200-901 Practice Test 28 — 15 Questions

Question 1

A developer receives HTTP 409 Conflict when updating a network configuration via Cisco NX-OS API. Which two scenarios could cause this error?

Accepted Answer

The resource was recently modified by another client.. HTTP 409 Conflict indicates a request conflicts with the current state of the resource. In the context of Cisco NX-OS API, this error occurs when the resource was recently modified by another client (option A) or when the update conflicts with a lock held by another transaction (option B). Both scenarios involve a state mismatch that the server cannot resolve without client intervention, often requiring the client to re-fetch the resource and retry.

Answer

The request body contains malformed JSON.

Answer

The request includes unsupported parameters.

Answer

The API key used is invalid.

Question 2

A developer is using the Meraki Dashboard API to programmatically change the SSID name of a wireless network. The developer successfully authenticates with an API key and sends a PUT request to /networks/{networkId}/wireless/ssids/{number} with a JSON body containing the updated name. The API returns a 200 OK response, but the SSID name does not change in the Meraki Dashboard. The developer double-checks the networkId and SSID number, and they are correct. The developer also confirms that the API key has full write access to the network. What additional step is most likely required?

Accepted Answer

Log out of the Meraki Dashboard and re-login to see the change.. The Meraki Dashboard API uses PUT to update SSID settings. A 200 OK response means the update was accepted and applied immediately; no separate provisioning call or PATCH request is required. If the SSID name still appears unchanged in the dashboard UI, the most likely remaining step is to refresh or log out and back in to display the already-applied update.

Answer

After the PUT request, send a POST request to /networks/{networkId}/wireless/ssids/{number}/provision to apply the change.

Answer

Use a PATCH request instead of PUT to update the SSID.

Answer

Regenerate the API key and try again with the new key.

Question 3

An organization implements zero-touch provisioning (ZTP) for new Cisco routers using DHCP and TFTP. The provision script is not being executed even though the device obtains an IP address. The DHCP server logs show the option 67 (bootfile-name) and option 150 (tftp-server) are set. What is the most probable reason?

Accepted Answer

The script file name in option 67 does not match the actual file on the TFTP server. The most common reason for a ZTP script not executing after a device obtains an IP address is a mismatch between the bootfile name specified in DHCP option 67 and the actual filename on the TFTP server. Even if the DHCP server logs show option 67 and 150 are set, the router will attempt to download the file specified in option 67; if that file does not exist or is named differently on the TFTP server, the download fails and the script is not executed.

Answer

The DHCP server is not authoritative

Answer

The TFTP server IP is unreachable from the router

Answer

The router does not support ZTP

Question 4

A developer is using the Meraki Dashboard API and notices that some requests return a 429 status code. What is the most likely cause?

Accepted Answer

The rate limit of 5 requests per second has been exceeded.. Meraki API rate limits at 5 calls per second; exceeding this returns 429 Too Many Requests.

Answer

The organization ID is incorrect.

Answer

The request payload is too large.

Answer

The API key is invalid.

Question 5

A Python script uses the ncclient library to connect to a Cisco NX-OS device over NETCONF. After establishing the session, the script executes an editing operation with candidate datastore. Which additional step is required to make the changes take effect immediately on the running configuration?

Accepted Answer

Execute a commit operation on the candidate datastore. When using NETCONF with the candidate datastore on Cisco NX-OS, changes are staged in the candidate configuration and do not affect the running configuration until a commit operation is explicitly sent. The commit operation copies the candidate configuration to the running datastore, making the changes take effect immediately. Without this step, the candidate changes remain unapplied.

Answer

Execute a discard-changes operation on the candidate datastore

Answer

Execute a validate operation on the candidate datastore

Answer

No additional step is needed; candidate changes are automatically applied to running

Question 6

A team is designing a CI/CD pipeline that uses the Cisco ACI REST API to deploy tenant policies. Which best practice should be followed for secure credential management?

Accepted Answer

Use a secrets management service and reference it in the pipeline. Storing credentials in a secrets management service and referencing them in the pipeline is a security best practice. Hardcoding or storing in plain text is insecure.

Answer

Store credentials in plain text in the pipeline configuration

Answer

Hardcode credentials in the source code

Answer

Use a shared user account with no MFA

Question 7

You are writing a Dockerfile for a Python application. Which instruction should you use to install the dependencies from a requirements.txt file?

Accepted Answer

RUN pip install -r requirements.txt. The RUN instruction executes commands in a new layer on top of the current image and commits the results. Using RUN pip install -r requirements.txt ensures that the Python dependencies are installed during the image build process, making them part of the final image. This is the correct approach because dependencies should be installed at build time, not at container runtime.

Answer

ENTRYPOINT pip install -r requirements.txt

Answer

CMD pip install -r requirements.txt

Question 8

A network automation team uses Ansible to manage Cisco ACI fabrics. They have a playbook that creates application profiles using the 'aci_ap' module. Recently, they started using a new Python script that directly uses the Cisco ACI REST API to perform the same tasks. The script often fails with a 403 Forbidden error, although the Ansible playbook works fine. The authentication method is the same: basic authentication over HTTPS. The API user has the same privileges. Which of the following is the most likely cause?

Accepted Answer

The script is not including the APIC cookie in subsequent requests. The 403 Forbidden error indicates that the APIC is rejecting the request due to authentication or authorization failure. Ansible's 'aci_ap' module automatically handles session cookies by logging in once and reusing the APIC cookie for subsequent requests. The Python script likely fails because it does not capture and include the session cookie returned by the APIC login response in its subsequent REST API calls, causing the APIC to treat each request as unauthenticated.

Answer

The script is not setting the proper Content-Type header for POST requests

Answer

The script is using HTTP instead of HTTPS

Answer

The API user's password was changed between runs

Question 9

A developer is designing a Python script that needs to make multiple REST API calls to different endpoints sequentially. The script must handle the following requirements: (1) Use a variable timeout for each request, (2) Include an authorization token in every request, (3) Parse JSON responses. Which TWO features of the requests library should be used? (Choose two.)

Accepted Answer

Use the `timeout` parameter to specify a maximum wait time.. The `timeout` parameter in the requests library allows you to specify a maximum wait time (in seconds) for each request, directly addressing requirement (1) for a variable timeout. Option E is correct because the `headers` parameter is the standard way to include an authorization token (e.g., `{'Authorization': 'Bearer <token>'}`) in every request, satisfying requirement (2). Both features are essential for controlling request behavior and authentication in REST API calls.

Answer

Set the `data` parameter to JSON for request body.

Answer

Use `verify=False` to speed up requests.

Answer

Set the `auth` parameter with a tuple (username, token).

Question 10

In a Kubernetes cluster, you need to store non-sensitive configuration data (e.g., database hostname) that can be consumed by pods as environment variables. Which resource should you use?

Accepted Answer

ConfigMap. A ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data like a database hostname. It is designed to decouple configuration artifacts from image content, allowing pods to consume this data as environment variables or mounted files without hardcoding values into container images.

Answer

PersistentVolume

Answer

Secret

Question 11

When using the Cisco Meraki Dashboard API to create an HTTP webhook for network alerts, which authentication method is required in the request header?

Accepted Answer

X-Cisco-Meraki-API-Key: <your_api_key>. The Cisco Meraki Dashboard API requires authentication via a custom HTTP header named `X-Cisco-Meraki-API-Key`, where the value is your API key. This is the only supported method for authenticating requests to the Meraki API, as documented in the official API reference. Option D correctly specifies this header, making it the required authentication method for creating an HTTP webhook for network alerts.

Answer

Authorization: Bearer <token>

Answer

Include the API key as a query parameter.

Answer

Authorization: Basic <base64>

Question 12

A developer is implementing OAuth 2.0 for a Cisco Webex integration that needs to send messages on behalf of a user. The integration runs on a server with no user interface. Which OAuth 2.0 flow should be used?

Accepted Answer

Client Credentials flow. For a server-to-server scenario without a user interface, the client credentials grant is appropriate, even though Webex typically uses authorization code for user context. However, the question implies a machine-to-machine scenario; client credentials flow is for server-to-server where no user is present.

Answer

Implicit flow

Answer

Authorization Code flow with PKCE

Answer

Device Code flow

Question 13

A developer is implementing exception handling in Python for a function that makes an HTTP request. Which THREE exception types should be caught to handle common network and HTTP errors? (Choose three.)

Accepted Answer

requests.exceptions.ConnectionError. `requests.exceptions.ConnectionError` is raised when a network connection cannot be established, such as DNS resolution failure or refused TCP connection. This is a fundamental network error that must be handled in any HTTP client to ensure robust error recovery.

Answer

requests.exceptions.InvalidURL

Answer

requests.exceptions.TooManyRedirects

Question 14

A developer is using a Dockerfile to build an image. The image must be based on a minimal Linux distribution to reduce attack surface. Which base image should be used?

Accepted Answer

alpine:latest. Alpine Linux is a minimal Linux distribution designed for security, simplicity, and resource efficiency. Its base image is typically around 5 MB, significantly reducing the attack surface compared to full-featured distributions like Ubuntu, Debian, or CentOS. This makes it the ideal choice for minimizing vulnerabilities in containerized applications.

Answer

ubuntu:latest

Answer

debian:latest

Answer

centos:latest

Question 15

You manage a network that uses a mix of Cisco IOS and IOS-XE devices. The company wants to implement network automation using RESTCONF and YANG. You have configured RESTCONF on a branch router running IOS-XE 16.12. You can successfully retrieve the interface configuration using a GET request from a Python script. However, when you try to modify the description of an interface using a PATCH request, you receive a 405 Method Not Allowed error. The script uses basic authentication over HTTPS. The URL is correct, and the YANG data payload is valid. What is the most likely reason for the failure?

Accepted Answer

The RESTCONF service on the router is not enabled for write operations.. The 405 Method Not Allowed error indicates that the RESTCONF service on the router is not enabled for write operations. By default, RESTCONF on IOS-XE devices may be configured in read-only mode, or the necessary HTTP methods (PATCH, PUT, POST) are not permitted. Since the GET request succeeds but PATCH fails, the service is operational but write access is restricted, often due to missing 'ip http secure-server' or 'restconf' configuration with write permissions.

Answer

The YANG payload must be in XML format instead of JSON.

Answer

Basic authentication is not supported for PATCH requests.

Answer

The PATCH request must target the entire configuration data store, not a specific interface.