by sending the full representation?

Accepted Answer

PUT. PUT is idempotent because making the same request multiple times results in the same server state. It requires the client to send a full representation of the resource, replacing any existing resource at that URI. This aligns with RFC 7231, which defines PUT as a method that creates or replaces the target resource with the enclosed representation.

Answer

DELETE

Answer

POST

Answer

GET

Question 11

A developer needs to retrieve a list of network devices from Cisco DNA Center. Which API endpoint should be used?

Accepted Answer

GET /dna/intent/api/v1/network-device. The intent API endpoint /dna/intent/api/v1/network-device retrieves network devices.

Answer

GET /dna/intent/api/v1/topology

Answer

POST /dna/intent/api/v1/network-device

Answer

GET /dna/intent/api/v1/site

Question 12

A university IT department manages a Cisco Meraki network with 200 MR access points and 50 MS switches. They use the Meraki dashboard API to automate network provisioning. A new student dormitory was added, and the team needs to create a new network and claim devices. They have a Python script that uses the Meraki API to create the network and then claim devices by serial numbers. The script successfully creates the network but fails when claiming devices with a 400 error: 'Device serial number is not valid or already claimed'. The serial numbers are correct and unused. The API key has full organization access. The script uses the endpoint 'POST /networks/{networkId}/devices/claim' with the correct body. What is the most likely cause of the failure?

Accepted Answer

The devices have not been added to the organization's inventory first.. In the Meraki API workflow, devices must first be added to the organization's inventory via the 'POST /organizations/{organizationId}/inventory/devices' endpoint before they can be claimed into a specific network. The 400 error 'Device serial number is not valid or already claimed' occurs when the serial numbers are not present in the organization's inventory, even if they are correct and unused. The script successfully creates the network but fails at the claim step because the devices have not been inventoried at the organization level.

Answer

The API key does not have permission to claim devices.

Answer

The serial numbers contain a typo.

Answer

The devices are not Meraki MR or MS models.

Question 13

A DNS AAAA record is used to resolve a hostname to what type of address?

Accepted Answer

IPv6 address. A DNS AAAA record maps a hostname to an IPv6 address, analogous to how an A record maps to an IPv4 address. The four A's in 'AAAA' correspond to the 128-bit IPv6 address being four times the 32-bit IPv4 size, making it the standard record type for IPv6 resolution.

Answer

Mail exchange server

Answer

IPv4 address

Answer

Canonical name alias

Question 14

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

Accepted Answer

Configure the bridge priority to 61440. Setting the bridge priority to 61440 (which is a valid priority value in increments of 4096) ensures the new switch has a higher numerical priority than the current root bridge, preventing it from becoming the root. In STP/RSTP, the switch with the lowest bridge priority becomes the root bridge; by configuring a high priority, the new switch will not disrupt the existing topology.

Answer

Enable root guard on the trunk ports

Answer

Enable BPDU guard on the trunk ports

Answer

Set the bridge priority to 0

Question 15

During a security audit, it is found that a microservice exposes its internal IP address in error responses. This could help attackers map the network. What is the BEST remediation?

Accepted Answer

Configure the application to return generic error messages without internal details.. Exposing internal IP addresses in error responses violates the principle of least information disclosure. The best remediation is to configure the application to return generic error messages (e.g., HTTP 500 with a generic body) that strip out internal details like IP addresses, stack traces, or debug data. This prevents attackers from using error responses to map the internal network topology, a common information-gathering technique.

Answer

Use a service mesh to encrypt traffic.

Answer

Log the errors and monitor them.

Answer

Add a firewall to block external access to the service.