200-901 Practice Test 2 — 10 Questions

Question 1

A network automation script uses the Cisco DNAC Python SDK (dnacentersdk) to retrieve devices. Which method correctly lists all devices?

Accepted Answer

dnac.devices.get_device_list(). The Cisco DNAC Python SDK (dnacentersdk) uses a hierarchical method structure where the `devices` resource is accessed via `dnac.devices`, and the `get_device_list()` method is the exact SDK call to retrieve all devices from the Cisco DNA Center. This matches the official SDK documentation and the REST API endpoint `/dna/intent/api/v1/network-device`.

Answer

dnac.get_devices()

Answer

dnac.sites.get_site_devices()

Answer

dnac.devices.list_devices()

Question 2

Match each HTTP status code to its meaning.

Accepted Answer

200 OK: Request succeeded.. The correct matches are: 200 OK = Request succeeded, 201 Created = Resource created successfully, 400 Bad Request = Malformed syntax or invalid request, 404 Not Found = Resource not found. Common confusions include swapping 200 and 201, as well as 400 and 404.

Answer

200 OK: Resource created.

Answer

404 Not Found: Bad request.

Question 3

A developer is troubleshooting a Cisco RESTCONF API call that returns a 409 Conflict error. Which two scenarios could cause this? (Choose two.)

Accepted Answer

The resource's current state conflicts with the requested change (e.g., trying to delete a resource that is in use).. Option B is correct because RESTCONF returns HTTP 409 Conflict when the server cannot complete the request due to a conflict with the resource's current state, such as attempting to delete a resource that is still referenced or in use by another object. Option C is correct because a 409 Conflict is also returned when a client attempts to create a resource that already exists, violating the uniqueness constraint of the target data node. Option A is incorrect because a missing authentication token produces HTTP 401 Unauthorized (or 403 Forbidden), not 409. Option D is incorrect because a nonexistent resource yields HTTP 404 Not Found. Option E is incorrect because invalid data types trigger HTTP 400 Bad Request due to schema or validation failure.

Answer

Authentication token is missing.

Answer

The resource does not exist.

Answer

The request contains invalid data types.

Question 4

A network engineer configures an HTTP/2 server. Which feature of HTTP/2 reduces overhead by compressing headers using HPACK?

Accepted Answer

HPACK. HPACK is the header compression mechanism specified for HTTP/2 (RFC 7541). It reduces overhead by encoding HTTP headers into a compact binary format using static and dynamic tables, eliminating redundant header data across requests. This directly addresses the question's focus on reducing overhead through header compression.

Answer

Server push

Answer

Binary framing layer

Answer

Multiplexed streams

Question 5

An IPv6-enabled host is trying to discover the MAC address of another host on the same link. The host knows the destination IPv6 address but does not have a corresponding entry in the neighbor cache. Which protocol and message type does the host use?

Accepted Answer

Neighbor Solicitation (ICMPv6 type 135). When an IPv6 host needs to resolve a known destination IPv6 address to its MAC address on the same link, it sends a Neighbor Solicitation (NS) message, which is ICMPv6 type 135. This message is multicast to the solicited-node multicast address of the target, and the host with that IPv6 address responds with a Neighbor Advertisement (ICMPv6 type 136) containing its MAC address. This process replaces ARP in IPv4 and is defined in RFC 4861.

Answer

Neighbor Advertisement (ICMPv6 type 136)

Answer

Router Solicitation (ICMPv6 type 133)

Answer

Address Resolution Protocol (ARP)

Question 6

A company uses a /24 subnet for its office LAN. The network must accommodate 30 hosts per VLAN. Which subnet mask would be most efficient for each VLAN while minimizing wasted IP addresses?

Accepted Answer

255.255.255.224. A /27 subnet mask (255.255.255.224) provides 32 total addresses per subnet, with 30 usable host addresses (2^5 - 2 = 30). This exactly meets the requirement of 30 hosts per VLAN without wasting IP addresses, as any larger subnet would leave unused addresses.

Answer

255.255.255.240

Answer

255.255.255.0

Answer

255.255.255.128

Answer

255.255.255.192

Question 7

A developer is using NETCONF to retrieve the running configuration of a network device. Which operation should be used?

Accepted Answer

. The operation retrieves configuration from a datastore (e.g., running).

Answer

<get>

Answer

<copy-config>

Answer

<edit-config>

Question 8

Which TWO are valid methods to secure a Docker container?

Accepted Answer

Use read-only filesystem. Option A (Use read-only filesystem) is correct because mounting a container's root filesystem with the --read-only flag prevents processes from writing to the filesystem, which blocks malware persistence, unauthorized file modification, and many privilege-escalation or tampering attacks. Option C (Set resource limits) is correct because constraining CPU, memory, and other resources via flags such as --memory, --cpus, or --pids-limit mitigates denial-of-service and resource-exhaustion attacks, and limits the blast radius if a container is compromised. The remaining options weaken security: exposing all ports (B) unnecessarily enlarges the attack surface, running containers as root (D) violates least privilege and increases the impact of a container breakout, and disabling network isolation (E) removes segmentation that normally restricts lateral movement between containers and hosts.

Answer

Expose all ports

Answer

Run containers as root

Answer

Disable network isolation

Question 9

Which TWO Ansible modules are commonly used for automating Cisco IOS devices?

Accepted Answer

ios_config. The `ios_config` module is correct because it is specifically designed to manage Cisco IOS device configurations by sending configuration commands via SSH or Telnet, using the CLI to apply changes to the running or startup configuration. This module is part of Ansible's `cisco.ios` collection and directly supports the IOS operating system, making it the standard choice for automating configuration tasks on Cisco IOS devices.

Answer

junos_config

Answer

nxos_command

Answer

eos_config

Question 10

Which TWO actions are best practices for managing secrets in a CI/CD pipeline?

Accepted Answer

Store secrets as environment variables from a .env file not committed to version control. Option B is correct because loading secrets as environment variables from a .env file that is excluded from version control (e.g., via .gitignore) keeps credentials out of the repository history and injects them only at runtime, reducing exposure. Option E is correct because a dedicated secrets manager like HashiCorp Vault centralizes storage, enforces access policies, supports dynamic/short-lived credentials, and provides auditing and encryption, which are core best practices for CI/CD secret handling. Option A is wrong because long-lived static passwords increase the blast radius if leaked and violate rotation and least-privilege principles. Option C is wrong because hardcoding secrets in source code exposes them to anyone with repository access and persists them in build artifacts and history. Option D is wrong because committing secrets to a configuration file in git stores them in plaintext within version control, where they can be cloned, forked, or leaked.

Answer

Use long-lived static passwords for service accounts

Answer

Hardcode secrets directly in application code for ease of access

Answer

Store secrets in a configuration file stored in the git repository