200-901 Practice Test 36 — 15 Questions

Question 1

A network automation engineer is using a Python script with the requests library to configure VLAN 100 on a Cisco Catalyst 9300 switch via the REST API. The script sends a PUT request to https://switch-ip/restconf/data/Cisco-IOS-XE-native:native/vlan. The response returns a 201 Created, but subsequent checks show VLAN 100 is not present in the running configuration. The switch's management interface is in VLAN 99 with IP 10.10.99.10/24, and the engineer's workstation is on a different subnet (10.10.88.0/24). The switch has the following relevant configuration: ip default-gateway 10.10.99.1, and a route for 10.10.88.0/24 via 10.10.99.1. The engineer also verified that the REST API credentials are correct and that the switch's HTTP server is enabled. Which action should the engineer take to resolve the issue?

Accepted Answer

Send a commit operation to the RESTCONF API using the 'cisco-ia:commit' RPC to apply the candidate datastore changes.. The 201 Created response indicates the REST API request was accepted, but the VLAN is not appearing in the running config. This suggests the configuration was written to the candidate datastore but not committed. Cisco's RESTCONF requires a commit operation after editing the candidate datastore. To commit changes, a PATCH or POST request to the 'ietf-restconf:operations' with 'cisco-ia:commit' is needed. Alternatively, the switch might be using 'immediate' mode, but the default is 'candidate'. Checking the 'default-operation' setting would help, but the most direct correct action is to commit the changes. Distractors: checking MTU, resending the request with different data, or restarting the switch.

Answer

Resend the PUT request with the VLAN configuration nested under 'Cisco-IOS-XE-native:native/vlan' in YANG format.

Answer

Reboot the switch to force the candidate configuration to become active.

Answer

Check the MTU on the switch's management interface to ensure it can accept the configuration payload.

Question 2

You manage a network that uses a mix of Cisco IOS and IOS-XE devices. The company wants to implement network automation using RESTCONF and YANG. You have configured RESTCONF on a branch router running IOS-XE 16.12. You can successfully retrieve the interface configuration using a GET request from a Python script. However, when you try to modify the description of an interface using a PATCH request, you receive a 405 Method Not Allowed error. The script uses basic authentication over HTTPS. The URL is correct, and the YANG data payload is valid. What is the most likely reason for the failure?

Accepted Answer

The RESTCONF service on the router is not enabled for write operations.. RESTCONF on IOS-XE may require specific HTTP methods to be enabled. By default, only GET is allowed; PATCH and PUT require explicit configuration or the 'restconf' capability advertisement. Option A is correct because the router may not have the 'restconf' capability with write support. Option B is wrong because basic authentication is supported. Option C is wrong because the URL is for the interface, not the whole configuration. Option D is wrong because YANG is valid.

Answer

The YANG payload must be in XML format instead of JSON.

Answer

Basic authentication is not supported for PATCH requests.

Answer

The PATCH request must target the entire configuration data store, not a specific interface.

Question 3

A developer is working on a Python application that automates the configuration of multiple Cisco IOS-XE devices using RESTCONF. The application uses the requests library. The developer notices that sometimes the PUT request to update the interface description returns a 409 Conflict error. Upon investigation, the developer finds that the issue occurs when two instances of the application are running concurrently and attempt to update the same interface. The developer wants to implement a strategy to avoid conflicts. Which approach is most effective?

Accepted Answer

Use a distributed lock mechanism to ensure exclusive access. A 409 Conflict indicates that the resource was modified by another request. A distributed lock ensures exclusive access, preventing concurrent updates. Option A (retry with backoff) might eventually succeed but does not prevent conflicts and could increase server load. Option C (PATCH) does not solve the underlying concurrency issue. Option D (timestamp force overwrite) is not standard with RESTCONF and could lead to data loss.

Answer

Implement a retry mechanism with exponential backoff and random jitter

Answer

Change the PUT to PATCH and hope for partial updates

Answer

Use a timestamp in the request to force overwrite

Question 4

A junior network developer is tasked with writing a Python script that uses the Cisco NX-API to retrieve the current VLAN configuration from a Nexus switch. The script should output the VLAN IDs in a JSON format. The developer wrote the following code:

import requests
import json
url = "https://192.168.1.1/api/aaaLogin.json"
payload = {"aaaUser":{"attributes":{"name":"admin","pwd":"cisco123"}}}
r = requests.post(url, json=payload, verify=False)
token = r.json()["imdata"][0]["aaaLogin"]["attributes"]["token"]

After authentication, the developer attempts to get VLANs using a GET request to "https://192.168.1.1/api/mo/sys/vlan.json" but receives a 401 error. Which of the following should the developer do to fix the issue?

Accepted Answer

Include the token in the cookie header. Cisco NX-API requires the token obtained from the login to be sent as a cookie in subsequent requests. Option B correctly identifies this. Option A (using PUT) is not relevant to authentication. Option C (set Authorization header) is used for RESTCONF, not NX-API. Option D (use POST) is incorrect for retrieving data.

Answer

Set the 'Authorization' header to 'Bearer ' + token

Answer

Use a PUT request instead of GET

Answer

Use POST to retrieve VLANs

Question 5

A network administrator is deploying a custom container application on a Cisco Catalyst 9300 switch running IOS XE 16.12. The application is packaged as a .tar file and installed using 'app-hosting install app myapp flash:myapp.tar'. The administrator configures the app-hosting context as follows:

app-hosting app myapp
 app-default-gateway 192.168.1.1
 app-vnic gateway0 guest-interface 0
  guest-ipaddress 192.168.1.10 netmask 255.255.255.0
 app-resource profile custom
  cpu 1000
  memory 2048
  storage 5000

The administrator also creates a virtual port group 'vg0' and assigns it to the management interface. The application fails to start with the error: 'Application failed to start: guest interface not ready'. The administrator verifies that the .tar file is valid, the resources are sufficient, and the gateway is reachable. What is the most likely cause of the failure?

Accepted Answer

The guest-interface is not bound to the virtual port group.. The error 'guest interface not ready' indicates that the guest-interface (interface 0) is not properly bound to the virtual port group. After creating the virtual port group, the administrator must associate it with the app-vnic using the 'bind' command. Without this binding, the guest interface cannot obtain or use the IP configuration.

Answer

The application requires a DHCP server, but the configuration uses a static IP address.

Answer

The .tar file is corrupt despite appearing valid.

Answer

The CPU allocation of 1000 units is insufficient for the application.

Question 6

A network engineer is automating the deployment of new branch offices using Cisco DNA Center REST API. The script creates a new site under a parent site using the POST /dna/intent/api/v1/site API endpoint. The script runs successfully but when checking the DNA Center UI, the new site appears under the incorrect parent site. The script uses the following JSON payload:

{
  "parentId": "0a1b2c3d-4e5f-6789-0ab1-2c3d4e5f6789",
  "name": "Branch-Office-42",
  "type": "area",
  "latitude": 34.0522,
  "longitude": -118.2437
}

The parentId is obtained from a GET request to /dna/intent/api/v1/site that returns a list of all sites. The engineer verified that the parentId matches the UUID of a site named 'HQ', which the engineer believes is an area. However, 'HQ' is actually a building site. The engineer is not aware that the site type is different because the GET response does not display the type field prominently. What is the most likely cause of the new site being placed under the wrong parent?

Accepted Answer

The type field is set to 'area' but the parent site is of type 'building'. Option B is correct because the parent site 'HQ' is of type 'building', but the request is trying to create an 'area' under it. In Cisco DNA Center, the site hierarchy requires that an area cannot be directly under a building; areas can only be under Global or another area. The API may silently place the new area under the root or another compatible parent, resulting in the wrong parent. Option A is incorrect because the endpoint is correct. Option C is incorrect because there is no 'siteId' header requirement for site creation. Option D is incorrect because the 'address' field is not required for creating an area.

Answer

The script is using the wrong API endpoint for creating sites

Answer

The API is ignoring the parentId because the request is missing the 'siteId' header

Answer

The script is not including the 'address' field which is required for site creation

Question 7

A large enterprise uses Cisco DNA Center to manage its campus network. The network team has automated wireless SSID provisioning using the Intent API. Recently, a new SSID was created but it does not appear on the wireless LAN controllers. The Python script that calls the API returns a 200 OK response, but the SSID is not deployed. The script uses the POST /dna/intent/api/v1/ssid endpoint with a JSON body containing the SSID name and security settings. A day later, the SSID is still missing. The engineer checks the DNA Center GUI and sees the SSID in the 'Design' section but with a 'Provisioning Failed' status. Which step should the engineer take next to resolve the issue?

Accepted Answer

Use the 'Provision' API endpoint to deploy the SSID to the targeted sites. The 200 OK response from the POST /dna/intent/api/v1/ssid endpoint only confirms that the API request was accepted and the SSID configuration was created in the DNA Center design database. It does not automatically trigger deployment to the wireless LAN controllers. The 'Provisioning Failed' status in the GUI indicates that the SSID was designed but not successfully deployed to the targeted sites. To complete the deployment, the engineer must use the Intent API's 'Provision' endpoint (e.g., POST /dna/intent/api/v1/provision) to push the SSID configuration to the specific sites or devices, which is the missing step.

Answer

Re-run the same API call and ignore the 200 response

Answer

Delete the SSID and recreate it with a different name

Answer

Wait for the next scheduled provisioning cycle

Question 8

A network automation engineer is tasked with creating a Python script to automatically back up the running configuration of all IOS XE devices in a data center using the Cisco IOS XE REST API. The engineer has credentials for each device and knows the IP addresses. The script uses the requests library and sends a GET request to https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native?content=config. The script runs successfully for some devices but fails with a 401 Unauthorized error for others. The engineer confirms the credentials are correct and the devices are reachable. The working devices are running IOS XE 16.9, while the failing ones are running IOS XE 16.6. The engineer checks the API documentation and finds that RESTCONF is enabled on all devices. However, the engineer notices that the failing devices require a different authentication method. What should the engineer do to fix the authentication for the IOS XE 16.6 devices?

Accepted Answer

Modify the script to use HTTP Basic Authentication and disable CSRF check on the device.. Option D is correct because IOS XE 16.6 requires HTTP Basic Authentication with the 'Authorization' header, and the RESTCONF API on these older versions also requires disabling the CSRF (Cross-Site Request Forgery) check. The engineer must modify the script to include the 'requests.auth.HTTPBasicAuth' and set the 'X-CSRF-Token' header to 'false' or disable CSRF on the device. This resolves the 401 error while still using RESTCONF.

Answer

Switch from HTTPS to HTTP for the failing devices.

Answer

Use the NETCONF protocol instead of RESTCONF for all devices.

Answer

Change the URL to use the Cisco IOS XE CLI-based API instead of RESTCONF.

Question 9

A company uses Ansible to automate configuration of its Cisco IOS XE routers. The network team recently upgraded the routers' software from IOS 15.x to IOS XE 17.x. Since the upgrade, the Ansible playbook fails intermittently with the message: 'Failed to connect to the host via ssh: timed out'. However, the team can SSH manually to the routers from the Ansible control node without issues. The playbook uses the 'cisco.ios.ios_config' module with default SSH options. The routers have been configured with SSH version 2 and local authentication. The Ansible control node runs Red Hat Enterprise Linux 8. Which action should the network engineer take to resolve the issue?

Accepted Answer

Configure the routers to use SSH version 1 only.. Option B is correct because the intermittent SSH timeout after upgrading to IOS XE 17.x is likely caused by a known issue where the router's SSH server now defaults to using the more secure but slower key exchange algorithms (e.g., diffie-hellman-group-exchange-sha256) that require more CPU time. Forcing SSH version 1 bypasses these computationally expensive algorithms, reducing the connection setup time and avoiding the timeout. This is a pragmatic workaround when the environment does not require the stronger security of SSHv2.

Answer

Increase the SSH timeout in the Ansible configuration file (ansible.cfg) to 60 seconds.

Answer

Set the 'host_key_checking' option to False in ansible.cfg.

Answer

Use the 'ios_command' module instead of 'ios_config' to perform the tasks.

Question 10

A company has two Cisco Catalyst switches, SW1 and SW2, connected via a trunk link using port GigabitEthernet0/1 on both switches. SW1 is the root bridge for all VLANs spanning tree. VLAN 10 users on SW1 report they can access the internet and resources in VLAN 10 on SW2, but cannot reach a critical server in VLAN 20 connected to SW2. The server in VLAN 20 has a static IP address and can communicate with other VLAN 20 devices on SW2. SW2's configuration for the trunk port includes 'switchport trunk allowed vlan 10,20'. SW1's trunk port configuration is 'switchport trunk allowed vlan 10'. The network administrator has verified that both switches have VLANs 10 and 20 created and that the default gateways are correct. What is the most likely cause of the issue?

Accepted Answer

SW1's trunk port is not configured to allow VLAN 20.. SW1's trunk port is configured with 'switchport trunk allowed vlan 10', which explicitly permits only VLAN 10 traffic. Since VLAN 20 is not in the allowed list, frames from VLAN 20 (including traffic to the server) are dropped at the trunk egress on SW1. This prevents SW1 hosts in VLAN 10 from reaching the VLAN 20 server on SW2, even though the trunk is up and both VLANs exist on both switches.

Answer

SW1 is the root bridge for VLAN 20, causing traffic to be blocked.

Answer

The trunk link between SW1 and SW2 is down.

Answer

The server in VLAN 20 has an incorrect IP address configuration.

Question 11

You are a junior network developer tasked with automating device inventory retrieval using the Cisco Meraki Dashboard API. You have already generated an API key with the appropriate scopes and have tested it successfully with simple GET requests. However, when you attempt to retrieve the list of all devices in your organization via the 'GET /organizations/{organizationId}/devices' endpoint, you receive a 403 Forbidden error. You verify that the API key is correctly included in the request header as 'X-Cisco-Meraki-API-Key'. You also confirm that the organization ID is correct. You are able to reach the Meraki Dashboard API server from your environment, as other endpoints (e.g., 'GET /organizations') work fine. What is the most likely cause of the 403 error, and what should you do to resolve it?

Accepted Answer

The API key lacks the required permissions; regenerate the API key with full read access for devices.. A 403 Forbidden error specifically indicates that the server understood the request but refuses to authorize it. Since other endpoints like 'GET /organizations' work, network connectivity and API key validity are confirmed. The most likely cause is that the API key lacks the required scope or permission to access the 'GET /organizations/{organizationId}/devices' endpoint. Regenerating the API key with full read access (including device inventory) resolves this, as Meraki API keys are scoped at creation time and cannot be modified after generation.

Answer

The network firewall is blocking the request; check firewall logs and allow outbound traffic to the Meraki API.

Answer

The request should use POST instead of GET; change the HTTP method to POST to retrieve device data.

Answer

The API endpoint URL is incorrect; verify the exact path and version in the API documentation.

Question 12

A team is deploying a new microservice on Cisco Container Platform. The microservice needs to access a database hosted on a separate VM. The security policy requires that only the microservice can communicate with the database, and all traffic must be encrypted. The team is using Kubernetes network policies and mutual TLS. During testing, the microservice cannot reach the database. The database team reports that the database is reachable from other services. What is the most likely cause?

Accepted Answer

A Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP. The most likely cause is that a Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP. Since the database is reachable from other services, the issue is specific to the microservice pod's network access. A NetworkPolicy that does not explicitly allow egress traffic to the database IP will default to denying that traffic, preventing the microservice from reaching the database even though the database itself is operational.

Answer

The database server is not listening on the expected port

Answer

The mutual TLS certificates are expired or not trusted

Answer

The Istio sidecar proxy is misconfigured and rejecting traffic due to a missing ServiceEntry

Question 13

A developer is deploying a Python web application on Cisco UCS servers using a CI/CD pipeline that runs on Jenkins. The application uses a PostgreSQL database. The security team mandates that all database credentials must be rotated every 30 days. Currently, credentials are stored as plaintext in a configuration file in the application repository. Which approach should the developer take to meet the rotation requirement without storing secrets in the repository?

Accepted Answer

Integrate with HashiCorp Vault to dynamically generate credentials for each deployment. Integrating with HashiCorp Vault allows the CI/CD pipeline to dynamically generate short-lived database credentials for each deployment, eliminating the need to store secrets in the repository. Vault can be configured to automatically rotate credentials every 30 days (or less) and inject them into the application at runtime via sidecar containers or API calls, meeting the security mandate without manual intervention.

Answer

Set the credentials as environment variables in the Jenkins pipeline and generate a new set every month manually

Answer

Store the credentials in Jenkins credentials store and reference them in the pipeline

Answer

Store the credentials in a Kubernetes ConfigMap and update it every 30 days

Question 14

An organization uses Ansible for configuration management and wants to secure the automation secrets (e.g., SSH keys, API tokens). The secrets are currently stored in plaintext in inventory files. The security team requires that secrets be encrypted at rest and decrypted only at runtime by authorized users. Which solution should be implemented?

Accepted Answer

Use Ansible Vault to encrypt sensitive variables in the inventory files. Ansible Vault is the built-in tool for encrypting sensitive data such as passwords, API tokens, and SSH keys at rest. It encrypts variables or entire files using AES-256, and decryption occurs only at runtime when the correct vault password is provided, meeting the requirement that secrets are decrypted only by authorized users.

Answer

Store secrets in an encrypted SSH key file and use it for authentication

Answer

Set strict file permissions (0600) on the inventory files to limit access

Answer

Use environment variables to pass secrets at runtime

Question 15

A company uses Cisco Meraki APs and an internal web application hosted on AWS. The application store customer payment data. The security team discovers that sensitive application logs are being transmitted in plaintext over the network to the SIEM. The DevOps team wants to improve security without changing the application code because it is proprietary and cannot be modified. Which solution should be recommended?

Accepted Answer

Set up a site-to-site VPN between the Meraki network and AWS to encrypt all traffic, including logs. Option D is correct because a site-to-site VPN between the Meraki network and AWS encrypts all traffic traversing the link, including the sensitive application logs sent to the SIEM, without requiring any changes to the proprietary application code. This solution operates at the network layer, ensuring that even if the application transmits logs in plaintext, the entire payload is encrypted by the VPN tunnel. Meraki Auto VPN and AWS VPN Gateway can establish an IPsec tunnel, providing confidentiality for all data in transit between the on-premises network and the AWS VPC.

Answer

Modify the application to send logs via syslog over TLS

Answer

Enable HTTPS on the SIEM receiver to ensure logs are encrypted during transmission

Answer

Enable TLS on the web application to encrypt data in transit