200-901 Practice Test 35 — 15 Questions

Question 1

An engineer uses Ansible to push a configuration change to 100 switches. The playbook fails on 5 switches. What is the most efficient way to apply the change only to those 5?

Accepted Answer

Use Ansible's --limit with the retry file. Ansible generates a retry file by default when a playbook fails on some hosts. Using `--limit @<retry-file>` re-runs the playbook only against the failed hosts, avoiding unnecessary execution on the 95 successful switches. This is the most efficient method because it targets only the problematic devices without manual intervention or full re-runs.

Answer

Use --skip-tags on successful hosts

Answer

Re-run the playbook on all switches

Answer

Manually configure the 5 switches

Question 2

Which Cisco platform provides a cloud-managed dashboard with a REST API that uses an API key in the header and has a rate limit of 5 requests per second?

Accepted Answer

Cisco Meraki. Cisco Meraki is a cloud-managed networking platform whose Dashboard API is RESTful, uses an API key passed in the X-Cisco-Meraki-API-Key header, and enforces a rate limit of 5 requests per second per organization. This matches the question's description exactly.

Answer

Cisco Webex

Answer

Cisco DNA Center

Answer

Cisco IOS XE

Question 3

In a RESTCONF API call to retrieve a specific interface configuration on a Cisco device, an engineer sends a GET request to /restconf/data/interfaces/interface=GigabitEthernet0/1. What Content-Type should be specified in the Accept header to receive YANG-defined JSON?

Accepted Answer

application/yang-data+json. RESTCONF uses application/yang-data+json for JSON encoding of YANG data.

Answer

text/plain

Answer

application/xml

Answer

application/json

Question 4

A DevOps engineer is designing a REST API for a custom network automation tool. Which principle is essential for a RESTful design?

Accepted Answer

Use HTTP methods to perform CRUD operations on resources.. RESTful APIs are designed around resources, and HTTP methods (GET, POST, PUT, DELETE, PATCH) directly map to CRUD operations (Create, Read, Update, Delete). This stateless, resource-oriented approach is a core principle of REST as defined by Roy Fielding's dissertation, enabling uniform interfaces and predictable interactions.

Answer

Maintain session state on the server between requests.

Answer

Use a single URI for all operations with different method names.

Answer

Return XML responses by default for compatibility.

Question 5

An organization uses a private Docker registry with TLS. A developer attempts to pull an image and receives the error: "x509: certificate signed by unknown authority". What is the most likely cause and solution?

Accepted Answer

Add the CA certificate to the client's trust store. The error 'x509: certificate signed by unknown authority' occurs because the Docker client does not recognize the certificate authority (CA) that signed the registry's TLS certificate. The correct solution is to add the CA certificate to the client's trust store, typically by placing it in /etc/docker/certs.d/:/ca.crt on Linux or the equivalent Docker certs directory on other platforms. This allows the Docker daemon to validate the registry's certificate during the TLS handshake.

Answer

Use the registry's IP address instead of hostname

Answer

Disable TLS verification on the client

Answer

Use HTTP instead of HTTPS

Question 6

An engineer needs to automate the deployment of VLAN configurations on a fleet of Cisco Catalyst 9000 switches running IOS-XE. The team uses Ansible Tower for automation. Which Ansible module should be used to push VLAN configuration idempotently?

Accepted Answer

ios_vlan. The ios_vlan module is purpose-built for idempotent VLAN management on Cisco IOS-XE devices. It ensures that a VLAN with the specified VLAN ID, name, and state (active/suspend) is present or absent without affecting other VLANs, making it the correct choice for automating VLAN deployment idempotently.

Answer

ios_command

Answer

ios_config

Answer

ios_interface

Question 7

A team uses GitHub for version control and wants Jenkins to automatically run tests when changes are pushed to the main branch. Which trigger should be configured in the Jenkins job?

Accepted Answer

GitHub webhook. D is correct because a GitHub webhook sends an HTTP POST payload to Jenkins whenever a push event occurs on the main branch, triggering the Jenkins job in real time. This is the most efficient and immediate way to automate CI/CD pipelines in response to code changes, avoiding the need for polling or manual intervention.

Answer

Cron job on the Jenkins server

Answer

Poll SCM every minute

Answer

Manual build trigger

Question 8

An application needs to discover the MAC address of another device on the same local network. Which protocol does it use?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is used to map an IP address to a MAC address on a local network.

Answer

DNS

Answer

ICMP

Answer

DHCP

Question 9

A developer is designing a Python script that needs to make multiple REST API calls to different endpoints sequentially. The script must handle the following requirements: (1) Use a variable timeout for each request, (2) Include an authorization token in every request, (3) Parse JSON responses. Which TWO features of the requests library should be used? (Choose two.)

Accepted Answer

Use the `timeout` parameter to specify a maximum wait time.. Option B is correct because the requests library's timeout parameter accepts a float or tuple (connect, read) value that sets the maximum number of seconds to wait for a response, directly satisfying the requirement for a variable timeout on each request. Option E is correct because the headers parameter takes a dictionary such as {'Authorization': 'Bearer <token>'}, which is the standard way to attach an authorization token to every request. Option A is not correct because the data parameter is used for form-encoded or raw request bodies, not for parsing JSON responses, and JSON bodies are typically sent via the json parameter. Option C is not correct because verify=False disables TLS certificate verification, which is a security risk and unrelated to timeouts, tokens, or JSON parsing. Option D is not correct because the auth parameter expects an authentication handler or a (username, password) tuple for HTTP Basic/Digest auth, not a token, and tokens belong in headers.

Answer

Set the `data` parameter to JSON for request body.

Answer

Use `verify=False` to speed up requests.

Answer

Set the `auth` parameter with a tuple (username, token).

Question 10

An engineer needs to authenticate to the Cisco DNA Center API to obtain a token. What is the correct authentication method and endpoint?

Accepted Answer

POST /dna/system/api/v1/auth/token with Basic auth header. Cisco DNA Center uses Basic authentication (with username:password) to POST to /dna/system/api/v1/auth/token to obtain a token.

Answer

POST /dna/system/api/v1/token with Bearer auth

Answer

GET /dna/intent/api/v1/auth/token with Basic auth header

Answer

POST /dna/system/api/v1/auth/token with API key in header

Question 11

In the TCP three-way handshake, which sequence of flags is exchanged to establish a connection?

Accepted Answer

SYN, SYN-ACK, ACK. The TCP three-way handshake begins with the client sending a SYN packet to the server, the server responds with a SYN-ACK acknowledging the client's SYN and sending its own SYN, and the client completes with an ACK. This sequence establishes a reliable, bidirectional connection and synchronizes sequence numbers. The correct order is SYN, SYN-ACK, ACK.

Answer

SYN, ACK, SYN-ACK

Answer

ACK, SYN, SYN-ACK

Answer

SYN-ACK, SYN, ACK

Question 12

Which authentication flow is most appropriate for a native mobile app that needs to access the Webex API on behalf of a user?

Accepted Answer

Authorization code grant. The authorization code grant is the correct flow because it is designed for confidential and public clients (like native mobile apps) that need to act on behalf of a user. It redirects the user to an authorization server, returns a short-lived code, and exchanges it for tokens via a secure back channel, keeping credentials out of the app. This flow supports refresh tokens and is the OAuth 2.0 recommended approach for user-delegated access to APIs like Webex.

Answer

Client credentials grant

Answer

Resource owner password grant

Answer

Implicit grant

Question 13

Which TWO of the following are true about REST API design principles?

Accepted Answer

GET requests should not change state. Option B is correct because REST treats GET as a safe method, meaning it must be read-only and must not alter server state, so clients and intermediaries can cache or retry it without side effects. Option E is correct because PUT is defined by HTTP as idempotent and can target a client-known URI, so it may create the resource if it does not exist or fully replace it if it does, making it valid for both creation and update. Option A is wrong because PATCH performs a partial modification, whereas PUT is the method used for full replacement. Option C is wrong because POST is neither safe nor idempotent, so repeating it can create duplicate resources or trigger repeated side effects. Option D is wrong because DELETE responses are not required to include a body; a 204 No Content with an empty body is a standard and valid response.

Answer

PATCH is used for full replacement of a resource

Answer

POST requests should be idempotent

Answer

DELETE responses must always contain a body

Question 14

A network administrator is tasked with automating the deployment of a new VLAN configuration across a fabric of Cisco ACI switches. Which automation tool is best suited for interacting with the APIC REST API?

Accepted Answer

Ansible. Ansible is the best-suited tool because it provides a dedicated module (cisco.aci.aci_rest) that directly interacts with the APIC REST API, allowing declarative automation of VLAN and other ACI configurations. Unlike generic scripting, Ansible abstracts the HTTP requests and handles idempotency, authentication, and error handling natively for the ACI fabric.

Answer

Bash scripting with curl

Answer

Chef

Answer

Puppet

Question 15

In the context of microservices for network automation, which pattern ensures that each service has a separate database to avoid tight coupling?

Accepted Answer

Database per service. The Database per service pattern ensures each microservice owns its private database, preventing tight coupling by eliminating shared schema dependencies. This aligns with the bounded context principle in domain-driven design, where each service manages its own data model independently, enabling autonomous deployments and scaling.

Answer

Circuit breaker

Answer

API gateway

Answer

Shared database