200-901 Practice Test 25 — 15 Questions

Question 1

A developer must build a Python script that reads a list of devices from a YAML inventory file and then pushes configuration to each device using NETCONF over SSH. The script must be reusable and must not hardcode credentials. Which approach best satisfies these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the ncclient library, load the inventory with PyYAML, and retrieve credentials from environment variables.. The scenario requires a NETCONF client, a YAML parser, and externalized credentials. ncclient provides the NETCONF over SSH capability, PyYAML reads the inventory, and environment variables keep secrets out of the code. Together these choices meet both the protocol and the reusability requirements without embedding sensitive data.

Answer

Use paramiko to open an interactive SSH shell and type configuration commands into the CLI prompt.

Answer

Use the requests library to POST XML configuration directly to the device management IP on port 830.

Answer

Use the ncclient library and hardcode the device list and credentials inside the script for simplicity.

Question 2

Which HTTP header is used to specify the format of the request body (e.g., application/json) when sending a POST request to a REST API?

Accepted Answer

Content-Type. Content-Type indicates the media type of the request body. Accept indicates the desired response format. Authorization carries credentials.

Answer

Accept

Answer

Authorization

Answer

X-Requested-With

Question 3

A developer is using a REST API to retrieve data from a network controller. The API requires the client to include an API key in the HTTP request header for authentication. Which HTTP header is typically used to carry the API key?

Accepted Answer

Authorization. The Authorization header is the standard HTTP header for transmitting authentication credentials. API keys are commonly placed in this header, often with a prefix like Bearer. Other headers like Content-Type, Accept, and User-Agent serve different purposes such as content negotiation or client identification, and are not used for authentication.

Answer

User-Agent

Answer

Content-Type

Answer

Accept

Question 4

A network engineer is troubleshooting an issue where a client cannot reach a web server at 203.0.113.10. The engineer runs a traceroute from the client and sees that the path stops at a router with IP 198.51.100.1, which is the last hop before the destination. The engineer suspects that the router is dropping packets due to an ACL. Which command should the engineer use on the router to verify if an ACL is blocking traffic to the web server?

Accepted Answer

show ip access-lists. To verify if an ACL is blocking traffic, the engineer should examine the ACL configuration and match counters. The show ip access-lists command provides this information, allowing the engineer to see if a deny entry is matching the traffic in question. Other commands like show ip route or show ip interface do not show ACL contents, and debug ip packet is too disruptive for routine troubleshooting.

Answer

show ip interface

Answer

show ip route 203.0.113.10

Answer

debug ip packet

Question 5

A company uses a CI/CD pipeline to deploy network configurations. The pipeline includes a stage that runs automated tests against a simulated network environment. Which testing strategy does this represent?

Accepted Answer

Integration testing. Running automated tests against a simulated network environment validates how multiple network components (e.g., routers, switches, firewalls) interact as a whole. This is integration testing, which focuses on detecting interface and communication failures between integrated units, not on individual components or end-to-end system behavior. In a CI/CD pipeline for network configurations, this stage ensures that the combined changes work together before deployment to production.

Answer

Regression testing

Answer

Unit testing

Answer

Smoke testing

Question 6

A developer must configure a Cisco IOS XE device programmatically and needs the device to validate configuration changes against a data model before they are committed, with the ability to discard invalid candidate configurations. Which approach satisfies this requirement?

Accepted Answer

Use NETCONF with the candidate datastore, edit-config, validate, and commit operations.. A candidate datastore combined with validate and commit gives the developer a staged, model-checked, transactional change workflow. Invalid edits are caught before they reach the running configuration, and a failed validation simply discards the candidate, preserving service. This matches the requirement for pre-commit validation and the ability to abandon bad configurations.

Answer

Use SNMP set requests against the MIB to write configuration objects.

Answer

Use RESTCONF with a PATCH to the running datastore directly.

Answer

Send CLI commands over an SSH channel using a Python paramiko session and parse the output.

Question 7

A developer is writing a Python script that calls the Cisco DNA Center Intent API to retrieve a list of network devices. The script must handle the case where the API returns a 401 Unauthorized response by obtaining a new authentication token and retrying the request. Which Python construct should be used to implement this retry with token refresh?

Accepted Answer

A try/except block that catches requests.exceptions.HTTPError, checks the response status code, and if it is 401, obtains a new token using the DNA Center authentication endpoint and retries the original request.. The correct approach uses exception handling to catch the HTTP error from the failed request, then performs a token refresh via the DNA Center authentication API and retries the original request. This pattern is essential for robust API clients that must handle token expiration. The other options either loop without refreshing credentials, use static tokens, or abort without recovery, none of which solve the authentication failure scenario.

Answer

A while loop that continuously sends the same request with the same token until a 200 OK response is received.

Answer

A conditional statement that checks the response status code before sending the request and, if it is not 200, aborts the script.

Answer

A for loop that iterates over a list of predefined tokens, sending the request with each token until one succeeds.

Question 8

A developer needs to apply a Kubernetes deployment manifest from a file named 'deployment.yaml'. Which kubectl command should be used?

Accepted Answer

kubectl apply -f deployment.yaml. kubectl apply -f creates or updates resources from a file. get, describe, and create are not used for applying manifests.

Answer

kubectl create deployment.yaml

Answer

kubectl describe -f deployment.yaml

Answer

kubectl get -f deployment.yaml

Question 9

A network automation engineer is writing a YAML playbook to push a banner configuration to a group of Cisco IOS XE routers. The engineer wants to use an agentless tool that connects over SSH and requires no software installed on the managed devices. Which tool fits this description?

Accepted Answer

Ansible. Ansible satisfies the agentless, SSH-based, YAML-driven requirements in one tool. Its ios_config and related modules push configuration changes to Cisco IOS XE devices without installing anything on them, and playbooks express the desired banner state declaratively. Competing configuration management tools rely on agents that cannot run on the routers themselves.

Answer

Chef Infra Client running on each router

Answer

A custom Bash script using scp to copy configuration files

Answer

Puppet with a master-agent architecture

Question 10

A developer is building a Python application that consumes the Cisco Meraki Dashboard API. The application must handle rate limiting gracefully when it performs many calls in a short period. Which response should the application check to determine that it has exceeded the rate limit and must wait before retrying?

Accepted Answer

HTTP 429 Too Many Requests. Meraki enforces per-organization call limits and communicates throttling with the 429 Too Many Requests status. The application should catch that status, honor any Retry-After header, and back off before retrying. Authentication and permission errors use different codes, and server outages use 503, so only 429 correctly identifies rate limiting.

Answer

HTTP 403 Forbidden

Answer

HTTP 401 Unauthorized

Answer

HTTP 503 Service Unavailable

Question 11

A developer is writing a Python script that authenticates to a Cisco IOS XE device using NETCONF over SSH on port 830. The script must send a candidate configuration and commit it atomically. Which NETCONF capability must the device advertise for the script to use the candidate datastore?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. The candidate datastore capability is the only one that introduces a separate staging area plus a commit operation, enabling atomic configuration changes. Writable-running, rollback-on-error, and validate are separate capabilities that do not create a candidate store. When a NETCONF client must edit offline and commit transactionally, the hello message must include the candidate capability URI before the client can target candidate in edit-config.

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Answer

urn:ietf:params:netconf:capability:validate:1.1

Question 12

A developer is writing a Python script that calls the Cisco DNA Center Intent API to create a new network device. The script must send a JSON body and authenticate with a token. Which TWO HTTP request components are required for this API call to succeed? (Choose two.)

Accepted Answer

X-Auth-Token header containing the authentication token. Creating a device through the DNA Center Intent API requires a JSON body, so Content-Type must be application/json, and the call must be authenticated with the token in the X-Auth-Token header. Compression headers and browser-style cookies or Basic credentials do not satisfy these two mandatory requirements.

Answer

Cookie: JSESSIONID from a prior login

Answer

Authorization: Basic with the username and password

Answer

Accept-Encoding: gzip

Question 13

A network engineer is troubleshooting an Ansible playbook that targets Cisco IOS XE devices over SSH. The playbook connects successfully but fails when applying configuration, and the engineer suspects the connection plugin and transport settings. Which TWO actions should the engineer take to verify and correct the connection configuration? (Choose two.)

Accepted Answer

Confirm that ansible_connection is set to network_cli for the device group.. Network automation with Ansible requires the network_cli connection plugin and a correct ansible_network_os value so the right terminal and module behavior is selected. Using the local connection, switching to the NETCONF port, or applying Linux privilege escalation semantics all misrepresent how IOS XE devices are managed. Confirming the connection type and platform identifier addresses the most common causes of successful login but failed configuration.

Answer

Increase the ansible_port value to 830 to enable configuration over SSH.

Answer

Configure ansible_become_method to enable and use sudo on the device.

Answer

Set ansible_connection to local and run all modules on the control node.

Question 14

A network automation team is evaluating tools to manage configuration drift across a fleet of Cisco IOS XE devices. They want to ensure that device configurations remain in the desired state and that any unauthorized changes are detected and remediated. Which two capabilities are essential for a configuration drift detection and remediation solution in this environment? (Choose two.)

Accepted Answer

Automated remediation that pushes the baseline configuration back to the device when drift is detected.. A configuration drift detection and remediation solution must first identify when a device's configuration deviates from the baseline. This requires periodic collection and comparison. Once drift is found, the solution must be able to automatically restore the correct configuration. These two capabilities form the core loop of detect and remediate. Other features like telemetry, version control, or SNMP traps are useful supplements but not essential for the fundamental task.

Answer

Use of SNMP traps to alert on configuration change events.

Answer

Real-time streaming telemetry with sub-second granularity for all interface counters.

Answer

Integration with a version control system to store configuration history and track changes.

Question 15

An engineer is writing a Python script that must authenticate to the Cisco Meraki Dashboard API and then retrieve the list of organizations the API key can access. Which authentication method and endpoint combination is correct?

Accepted Answer

Include the API key in the X-Cisco-Meraki-API-Key HTTP header and send GET to /api/v1/organizations.. The Meraki Dashboard API authenticates requests with the API key placed in the X-Cisco-Meraki-API-Key header. To enumerate accessible organizations, the client sends a GET to /api/v1/organizations. Query-string keys, HTTP Basic auth, and OAuth bearer tokens are not the documented mechanism for this endpoint, so only the header-based approach with the correct path succeeds.

Answer

Obtain an OAuth 2.0 bearer token from the Meraki identity service and send it to /api/v1/organizations.

Answer

Send the API key as a query string parameter named key to /api/v1/organizations.

Answer

Use HTTP Basic authentication with the API key as the username and a blank password against /api/v1/networks.