200-901 Practice Exam 2 — 20 Questions

Question 1

An IPv6-enabled host is trying to discover the MAC address of another host on the same link. The host knows the destination IPv6 address but does not have a corresponding entry in the neighbor cache. Which protocol and message type does the host use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Neighbor Solicitation (ICMPv6 type 135). When an IPv6 host needs to resolve a known destination IPv6 address to its MAC address on the same link, it sends a Neighbor Solicitation (NS) message, which is ICMPv6 type 135. This message is multicast to the solicited-node multicast address of the target, and the host with that IPv6 address responds with a Neighbor Advertisement (ICMPv6 type 136) containing its MAC address. This process replaces ARP in IPv4 and is defined in RFC 4861.

Answer

Neighbor Advertisement (ICMPv6 type 136)

Answer

Router Solicitation (ICMPv6 type 133)

Answer

Address Resolution Protocol (ARP)

Question 2

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

Accepted Answer

Use a secure secret store like HashiCorp Vault and retrieve secrets at runtime via API.. It follows the principle of secret management by decoupling sensitive data from application code and container images. HashiCorp Vault provides a centralized, encrypted secret store with dynamic secrets, access policies, and audit logging, allowing the microservices to authenticate and retrieve credentials at runtime via its REST API, eliminating the need to hardcode secrets.

Answer

Embed secrets directly in the container image using COPY instructions.

Answer

Pass secrets as build arguments in the Docker build command.

Answer

Store secrets as environment variables in the Docker Compose file.

Question 3

A developer needs to send a diagnostic request to a network device to verify if it supports a specific MIB object. Which protocol and operation should be used?

Accepted Answer

SNMP GET. SNMP GET is the correct operation to retrieve the value of a specific MIB object from a network device. It sends a diagnostic request to verify if the device supports that object by checking whether a valid response is returned. This is the standard SNMP operation for reading a single managed object's value.

Answer

ICMP ping

Answer

HTTP GET

Answer

SNMP SET

Answer

NETCONF get-config

Question 4

Which TWO statements about the MVC pattern are correct? (Choose two.)

Accepted Answer

Controller handles user input and updates the Model.. MVC separates Model (data), View (UI), Controller (logic). Controller updates Model, View reflects Model.

Answer

Model is dependent on the View.

Answer

Model represents the user interface.

Answer

View directly modifies the Model.

Question 5

A DevOps team uses GitLab CI to deploy a containerized application to a Kubernetes cluster. The deployment pipeline fails at the 'deploy' stage with an error: 'unable to connect to server'. What is the most likely cause?

Accepted Answer

The kubeconfig file for the cluster is missing or invalid.. The error 'unable to connect to server' indicates that the GitLab CI runner cannot establish a TCP connection to the Kubernetes API server. This is most commonly caused by a missing or invalid kubeconfig file, which contains the cluster endpoint, credentials, and context required by kubectl to authenticate and communicate with the cluster. Without a valid kubeconfig, the deployment stage cannot proceed.

Answer

The Git repository is private and cannot be accessed.

Answer

The Docker image was not built successfully.

Answer

The Kubernetes cluster has insufficient resources to schedule the pod.

Question 6

A company uses a /24 subnet for its office LAN. The network must accommodate 30 hosts per VLAN. Which subnet mask would be most efficient for each VLAN while minimizing wasted IP addresses?

Accepted Answer

255.255.255.224. A /27 subnet mask (255.255.255.224) provides 32 total addresses per subnet, with 30 usable host addresses (2^5 - 2 = 30). This exactly meets the requirement of 30 hosts per VLAN without wasting IP addresses, as any larger subnet would leave unused addresses.

Answer

255.255.255.240

Answer

255.255.255.0

Answer

255.255.255.128

Answer

255.255.255.192

Question 7

Which two Meraki Dashboard API features are used to paginate through large result sets? (Choose two.)

Accepted Answer

startingAfter and endingBefore parameters. Meraki supports Link header for standard pagination and startingAfter/endingBefore parameters for cursor-based pagination.

Answer

offset and limit parameters

Answer

page and perPage query parameters

Answer

Retry-After header

Question 8

A network engineer is configuring a new switch and needs to ensure that frames from VLAN 10 and VLAN 20 are isolated on the same trunk link to another switch. Which IEEE standard should be configured on the trunk interfaces?

Accepted Answer

802.1Q. C is correct because 802.1Q is the IEEE standard that defines VLAN tagging, allowing multiple VLANs (such as VLAN 10 and VLAN 20) to be carried over a single trunk link while maintaining isolation between them. By inserting a 4-byte VLAN tag into the Ethernet frame, 802.1Q enables the receiving switch to identify which VLAN a frame belongs to, ensuring traffic from different VLANs remains separate.

Answer

802.3

Answer

802.11

Answer

802.1X

Question 9

A developer writes a Python script using Cisco's pyATS framework to test network reachability after a configuration change. What is a key advantage of using pyATS over a simple script that uses ping?

Accepted Answer

pyATS allows writing reusable test scripts with built-in test libraries. PyATS is a test automation framework designed for network engineers, providing built-in test libraries (e.g., `pyats.aetest`) that enable writing reusable, modular test scripts. Unlike a simple ping script, pyATS supports structured test cases, data-driven testing, and integration with Cisco devices via libraries like `Genie`, allowing for comprehensive validation beyond basic reachability.

Answer

pyATS requires less code than a ping script

Answer

pyATS can test multiple devices in parallel

Answer

pyATS automatically generates test reports

Question 10

A network automation script uses the Python ncclient library to modify a device configuration. Which NETCONF operation should be used to apply configuration changes?

Accepted Answer

. The operation is used to modify configuration in NETCONF.

Answer

<close-session>

Answer

<get-config>

Answer

<get>

Question 11

Drag and drop the steps to set up a basic DHCP server on a Cisco router into the correct order.

Accepted Answer

First, configure the excluded address range using 'ip dhcp excluded-address'. Then, create the DHCP pool with 'ip dhcp pool'. Next, define the network subnet with 'network'. Finally, set the default gateway with 'default-router'.. DHCP configuration on Cisco routers involves creating a pool, defining the network, and setting options like default gateway.

Answer

First, create the DHCP pool with 'ip dhcp pool'. Then, define the network subnet with 'network'. Next, set the default gateway with 'default-router'. Finally, configure the excluded address range using 'ip dhcp excluded-address'.

Answer

First, define the network subnet with 'network'. Then, create the DHCP pool with 'ip dhcp pool'. Next, set the default gateway with 'default-router'. Finally, configure the excluded address range using 'ip dhcp excluded-address'.

Answer

First, set the default gateway with 'default-router'. Then, create the DHCP pool with 'ip dhcp pool'. Next, define the network subnet with 'network'. Finally, configure the excluded address range using 'ip dhcp excluded-address'.

Question 12

An automation engineer wants to programmatically retrieve the interface configuration of a Cisco Nexus switch using NX-API. Which API call method is most appropriate?

Accepted Answer

GET. The NX-API on Cisco Nexus switches uses HTTP methods that map to CRUD operations. To retrieve (read) interface configuration without modifying any state, the GET method is the correct and most appropriate choice, as it corresponds to the 'show' commands in the CLI. POST, PUT, and DELETE are intended for creating, updating, or deleting resources, not for read-only queries.

Answer

POST

Answer

DELETE

Answer

PUT

Question 13

A REST API returns a 500 Internal Server Error when a client sends a malformed JSON payload. What is the most appropriate HTTP response code to indicate a client-side error?

Accepted Answer

400 Bad Request. A 400 Bad Request is the correct response because the client sent a malformed JSON payload, which is a client-side error. HTTP 400 indicates that the server cannot process the request due to something perceived as a client error (e.g., malformed syntax). This aligns with RFC 7231, which defines 400 as appropriate for requests with invalid syntax or structure.

Answer

401 Unauthorized

Answer

403 Forbidden

Answer

422 Unprocessable Entity

Question 14

A team is using Python scripts with netmiko to back up configurations from a large number of network devices. What is the primary advantage of using netmiko over direct paramiko for this task?

Accepted Answer

Netmiko simplifies the handling of device-specific prompts and command output. Netmiko is built on top of Paramiko but adds a higher-level abstraction layer that automatically handles device-specific prompt detection, command output parsing, and SSH session management. This simplifies the backup process across heterogeneous devices by eliminating the need to manually write code for each device's unique prompt patterns and command responses.

Answer

Netmiko supports only Cisco devices

Answer

Netmiko uses REST API instead of SSH

Answer

Netmiko is faster than paramiko

Question 15

A security team is developing an application that collects network alerts from Cisco Firepower Management Center (FMC) API. The API requires OAuth2 authorization code grant flow. After obtaining an authorization code, what must the application do to get an access token?

Accepted Answer

Exchange the authorization code for an access token by calling the token endpoint with the code and client credentials.. In the OAuth2 authorization code grant flow, the authorization code is an intermediate credential that must be exchanged for an access token. The application must call the token endpoint, presenting the authorization code along with its client credentials (client ID and client secret) to receive the access token. This exchange is required by RFC 6749 and is a fundamental security measure to ensure the client is authorized to obtain the token.

Answer

Resend the authorization request with the code included in the redirect URI.

Answer

Decode the authorization code using base64 to extract the access token.

Answer

Use the authorization code directly in subsequent API requests as a bearer token.

Question 16

A network automation engineer uses Terraform to manage Cisco Catalyst Center (formerly DNA Center) resources. What is the purpose of the Cisco Catalyst Center Terraform provider?

Accepted Answer

To define and manage network infrastructure resources in a declarative state file. The Cisco Catalyst Center Terraform provider allows network automation engineers to define and manage network infrastructure resources in a declarative state file. Terraform uses a desired-state approach where the configuration file describes the intended end state of resources, and the provider communicates with Catalyst Center's REST API to enforce that state, enabling idempotent and version-controlled infrastructure management.

Answer

To execute a series of CLI commands on network devices in sequence

Answer

To write imperative scripts that configure network devices via SSH

Answer

To directly manage routers and switches without using Catalyst Center

Question 17

A large enterprise uses Cisco SD-Access with fabric automation. The network administrator wants to automate the process of adding a new user device to a specific virtual network (VN) based on its MAC address. Which API or tool should they use?

Accepted Answer

Cisco ISE REST API. Cisco ISE REST API is the correct choice because ISE is the policy and authentication engine in SD-Access that manages endpoint identity and virtual network (VN) assignments. When a new user device is added, the administrator can use the ISE REST API to programmatically create an endpoint entry with its MAC address and map it to a specific VN, leveraging ISE's policy sets and authorization profiles. This directly automates the VN assignment without requiring changes to fabric underlay or overlay configurations.

Answer

Ansible playbook with ios_config

Answer

Cisco DNA Center REST API

Answer

Cisco APIC-EM REST API

Question 18

Which TWO Ansible modules are commonly used for automating Cisco IOS devices?

Accepted Answer

ios_config. The `ios_config` module is correct because it is specifically designed to manage Cisco IOS device configurations by sending configuration commands via SSH or Telnet, using the CLI to apply changes to the running or startup configuration. This module is part of Ansible's `cisco.ios` collection and directly supports the IOS operating system, making it the standard choice for automating configuration tasks on Cisco IOS devices.

Answer

junos_config

Answer

nxos_command

Answer

eos_config

Question 19

When implementing network automation with Cisco devices, which THREE practices help ensure idempotency? (Select THREE)

Accepted Answer

Performing a full configuration replace using RESTCONF PUT instead of PATCH.. A full configuration replace using RESTCONF PUT ensures idempotency by setting the entire configuration to a known state, regardless of the current state. Unlike PATCH, which applies incremental changes that may behave differently depending on the existing configuration, PUT overwrites the entire resource, guaranteeing the same result every time it is executed.

Answer

Writing scripts that only push incremental configurations.

Answer

Relying on manual rollback procedures after automation failures.

Question 20

A YANG module defines a leaf named 'bandwidth' of type 'uint32'. What does this represent in the context of a network device?

Accepted Answer

A single integer value representing bandwidth in kilobits per second. In YANG, a 'leaf' node defines a single, scalar value of a specific data type. When the leaf is named 'bandwidth' with type 'uint32', it represents a single integer value, typically interpreted as kilobits per second (kbps) in the context of network device configuration (e.g., interface bandwidth). This aligns with the standard YANG data modeling approach where a leaf cannot hold multiple values or complex structures.

Answer

A set of unique bandwidth values

Answer

A grouping of related bandwidth parameters

Answer

An ordered list of bandwidth values