200-901 Practice Test 37 — 15 Questions

Question 1

A developer is using the Meraki Dashboard API to programmatically change the SSID name of a wireless network. The developer successfully authenticates with an API key and sends a PUT request to /networks/{networkId}/wireless/ssids/{number} with a JSON body containing the updated name. The API returns a 200 OK response, but the SSID name does not change in the Meraki Dashboard. The developer double-checks the networkId and SSID number, and they are correct. The developer also confirms that the API key has full write access to the network. What additional step is most likely required?

Accepted Answer

After the PUT request, send a POST request to /networks/{networkId}/wireless/ssids/{number}/provision to apply the change.. The Meraki Dashboard API requires an explicit provisioning step to apply configuration changes to SSIDs. After a successful PUT request to update the SSID name, the developer must send a POST request to /networks/{networkId}/wireless/ssids/{number}/provision to push the change to the access points. The 200 OK response only confirms the API accepted the update, but the change is not applied until the provisioning endpoint is called.

Answer

Use a PATCH request instead of PUT to update the SSID.

Answer

Log out of the Meraki Dashboard and re-login to see the change.

Answer

Regenerate the API key and try again with the new key.

Question 2

A developer has created a Webex Teams bot that listens for messages in a specific room and responds with information from an external database. The bot uses the Webex API's 'messages.create' method to post replies. During testing, the bot sometimes fails to respond, but no errors are logged. The developer checks the Webex Developer Portal and sees that the bot's rate limit is set to 10 requests per second. The bot's average load is 5 requests per second, but occasionally spikes to 15 requests per second for a few seconds. The developer wants to ensure the bot functions reliably without exceeding rate limits. Which approach should the developer implement?

Accepted Answer

Implement a request queue that limits outgoing requests to 10 per second and uses exponential backoff on failure.. Option A is correct because implementing a request queue that limits outgoing requests to 10 per second and uses exponential backoff on failure ensures the bot respects the Webex API rate limit of 10 requests per second. The queue smooths out spikes (e.g., 15 req/s) by buffering excess requests, while exponential backoff handles any HTTP 429 responses gracefully by retrying after increasing delays, preventing further rate limit violations. This approach directly addresses the bot's intermittent failure without relying on external support or sacrificing functionality.

Answer

Request a higher rate limit from the Webex API support team.

Answer

Catch HTTP 429 (Too Many Requests) errors and immediately retry the request.

Answer

Reduce the bot's overall request rate to 5 per second to stay well within the limit.

Question 3

A junior developer is writing a Python script to gather interface statistics from a Cisco IOS-XE device using NETCONF. They use the 'ncclient' library and successfully connect. They want to retrieve the operational status of all interfaces. Which YANG model and XPATH expression should they use to get the operational data?

Accepted Answer

Model: ietf-interfaces, XPATH: /interfaces-state/interface. Option A is correct because the 'ietf-interfaces' YANG model defines the '/interfaces-state' container specifically for operational state data (e.g., status, counters), as per RFC 7223. The XPATH '/interfaces-state/interface' retrieves the list of all interfaces with their operational status, which is exactly what the developer needs. The 'ncclient' library can filter using this XPATH to get read-only operational data from a NETCONF-enabled Cisco IOS-XE device.

Answer

Model: cisco-native, XPATH: /native/interface

Answer

Model: ietf-interfaces, XPATH: /interfaces/interface

Answer

Model: ietf-interfaces, XPATH: /interfaces-state

Question 4

A network automation engineer is developing a Python script that uses the NETCONF protocol to retrieve the running configuration from a Cisco IOS XE device. They use the ncclient library. The script works on the test device but fails on a production device with an error: "ncclient.transport.errors.AuthenticationError: Authentication exception". The engineer verifies that the SSH credentials (username and password) are correct and that the production device is reachable via SSH on port 830. What is the most likely issue?

Accepted Answer

The production device requires SSH key-based authentication, but the script uses password.. The error 'AuthenticationException' from ncclient indicates that the NETCONF session over SSH failed during authentication. Since the engineer verified the password is correct and the device is reachable on port 830, the most likely cause is that the production device is configured to require SSH key-based authentication (e.g., using 'ip ssh server algorithm authentication publickey' or similar), while the script is attempting password-based authentication. ncclient defaults to password authentication unless explicitly configured with a key filename.

Answer

The production device uses a different port for NETCONF than the test device.

Answer

The production device has a firewall rule blocking NETCONF capabilities.

Answer

The production device does not have NETCONF enabled; it only supports SSH.

Question 5

A large enterprise uses Cisco DNA Center to manage over 500 network devices across multiple sites. The network operations team wants to automate the validation of device compliance with a baseline configuration. They have a Python script that uses the Cisco DNA Center REST API to retrieve the device configuration and compare it against a golden configuration stored in a local file. Recently, the script started failing with a 401 HTTP response code when trying to authenticate. The team confirmed the username and password are correct and that the DNA Center server is reachable. The script uses the /api/system/v1/auth/token endpoint to obtain a token. Which of the following is the most likely cause of the 401 error?

Accepted Answer

The authentication token has expired and the script is not refreshing it.. The 401 HTTP response code indicates an authentication failure. Since the username and password are confirmed correct and the server is reachable, the most likely cause is that the script obtained a token earlier but is now using an expired token without refreshing it. Cisco DNA Center tokens have a configurable timeout (default 1 hour), and the script must re-authenticate or refresh the token before it expires.

Answer

The API endpoint requires a different HTTP method (e.g., POST vs GET).

Answer

The script is using an incorrect API version path (e.g., /v2 instead of /v1).

Answer

CORS (Cross-Origin Resource Sharing) is blocking the request.

Question 6

A network administrator automates the provisioning of Meraki MX security appliances using the Meraki Dashboard API. The Python script reads a CSV file with site details and creates VLANs, firewall rules, and VPN settings. Recently, the script started throwing an HTTP 429 error. The script is single-threaded and makes fewer than 10 requests per second. Which of the following is the most likely cause of the 429 error?

Accepted Answer

The organization has a lower rate limit than the API key's default.. The HTTP 429 (Too Many Requests) error indicates the client has exceeded the rate limit imposed by the Meraki Dashboard API. Even though the script makes fewer than 10 requests per second, the organization-level rate limit can be lower than the default API key limit. Option D is correct because the organization's rate limit overrides the default, and the script's request rate may still exceed that lower threshold.

Answer

The API key has been revoked.

Answer

The rate limit for the API key is 5 requests per second.

Answer

The Meraki cloud is under maintenance.

Question 7

A network engineer is developing a Python script to automate the collection of interface statistics from multiple Cisco Catalyst switches using NETCONF. The engineer uses the 'ncclient' library to connect to each switch. The script works for most switches, but for one switch, the connection consistently fails with an authentication error. The engineer has verified that the username and password are correct and that the switch has NETCONF enabled. The engineer suspects the issue might be related to SSH host key checking. The engineer wants to modify the script to bypass host key checking for this specific switch. Which approach should the engineer use?

Accepted Answer

Set the 'hostkey_verify' parameter to False in the connect method. Option A is correct because the 'ncclient' library's connect method accepts a 'hostkey_verify' parameter. Setting it to False disables SSH host key checking, which bypasses the verification of the switch's host key against the known_hosts file. This resolves authentication errors caused by host key mismatches, such as when the switch's host key has changed or is not present in the known_hosts file.

Answer

Disable SSH key-based authentication by setting 'look_for_keys=False'

Answer

Use the 'allow_agent' parameter set to False

Answer

Set the 'known_hosts' parameter to an empty file in the connect method

Question 8

A large enterprise is migrating to a DevOps model and needs to automate the provisioning of network devices. The team has chosen Ansible for configuration management and is using a Git repository for version control. The network includes Cisco IOS routers, Catalyst switches running IOS-XE, and ASA firewalls. The team has written Ansible playbooks for each device type. The goal is to have a CI/CD pipeline that automatically deploys configuration changes to the production network after the changes are merged into the main branch. However, during a recent deployment, a misconfiguration was pushed to a core router, causing a 10-minute outage. The root cause was that the playbook that was executed was not the correct one for that device model. The team wants to implement a mechanism to prevent similar incidents. Which approach should the team adopt?

Accepted Answer

Implement a CI/CD pipeline that runs playbooks against a staging environment with similar devices, and only deploy to production after successful validation. Option A is correct because a staging environment with similar devices allows the team to validate playbooks against representative hardware before production deployment. This catches model-specific incompatibilities (e.g., a playbook written for IOS-XE being applied to a classic IOS router) without risking production outages. The CI/CD pipeline can run the same playbooks in staging, verify the resulting device state, and only promote changes to production after successful validation.

Answer

Require all changes to be approved by a change advisory board before merging

Answer

Require two-person peer review for all playbook changes

Answer

Use a pre-commit hook that checks the playbook syntax and device compatibility

Question 9

A university IT department manages a Cisco Meraki network with 200 MR access points and 50 MS switches. They use the Meraki dashboard API to automate network provisioning. A new student dormitory was added, and the team needs to create a new network and claim devices. They have a Python script that uses the Meraki API to create the network and then claim devices by serial numbers. The script successfully creates the network but fails when claiming devices with a 400 error: 'Device serial number is not valid or already claimed'. The serial numbers are correct and unused. The API key has full organization access. The script uses the endpoint 'POST /networks/{networkId}/devices/claim' with the correct body. What is the most likely cause of the failure?

Accepted Answer

The devices have not been added to the organization's inventory first.. Option C is correct because in the Meraki API workflow, devices must first be added to the organization's inventory via the 'POST /organizations/{organizationId}/inventory/devices' endpoint before they can be claimed into a specific network. The 400 error 'Device serial number is not valid or already claimed' occurs when the serial numbers are not present in the organization's inventory, even if they are correct and unused. The script successfully creates the network but fails at the claim step because the devices have not been inventoried at the organization level.

Answer

The API key does not have permission to claim devices.

Answer

The serial numbers contain a typo.

Answer

The devices are not Meraki MR or MS models.

Question 10

A network engineer is automating the deployment of a new VLAN across multiple Cisco switches using Ansible. The engineer has written a playbook that uses the ios_vlan module to create VLAN 100 with name 'Users'. The playbook runs successfully on the first switch but fails on the second switch with the error message: 'VLAN name is already in use'. The engineer checks the second switch and confirms that VLAN 100 does not exist, but a different VLAN with the name 'Users' exists. The engineer wants to ensure that the playbook creates VLAN 100 with the exact name 'Users' only if it does not already exist, and without conflicting with existing VLANs. Which approach should the engineer take?

Accepted Answer

Use the ios_vlan module with parameters vlan_id=100 and name='Users' and set state=present. The module will create the VLAN if it does not exist or update the name if it exists with a different name.. Option A is correct because the `ios_vlan` module with `state=present` ensures idempotency: if VLAN 100 does not exist, it creates it with the specified name; if VLAN 100 exists but has a different name, it updates the name to 'Users'. This directly resolves the conflict where a different VLAN ID already uses the name 'Users', as the module will not attempt to reuse a name that is already assigned to another VLAN — instead, it will fail with the observed error only if the name is already in use by a different VLAN ID. The engineer's goal is to create VLAN 100 with name 'Users' only if it does not already exist, and the module's default behavior (without additional checks) will fail when the name is taken, so the correct approach is to rely on the module's built-in idempotency to create or update VLAN 100 without conflicting with existing VLAN names.

Answer

First use the ios_command module to run 'show vlan name Users' and then conditionally create VLAN 100 if no output is returned.

Answer

Use the ios_config module to directly apply the configuration 'vlan 100
 name Users' and then use the 'parents' directive to ensure idempotency.

Answer

Use the ios_vlan module with vlan_id=100 and state=present, but omit the name parameter.

Question 11

A DevOps team manages a hybrid cloud environment with on-premises Cisco Nexus switches and AWS VPCs using Terraform. They have a configuration management tool that pushes VLAN and interface configurations to the Nexus switches. Recently, they noticed that after a Terraform run that updates the AWS VPC subnets, some on-premises switches lose connectivity to the cloud. The team suspects a mismatch between the VLAN configurations on the Nexus switches and the AWS VPC subnets. They have a centralized source of truth stored in a Git repository containing YAML files for network definitions. Which action should the team take first to resolve the issue and prevent future occurrences?

Accepted Answer

Compare the Git repository's YAML definitions with the actual switch configurations and AWS VPC subnets, then correct any discrepancies.. Option C is correct because the team's centralized source of truth in Git (YAML files) should be the authoritative reference for network definitions. By comparing these definitions against both the actual Nexus switch configurations and AWS VPC subnets, the team can identify and correct any drift or mismatch. This aligns with Infrastructure as Code (IaC) best practices, ensuring that all environments are synchronized from a single, version-controlled source before making any changes.

Answer

Restore the Nexus switch configurations from the most recent backup.

Answer

Modify the Terraform scripts to automatically update Nexus switches when AWS VPC subnets change.

Answer

Manually reconfigure the VLANs on the Nexus switches to match the AWS VPC subnets.

Question 12

You are a network automation engineer at a large enterprise. The network consists of 200 Cisco Catalyst switches distributed across five data centers. Each switch runs IOS-XE and supports NETCONF. Your team uses a centralized Ansible control node to manage configurations. Recently, the security team mandated that all management access must use SSH keys instead of passwords. You updated the Ansible inventory to use SSH keys and tested on a few switches successfully. However, when you run the playbook against all switches, about 30 switches fail with the error: 'Authentication failed.' You verify that the SSH public key is correctly deployed on those switches via the console. What is the most likely cause of the failure?

Accepted Answer

The private key file on the Ansible control node has permissions 644, which SSH rejects. SSH strictly requires private key files to have permissions no more permissive than 600 (owner read/write) or 640 (owner read/write, group read) on Unix-like systems. A permission of 644 allows group and others to read the key, which SSH interprets as insecure and refuses to use, causing 'Authentication failed' even though the public key is correctly deployed on the switches.

Answer

The public key on the switches is not in the correct format

Answer

The Ansible become method is misconfigured

Answer

The switches are not reachable over the network

Question 13

You are automating the deployment of a new software image on a fleet of Cisco Nexus switches using Ansible. The switches are in a production environment and must have minimal downtime. You have a maintenance window of 30 minutes per switch. Your playbook performs the following steps: 1) Copy the image to the switch via SCP, 2) Set the boot variable to the new image, 3) Save the configuration, 4) Reload the switch. During a dry run on a test switch, you notice that the reload step takes 8 minutes, but the copy step takes 15 minutes due to slow link speed. For the production rollout, you need to reduce the overall time per switch. Which approach should you take?

Accepted Answer

Use a local file server with HTTP for image transfer to improve speed. Option B is correct because the bottleneck is the SCP copy time (15 minutes), which exceeds the 30-minute maintenance window when combined with the reload (8 minutes). Using HTTP for image transfer leverages a more efficient protocol with better throughput and lower overhead than SCP, which uses SSH encryption and can be slower on low-bandwidth links. This directly reduces the copy time, bringing the total per-switch time under the maintenance window limit.

Answer

Skip the save configuration step to save time

Answer

Use a compressed image to reduce copy time

Answer

Reload all switches simultaneously in the same maintenance window

Question 14

A university campus network uses Cisco switches with 802.1X for wired authentication. Recently, users in a dormitory report intermittent connectivity: they can connect initially but are disconnected after a few minutes. The network team checks the switch logs and sees messages like 'Authentication failure for MAC address xxxx.xxxx.xxxx on port GigabitEthernet1/0/5' but the users claim they are using valid credentials. The same users can connect from other ports without issues. The port configuration for Gi1/0/5 is: switchport mode access, authentication port-control auto, dot1x pae authenticator, authentication periodic, authentication timer reauthenticate 3600. The team suspects a misconfiguration. What is the most likely cause of the intermittent disconnections?

Accepted Answer

The 'authentication periodic' command forces reauthentication every 3600 seconds, and the client fails to reauthenticate. The 'authentication periodic' command enables periodic reauthentication, and the 'authentication timer reauthenticate 3600' sets the interval to 3600 seconds (1 hour). However, the logs show authentication failures occurring much sooner than 3600 seconds, indicating that the client is failing reauthentication attempts triggered by other events (e.g., a new supplicant attempt or a reauthentication due to a port state change). The intermittent disconnections are caused by the client failing to reauthenticate when the switch initiates a new authentication exchange, likely due to a mismatch in EAP method or credential caching issues.

Answer

The port is a trunk port but configured as access, causing VLAN mismatch

Answer

The port is configured in multi-auth host mode, causing conflicts

Answer

The switch is using MAC authentication bypass (MAB) as a fallback, which fails for some devices

Question 15

A company runs a microservices application on a Kubernetes cluster with 10 worker nodes. The application consists of 3 services: frontend, backend, and database. The database service is stateful and uses persistent volumes. Recently, the operations team noticed that the backend service is experiencing intermittent failures with 'Connection refused' errors when trying to connect to the database. The database service is exposed via a ClusterIP service named 'database-service'. The backend service uses environment variable DB_HOST=database-service to connect. The pod logs show that the connection is attempted to an IP address that does not correspond to any database pod. Further investigation reveals that the database pod has been restarted multiple times due to OOMKilled errors. The backend service is configured with a liveness probe that checks the health endpoint every 10 seconds, and a readiness probe that checks the same endpoint every 5 seconds. The database pod has resource limits set to 512Mi memory and 500m CPU. The node running the database pod has 4Gi memory and 2 CPU cores. What is the most likely cause of the intermittent connection failures?

Accepted Answer

The database pod is being killed due to memory limits, causing frequent restarts and temporary unavailability; the backend's connection attempts fail during the restart window.. The intermittent 'Connection refused' errors are caused by the database pod being repeatedly killed due to exceeding its memory limit (512Mi), which triggers OOMKilled restarts. During the restart window, the database pod is unavailable, and the backend's connection attempts to the ClusterIP service (which resolves to the pod's IP) fail because no pod is ready to accept connections. The frequent restarts create a pattern of temporary unavailability that aligns with the observed symptoms.

Answer

The backend service is using a hardcoded IP address instead of the service DNS name.

Answer

The backend service's readiness probe is failing, so it is not receiving traffic, but the backend still tries to connect.

Answer

The DNS entry for database-service is cached and pointing to the old pod IP after the database pod restarts.