200-901 Practice Test 36 — 15 Questions

Question 1

When using RESTCONF to configure a network device, which URL path prefix and content-type header should be used?

Accepted Answer

/restconf/data/ and Content-Type: application/yang-data+json. RESTCONF uses the '/restconf/data/' path prefix to access configuration and state data modeled in YANG, and the standard media type for JSON-encoded YANG data is 'application/yang-data+json'. The '+json' suffix is required by RFC 8040 to distinguish YANG data from generic JSON. Using '/restconf/operations/' is for invoking RPCs, not for data configuration.

Answer

/restconf/operations/ and Content-Type: application/xml

Answer

/restconf/data/ and Content-Type: application/json

Answer

/restconf/ and Content-Type: text/plain

Question 2

What is the default transport protocol for NETCONF sessions?

Accepted Answer

SSH. NETCONF (Network Configuration Protocol) uses SSH as its default transport protocol, as specified in RFC 6242. SSH provides the required secure, authenticated, and encrypted channel for NETCONF sessions, ensuring confidentiality and integrity of configuration data exchanged between the client and server.

Answer

HTTP

Answer

TLS

Answer

SNMP

Question 3

An engineer is designing a CI/CD pipeline for a Python application. The pipeline should automatically run unit tests, build a Docker image, push it to a private registry, and deploy to a Kubernetes cluster. Which sequence of stages is correct?

Accepted Answer

Test -> Build -> Push -> Deploy. A CI/CD pipeline for a Python application must first run unit tests to validate code quality, then build the Docker image from the tested code, push the image to a private registry, and finally deploy to Kubernetes. This sequence ensures that only tested and built artifacts are deployed, preventing deployment of broken or untested code.

Answer

Build -> Test -> Push -> Deploy

Answer

Test -> Push -> Deploy

Answer

Test -> Deploy -> Build -> Push

Question 4

A developer is writing a web application and needs to prevent SQL injection attacks. Which coding practice is most effective?

Accepted Answer

Use parameterized queries with prepared statements. Parameterized queries with prepared statements separate SQL code from user-supplied data, so the database treats input as data rather than executable SQL. This prevents attackers from injecting SQL syntax regardless of the input's content. It is the most robust and recommended defense against SQL injection.

Answer

Validate input with regex to allow only alphanumeric characters

Answer

Use stored procedures exclusively

Answer

Escape all user input with htmlspecialchars

Question 5

Which TWO of the following are features of the DNA Center 'Platform' API category?

Accepted Answer

Task management. The Platform category includes event notifications and task management.

Answer

Template deployment

Answer

Path trace

Answer

Device inventory

Question 6

Which TWO statements are true about VXLAN? (Choose two.)

Accepted Answer

VXLAN encapsulates Ethernet frames in UDP packets. Option B is correct because VXLAN (RFC 7348) performs MAC-in-UDP encapsulation, taking an inner Layer 2 Ethernet frame and wrapping it in an outer UDP header (destination port 4789) carried over the IP underlay, which is what allows the Layer 2 overlay to traverse a routed Layer 3 network. Option E is correct because VXLAN uses a 24-bit VXLAN Network Identifier (VNI), yielding 2^24 = 16,777,216 distinct logical segments, far exceeding the 12-bit VLAN limit of 4094. Option A is wrong because VXLAN's underlay only needs IP reachability and multicast or unicast (e.g., via EVPN) for BUM traffic; MPLS is not required. Option C is wrong because IP-in-IP is a different tunneling mechanism (protocol 4) that does not carry an inner Ethernet frame or a VNI. Option D is wrong because VXLAN is a Layer 2-over-Layer 3 overlay: it encapsulates Layer 2 frames but relies on Layer 3 IP routing in the underlay, so it does not operate at Layer 2 only.

Answer

VXLAN requires MPLS in the underlay

Answer

VXLAN uses IP-in-IP encapsulation

Answer

VXLAN operates at Layer 2 only

Question 7

Which Cisco DNA Center API is used to retrieve a list of network devices?

Accepted Answer

GET /dna/intent/api/v1/network-device. The Cisco DNA Center Intent API endpoint GET /dna/intent/api/v1/network-device is specifically designed to return a list of all network devices managed by DNA Center. It provides details such as device ID, hostname, management IP, platform, software version, and reachability status. This is the canonical endpoint for device inventory retrieval, making it the correct choice.

Answer

GET /dna/intent/api/v1/topology

Answer

GET /dna/intent/api/v1/issue

Answer

GET /dna/intent/api/v1/site

Question 8

A network administrator is configuring a new subnet for a branch office that requires at least 50 usable host addresses. Which subnet mask would meet this requirement while minimizing address waste?

Accepted Answer

255.255.255.192 (/26). A /26 subnet provides 62 usable hosts (2^6 - 2 = 62), which is the smallest subnet meeting the requirement of 50 hosts.

Answer

255.255.255.0 (/24)

Answer

255.255.255.128 (/25)

Answer

255.255.255.224 (/27)

Question 9

Which IP address is a valid host address in the 192.168.1.0/24 network?

Accepted Answer

192.168.1.128. In 192.168.1.0/24, usable host addresses range from 192.168.1.1 through 192.168.1.254. The address 192.168.1.128 falls within this range and is not the network or broadcast address, so it is a valid host address. It is a normal unicast address that can be assigned to a device.

Answer

192.168.2.1

Answer

192.168.1.255

Answer

192.168.1.0

Question 10

A REST API returns a 500 Internal Server Error when a client sends a malformed JSON payload. What is the most appropriate HTTP response code to indicate a client-side error?

Accepted Answer

400 Bad Request. A 400 Bad Request is the correct response because the client sent a malformed JSON payload, which is a client-side error. HTTP 400 indicates that the server cannot process the request due to something perceived as a client error (e.g., malformed syntax). This aligns with RFC 7231, which defines 400 as appropriate for requests with invalid syntax or structure.

Answer

401 Unauthorized

Answer

403 Forbidden

Answer

422 Unprocessable Entity

Question 11

An engineer is troubleshooting packet loss between two hosts on different subnets. The traceroute shows that packets reach the first hop router but then stop. The router's ARP table shows an incomplete entry for the next-hop IP address. What is the most likely cause?

Accepted Answer

The next-hop device is powered off or has a Layer 1 issue.. An incomplete ARP entry for the next-hop IP address indicates that the router sent an ARP request but received no reply. This typically means the next-hop device is unreachable at Layer 2, often because it is powered off, has a failed interface, or there is a cabling issue. Since traceroute shows packets reaching the first hop but not beyond, the Layer 2 failure at the next hop is the most direct cause.

Answer

The MTU is misconfigured on the outgoing interface.

Answer

The routing protocol has not converged yet.

Answer

An ACL is blocking traffic on the outgoing interface.

Question 12

Which TWO are common authentication methods used when interacting with Cisco APIs?

Accepted Answer

HTTP Basic Authentication. HTTP Basic Authentication (B) is a common method for Cisco APIs, where the client sends a Base64-encoded username and password in the Authorization header, often used with Cisco DNA Center, Meraki, and other REST APIs. API key in HTTP header (C) is also widely used, for example Cisco Meraki uses an X-Cisco-Meraki-API-Key header, and Cisco Intersight uses API keys for authentication. Client certificate exchange (A) is not typically classified as a common authentication method for Cisco APIs, though it can be used for mutual TLS in some contexts. LDAP bind credentials (D) are used for directory authentication, not directly for Cisco API authentication. SNMPv3 authentication (E) is for network management via SNMP, not for Cisco API interactions.

Answer

Client certificate exchange

Answer

LDAP bind credentials

Answer

SNMPv3 authentication

Question 13

A DevOps engineer is automating network configuration using REST APIs. The engineer needs to choose between NETCONF and OpenFlow as southbound protocols. Which TWO statements are correct?

Accepted Answer

OpenFlow allows the controller to install flow entries in switches. Option A is correct because OpenFlow is a southbound protocol in SDN in which the controller pushes flow entries (match/action rules) into the flow tables of OpenFlow-enabled switches to dictate forwarding behavior. Option E is correct because NETCONF is a configuration protocol that models device data with YANG and encodes messages in XML over SSH (port 830), making it well suited for automated configuration management. Option B is wrong because NETCONF handles configuration and state retrieval, not real-time per-packet forwarding control, which is OpenFlow's role. Option C is wrong because both NETCONF and OpenFlow are southbound protocols, not northbound APIs. Option D is wrong because OpenFlow is primarily a forwarding-plane control protocol, whereas configuration management is NETCONF's domain.

Answer

NETCONF provides real-time packet forwarding control

Answer

Both protocols are used exclusively for northbound APIs

Answer

OpenFlow is primarily used for configuration management

Question 14

A Python script using the Cisco Meraki API must update the SSID settings for a network. Which HTTP method should be used to modify an existing SSID?

Accepted Answer

PUT. To modify an existing SSID in the Cisco Meraki API, the HTTP PUT method is used because it performs an idempotent update of the resource at the specified URI. The Meraki API follows RESTful conventions where PUT replaces the entire representation of the SSID object, making it the correct choice for updating an existing SSID's settings (e.g., name, encryption, or splash page).

Answer

POST

Answer

DELETE

Answer

GET

Question 15

A developer wants to get the current user's information from the Webex API. Which endpoint should they use?

Accepted Answer

GET /v1/people/me. The Webex API endpoint GET /v1/people/me returns the profile information of the authenticated user, which is exactly what the developer needs. It uses the OAuth token of the current user to identify 'me'. Other endpoints serve different resources like messages, webhooks, or rooms.

Answer

POST /v1/messages

Answer

GET /v1/webhooks

Answer

GET /v1/rooms