200-901 Practice Test 34 — 15 Questions

Question 1

A network administrator uses the Cisco IOS XE CLI to configure a router. They want to use a Python script to automate this configuration via the guest shell. Which library should they use to interact with the CLI from within the guest shell?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cli. The `cli` library is a built-in Python module available within the Cisco Guest Shell that allows scripts to execute IOS XE CLI commands directly on the host device. This library provides functions like `cli.execute()` and `cli.configure()` to send commands and retrieve output, making it the correct choice for automating configuration via the Guest Shell without external dependencies.

Answer

requests

Answer

ncclient

Answer

paramiko

Question 2

A developer is writing a Python script using the Cisco Webex Teams API to send a message to a specific room. The script works for some rooms but fails for others with a 404 error. What is the most likely reason?

Accepted Answer

The bot is not a member of those rooms.. The 404 error indicates that the resource (the room) was not found by the API. In the Cisco Webex Teams API, a bot can only interact with rooms it has been added to as a member. If the bot is not a member of a room, the API cannot locate the room from the bot's perspective, resulting in a 404 error. This is the most common cause of intermittent 404 errors when the script works for some rooms but not others.

Answer

The API rate limit has been exceeded for those rooms.

Answer

The access token is invalid for those rooms.

Answer

The bot does not have permission to send messages in those rooms.

Question 3

An application exposes a REST API. To ensure that only authorized clients can access the API, the developer implements token-based authentication. Which HTTP header is typically used to transmit the bearer token?

Accepted Answer

Authorization: Bearer. The Authorization header with the Bearer scheme (RFC 6750) is the standard method for transmitting bearer tokens in HTTP requests. When a client authenticates and receives a token, it includes the token in the Authorization header as 'Bearer <token>', allowing the server to validate the token and authorize the request without requiring session state.

Answer

Cookie

Answer

X-API-Key

Answer

Authorization: Basic

Question 4

Which TWO of the following Git commands modify the commit history? (Select TWO)

Accepted Answer

git commit --amend. `git commit --amend` modifies the most recent commit by replacing it with a new commit that incorporates staged changes or an updated commit message, effectively rewriting the commit history. `git rebase -i` (interactive rebase) allows you to reorder, squash, edit, or drop commits, which also rewrites the commit history by creating new commit objects.

Answer

git diff

Answer

git log

Answer

git status

Question 5

Which THREE of the following are key characteristics of a RESTful API? (Choose three.)

Accepted Answer

Resource-based URLs. RESTful APIs use resource-based URLs (e.g., /users/123) to uniquely identify resources, which aligns with the uniform interface constraint of REST. This design makes the API intuitive and self-descriptive, allowing clients to interact with resources directly via the URL structure.

Answer

Uses SOAP protocol

Answer

Relies on session cookies for state

Question 6

A network engineer runs an Ansible playbook to backup a Cisco router configuration. The playbook fails with the error: 'ssh: connect to host 192.168.1.1 port 22: Connection timed out'. What is the most likely cause?

Accepted Answer

The router's IP address is unreachable from the control node.. The error 'Connection timed out' indicates that the control node sent a TCP SYN to 192.168.1.1 on port 22 but never received a SYN-ACK response. This occurs when the destination IP is unreachable due to routing issues, a firewall dropping packets, or the host being offline. Since Ansible uses SSH to connect to network devices, a timeout at the transport layer points directly to network reachability problems, not authentication or service configuration.

Answer

The playbook uses the incorrect gather_facts setting.

Answer

The SSH key is not authorized on the router.

Answer

The router does not have SSH enabled.

Question 7

A microservice application uses JWT for authentication. The JWT is signed with RS256. Which practice ensures that the public key used for verification is securely distributed to all services?

Accepted Answer

Store the public key in a Kubernetes ConfigMap and mount it into pods.. Kubernetes ConfigMaps allow you to decouple configuration artifacts like public keys from container images, enabling secure, centralized distribution. Mounting the ConfigMap into pods ensures that all microservice instances can access the same public key without embedding it in source code or relying on external PKI for every verification. This approach aligns with cloud-native best practices for managing secrets and configuration in a microservice architecture.

Answer

Include the public key in the JWT header.

Answer

Embed the public key in each service's source code.

Answer

Use a public key infrastructure (PKI) and distribute via HTTPS.

Question 8

Match each CI/CD concept to its definition.

Accepted Answer

Continuous Integration: The practice of automatically building and testing code changes frequently.. Continuous Integration (CI) focuses on merging and automated testing. Continuous Delivery (CD) ensures code is always ready for production deployment but requires manual approval. Continuous Deployment (CDep) automates deployment to production after tests pass. Common confusions involve swapping definitions of CI and CD or CDep.

Answer

Continuous Integration: The practice of automatically deploying code to production after tests pass.

Answer

Continuous Delivery: The practice of merging code changes frequently and automatically testing them.

Question 9

Which TWO of the following are essential steps in a typical Git workflow when collaborating on a feature branch? (Choose two.)

Accepted Answer

Merge the branch into master. Creating a branch isolates work, and merging integrates it back. While rebasing is common, the question asks for essential steps; merge is more fundamental than rebase.

Answer

Rebase onto master

Answer

Delete the remote repository

Answer

Stash changes before switching branches

Question 10

A team uses GitHub for version control and wants Jenkins to automatically run tests when changes are pushed to the main branch. Which trigger should be configured in the Jenkins job?

Accepted Answer

GitHub webhook. D is correct because a GitHub webhook sends an HTTP POST payload to Jenkins whenever a push event occurs on the main branch, triggering the Jenkins job in real time. This is the most efficient and immediate way to automate CI/CD pipelines in response to code changes, avoiding the need for polling or manual intervention.

Answer

Cron job on the Jenkins server

Answer

Poll SCM every minute

Answer

Manual build trigger

Question 11

A university IT department manages a Cisco Meraki network with 200 MR access points and 50 MS switches. They use the Meraki dashboard API to automate network provisioning. A new student dormitory was added, and the team needs to create a new network and claim devices. They have a Python script that uses the Meraki API to create the network and then claim devices by serial numbers. The script successfully creates the network but fails when claiming devices with a 400 error: 'Device serial number is not valid or already claimed'. The serial numbers are correct and unused. The API key has full organization access. The script uses the endpoint 'POST /networks/{networkId}/devices/claim' with the correct body. What is the most likely cause of the failure?

Accepted Answer

The devices have not been added to the organization's inventory first.. In the Meraki API workflow, devices must first be added to the organization's inventory via the 'POST /organizations/{organizationId}/inventory/devices' endpoint before they can be claimed into a specific network. The 400 error 'Device serial number is not valid or already claimed' occurs when the serial numbers are not present in the organization's inventory, even if they are correct and unused. The script successfully creates the network but fails at the claim step because the devices have not been inventoried at the organization level.

Answer

The API key does not have permission to claim devices.

Answer

The serial numbers contain a typo.

Answer

The devices are not Meraki MR or MS models.

Question 12

In a Python application that uses the ncclient library to manage Cisco devices via NETCONF, the developer encounters an error: 'ncclient.transport.errors.SessionCloseError: session closed on error'. Which of the following is the most likely cause?

Accepted Answer

The NETCONF session timed out due to inactivity. The 'SessionCloseError: session closed on error' in ncclient typically occurs when the NETCONF server (Cisco device) closes the session due to inactivity. NETCONF sessions have a default idle timeout (often 10 minutes on Cisco IOS-XE/IOS-XR). If the client does not send any RPCs or keepalive messages within that period, the server terminates the session, causing this error.

Answer

The device does not support base NETCONF 1.0

Answer

The device's SSH key has changed

Answer

The device does not support the candidate datastore

Question 13

A network automation script using NX-API on a Nexus switch fails intermittently with HTTP 500 errors. Which two troubleshooting steps are most effective in diagnosing the issue? (Choose two.)

Accepted Answer

Enable NX-API debugging on the switch to capture detailed logs.. Enabling NX-API debugging on the switch (using the 'debug nxapi' command) captures detailed logs of API requests and responses, including HTTP 500 error details. This allows you to pinpoint the root cause, such as malformed payloads, internal server errors, or resource exhaustion. Without debugging, the generic 500 error provides no insight into the specific failure.

Answer

Check the length of the JSON payload sent to the API.

Answer

Ensure the switch is running NX-OS version 9.3(1) or later.

Answer

Use HTTP instead of HTTPS for the API requests.

Question 14

A developer wants to automate the provisioning of a UCS server using Cisco Intersight. Which authentication method is recommended for programmatic access?

Accepted Answer

API Key with HMAC signing. Cisco Intersight recommends API key authentication with HMAC signing for programmatic access because it provides a secure, non-interactive method for automation scripts and tools. The API key consists of a key ID and a secret, and each request must include an HMAC signature generated from the request details, ensuring integrity and authenticity without exposing static credentials over the network.

Answer

Basic authentication with username and password

Answer

Session token from Intersight UI

Answer

OAuth2 with client credentials

Question 15

Which THREE are best practices for securing a CI/CD pipeline?

Accepted Answer

Use dynamic application security testing (DAST) tools. Dynamic application security testing (DAST) tools analyze a running application by simulating external attacks, which helps identify runtime vulnerabilities such as SQL injection or cross-site scripting. Integrating DAST into a CI/CD pipeline ensures that security checks are automated and performed before deployment, catching issues that static analysis might miss. This aligns with the DevSecOps principle of shifting security left without slowing down delivery.

Answer

Store credentials in the source code repository

Answer

Run all pipeline steps as the same user