200-901 Practice Test 22 — 15 Questions

Question 1

A developer is writing a Python script that consumes a REST API. The API returns a large number of records and uses pagination via a 'next' link in the response body. The developer needs to automatically follow these links until all records are retrieved. Which Python library feature is most appropriate for making the HTTP requests and handling the pagination loop?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

requests library with a while loop that checks for the 'next' link. The requests library simplifies HTTP interactions and, combined with a while loop that follows the 'next' link until it is absent, efficiently retrieves all paginated records. Other options are either too low-level, assume fixed pagination, or use inappropriate constructs like recursion, making them less suitable for this task.

Answer

http.client with a for loop over a range of page numbers

Answer

urllib.request with a recursive function

Answer

socket library to send raw HTTP requests

Question 2

A developer is writing a Python script that calls the Cisco Webex Teams API. The script must handle the case where the access token has expired. Which HTTP status code should the script check for to detect an expired or invalid token?

Accepted Answer

401 Unauthorized. Cisco Webex APIs return HTTP 401 Unauthorized when the access token is expired, revoked, or invalid. The client should detect this status and trigger a token refresh or re-authentication flow. Other status codes such as 403, 404, or 429 represent different conditions and would not correctly identify an expired token.

Answer

403 Forbidden

Answer

429 Too Many Requests

Answer

404 Not Found

Question 3

An engineer is writing a script that calls the Cisco DNA Center API to create a new site. The API requires the request body to be encoded as JSON. Which HTTP request header should the script set so the server interprets the payload correctly?

Accepted Answer

Content-Type: application/json. Content-Type describes the media type of the request body, which is exactly what a server needs in order to parse a JSON payload. Cisco DNA Center's create-site operation expects application/json, so the client must send that header or risk a 415 error. Accept negotiates the response format, Authorization supplies credentials, and Content-Length must be a byte count, so none of those substitutes for declaring the request body encoding.

Answer

Authorization: Bearer <token>

Answer

Accept: application/json

Answer

Content-Length: application/json

Question 4

A developer is integrating with the Cisco Webex API and wants to authenticate on behalf of users without ever handling their passwords. The integration is a web application hosted on a public server, and the developer needs a refresh token so the app can keep working after the user's access token expires. Which OAuth 2.0 grant type should be used?

Accepted Answer

Authorization code grant. For a confidential web application that must act on behalf of users and continue operating after access tokens expire, the OAuth 2.0 authorization code grant is the correct choice. The user's credentials are entered only at the Cisco Webex authorization endpoint, and the app receives an authorization code that it exchanges server-side, along with its client secret, for both an access token and a refresh token.

Answer

Implicit grant

Answer

Client credentials grant

Answer

Authorization code grant with PKCE

Question 5

A developer sends a GET request to https://sandboxdnac.cisco.com/dna/system/api/v1/auth/token and receives an HTTP 401 Unauthorized response. The request included no Authorization header. Which HTTP request header must be added to obtain a token from Cisco DNA Center?

Accepted Answer

Authorization: Basic <base64(username:password)>. Cisco DNA Center issues tokens through /dna/system/api/v1/auth/token, and that endpoint authenticates the caller with HTTP Basic credentials encoded in the Authorization header. Once the controller validates the username and password, it returns a token used for later intent API calls. Other headers such as Content-Type or custom token headers do not satisfy the initial credential check.

Answer

Content-Type: application/json

Answer

Authorization: Bearer <token>

Answer

X-Auth-Token: <apiKey>

Question 6

A developer's script calls a REST API and receives HTTP 429 Too Many Requests. The response includes a Retry-After header with a value of 30. What should the script do to behave correctly?

Accepted Answer

Wait at least 30 seconds, then retry the request.. A 429 response signals that the client has exceeded a rate limit, and the accompanying Retry-After header states how long to wait before retrying. Pausing for that interval respects the server's throttling policy and avoids worsening the condition. Immediate retries, method changes, or permanently aborting all fail to follow the server's explicit guidance.

Answer

Immediately resend the identical request in a tight loop until it succeeds.

Answer

Change the HTTP method from GET to POST and resend.

Answer

Treat the response as a permanent failure and stop all further API calls.

Question 7

A developer is building a Python script that calls the Cisco Webex API to create a new room. The API returns a JSON payload containing the room ID. The developer needs to extract the room ID from the response and use it in a subsequent API call to add a member to that room. Which Python code snippet correctly parses the JSON response and extracts the room ID, assuming the response object is stored in a variable named `response` and the JSON key is `id`?

Accepted Answer

room_id = response.json()['id']. The correct approach is to use the .json() method provided by the requests library to parse the JSON response into a Python dictionary, then access the 'id' key. This yields the room ID needed for subsequent API calls. The other options incorrectly assume that the response object can be indexed directly or that .json is a property.

Answer

room_id = response.text['id']

Answer

room_id = response.json['id']

Answer

room_id = response.content['id']

Question 8

A developer is building a Python script to create a new network in a Cisco Meraki organization. The developer must authenticate to the Dashboard API. Which HTTP header is used to pass the API key?

Accepted Answer

X-Cisco-Meraki-API-Key. The Meraki Dashboard API authenticates requests using an API key passed in the X-Cisco-Meraki-API-Key HTTP header. This is a custom header specific to Meraki, and it must be present in all API calls. Other authentication schemes like Bearer tokens or Basic auth are not used. Understanding the correct header is essential for successful API integration.

Answer

Authorization: Bearer <token>

Answer

Authorization: Basic <base64-encoded-credentials>

Answer

X-Api-Key

Question 9

A developer is building a Python script that calls the Cisco Webex API. The API returns JSON with a top-level key "items" containing a list of records, and a "link" object with a "next" URL when more records exist. The developer needs to iterate through all pages until every record is retrieved. Which approach correctly handles this pagination style?

Accepted Answer

Parse the top-level "items" array, then check the "link" object for a "next" URL and request that URL until no "next" key is present.. The Webex API paginates by returning an "items" array plus a "link" object whose "next" field holds the URL of the following page. A correct client parses each page, then follows the "next" URL until that field disappears, indicating the last page. This link-driven approach avoids guessing page sizes or totals and adapts if the server changes page boundaries.

Answer

Read the "X-Total-Count" response header and loop exactly that many times using an offset parameter.

Answer

Request the same endpoint repeatedly and deduplicate results until the returned item count stabilizes.

Answer

Increment a "page" query parameter starting at 1 and stop when the response body is empty.

Question 10

A network engineer is using curl to test a REST API endpoint on a Cisco IOS XE device that supports RESTCONF. The engineer wants to retrieve the configuration of the GigabitEthernet1 interface. Which curl command correctly sends a GET request to the RESTCONF API with the appropriate headers to retrieve the interface configuration in JSON format?

Accepted Answer

curl -X GET -H 'Accept: application/yang-data+json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'. To retrieve data via RESTCONF, a GET request must be sent with the Accept header set to 'application/yang-data+json' to request JSON-formatted YANG data. The URL must correctly reference the data node using the module name and interface name. The other options use incorrect headers or HTTP methods.

Answer

curl -X POST -H 'Accept: application/yang-data+json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'

Answer

curl -X GET -H 'Accept: application/json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'

Answer

curl -X GET -H 'Content-Type: application/yang-data+json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'

Question 11

A developer is integrating a Python application with the Cisco DNA Center API. The application must handle rate limiting gracefully. The API returns HTTP 429 Too Many Requests with a 'Retry-After' header indicating the number of seconds to wait before retrying. Which approach best implements exponential backoff with jitter to respect the rate limit and avoid overwhelming the server?

Accepted Answer

Upon receiving 429, wait for the number of seconds specified in Retry-After, then retry the request. If it fails again, double the wait time and add a random jitter between 0 and 1 second.. The best practice for handling 429 responses is to honor the Retry-After header and then apply exponential backoff with jitter for subsequent retries. This respects the server's guidance while preventing synchronized retries from multiple clients. The other options either ignore the header, use fixed waits, or give up permanently, all of which are suboptimal.

Answer

Upon receiving 429, wait for a fixed 60 seconds before retrying, regardless of the Retry-After header. Repeat this fixed wait for each retry.

Answer

Upon receiving 429, log the error and abort the request permanently, as rate limiting indicates a fatal error.

Answer

Upon receiving 429, immediately retry the request in a tight loop until it succeeds, ignoring the Retry-After header.

Question 12

A developer calls a REST API with GET /api/v1/devices?limit=50 and receives the first page of results plus a body field named nextPageToken. The API documentation states that results are cursor-paginated. How should the script request the next page?

Accepted Answer

Call GET /api/v1/devices?limit=50&nextPageToken=<value>.. Cursor pagination relies on an opaque token that marks the position of the last retrieved record. The client echoes that token in the next request, and the server returns the subsequent slice. Loop until the token is missing. Offset, page-number, and oversized-limit approaches do not follow the API's documented contract and can skip or repeat data.

Answer

Call GET /api/v1/devices?limit=50&page=2.

Answer

Call GET /api/v1/devices?limit=100 to fetch everything at once.

Answer

Call GET /api/v1/devices?limit=50&offset=50.

Question 13

A developer is automating a Cisco IOS XE device with NETCONF over SSH. The developer must retrieve only the running configuration's hostname without pulling the entire configuration datastore. Which NETCONF operation should the developer use?

Accepted Answer

with a source of and a subtree filter selecting the native hostname node. Reading a targeted piece of configuration from a NETCONF-capable device requires the read-oriented get-config operation, an explicit source datastore, and a filter that narrows the reply. Selecting the running datastore with a subtree filter that matches the IOS XE native hostname leaf returns exactly that value and nothing else, keeping the payload small and the device state unchanged.

Answer

copying into and then reading the response body

Answer

<get> with an empty filter, which returns operational and configuration state together

Answer

targeting with a merge operation on the hostname leaf

Question 14

A developer is writing a script that uses the Cisco DNA Center Intent API to retrieve a list of all sites in the network hierarchy. The developer needs to authenticate first. Which authentication method should be used to obtain a token for subsequent API calls?

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with Basic authentication using the username and password.. Cisco DNA Center's Intent API uses a token-based authentication flow. The client sends a POST to /dna/system/api/v1/auth/token with HTTP Basic authentication, and the response includes a token. That token is then sent in the X-Auth-Token header for subsequent API calls, such as retrieving the site hierarchy.

Answer

Use OAuth 2.0 client credentials flow with a client ID and secret to obtain an access token.

Answer

Send a POST request to /dna/system/api/v1/auth/token with the username and password in the JSON body.

Answer

Send a GET request to /dna/system/api/v1/auth/token with an API key in the query string.

Question 15

A developer is building a Python application that manages Cisco IOS XE devices through the Python library ncclient. The application must apply a configuration change atomically, validate it before committing, and avoid persisting the change if validation fails. Which approach should the developer take?

Accepted Answer

Lock the candidate datastore, edit the candidate, validate it with the validate operation, then commit and unlock. Transactional configuration over NETCONF depends on a staging datastore and an explicit validation step. Locking the candidate, editing it, running the validate operation, and then committing ensures the change is checked before it becomes active. If validation fails, the candidate can be discarded and running is never touched, satisfying the atomic and non-persistent requirements.

Answer

Issue a discard-changes operation against running after each edit-config to confirm the edit was accepted

Answer

Send an edit-config directly to the running datastore with the default merge operation

Answer

Use the copy-config operation to copy running into startup, then edit startup directly