200-901 Practice Test 2 — 30 Questions

Question 1

A developer is writing a Python script using the Cisco Webex Teams API to send a message to a specific room. The script works for some rooms but fails for others with a 404 error. What is the most likely reason?

Accepted Answer

The bot is not a member of those rooms.. The 404 error indicates that the resource (the room) was not found by the API. In the Cisco Webex Teams API, a bot can only interact with rooms it has been added to as a member. If the bot is not a member of a room, the API cannot locate the room from the bot's perspective, resulting in a 404 error. This is the most common cause of intermittent 404 errors when the script works for some rooms but not others.

Answer

The API rate limit has been exceeded for those rooms.

Answer

The access token is invalid for those rooms.

Answer

The bot does not have permission to send messages in those rooms.

Question 2

A developer is designing a REST API that will be used by multiple client applications. The API must support versioning to ensure backward compatibility. Which approach should the developer use to implement API versioning?

Accepted Answer

Embed the version in the URI, e.g., /v1/resource. Embedding the version in the URI (e.g., /v1/resource) is the most common and straightforward approach for REST API versioning. It makes the version explicit in the URL, allowing clients to directly target a specific version without requiring special header handling or query parameter parsing. This method is widely adopted in industry APIs (e.g., GitHub, Twilio) and ensures backward compatibility by keeping older endpoints accessible under their original URI path.

Answer

Use different HTTP methods for different versions

Answer

Pass the version as a query parameter, e.g., ?version=1

Answer

Use a custom HTTP header to specify the version

Question 3

A developer is working with a REST API that uses HTTP Basic Authentication. The developer needs to send a request with the username 'admin' and password 'secret'. Which HTTP header should be set?

Accepted Answer

Authorization: Basic YWRtaW46c2VjcmV0. HTTP Basic Authentication requires the credentials to be formatted as 'username:password', then Base64-encoded, and sent in the Authorization header with the 'Basic' scheme. Option C correctly includes the 'Basic' scheme followed by the Base64-encoded string 'YWRtaW46c2VjcmV0' (which decodes to 'admin:secret').

Answer

Authorization: Basic admin:secret

Answer

Authorization: YWRtaW46c2VjcmV0

Answer

Authorization: Bearer YWRtaW46c2VjcmV0

Question 4

A developer is writing a Python script that uses the Cisco Catalyst Center (formerly DNA Center) API to get the list of sites. The API returns a response with a 'response' key containing a list of sites. The developer wants to access the 'response' field from the JSON response. Which code snippet correctly extracts the list?

Accepted Answer

sites = response['response']. Option B is correct because the Cisco Catalyst Center API returns a JSON response where the list of sites is nested under the 'response' key. Using dictionary-style indexing with `response['response']` directly retrieves that list, which is the standard way to access a known key in a Python dictionary parsed from JSON.

Answer

sites = list(response)

Answer

sites = response[0]

Answer

sites = response.get('response')

Question 5

A network automation engineer is using Ansible to manage Cisco IOS devices. The playbook includes a task that executes a 'show version' command and registers the output. The engineer then wants to parse the output to extract the IOS version. Which approach should be used?

Accepted Answer

Use the 'cisco.ios.ios_facts' module to get structured facts. The 'cisco.ios.ios_facts' module retrieves structured data from Cisco IOS devices, including the IOS version as a key-value pair in the Ansible facts dictionary. This eliminates the need for manual parsing, as the module uses the device's CLI or NETCONF to gather structured output, making it the most efficient and reliable approach for extracting specific device attributes.

Answer

Use the 'cisco.ios.ios_command' module and parse the output with regex

Answer

Use the 'cisco.ios.ios_command' module and the 'parse' option

Answer

Use the 'cisco.ios.ios_config' module to retrieve the version

Question 6

A Python script uses the Cisco Meraki API to fetch the list of organizations. The script fails with a 401 HTTP status. What is the most likely cause?

Accepted Answer

The API key is invalid or missing.. A 401 HTTP status indicates 'Unauthorized', which in the context of the Meraki API means the request lacks valid authentication credentials. The most common cause is an invalid or missing API key, as the Meraki API requires a valid API key in the `X-Cisco-Meraki-API-Key` header for all requests.

Answer

The API request exceeded the rate limit.

Answer

The API key does not have permission to list organizations.

Answer

The API endpoint URL is incorrect.

Question 7

A DevOps team is using Cisco NSO to manage network devices. They want to ensure that the configuration is compliant with corporate standards. Which NSO feature should they use?

Accepted Answer

Service reconciliation using FastMap. Service reconciliation using FastMap is the correct NSO feature for ensuring configuration compliance with corporate standards because it detects and corrects deviations between the intended service model (defined in YANG) and the actual device configuration. FastMap performs a diff and re-applies the service logic to bring the device back into compliance, making it ideal for continuous compliance enforcement.

Answer

Configuration Snapshots

Answer

NETCONF notifications

Answer

Configuration Database (CDB) rollback

Question 8

A developer is building a chatbot that retrieves interface status from a Cisco Catalyst 9000 switch using RESTCONF. Which authentication method is most appropriate for programmatic access?

Accepted Answer

HTTP Basic Authentication over HTTPS.. RESTCONF on Cisco Catalyst 9000 switches supports HTTP Basic Authentication over HTTPS as a straightforward, standards-based method for programmatic access. Basic authentication sends the username and password in the HTTP Authorization header, and when combined with HTTPS, the credentials are encrypted in transit, providing adequate security for device management without requiring additional infrastructure like an OAuth provider or certificate authority.

Answer

API key passed in the HTTP header.

Answer

OAuth 2.0 with client credentials grant.

Answer

Client certificate authentication.

Question 9

A network administrator uses the Cisco IOS XE CLI to configure a router. They want to use a Python script to automate this configuration via the guest shell. Which library should they use to interact with the CLI from within the guest shell?

Accepted Answer

cli. The `cli` library is a built-in Python module available within the Cisco Guest Shell that allows scripts to execute IOS XE CLI commands directly on the host device. This library provides functions like `cli.execute()` and `cli.configure()` to send commands and retrieve output, making it the correct choice for automating configuration via the Guest Shell without external dependencies.

Answer

requests

Answer

ncclient

Answer

paramiko

Question 10

A network engineer needs to automate the configuration of VLANs across 50 switches. Which approach best follows Cisco’s recommended practices for programmability?

Accepted Answer

Write an Ansible playbook using the ios_vlan module to configure VLANs on all switches.. Option A is correct because Ansible's ios_vlan module is purpose-built for automating VLAN configuration on Cisco IOS devices, aligning with Cisco's recommended practices for programmability by using a declarative, agentless automation tool that abstracts the underlying CLI and ensures idempotent configuration across multiple switches.

Answer

Use a REST API on each switch to push the VLAN configuration individually.

Answer

Use a Python script that manually SSHes into each switch and applies CLI commands.

Answer

Configure all VLANs via SNMP MIBs.

Question 11

Which TWO are common authentication methods used when interacting with Cisco APIs?

Accepted Answer

HTTP Basic Authentication. HTTP Basic Authentication (option B) is a common method for authenticating to Cisco APIs, where the client sends a base64-encoded username:password string in the Authorization header. API keys in HTTP headers (option C) are also widely used, especially with REST APIs like Cisco DNA Center or Meraki, where the key is passed in a custom header (e.g., 'X-Cisco-Meraki-API-Key'). Both are simple, stateless mechanisms supported by many Cisco platforms.

Answer

Client certificate exchange

Answer

LDAP bind credentials

Answer

SNMPv3 authentication

Question 12

Refer to the exhibit. A service engineer runs a 'check-sync' action on the NSO service 'vpn1'. The result shows 'out-of-sync' for device 'pe1'. What does this indicate?

Accepted Answer

The configuration on pe1 differs from the service model defined in NSO.. The 'check-sync' action in NSO compares the actual device configuration (retrieved via NETCONF or CLI) against the configuration that NSO's service model expects. An 'out-of-sync' result for device 'pe1' means the running configuration on pe1 does not match the configuration defined by the NSO service model for that device. This is a standard NSO feature to detect configuration drift.

Answer

The device pe1 is unreachable via NETCONF.

Answer

The service model in NSO does not have a configuration for pe1.

Answer

The device pe1 has a hardware failure.

Question 13

A security policy requires that all container images in a registry are scanned for vulnerabilities before deployment. Which approach best integrates this into a CI/CD pipeline without slowing down the pipeline?

Accepted Answer

Build the image, scan it locally, and if it passes, push it to the registry; run scans in parallel with the build if possible.. Option C is correct because it shifts the vulnerability scan left in the pipeline: the image is built and scanned locally before being pushed to the registry. If the scan passes, the image is pushed; if it fails, the pipeline stops early, avoiding the overhead of pushing a vulnerable image and then rebuilding. This approach minimizes pipeline latency by running scans in parallel with the build where possible, ensuring security without blocking the deployment flow.

Answer

Build the image, push it, then scan it, and if vulnerabilities are found, rebuild and repush.

Answer

Run the vulnerability scan on the image after pushing to the registry and block deployment if critical vulnerabilities are found.

Answer

Scan the source code dependencies before building the image, and skip image scanning.

Question 14

Which TWO are valid methods to secure a REST API? (Choose two.)

Accepted Answer

Use HTTPS to encrypt data in transit.. HTTPS (HTTP over TLS) encrypts the entire HTTP conversation, including headers and payload, using Transport Layer Security (TLS). This prevents eavesdropping, man-in-the-middle attacks, and tampering of data in transit. For a REST API, HTTPS is a fundamental security requirement to protect sensitive data and credentials from being exposed on the network.

Answer

Use HTTP with basic authentication.

Answer

Embed API keys in the URL query string.

Answer

Implement rate limiting to prevent abuse.

Question 15

A network engineer is troubleshooting a Kubernetes deployment where pods are failing to start with the error 'CrashLoopBackOff'. The pod log shows 'bind: address already in use'. The deployment runs multiple replicas of a container that listens on port 8080. What is the most likely cause?

Accepted Answer

The deployment has hostPort: 8080 specified, causing port conflict when multiple replicas are scheduled on the same node.. The 'bind: address already in use' error indicates that the container's process cannot bind to port 8080 because it is already occupied. When `hostPort: 8080` is specified in the pod spec, Kubernetes instructs the container runtime to map the container port to the same port on the node's network namespace. If multiple replicas of the deployment are scheduled on the same node, each pod attempts to bind to port 8080 on the host, causing a conflict and the CrashLoopBackOff state. This is a common misconfiguration when using hostPort without ensuring that replicas are spread across different nodes.

Answer

The container is attempting to bind to a privileged port without the necessary capabilities.

Answer

The service is using NodePort and the node port is already in use.

Answer

Multiple containers in the same pod are trying to bind to the same port.

Question 16

A developer needs to ensure that microservice A can securely communicate with microservice B over HTTPS within a Kubernetes cluster. What is the simplest approach?

Accepted Answer

Create a Kubernetes Service of type ClusterIP for microservice B and configure microservice A to use HTTPS with the service DNS name.. Option D is correct because using a ClusterIP Service for microservice B provides a stable DNS name within the cluster, allowing microservice A to communicate over HTTPS without exposing the service externally. This approach leverages Kubernetes' internal service discovery and can be paired with a service mesh or mutual TLS (mTLS) for secure communication, meeting the requirement for simplicity and security.

Answer

Use a Kubernetes Ingress resource with TLS termination for microservice B.

Answer

Expose microservice B via a LoadBalancer Service and use HTTPS from microservice A.

Answer

Connect directly using the pod IP of microservice B over HTTP.

Question 17

During an automation script run, a network device returns HTTP 429. What does this indicate?

Accepted Answer

Rate limiting. HTTP 429 (Too Many Requests) indicates the client has sent too many requests in a given amount of time, triggering rate limiting on the server. In network automation, devices like routers or switches enforce rate limits to prevent resource exhaustion, often based on RFC 6585. This is common when automation scripts exceed API call thresholds, requiring retry logic with exponential backoff.

Answer

Internal server error

Answer

Authentication failure

Answer

Resource not found

Question 18

Which THREE of the following are best practices for writing Ansible playbooks for network automation? (Select exactly 3.)

Accepted Answer

Include a validation task after configuration changes. Option B is correct because after applying configuration changes via modules like `ios_config` or `junos_config`, a validation task (e.g., using `wait_for` or `assert` to verify operational state) ensures the device is reachable and the changes took effect before proceeding. This prevents cascading failures in multi-device playbooks and aligns with network automation best practices for reliability.

Answer

Run all tasks without checking for errors

Answer

Hardcode device IPs in the playbook

Question 19

In a network automation workflow, a developer needs to ensure idempotency. What does idempotency mean in this context?

Accepted Answer

Running the script once produces the same result as running it multiple times. Idempotency in network automation means that executing an operation multiple times results in the same network state as executing it once. For example, using a REST API PUT request to set a VLAN configuration will leave the device in the same state whether the request is sent once or repeatedly, because PUT is inherently idempotent. This prevents unintended side effects like duplicate VLANs or interface misconfigurations when a script is retried due to network failures or timeouts.

Answer

The script uses a single API call

Answer

The script can recover from failures

Answer

The script can run on multiple devices simultaneously

Question 20

Which THREE of the following are valid methods to handle API rate limiting in a Python automation script? (Select exactly 3.)

Accepted Answer

Parse the Retry-After header from the response. Option A is correct because the Retry-After header is a standard HTTP mechanism (defined in RFC 7231) that explicitly tells the client how long to wait before making the next request. Parsing this header allows your Python script to respect the server's rate limit dynamically, rather than using a fixed or arbitrary delay. This is a common pattern when interacting with REST APIs that enforce rate limiting.

Answer

Sleep for a fixed amount of time between requests

Answer

Ignore the limit and send requests faster