200-901 Practice Exam 4 — 20 Questions

Question 1

A network administrator configures a switch port to belong to VLAN 10. Which OSI layer is primarily involved in VLAN tagging?

Accepted Answer

Layer 2 (Data Link). VLANs operate at Layer 2 (Data Link) by adding tags to Ethernet frames.

Answer

Layer 1 (Physical)

Answer

Layer 3 (Network)

Answer

Layer 4 (Transport)

Question 2

Which OSI layer is responsible for routing packets across different networks?

Accepted Answer

Layer 3 (Network). The Network layer (Layer 3) is responsible for logical addressing and routing packets between different networks. Protocols like IP (IPv4/IPv6) use routing tables and algorithms (e.g., OSPF, BGP) to determine the best path for forwarding packets across multiple hops. Without Layer 3, traffic could not leave a local broadcast domain.

Answer

Layer 1 (Physical)

Answer

Layer 4 (Transport)

Answer

Layer 2 (Data Link)

Question 3

Which Python exception would be raised by the following code?

my_dict = {'a': 1}
value = my_dict['b']

Accepted Answer

KeyError. Accessing a dictionary key that does not exist raises a KeyError in Python. In the code, my_dict['b'] attempts to retrieve the value for key 'b', which is not present in the dictionary {'a': 1}, so Python raises KeyError.

Answer

ValueError

Answer

IndexError

Answer

AttributeError

Question 4

An application uses the Meraki Dashboard API and receives a 429 Too Many Requests error. What is the most likely cause, and how should the application adjust?

Accepted Answer

The application exceeded the rate limit of 5 calls per second; implement exponential backoff.. Meraki API rate limits at 5 calls per second; a 429 indicates rate limit exceeded. The application should implement retry with backoff.

Answer

The request body is malformed; check JSON syntax.

Answer

The API key is invalid; regenerate the key.

Answer

The network is down; check connectivity.

Question 5

A network engineer is troubleshooting a connectivity issue between two hosts in different VLANs on the same switch. The hosts are in VLAN 10 and VLAN 20, respectively. The switch has an SVI for each VLAN and IP routing is enabled. Which command should be used to verify that the switch is forwarding traffic between the VLANs?

Accepted Answer

show ip route. 'show ip route' displays the switch's routing table, which contains the directly connected subnets for VLAN 10 and VLAN 20 (via their SVIs) and any learned routes. Since IP routing is enabled, the switch uses this table to make forwarding decisions between VLANs. Verifying that both VLAN subnets appear in the routing table confirms that the switch can route traffic between them.

Answer

show interfaces trunk

Answer

show vlan

Answer

show mac address-table

Question 6

Which THREE are valid methods for managing Kubernetes application configuration?

Accepted Answer

Helm values.. Helm values (A) are correct because Helm is a package manager for Kubernetes that uses values.yaml files to inject configuration into templates at deployment time, enabling dynamic, environment-specific application configuration without modifying the underlying chart. This is a standard method for managing Kubernetes application configuration in production workflows.

Answer

Operator custom resources.

Answer

Environment variables in the Dockerfile.

Question 7

A company uses a centralized automation server that runs Ansible playbooks. What is the best security practice for storing SSH credentials?

Accepted Answer

Use Ansible Vault. Ansible Vault is the recommended security practice for encrypting sensitive data like SSH credentials. It allows you to store encrypted variables and files within your playbooks or inventory, protecting secrets at rest while enabling decryption at runtime via a password or key file. This avoids exposing credentials in plain text, which is critical for centralized automation servers that may be accessed by multiple users or integrated into CI/CD pipelines.

Answer

Store credentials in a public repository

Answer

Hardcode credentials in playbooks

Answer

Use plain text inventory files

Question 8

Which authentication method is used by the Cisco Meraki Dashboard API?

Accepted Answer

API key in the X-Cisco-Meraki-API-Key header. Meraki Dashboard API uses an API key passed in the X-Cisco-Meraki-API-Key header.

Answer

JWT token in the Authorization header

Answer

OAuth 2.0 token in the Authorization header

Answer

HTTP Basic authentication with username and password

Question 9

Which of the following is a private IPv4 address range as defined by RFC 1918?

Accepted Answer

10.0.0.0/8. (10.0.0.0/8) is correct because RFC 1918 reserves this range, along with 172.16.0.0/12 and 192.168.0.0/16, for private IPv4 addressing. These addresses are not routable on the public internet and are intended for use within private networks, such as corporate LANs or home networks.

Answer

169.254.0.0/16

Answer

192.167.0.0/16

Answer

172.32.0.0/16

Question 10

A network administrator is using Cisco DNA Center APIs to automate network changes. Which two API categories are used to perform configuration deployments? (Choose two.)

Accepted Answer

Platform. DNAC API categories: 'Change your network' includes template deployment and PnP; 'Platform' includes task management for monitoring deployment status.

Answer

Know your network

Answer

Run your network

Answer

Event notifications

Question 11

Which THREE of the following are characteristics of IPv6? (Select exactly three.)

Accepted Answer

IPv6 does not have a built-in NAT requirement.. IPv6 was designed without a built-in requirement for Network Address Translation (NAT) because its vast 128-bit address space allows every device to have a globally unique public IP address. Unlike IPv4, which relies on NAT to conserve limited address space, IPv6 restores end-to-end connectivity by default, eliminating the need for address translation at the network edge.

Answer

IPv6 addresses are 32 bits in length.

Answer

IPv6 uses ARP to resolve MAC addresses.

Question 12

An engineer needs to identify which hosts are reachable in a 10.0.0.0/24 network using an automated script that does not require any credentials on the target devices. Which protocol is best suited for this task?

Accepted Answer

ICMP. ICMP (Internet Control Message Protocol) is the correct choice because it provides the Echo Request and Echo Reply messages (commonly used by the 'ping' command) that can determine host reachability without requiring any authentication or credentials on the target devices. This makes ICMP ideal for an automated script that needs to probe a 10.0.0.0/24 network for live hosts, as it operates at the network layer and only requires IP connectivity.

Answer

CDP

Answer

SNMP

Answer

ARP

Question 13

A network automation solution uses YANG data models to describe network configurations. Which THREE statements about YANG are true? (Select THREE)

Accepted Answer

YANG can be used in conjunction with NETCONF and RESTCONF.. YANG is a data modeling language that defines the structure and constraints of configuration and state data, and it is designed to be used with NETCONF (RFC 6241) and RESTCONF (RFC 8040) as the transport protocols. This makes option A correct because YANG models are encoded in XML or JSON and exchanged via these protocols.

Answer

YANG models are always written in XML syntax.

Answer

YANG is a replacement for SNMP.

Question 14

During a TCP three-way handshake, which sequence of flags is sent from the client to initiate the connection?

Accepted Answer

SYN. The client sends a SYN segment to start the handshake.

Answer

SYN-ACK

Answer

ACK

Answer

FIN

Question 15

Refer to the exhibit. A switch has the VLAN configuration shown. If a device is connected to interface Gi0/3 and another to Gi0/5, can they communicate if the switch is not configured with any inter-VLAN routing?

Accepted Answer

No, because they are in different VLANs and no routing is configured.. Devices in different VLANs (VLAN 10 and VLAN 20) are on separate Layer 2 broadcast domains. Without inter-VLAN routing (either a Layer 3 switch with IP routing enabled or an external router), traffic cannot cross VLAN boundaries, even if the devices share the same physical switch. The switch forwards frames only within the same VLAN unless routing is explicitly configured.

Answer

Yes, if the default gateway is configured on each device.

Answer

No, because VLAN 20 is not active on those ports.

Answer

Yes, if the devices have IP addresses in the same subnet.

Answer

Yes, because all ports are on the same switch.

Question 16

Which header is used in an HTTP request to tell the server the format of the request body?

Accepted Answer

Content-Type. Content-Type header specifies the media type of the request body, e.g., application/json.

Answer

Authorization

Answer

Accept

Answer

Host

Question 17

A company has a three-tier data center architecture with access, aggregation, and core layers. The network team is migrating to a leaf-spine architecture to support increasing east-west traffic. The current network uses STP for loop prevention, and the team wants to eliminate STP in the new design. They plan to use VXLAN overlays with BGP EVPN for control plane. During a pilot deployment, the team notices that some legacy servers that rely on traditional VLANs are not reachable across the new fabric. The servers are connected to access switches that are part of the leaf layer. The access switches are configured as VXLAN tunnel endpoints (VTEPs) but the legacy servers are still using traditional VLANs. The team needs to ensure connectivity between the legacy VLAN-based servers and the new VXLAN-based network. What is the best approach to integrate these legacy servers without changing their configuration?

Accepted Answer

Implement a Layer 2 gateway (L2GW) on the leaf switches to bridge VLANs to VXLAN using IRB. An Integrated Routing and Bridging (IRB) interface on the leaf switch acts as a Layer 2 gateway (L2GW), bridging the legacy VLAN to a VXLAN segment. This allows the legacy server, which still uses traditional VLAN tagging, to communicate with the VXLAN-based fabric without any configuration changes on the server. The IRB interface performs the VLAN-to-VXLAN mapping and handles ARP suppression, enabling seamless integration.

Answer

Create a separate VRF for legacy VLANs and redistribute into BGP EVPN

Answer

Configure the same VLAN on all leaf switches and use VXLAN to stretch the VLAN across the fabric

Answer

Reconfigure the legacy servers to use VXLAN encapsulation

Question 18

A developer calls Cisco DNA Center API to get device details and receives the JSON response shown. The device 'Switch-A' is listed but the status is 'unreachable'. Which Cisco DNA Center API endpoint was most likely used?

Accepted Answer

/dna/intent/api/v1/network-device/{id}. The endpoint /dna/intent/api/v1/network-device/{id} retrieves detailed information for a specific network device, including its management IP address, reachability status, and other attributes. The JSON response showing 'Switch-A' with status 'unreachable' indicates a single-device query, which matches the path parameter {id} used to target a particular device. This endpoint returns a device-level status field (e.g., 'reachabilityStatus') that directly reflects the 'unreachable' value seen in the response.

Answer

/dna/intent/api/v1/site/{siteId}/device

Answer

/dna/intent/api/v1/device-health

Answer

/dna/intent/api/v1/network-device

Question 19

Which TWO are common authentication methods used when interacting with Cisco APIs?

Accepted Answer

HTTP Basic Authentication. HTTP Basic Authentication (option B) is a common method for authenticating to Cisco APIs, where the client sends a base64-encoded username:password string in the Authorization header. API keys in HTTP headers (option C) are also widely used, especially with REST APIs like Cisco DNA Center or Meraki, where the key is passed in a custom header (e.g., 'X-Cisco-Meraki-API-Key'). Both are simple, stateless mechanisms supported by many Cisco platforms.

Answer

Client certificate exchange

Answer

LDAP bind credentials

Answer

SNMPv3 authentication

Question 20

Which TWO of the following are valid OAuth 2.0 grant types? (Select TWO)

Accepted Answer

Client credentials. Authorization code and client credentials are standard grant types. Basic is not OAuth 2.0. API key is a different authentication method. Implicit is deprecated.

Answer

API key

Answer

Basic authentication

Answer

Implicit grant