200-901 Practice Test 32 — 15 Questions

Question 1

In a Kubernetes cluster, you need to expose a set of pods running a web application to external traffic on a specific port. Which Service type should you use to provide a stable external IP address?

Accepted Answer

LoadBalancer. LoadBalancer provisions a cloud load balancer and assigns a stable external IP, making the service accessible from outside the cluster.

Answer

ClusterIP

Answer

NodePort

Question 2

Which three statements are true about the Cisco Catalyst Center (formerly DNA Center) intent API? (Choose three.)

Accepted Answer

The base URL for the API includes the Catalyst Center hostname and port.. Option A is correct because every Catalyst Center intent API call is built on a base URL of the form https://:, typically port 443 for HTTPS, followed by the service path such as /dna/intent/api/v1. Option B is correct because authentication is performed by sending a POST request with the username and password in a JSON body to /dna/system/api/v1/auth/token, which returns a JWT token used as a Bearer token in the X-Auth-Token header for subsequent calls. Option D is correct because the intent API follows RESTful principles, using resource-oriented URIs and standard HTTP verbs, and returns responses formatted as JSON. Option C is incorrect because the API also uses PUT and DELETE methods (for example, to update or remove resources), not only GET and POST. Option E is incorrect because the X-Cisco-Meraki-API-Key header belongs to the Cisco Meraki Dashboard API, not to Catalyst Center, which relies on token-based authentication.

Answer

The API uses only GET and POST methods.

Answer

It requires an API key passed in the X-Cisco-Meraki-API-Key header.

Question 3

In a wireless network using 802.11ac, which frequency band does the standard primarily operate in to achieve higher throughput?

Accepted Answer

5 GHz. 5 GHz is correct because 802.11ac (Wi-Fi 5) was designed to operate exclusively in the 5 GHz band, which offers wider channels (up to 160 MHz) and less interference compared to 2.4 GHz. This enables the higher throughput and multi-user MIMO capabilities that define 802.11ac. The standard does not define operation in 2.4 GHz or 6 GHz.

Answer

2.4 GHz

Answer

6 GHz

Answer

Both 2.4 GHz and 5 GHz

Question 4

Drag and drop the steps to use Git to commit and push code changes to a remote repository into the correct order.

Accepted Answer

Stage changes, commit changes, pull the latest changes from remote, resolve any merge conflicts, then push.. The correct Git workflow for committing and pushing code changes is to first stage your changes, then commit them locally. Next, pull the latest changes from the remote repository to sync with upstream work. If there are any merge conflicts, resolve them during the pull or after. Finally, push your commits to the remote repository. This order ensures that your local repository is up-to-date and minimizes merge conflicts.

Answer

Commit changes, stage changes, pull from remote, push, then resolve conflicts.

Answer

Pull from remote, stage changes, commit changes, push, then resolve conflicts.

Answer

Stage changes, commit changes, push, pull from remote, then resolve conflicts.

Question 5

Which THREE of the following are valid methods to handle API rate limiting in a Python automation script? (Select exactly 3.)

Accepted Answer

Parse the Retry-After header from the response. Option A is correct because the Retry-After header, returned with HTTP 429 (Too Many Requests) or 503 responses, tells the client exactly how many seconds to wait before retrying, making it a standards-based way to honor server-imposed rate limits. Option B is correct because a token bucket algorithm explicitly controls the request rate by issuing tokens at a defined rate and consuming one per request, allowing bursts up to the bucket capacity while preventing sustained over-limit traffic. Option E is correct because retry logic with exponential backoff progressively increases the delay between attempts (e.g., 1s, 2s, 4s, 8s, often with jitter), which reduces request pressure and avoids hammering an API that is throttling the client. Option C is not among the marked answers because a fixed sleep interval is a crude, static approach that does not adapt to the server's actual limit signals and can either waste time or still exceed the quota. Option D is clearly wrong because ignoring the limit and sending requests faster will trigger further 429 responses, potential IP bans, or account suspension rather than handling the rate limit.

Answer

Sleep for a fixed amount of time between requests

Answer

Ignore the limit and send requests faster

Question 6

A DevOps team manages a hybrid cloud environment with on-premises Cisco Nexus switches and AWS VPCs using Terraform. They have a configuration management tool that pushes VLAN and interface configurations to the Nexus switches. Recently, they noticed that after a Terraform run that updates the AWS VPC subnets, some on-premises switches lose connectivity to the cloud. The team suspects a mismatch between the VLAN configurations on the Nexus switches and the AWS VPC subnets. They have a centralized source of truth stored in a Git repository containing YAML files for network definitions. Which action should the team take first to resolve the issue and prevent future occurrences?

Accepted Answer

Compare the Git repository's YAML definitions with the actual switch configurations and AWS VPC subnets, then correct any discrepancies.. The team's centralized source of truth in Git (YAML files) should be the authoritative reference for network definitions. By comparing these definitions against both the actual Nexus switch configurations and AWS VPC subnets, the team can identify and correct any drift or mismatch. This aligns with Infrastructure as Code (IaC) best practices, ensuring that all environments are synchronized from a single, version-controlled source before making any changes.

Answer

Restore the Nexus switch configurations from the most recent backup.

Answer

Modify the Terraform scripts to automatically update Nexus switches when AWS VPC subnets change.

Answer

Manually reconfigure the VLANs on the Nexus switches to match the AWS VPC subnets.

Question 7

Which THREE of the following are common design patterns for microservices? (Choose three.)

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern (B) is a core microservices resilience pattern: it wraps calls to a remote service and, after a threshold of failures, 'trips' to fail fast instead of letting threads pile up on a slow or dead dependency, allowing recovery via half-open probing. Service Registry (D) is a standard microservices pattern for dynamic service discovery, where instances register their network locations (e.g., with Eureka or Consul) so consumers can locate healthy instances without hardcoded endpoints. API Gateway (E) is the canonical edge pattern: a single entry point that routes requests to backend microservices and centralizes cross-cutting concerns such as authentication, rate limiting, and response aggregation. By contrast, Chain of Responsibility (A) is a general GoF behavioral pattern for passing a request along a handler chain, not specific to microservice architecture, and Singleton (C) is a GoF creational pattern that is actually discouraged in microservices because shared global state undermines independent deployability and horizontal scaling.

Answer

Chain of Responsibility

Answer

Singleton

Question 8

A developer is writing a Dockerfile for a Node.js application. Which TWO instructions are commonly used to define the command that runs when the container starts?

Accepted Answer

CMD. Option A (CMD) is correct because CMD specifies the default command (and/or arguments) executed when a container starts from the image, and it can be overridden at runtime by arguments passed to `docker run`. Option D (ENTRYPOINT) is correct because ENTRYPOINT configures the executable that always runs when the container starts, making it the primary way to define the container's startup process; CMD then typically supplies default arguments to it. Option B (RUN) is incorrect because RUN executes commands during image build time to create layers, not at container startup. Option C (START) is incorrect because there is no Dockerfile START instruction; container startup is governed by CMD/ENTRYPOINT. Option E (EXPOSE) is incorrect because EXPOSE only documents the port the container listens on at runtime and does not define any startup command.

Answer

RUN

Answer

START

Answer

EXPOSE

Question 9

A network automation engineer is writing a Python script to configure multiple devices. Which library is most appropriate for SSH-based interactions?

Accepted Answer

Netmiko. Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It provides high-level methods for sending commands, handling prompts, and managing device interactions, making it the most appropriate choice for automating configuration tasks across multiple devices.

Answer

requests

Answer

socket

Answer

paramiko

Question 10

Which TWO of the following are valid private IPv4 address ranges? (Select two.)

Accepted Answer

10.0.0.0/8. Option B, 10.0.0.0/8, is correct because RFC 1918 designates the entire 10.0.0.0/8 block as a private IPv4 range, giving roughly 16.7 million addresses for internal use. Option E, 192.168.0.0/16, is also correct because RFC 1918 reserves 192.168.0.0/16 for private networks, commonly used in home and small-office LANs. The third RFC 1918 range, 172.16.0.0/12, covers 172.16.0.0 through 172.31.255.255, which is why option A (172.15.0.0/12) and option C (172.32.0.0/12) fall outside the private block and are invalid. Option D, 169.254.0.0/16, is not a private range but the APIPA/link-local block (RFC 3927), automatically self-assigned when DHCP fails, so it does not qualify.

Answer

172.15.0.0/12

Answer

172.32.0.0/12

Answer

169.254.0.0/16

Question 11

A developer is creating a YANG data model for a new interface feature. The model must allow the user to choose from a predefined set of values for the 'duplex' leaf. Which YANG statement should be used to restrict the values to 'full', 'half', and 'auto'?

Accepted Answer

type enumeration { enum full; enum half; enum auto; }. The 'type enumeration' statement in YANG defines a leaf that can only take one of the explicitly listed enum values. By specifying 'enum full;', 'enum half;', and 'enum auto;', the developer restricts the 'duplex' leaf to exactly those three predefined strings, which matches the requirement.

Answer

choice duplex-options { case full; case half; case auto; }

Answer

type string;

Answer

type leafref { path '/other:duplex-list'; }

Question 12

Refer to the exhibit. A security audit reveals that the authentication mechanism is vulnerable. Which attack is most likely possible?

Accepted Answer

Token forgery if the secret key is weak.. The exhibit shows a JSON Web Token (JWT) being used for authentication. If the secret key used to sign the JWT is weak or easily guessable, an attacker can forge a valid token by brute-forcing the secret and then crafting a token with arbitrary claims (e.g., elevated privileges). This is a classic token forgery attack, not a cross-site scripting or injection attack, because the vulnerability lies in the signing mechanism, not in input handling or transport security.

Answer

Cross-site scripting (XSS) via the token.

Answer

Man-in-the-middle attack due to missing HTTPS.

Answer

SQL injection through the login endpoint.

Question 13

A developer needs to retrieve the list of devices from a Meraki network using the Meraki Dashboard API. Which HTTP method and endpoint should be used?

Accepted Answer

GET /networks/{networkId}/devices. The Meraki Dashboard API uses RESTful conventions: to retrieve a list of devices within a specific network, you send a GET request to the endpoint `/networks/{networkId}/devices`. This follows the standard pattern of using GET for read operations and scoping the resource under the network identifier.

Answer

POST /networks/{networkId}/devices

Answer

GET /devices

Answer

GET /organizations/{organizationId}/networks

Question 14

Which Cisco platform uses NX-API to allow programmatic access to CLI commands via JSON?

Accepted Answer

Cisco NX-OS. Cisco NX-OS is the network operating system that runs on Nexus switches and supports NX-API, which allows programmatic access to CLI commands via JSON (or XML) over HTTP/HTTPS. NX-API exposes the /ins endpoint for CLI execution and /api for model-driven REST access.

Answer

Cisco Meraki

Answer

Cisco DNA Center

Answer

Cisco IOS XE

Question 15

Which two authentication methods are commonly used with Cisco APIs? (Choose two.)

Accepted Answer

Basic Authentication over HTTPS. Basic Authentication over HTTPS (B) is correct because Cisco APIs such as the DNA Center, Meraki, and ACI REST APIs accept an HTTP Authorization header containing base64-encoded username:password credentials, with HTTPS providing transport encryption. API Token (Bearer Token) (E) is also correct because many Cisco platforms (e.g., Meraki Dashboard API with the X-Cisco-Meraki-API-Key header, Webex with OAuth bearer tokens, and DNA Center token-based auth) authenticate requests using a token rather than credentials on every call. SNMPv3 (A) is a network management protocol for polling and traps, not an HTTP API authentication method. SSH Key (C) is used for secure CLI/shell access, not for REST API authentication. RADIUS (D) is an AAA protocol for network access control (802.1X, VPN), not a mechanism for authenticating API calls.

Answer

SNMPv3

Answer

SSH Key

Answer

RADIUS