200-901 Practice Test 35 — 15 Questions

Question 1

A developer needs to authenticate to the Cisco SD-WAN vManage API. Which two steps are required to obtain a session token?

Accepted Answer

POST j_username and j_password to the /j_security_check endpoint.. The Cisco SD-WAN vManage API uses a form-based authentication mechanism where credentials (j_username and j_password) are submitted via a POST request to the /j_security_check endpoint. This endpoint validates the credentials and, upon success, returns a JSESSIONID cookie that serves as the session token for subsequent API calls. Option B is correct because after obtaining the JSESSIONID, a GET request to /dataservice/client/token is required to retrieve an XSRF token, which must be included in the header of all subsequent requests to prevent cross-site request forgery attacks.

Answer

Provide an API key in the HTTP header.

Answer

POST credentials to the /authenticate endpoint.

Answer

Use OAuth2 client credentials grant.

Question 2

A team is implementing a CI/CD pipeline using Jenkins. The pipeline must build a Docker image and push it to a private registry. Which Jenkins plugin is specifically designed to handle Docker builds and pushes?

Accepted Answer

Docker Pipeline Plugin. The Docker Pipeline Plugin is the correct choice because it provides Jenkins Pipeline steps specifically for building and pushing Docker images, such as `docker.build()` and `docker.withRegistry()`. This plugin integrates Docker operations directly into Declarative or Scripted Pipelines, enabling seamless CI/CD workflows without requiring shell commands.

Answer

Credentials Plugin

Answer

Pipeline Plugin

Answer

Git Plugin

Question 3

A junior network developer is tasked with writing a Python script that uses the Cisco NX-API to retrieve the current VLAN configuration from a Nexus switch. The script should output the VLAN IDs in a JSON format. The developer wrote the following code:

import requests
import json
url = "https://192.168.1.1/api/aaaLogin.json"
payload = {"aaaUser":{"attributes":{"name":"admin","pwd":"cisco123"}}}
r = requests.post(url, json=payload, verify=False)
token = r.json()["imdata"][0]["aaaLogin"]["attributes"]["token"]

After authentication, the developer attempts to get VLANs using a GET request to "https://192.168.1.1/api/mo/sys/vlan.json" but receives a 401 error. Which of the following should the developer do to fix the issue?

Accepted Answer

Include the token in the cookie header. C is correct because Cisco NX-API uses cookie-based authentication, not bearer tokens. After a successful login via POST to /api/aaaLogin.json, the token must be included in the Cookie header (e.g., 'Cookie: APIC-cookie=' + token) for subsequent requests. Without this cookie, the GET request to retrieve VLANs is unauthorized, resulting in a 401 error.

Answer

Set the 'Authorization' header to 'Bearer ' + token

Answer

Use a PUT request instead of GET

Answer

Use POST to retrieve VLANs

Question 4

Match each Cisco DevNet Associate exam topic to its description.

Accepted Answer

Software Development and Design: Focuses on design principles, version control, and testing.. The correct matches pair each exam topic with its appropriate description. The Software Development and Design domain emphasizes design, version control, and testing. Understanding and Using APIs focuses on REST, HTTP methods, and authentication. Cisco Platforms and Development involves working with specific Cisco platforms. Common confusions arise from swapping the descriptions of Software Development and Design with Cisco Platforms and Development.

Answer

Software Development and Design: Involves using Cisco platforms like Meraki, Webex, and ACI.

Answer

Understanding and Using APIs: Focuses on design principles, version control, and testing.

Question 5

An application uses OAuth 2.0 for authorization. The developer receives an access token but needs to know the user's identity. Which OAuth flow should be used to also obtain an ID token that contains user claims?

Accepted Answer

Authorization Code Grant with OpenID Connect. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds an ID token (a JWT) containing user claims such as name, email, and sub. The Authorization Code Grant with OIDC is the correct flow because it allows the client to request both an access token and an ID token, enabling the application to verify the user's identity while obtaining authorization.

Answer

Authorization Code Grant without PKCE

Answer

Resource Owner Password Grant

Answer

Client Credentials Grant

Question 6

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then configure the static route using the ip route command with the destination network, subnet mask, and next-hop address, then verify with the show ip route command. Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

Configure the static route using the ip route command first, then enter global configuration mode, then verify with show ip route

Answer

Enter global configuration mode, then verify with show ip route, then configure the static route using the ip route command

Answer

Verify with show ip route, then enter global configuration mode, then configure the static route using the ip route command

Question 7

A developer is using a REST API and receives HTTP status codes. Which two codes indicate a client-side error that the developer should fix? (Choose two.)

Accepted Answer

401 Unauthorized. A 401 Unauthorized status code indicates that the request lacks valid authentication credentials for the target resource. This is a client-side error because the developer must provide correct credentials (e.g., API key, OAuth token) or fix the authentication header in the request. A 400 Bad Request status code means the server cannot process the request due to malformed syntax, invalid request message framing, or deceptive request routing — all issues the developer must correct on the client side.

Answer

500 Internal Server Error

Answer

200 OK

Answer

404 Not Found

Question 8

A team uses Ansible Tower for network automation. They need to restrict a user to only view job results without making any changes. Which Tower role should be assigned?

Accepted Answer

Read. The Read role in Ansible Tower grants read-only access to all resources, including job results, without allowing any modifications. This is the correct choice because the requirement is to restrict the user to viewing job results only, and Read provides exactly that level of access without any write or execute permissions.

Answer

Execute

Answer

Auditor

Answer

Admin

Question 9

Which TWO of the following are valid security considerations when deploying an application to a Kubernetes cluster managed by Cisco Intersight? (Choose two.)

Accepted Answer

Define Network Policies to isolate pods and control traffic flow.. Network Policies in Kubernetes act as a firewall at the pod level, using label selectors and namespace selectors to control ingress and egress traffic. In a Cisco Intersight-managed cluster, defining these policies is a critical security consideration to enforce micro-segmentation and prevent lateral movement of threats. Option E is correct because Pod Security Policies (PSPs) are a cluster-level resource that control security-sensitive aspects of pod specification, such as preventing privileged containers, which is a key security best practice in Kubernetes.

Answer

Store secrets in ConfigMaps for easy retrieval.

Answer

Disable RBAC to simplify management and reduce overhead.

Answer

Use default service accounts for all pods to avoid misconfiguration.

Question 10

An engineer uses the Cisco Webex Teams API to send a message to a room. The API returns HTTP 403 Forbidden. What is the most likely cause?

Accepted Answer

The token does not have permission to post to that room.. HTTP 403 Forbidden indicates the server understood the request but refuses to authorize it. In the context of the Cisco Webex Teams API, this status code most commonly means the access token provided does not have the required scopes or permissions to post messages to the specified room. The token may be valid and not expired, but it lacks the authorization (e.g., the `spark:rooms_write` scope) needed for the action.

Answer

The message payload is too large.

Answer

The bot token has expired.

Answer

The room ID is incorrect.

Question 11

A company has a web application running on Cisco DNA Center. The application uses OAuth 2.0 for authentication with an external identity provider (IdP). Recently, users have reported that they are being logged out unexpectedly after a few minutes of inactivity, even though the IdP token has a 1-hour expiration. The application developer wants to maintain usability while keeping security controls. What is the most likely cause and solution?

Accepted Answer

The application session timeout is shorter than the token lifetime; align the application session timeout to the token expiration or implement silent token refresh. The most likely cause is that the application's session timeout is set to a shorter duration than the OAuth 2.0 token's 1-hour expiration. When the application session expires, the user is logged out even though the IdP token is still valid. The solution is to align the application session timeout with the token expiration or implement silent token refresh using a refresh token, which allows the application to obtain a new access token without user interaction, maintaining usability while preserving security.

Answer

The application is not properly validating the token expiry and needs to refresh tokens proactively

Answer

The IdP is configured to log out users automatically after 5 minutes; reconfigure IdP session settings

Answer

The OAuth 2.0 access token is set to expire in 5 minutes; increase it to 1 hour

Question 12

When designing a REST API for managing network devices, which two principles should be followed to ensure statelessness?

Accepted Answer

All state information is stored on the client.. Statelessness in REST requires that all session state be stored on the client, not the server. Each request must be self-contained, meaning the server does not retain any client context between requests. This aligns with the REST architectural constraint defined by Roy Fielding, where the server treats each request independently.

Answer

The server maintains session data and identifies clients via cookies.

Answer

API endpoints include version numbers to support backward compatibility.

Answer

Responses are idempotent for all POST requests.

Question 13

Based on the exhibit, what is the most likely reason for the connection timeout?

Accepted Answer

The network is not able to reach the sandbox server due to firewall or DNS issues. The connection timeout indicates that the client cannot establish a TCP connection to the server at all. This is most likely caused by a network-level issue such as a firewall blocking the port or DNS resolution failure, which prevents the HTTP request from reaching the sandbox server. Options A, B, and C would produce different HTTP error responses (e.g., 404, 401, or SSL certificate errors), not a timeout.

Answer

The URL is incorrect; the correct endpoint is /api/system/v1/auth/token

Answer

The username and password are invalid, causing the server to drop the connection

Answer

The verify=False parameter causes SSL handshake failure and timeout

Question 14

A DevOps team is building a CI/CD pipeline that configures Cisco NX-OS switches. They want to use model-driven telemetry to stream operational data. Which protocol should they use for on-change telemetry?

Accepted Answer

gRPC. gRPC (Google Remote Procedure Call) is the correct protocol for on-change telemetry on Cisco NX-OS because it supports a publish-subscribe model where the switch pushes data only when a monitored value changes, reducing bandwidth and CPU overhead. This is defined in the Cisco MDT (Model-Driven Telemetry) framework, which uses gRPC with Protobuf encoding for efficient streaming of YANG-modeled operational data.

Answer

SSH

Answer

HTTP

Answer

SNMP

Question 15

Which TWO of the following are true about REST API design principles?

Accepted Answer

GET requests should not change state. B is correct because REST APIs are designed to be stateless, and GET requests are defined as safe methods in RFC 7231. A safe method does not alter server state; it only retrieves data. Therefore, a GET request should never trigger side effects like creating or modifying resources.

Answer

PATCH is used for full replacement of a resource

Answer

POST requests should be idempotent

Answer

DELETE responses must always contain a body