200-901 Practice Test 36 — 15 Questions

Question 1

An Ansible playbook using the ios_config module fails with the error 'unable to open connection'. The network device is reachable via SSH from the Ansible control node. What is the most likely cause?

Accepted Answer

The SSH key exchange algorithm is not supported by the device. The error 'unable to open connection' indicates that Ansible cannot establish an SSH session with the device, even though the device is reachable. Since the device is reachable via SSH from the control node, the most likely cause is a mismatch in SSH key exchange algorithms, where the device only supports older algorithms (e.g., diffie-hellman-group1-sha1) that are not enabled by default in modern SSH clients. This is a common issue when connecting to legacy Cisco IOS devices that lack updated SSH configurations.

Answer

The device has an invalid username and password

Answer

The Ansible user does not have privilege level 15 on the device

Answer

The ios_config module requires NETCONF instead of SSH

Question 2

A developer is writing a Python script to back up Cisco router configurations via SSH. Which two libraries are appropriate for this task? (Choose two.)

Accepted Answer

netmiko. Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices, including Cisco routers. It provides high-level methods for sending commands and retrieving output, making it ideal for automating configuration backups via SSH.

Answer

requests

Answer

urllib

Answer

flask

Question 3

Which THREE of the following are common security vulnerabilities listed in the OWASP Top 10? (Choose three.)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) is a common security vulnerability in the OWASP Top 10 because it allows attackers to inject malicious scripts into web pages viewed by other users, typically through input fields that are not properly sanitized. This can lead to session hijacking, defacement, or redirection to malicious sites, exploiting the trust a user has in a legitimate application.

Answer

Multi-Factor Authentication

Answer

DNS Cache Poisoning

Question 4

A DevOps team is securing a CI/CD pipeline that deploys containerized applications to Kubernetes. Which THREE practices enhance security?

Accepted Answer

Implementing network policies to restrict pod communication.. Network policies in Kubernetes act as a firewall for pods, restricting ingress and egress traffic based on labels, namespaces, or IP blocks. This implements a zero-trust model by default, preventing lateral movement if a container is compromised. Option A is correct because it directly reduces the attack surface within the cluster.

Answer

Allowing containers to run with privileges.

Answer

Running containers as root.

Question 5

Which data serialization format is most commonly used for configuration files in Cisco automation tools like Ansible?

Accepted Answer

YAML. YAML is the most commonly used data serialization format for configuration files in Cisco automation tools like Ansible because it is human-readable, supports complex data structures (lists, dictionaries), and is natively parsed by Ansible playbooks. Cisco's automation solutions, including those for network devices, rely on YAML for defining tasks, variables, and inventory files due to its minimal syntax and compatibility with Jinja2 templating.

Answer

CSV

Answer

HTML

Answer

XML

Question 6

A Python script uses the Cisco Meraki API to list networks in an organization. The API returns HTTP 403 Forbidden. What is the most likely cause?

Accepted Answer

The API key is invalid or missing.. HTTP 403 Forbidden indicates the server understood the request but refuses to authorize it. In the context of the Meraki API, this almost always means the API key (X-Cisco-Meraki-API-Key header) is invalid, expired, or missing from the request. Without a valid API key, the server cannot authenticate the client and returns 403.

Answer

The request was sent over HTTP instead of HTTPS.

Answer

The network ID specified is incorrect.

Answer

The organization ID was omitted from the request.

Question 7

Which TWO are valid methods to secure a Docker container?

Accepted Answer

Use read-only filesystem. Mounting the container's filesystem as read-only prevents any process inside the container from writing to the filesystem, which blocks malware persistence, log tampering, and unauthorized configuration changes. This is enforced by the Linux kernel's mount namespace and can be set with the `--read-only` flag in `docker run`. It is a key principle of immutable infrastructure for containers.

Answer

Expose all ports

Answer

Run containers as root

Answer

Disable network isolation

Question 8

A company wants to implement a zero-trust model for API access between microservices. What is the most effective way to authenticate service-to-service communication?

Accepted Answer

Issue short-lived TLS certificates for each service.. Mutual TLS (mTLS) with short-lived certificates validates identity and limits exposure. Options A and D are incorrect because shared secrets and long-lived API keys are less secure. Option B is incorrect because network segmentation is not authentication.

Answer

Rely on network segmentation with firewalls.

Answer

Use a shared secret that all services know.

Answer

Use long-lived API keys.

Question 9

Which THREE factors influence the convergence time of OSPF in a large enterprise network? (Choose three.)

Accepted Answer

CPU processing power for SPF calculations. CPU processing power for SPF calculations directly affects convergence time because OSPF must run the Dijkstra algorithm to compute the shortest path tree after a topology change. In large networks with many routers and LSAs, a slower CPU increases the time to complete SPF, delaying route convergence.

Answer

Bidirectional Forwarding Detection (BFD) implementation

Answer

DUAL algorithm processing time

Question 10

A CI/CD pipeline for network automation includes a stage that runs Ansible playbooks against a staging environment. The pipeline is triggered by Git commits. After a commit, the pipeline fails because the Ansible inventory file is missing. What is the most likely reason?

Accepted Answer

The inventory file is listed in .gitignore. The most likely reason the Ansible inventory file is missing is that it is listed in .gitignore, which prevents it from being tracked by Git and thus not present in the repository when the pipeline clones it. Since the pipeline is triggered by Git commits, it only has access to files that are committed and pushed. If the inventory file is ignored, it will not be available for the Ansible playbook execution, causing the pipeline to fail.

Answer

The pipeline script has a typo in the inventory path

Answer

The Ansible version in the pipeline is incompatible

Answer

The staging environment is not reachable

Question 11

Which THREE are characteristics of OSPF? (Choose three.)

Accepted Answer

It uses cost as the metric. OSPF uses cost as its metric, which is derived from the bandwidth of the interface (calculated as 10^8 / bandwidth in bps by default). This allows OSPF to select the most efficient path based on link speed rather than a simple hop count, making it suitable for larger, more complex networks.

Answer

It is a distance-vector routing protocol

Answer

It uses hop count as the metric

Question 12

A developer uses Kubernetes and wants to expose a deployment named 'web-app' externally via a cloud load balancer. Which Service type should be used?

Accepted Answer

LoadBalancer. The LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that routes external traffic to the 'web-app' deployment's pods. This is the only Service type that directly integrates with a cloud provider's load balancing infrastructure to expose the service externally.

Answer

ClusterIP

Answer

ExternalName

Answer

NodePort

Question 13

An engineer needs to transfer a router configuration file to a server in the same network using a simple protocol that does not require authentication. Which protocol is best?

Accepted Answer

TFTP. TFTP (Trivial File Transfer Protocol) is the best choice because it is a lightweight, connectionless protocol that operates over UDP (port 69) and does not require any authentication or user credentials. It is commonly used for transferring router configuration files and IOS images in local network environments where simplicity and speed are prioritized over security.

Answer

SCP

Answer

FTP

Answer

HTTP

Question 14

During a network outage, a technician notices that hosts in VLAN 10 cannot reach the default gateway at 192.168.10.1, but hosts in VLAN 20 can. The switch interfaces are up, and the router is configured with subinterfaces. What is the most likely cause?

Accepted Answer

The router subinterface for VLAN 10 is down or misconfigured.. The router subinterface for VLAN 10 is down or misconfigured. Since hosts in VLAN 10 cannot reach the default gateway but hosts in VLAN 20 can, the issue is isolated to VLAN 10. The router uses subinterfaces to route between VLANs via a trunk link; if the subinterface for VLAN 10 is down (e.g., no 'no shutdown' command) or misconfigured (e.g., wrong VLAN ID or encapsulation), it will not process traffic for that VLAN, while other subinterfaces remain functional.

Answer

The trunk link is administratively down.

Answer

The switchport trunk native VLAN is mismatched.

Answer

The router does not have an IP address configured.

Question 15

Which IPv6 address type is equivalent to a private IPv4 address?

Accepted Answer

Unique local. Unique local addresses (ULA) in IPv6, defined in RFC 4193, are the equivalent of private IPv4 addresses (RFC 1918) because they are intended for local communication within a site or organization and are not routable on the global internet. They use the prefix fc00::/7, with the L bit set to 1 (fd00::/8) for locally assigned addresses, ensuring uniqueness within a site without requiring global registration.

Answer

Multicast

Answer

Global unicast

Answer

Link-local