200-901 Practice Test 4 — 25 Questions

Question 1

A team uses Chef to manage network device configurations. Which component of Chef is responsible for storing configuration policy and distributing it to nodes?

Accepted Answer

Chef Server. The Chef Server is the central hub that stores configuration policies (cookbooks, roles, environments, data bags) and distributes them to nodes via a REST API. When a Chef Client runs on a node, it authenticates with the Chef Server and downloads the relevant policy to converge the node to the desired state. This makes the Chef Server the authoritative source of configuration policy in a Chef architecture.

Answer

Knife

Answer

Chef Client

Answer

Supermarket

Question 2

In a Docker Compose file, a service 'web' depends on 'db'. The 'db' service uses a volume to persist data. Which compose key ensures that the database starts before the web service?

Accepted Answer

depends_on. depends_on creates a startup order: Docker Compose starts 'db' before 'web'. It does not wait for 'db' to be ready; that requires healthchecks.

Answer

volumes

Answer

links

Answer

networks

Question 3

Which THREE options are valid methods to expose a Kubernetes service to external traffic?

Accepted Answer

NodePort. NodePort (B) is correct because it allocates a static port in the 30000-32767 range on every node's IP, allowing external clients to reach the service via :. Ingress (D) is correct because it provides HTTP/HTTPS routing from outside the cluster to internal services through an ingress controller acting as a reverse proxy. LoadBalancer (E) is correct because it provisions an external load balancer (e.g., via a cloud provider) with a public IP that forwards traffic to the service's NodePort. ExternalName (A) is not a valid exposure method for external traffic; it merely creates a CNAME DNS alias to an external hostname without proxying traffic. ClusterIP (C) is incorrect because it only exposes the service on an internal cluster IP reachable solely from within the cluster.

Answer

ExternalName

Answer

ClusterIP

Question 4

Which TWO HTTP status codes indicate client errors?

Accepted Answer

404 Not Found. Option B, 404 Not Found, is correct because it is a 4xx-class status code signaling that the client requested a resource the server cannot locate, which is by definition a client-side error. Option C, 400 Bad Request, is also correct because it is a 4xx status returned when the server cannot process the request due to malformed syntax, invalid framing, or deceptive routing sent by the client. The unmarked options do not belong: 500 Internal Server Error (A) is a 5xx server error indicating the server failed unexpectedly, while 200 OK (D) and 201 Created (E) are 2xx success codes confirming the request was received, understood, and processed (with 201 specifically indicating a new resource was created).

Answer

500 Internal Server Error

Answer

200 OK

Answer

201 Created

Question 5

A network engineer is tasked with segmenting a large broadcast domain into smaller ones using VLANs. In the OSI model, at which layer does a VLAN operate?

Accepted Answer

Layer 2 - Data Link. VLANs operate at Layer 2 (Data Link) of the OSI model because they segment broadcast domains by tagging Ethernet frames with VLAN IDs (802.1Q). This allows logical separation of networks without regard to physical location, and switches use MAC addresses to forward frames within VLANs. Layer 2 is where framing, MAC addressing, and VLAN tagging occur.

Answer

Layer 4 - Transport

Answer

Layer 1 - Physical

Answer

Layer 3 - Network

Question 6

A network administrator configures a switch port to belong to VLAN 10. Which OSI layer is primarily involved in VLAN tagging?

Accepted Answer

Layer 2 (Data Link). VLAN tagging is defined in IEEE 802.1Q, which operates at Layer 2 (Data Link) of the OSI model. The 802.1Q tag is inserted into the Ethernet frame header, and switches use this tag to make forwarding decisions within the same broadcast domain. Therefore, VLAN tagging is primarily a Layer 2 function.

Answer

Layer 1 (Physical)

Answer

Layer 3 (Network)

Answer

Layer 4 (Transport)

Question 7

A Python script sends a PUT request to update a resource. The API returns a response with status code 204. What does this indicate?

Accepted Answer

The update was successful and no content is returned.. HTTP 204 No Content means the server successfully processed the request and is not returning any body content. For a PUT request, this indicates the resource was updated successfully but the server chose not to return the updated representation. It is a 2xx success status, distinct from 200 OK which would include a response body.

Answer

The request was malformed.

Answer

The resource was not found.

Answer

The update failed due to a server error.

Question 8

A developer needs to share a Docker image with a colleague. They decide to push the image to a registry. Which Docker command pushes an image to a registry?

Accepted Answer

docker push my-image:latest. The `docker push` command is specifically designed to upload a local Docker image to a registry, such as Docker Hub or a private registry. It takes the image name and tag, and sends the image layers to the registry, making it available for others to pull. This is the standard way to share images with colleagues or deploy to other environments.

Answer

docker export my-image:latest

Answer

docker commit my-image:latest

Answer

docker pull my-image:latest

Question 9

Which two statements are true about Cisco DevNet Sandboxes?

Accepted Answer

DevNet Sandboxes include reserved labs for fixed time periods and always-on labs.. DevNet Sandboxes offer two primary reservation models: reserved labs, which provide exclusive access to a sandbox for a fixed time period (e.g., 4 hours), and always-on labs, which are perpetually available but shared among users. This flexibility allows developers to choose between dedicated, time-limited environments for intensive testing and persistent, always-available environments for ongoing development and learning.

Answer

DevNet Sandboxes are only available with a paid subscription.

Answer

DevNet Sandboxes only support Cisco Catalyst switches.

Answer

DevNet Sandboxes do not support third-party devices.

Question 10

In a microservices architecture, which communication pattern is typically asynchronous and decoupled?

Accepted Answer

Event-driven architecture. Event-driven architecture (D) is the correct answer because it is inherently asynchronous and decoupled: services communicate by publishing events to a message broker (e.g., Kafka, RabbitMQ) without needing to know about the consumers. This pattern allows the producer to emit an event and continue processing immediately, while consumers react to events at their own pace, achieving loose coupling and high scalability.

Answer

REST over HTTP

Answer

SOAP

Answer

gRPC

Question 11

An engineer is troubleshooting a NETCONF session that fails to establish with a Cisco IOS XE device. The SSH connection succeeds, but NETCONF capabilities are not exchanged. What is the most likely cause?

Accepted Answer

The device's NETCONF server is not enabled.. NETCONF uses a client-server model where the server (the Cisco IOS XE device) must have the NETCONF server explicitly enabled. If the SSH transport succeeds but capabilities are not exchanged, it indicates the NETCONF subsystem is not active on the device. The `netconf-yang` feature must be enabled via `netconf-yang` in global configuration mode to start the NETCONF server and allow capability exchange.

Answer

The device requires authentication via SSH keys but password was used.

Answer

The firewall is blocking port 830.

Answer

The device is running an older IOS version that does not support NETCONF.

Question 12

An engineer is writing a Python script using the Cisco DevNet sandbox to configure OSPF on a CSR1000v via RESTCONF. What authentication method is typically used for RESTCONF requests?

Accepted Answer

Basic authentication over HTTPS. RESTCONF typically uses Basic authentication over HTTPS (RFC 7235) because it is a lightweight, stateless mechanism that sends a base64-encoded username:password pair in the Authorization header. In the Cisco DevNet sandbox CSR1000v environment, this is the standard method for authenticating RESTCONF requests, as the sandbox provides a username and password for access.

Answer

No authentication

Answer

OAuth2

Answer

API token only

Question 13

In a CI/CD pipeline for a network automation project, which stage is responsible for validating the syntax of YAML configuration files?

Accepted Answer

Lint. The Lint stage in a CI/CD pipeline is specifically designed to perform static analysis on code and configuration files, including YAML syntax validation. For network automation projects, tools like yamllint or ansible-lint check for indentation errors, missing colons, or invalid data types before the configuration is applied to network devices. This ensures that only syntactically correct YAML files proceed to later stages, preventing deployment failures.

Answer

Deploy

Answer

Test

Answer

Build

Question 14

A Cisco DevNet engineer is configuring model-driven telemetry on a Cisco IOS-XE device. The telemetry subscription includes the following path: 'Cisco-IOS-XE-native:native/interface/GigabitEthernet[Name='1/0/1']/ip/address'. Which part of this path identifies a specific list instance?

Accepted Answer

[Name='1/0/1']. The XPath expression `[Name='1/0/1']` is a predicate filter that selects a specific list instance from the `GigabitEthernet` YANG list. In YANG model-driven telemetry, list keys are used to identify individual entries, and the predicate syntax `[key='value']` pinpoints exactly one instance within the list.

Answer

Cisco-IOS-XE-native

Answer

GigabitEthernet

Answer

ip/address

Question 15

In an SDN architecture, which API is used by the controller to communicate with network devices to install forwarding rules?

Accepted Answer

Southbound API. In SDN, the southbound API is the interface between the controller and the network devices (switches, routers). It allows the controller to install forwarding rules, such as flow entries in OpenFlow switches, enabling centralized control of the data plane.

Answer

REST API

Answer

East-West API

Answer

Northbound API

Question 16

A developer wants to send a message to a Webex room using the API. The message should contain a simple text body. Which endpoint and parameter are required?

Accepted Answer

POST /v1/messages with body parameter 'roomId' and 'text'. To send a message, a POST request is made to /v1/messages with a JSON body containing roomId and text (or markdown). roomId identifies the target room.

Answer

GET /v1/messages with query parameter 'roomId'

Answer

POST /v1/memberships with body parameter 'message'

Answer

POST /v1/rooms with body parameter 'text'

Question 17

Based on the NAT translation table, what type of NAT is being used?

Accepted Answer

PAT (overload). The NAT translation table shows multiple internal IP addresses (e.g., 10.1.1.1, 10.1.1.2) being translated to the same public IP address (e.g., 203.0.113.1) but with different source ports. This is the defining characteristic of Port Address Translation (PAT), also known as NAT overload, where a single public IP is shared among many internal hosts by multiplexing on layer-4 port numbers.

Answer

Dynamic NAT

Answer

Static PAT

Answer

Static NAT

Question 18

A company is implementing a secure CI/CD pipeline. Which THREE practices are essential for securing the pipeline?

Accepted Answer

Sign and verify all build artifacts.. Option A is correct because signing build artifacts (e.g., with Sigstore/cosign or GPG) and verifying those signatures before deployment ensures integrity and provenance, preventing tampered or unauthorized artifacts from reaching production. Option D is correct because implementing role-based access control (RBAC) on the CI/CD system enforces least privilege, restricting who can modify pipelines, trigger builds, or access secrets and deployment targets. Option E is correct because integrating SAST tools into the build stage catches code-level vulnerabilities (e.g., injection flaws, insecure deserialization) early, before artifacts are promoted through the pipeline. Option B is incorrect because pulling container images from any public registry exposes the pipeline to untrusted or malicious images; images should come from vetted, trusted registries with scanning and signature verification. Option C is incorrect because storing secrets such as API keys and passwords in version control exposes them to anyone with repository access and to history leaks; secrets should be kept in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) and injected at runtime.

Answer

Allow all container images to be pulled from any public registry.

Answer

Store secrets (API keys, passwords) in version control.

Question 19

A developer uses the Cisco DNA Center API to retrieve device inventory. The JSON response is shown. Which Python code snippet correctly extracts the serial number?

Accepted Answer

data['response'][0]['serialNumber']. The JSON response from the Cisco DNA Center device inventory API returns a list of devices under the 'response' key, and each device is a dictionary. The serial number for the first device is accessed by indexing into the list with [0] and then retrieving the 'serialNumber' key from that dictionary.

Answer

data['serialNumber']

Answer

data['response']['serialNumber']

Answer

data[0]['serialNumber']

Question 20

A network developer is using Cisco NSO to manage multi-vendor devices. Which three are valid approaches to handle device-specific differences? (Choose three.)

Accepted Answer

Write custom Python code in the service model. Cisco NSO allows developers to write custom Python code within the service model to handle device-specific logic, such as translating abstract service parameters into vendor-specific CLI or NETCONF commands. This approach provides flexibility to accommodate non-standard configurations that cannot be expressed purely through YANG models or NEDs.

Answer

Use SNMP MIBs for all configurations

Answer

Configure each device manually through CLI