200-901 Practice Test 2 — 25 Questions

Question 1

A developer is writing a Python script that uses the Cisco Meraki API to retrieve a list of networks for an organization. The API returns a JSON array. The developer wants to filter networks where the 'tags' field contains 'production'. Which code snippet correctly filters the results?

Accepted Answer

filtered = [net for net in networks if 'production' in net['tags']]. Option A is correct because the Meraki API returns the 'tags' field as a list of strings (e.g., ['production', 'critical']). The Python `in` operator directly checks membership in a list, so `'production' in net['tags']` efficiently filters networks where the exact string 'production' appears as an element in the list.

Answer

filtered = [net for net in networks if 'production' in str(net['tags'])]

Answer

filtered = [net for net in networks if 'production' in net['tags'].split(',')]

Answer

filtered = [net for net in networks if any('production' in t for t in net['tags'])]

Question 2

A developer is using Git for source control. They have made changes to a file and want to temporarily save the changes without committing, then work on a different branch. Which Git command should they use?

Accepted Answer

git stash. Option D is correct because `git stash` temporarily saves uncommitted changes (both staged and unstaged) to a stack, reverting the working directory to the last commit. This allows the developer to switch branches without losing work, then later reapply the changes with `git stash pop` or `git stash apply`.

Answer

git checkout other-branch

Answer

git commit -m 'temp'

Answer

git reset --hard

Question 3

Which THREE of the following are common design patterns for microservices? (Choose three.)

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern (B) is a common microservices design pattern that prevents cascading failures by monitoring for failures and opening a circuit to stop requests to a failing service, allowing it to recover. It is widely implemented in frameworks like Netflix Hystrix or Resilience4j, where states (closed, open, half-open) control request flow and timeout thresholds.

Answer

Chain of Responsibility

Answer

Singleton

Question 4

Which TWO are benefits of using model-driven programmability (e.g., NETCONF/RESTCONF) over traditional CLI scripting for network automation?

Accepted Answer

Data is structured and machine-readable (e.g., XML/JSON).. Option D is correct because model-driven programmability with NETCONF/RESTCONF uses structured data formats like XML or JSON, which are machine-readable. This eliminates the need for screen-scraping or parsing CLI output, making automation scripts more reliable and easier to maintain. Structured data also enables consistent validation and integration with other systems.

Answer

Reduces network latency because it uses a lighter protocol.

Answer

Requires no additional learning beyond CLI commands.

Answer

Easier to debug because it uses the same syntax as CLI.

Question 5

Which THREE are valid reasons to use Cisco DNA Center's Assurance APIs in an enterprise network?

Accepted Answer

Proactively detect client connectivity issues.. Option B is correct because Cisco DNA Center's Assurance APIs provide proactive monitoring and analytics that can detect client connectivity issues before they impact users, leveraging telemetry data from network devices to identify problems like authentication failures, DHCP timeouts, or signal degradation.

Answer

Automatically enforce QoS policies on switches.

Answer

Collect NetFlow data from all network devices.

Question 6

During a migration from legacy to SD-Access, a network team wants to use Cisco DNA Center to automate policy deployment. They have defined a macro-level intent but need to ensure that the fabric devices are correctly configured. Which API call should they use to validate the fabric configuration?

Accepted Answer

GET /dna/intent/api/v1/business/sda/fabric-site. The GET /dna/intent/api/v1/business/sda/fabric-site API call retrieves the current configuration of fabric sites, allowing the team to validate that fabric devices are correctly provisioned and associated with the intended site. This aligns with the intent-based API model where GET operations are used for validation and monitoring of deployed policies.

Answer

PUT /dna/intent/api/v1/business/sda/fabric-device

Answer

POST /dna/intent/api/v1/business/sda/fabric-site

Answer

GET /dna/intent/api/v1/business/sda/network-profile

Question 7

A developer is writing a Python script using the Cisco Webex Teams API to send a message to a specific room. The script works for some rooms but fails for others with a 404 error. What is the most likely reason?

Accepted Answer

The bot is not a member of those rooms.. The 404 error indicates that the resource (the room) was not found by the API. In the Cisco Webex Teams API, a bot can only interact with rooms it has been added to as a member. If the bot is not a member of a room, the API cannot locate the room from the bot's perspective, resulting in a 404 error. This is the most common cause of intermittent 404 errors when the script works for some rooms but not others.

Answer

The API rate limit has been exceeded for those rooms.

Answer

The access token is invalid for those rooms.

Answer

The bot does not have permission to send messages in those rooms.

Question 8

A developer is designing a REST API that will be used by multiple client applications. The API must support versioning to ensure backward compatibility. Which approach should the developer use to implement API versioning?

Accepted Answer

Embed the version in the URI, e.g., /v1/resource. Embedding the version in the URI (e.g., /v1/resource) is the most common and straightforward approach for REST API versioning. It makes the version explicit in the URL, allowing clients to directly target a specific version without requiring special header handling or query parameter parsing. This method is widely adopted in industry APIs (e.g., GitHub, Twilio) and ensures backward compatibility by keeping older endpoints accessible under their original URI path.

Answer

Use different HTTP methods for different versions

Answer

Pass the version as a query parameter, e.g., ?version=1

Answer

Use a custom HTTP header to specify the version

Question 9

A developer is working with a REST API that uses HTTP Basic Authentication. The developer needs to send a request with the username 'admin' and password 'secret'. Which HTTP header should be set?

Accepted Answer

Authorization: Basic YWRtaW46c2VjcmV0. HTTP Basic Authentication requires the credentials to be formatted as 'username:password', then Base64-encoded, and sent in the Authorization header with the 'Basic' scheme. Option C correctly includes the 'Basic' scheme followed by the Base64-encoded string 'YWRtaW46c2VjcmV0' (which decodes to 'admin:secret').

Answer

Authorization: Basic admin:secret

Answer

Authorization: YWRtaW46c2VjcmV0

Answer

Authorization: Bearer YWRtaW46c2VjcmV0

Question 10

A developer is writing a Python script that uses the Cisco Catalyst Center (formerly DNA Center) API to get the list of sites. The API returns a response with a 'response' key containing a list of sites. The developer wants to access the 'response' field from the JSON response. Which code snippet correctly extracts the list?

Accepted Answer

sites = response['response']. Option B is correct because the Cisco Catalyst Center API returns a JSON response where the list of sites is nested under the 'response' key. Using dictionary-style indexing with `response['response']` directly retrieves that list, which is the standard way to access a known key in a Python dictionary parsed from JSON.

Answer

sites = list(response)

Answer

sites = response[0]

Answer

sites = response.get('response')

Question 11

A network automation engineer is using Ansible to manage Cisco IOS devices. The playbook includes a task that executes a 'show version' command and registers the output. The engineer then wants to parse the output to extract the IOS version. Which approach should be used?

Accepted Answer

Use the 'cisco.ios.ios_facts' module to get structured facts. The 'cisco.ios.ios_facts' module retrieves structured data from Cisco IOS devices, including the IOS version as a key-value pair in the Ansible facts dictionary. This eliminates the need for manual parsing, as the module uses the device's CLI or NETCONF to gather structured output, making it the most efficient and reliable approach for extracting specific device attributes.

Answer

Use the 'cisco.ios.ios_command' module and parse the output with regex

Answer

Use the 'cisco.ios.ios_command' module and the 'parse' option

Answer

Use the 'cisco.ios.ios_config' module to retrieve the version

Question 12

A Python script uses the Cisco Meraki API to fetch the list of organizations. The script fails with a 401 HTTP status. What is the most likely cause?

Accepted Answer

The API key is invalid or missing.. A 401 HTTP status indicates 'Unauthorized', which in the context of the Meraki API means the request lacks valid authentication credentials. The most common cause is an invalid or missing API key, as the Meraki API requires a valid API key in the `X-Cisco-Meraki-API-Key` header for all requests.

Answer

The API request exceeded the rate limit.

Answer

The API key does not have permission to list organizations.

Answer

The API endpoint URL is incorrect.

Question 13

A DevOps team is using Cisco NSO to manage network devices. They want to ensure that the configuration is compliant with corporate standards. Which NSO feature should they use?

Accepted Answer

Service reconciliation using FastMap. Service reconciliation using FastMap is the correct NSO feature for ensuring configuration compliance with corporate standards because it detects and corrects deviations between the intended service model (defined in YANG) and the actual device configuration. FastMap performs a diff and re-applies the service logic to bring the device back into compliance, making it ideal for continuous compliance enforcement.

Answer

Configuration Snapshots

Answer

NETCONF notifications

Answer

Configuration Database (CDB) rollback

Question 14

A developer is building a chatbot that retrieves interface status from a Cisco Catalyst 9000 switch using RESTCONF. Which authentication method is most appropriate for programmatic access?

Accepted Answer

HTTP Basic Authentication over HTTPS.. RESTCONF on Cisco Catalyst 9000 switches supports HTTP Basic Authentication over HTTPS as a straightforward, standards-based method for programmatic access. Basic authentication sends the username and password in the HTTP Authorization header, and when combined with HTTPS, the credentials are encrypted in transit, providing adequate security for device management without requiring additional infrastructure like an OAuth provider or certificate authority.

Answer

API key passed in the HTTP header.

Answer

OAuth 2.0 with client credentials grant.

Answer

Client certificate authentication.

Question 15

A network administrator uses the Cisco IOS XE CLI to configure a router. They want to use a Python script to automate this configuration via the guest shell. Which library should they use to interact with the CLI from within the guest shell?

Accepted Answer

cli. The `cli` library is a built-in Python module available within the Cisco Guest Shell that allows scripts to execute IOS XE CLI commands directly on the host device. This library provides functions like `cli.execute()` and `cli.configure()` to send commands and retrieve output, making it the correct choice for automating configuration via the Guest Shell without external dependencies.

Answer

requests

Answer

ncclient

Answer

paramiko

Question 16

A network engineer needs to automate the configuration of VLANs across 50 switches. Which approach best follows Cisco’s recommended practices for programmability?

Accepted Answer

Write an Ansible playbook using the ios_vlan module to configure VLANs on all switches.. Option A is correct because Ansible's ios_vlan module is purpose-built for automating VLAN configuration on Cisco IOS devices, aligning with Cisco's recommended practices for programmability by using a declarative, agentless automation tool that abstracts the underlying CLI and ensures idempotent configuration across multiple switches.

Answer

Use a REST API on each switch to push the VLAN configuration individually.

Answer

Use a Python script that manually SSHes into each switch and applies CLI commands.

Answer

Configure all VLANs via SNMP MIBs.

Question 17

Which TWO are common authentication methods used when interacting with Cisco APIs?

Accepted Answer

HTTP Basic Authentication. HTTP Basic Authentication (option B) is a common method for authenticating to Cisco APIs, where the client sends a base64-encoded username:password string in the Authorization header. API keys in HTTP headers (option C) are also widely used, especially with REST APIs like Cisco DNA Center or Meraki, where the key is passed in a custom header (e.g., 'X-Cisco-Meraki-API-Key'). Both are simple, stateless mechanisms supported by many Cisco platforms.

Answer

Client certificate exchange

Answer

LDAP bind credentials

Answer

SNMPv3 authentication

Question 18

Refer to the exhibit. A service engineer runs a 'check-sync' action on the NSO service 'vpn1'. The result shows 'out-of-sync' for device 'pe1'. What does this indicate?

Accepted Answer

The configuration on pe1 differs from the service model defined in NSO.. The 'check-sync' action in NSO compares the actual device configuration (retrieved via NETCONF or CLI) against the configuration that NSO's service model expects. An 'out-of-sync' result for device 'pe1' means the running configuration on pe1 does not match the configuration defined by the NSO service model for that device. This is a standard NSO feature to detect configuration drift.

Answer

The device pe1 is unreachable via NETCONF.

Answer

The service model in NSO does not have a configuration for pe1.

Answer

The device pe1 has a hardware failure.

Question 19

A security policy requires that all container images in a registry are scanned for vulnerabilities before deployment. Which approach best integrates this into a CI/CD pipeline without slowing down the pipeline?

Accepted Answer

Build the image, scan it locally, and if it passes, push it to the registry; run scans in parallel with the build if possible.. Option C is correct because it shifts the vulnerability scan left in the pipeline: the image is built and scanned locally before being pushed to the registry. If the scan passes, the image is pushed; if it fails, the pipeline stops early, avoiding the overhead of pushing a vulnerable image and then rebuilding. This approach minimizes pipeline latency by running scans in parallel with the build where possible, ensuring security without blocking the deployment flow.

Answer

Build the image, push it, then scan it, and if vulnerabilities are found, rebuild and repush.

Answer

Run the vulnerability scan on the image after pushing to the registry and block deployment if critical vulnerabilities are found.

Answer

Scan the source code dependencies before building the image, and skip image scanning.

Question 20

Which TWO are valid methods to secure a REST API? (Choose two.)

Accepted Answer

Use HTTPS to encrypt data in transit.. HTTPS (HTTP over TLS) encrypts the entire HTTP conversation, including headers and payload, using Transport Layer Security (TLS). This prevents eavesdropping, man-in-the-middle attacks, and tampering of data in transit. For a REST API, HTTPS is a fundamental security requirement to protect sensitive data and credentials from being exposed on the network.

Answer

Use HTTP with basic authentication.

Answer

Embed API keys in the URL query string.

Answer

Implement rate limiting to prevent abuse.