200-901 Practice Test 39 — 15 Questions

Question 1

An engineer is tasked with automating the backup of running configurations from 50 routers. Which approach is most scalable?

Accepted Answer

Use an Ansible playbook with ios_config backup. An Ansible playbook with the ios_config module's backup option is the most scalable approach because it uses a push-based automation model that can manage all 50 routers from a single control node, leveraging SSH for secure transport and idempotent configuration management without requiring any agent on the routers.

Answer

SSH manually to each router and copy config

Answer

Schedule a cron job on each router to SCP config

Answer

Use SNMP to capture config

Question 2

During a security audit, an engineer discovers that a CI/CD pipeline is storing API keys in plain text in environment variables. Which best practice should be implemented to mitigate this risk?

Accepted Answer

Use a dedicated secrets management service like HashiCorp Vault or AWS Secrets Manager and retrieve secrets at runtime.. Dedicated secrets management services like HashiCorp Vault or AWS Secrets Manager provide secure storage, access control, and audit logging for sensitive data. They allow the CI/CD pipeline to retrieve API keys at runtime via authenticated API calls, ensuring secrets are never stored in plain text in environment variables or configuration files. This approach aligns with the principle of least privilege and eliminates the risk of exposure through source code or build logs.

Answer

Store secrets in a .env file and add it to the repository with restricted access.

Answer

Encrypt the environment variables using a tool like openssl and store the key elsewhere.

Answer

Remove the API keys from the pipeline and require manual entry each time a build runs.

Question 3

An organization is planning to implement HTTPS for their web services. Which three statements accurately describe the HTTPS protocol? (Choose three.)

Accepted Answer

HTTPS uses TLS to encrypt HTTP traffic.. HTTPS uses TLS for encryption, involves certificate verification, and negotiates a symmetric session key. It does not use UDP typically (TCP is used) and it is not stateless after the handshake.

Answer

HTTPS uses UDP as the transport protocol.

Answer

HTTPS is stateless after the initial handshake.

Question 4

A developer is designing a REST API for managing network devices. Which three best practices should be followed for the API design? (Choose three.)

Accepted Answer

Use nouns for resource names (e.g., /devices) rather than verbs.. Option B is correct because REST resource URIs should be noun-based (e.g., /devices) so that HTTP methods express the action, keeping the interface uniform and predictable. Option C is correct because embedding the version in the URL path (e.g., /v1/devices) provides explicit, easily routable versioning that lets clients pin to a stable contract while new versions are introduced. Option E is correct because returning semantically accurate HTTP status codes (e.g., 200 OK, 201 Created, 204 No Content, 400 Bad Request, 404 Not Found, 409 Conflict) lets clients interpret outcomes without parsing custom payloads. Option A is wrong because POST is neither idempotent nor the right verb for all state changes; PUT and DELETE are idempotent and should be used for updates and deletions. Option D is wrong because always returning the full representation wastes bandwidth and ignores partial responses, field selection, and caching semantics.

Answer

Use POST for all state-changing operations to ensure idempotency.

Answer

Always send the entire resource representation in all responses to reduce client requests.

Question 5

Which HTTP method is idempotent and safe?

Accepted Answer

GET. GET is both idempotent and safe because it is designed to retrieve a resource without causing any side effects on the server. According to RFC 7231, a safe method does not modify the resource state, and an idempotent method guarantees that multiple identical requests produce the same result as a single request. GET satisfies both conditions, as it never alters server state and repeating the same GET request returns the same representation.

Answer

DELETE

Answer

POST

Answer

PUT

Question 6

Which THREE of the following are characteristics of RESTCONF compared to NETCONF? (Select three.)

Accepted Answer

Uses HTTP as the transport protocol. RESTCONF is defined by RFC 8040 and uses HTTP/HTTPS as its transport protocol, so option A is correct—unlike NETCONF, which runs over SSH. RESTCONF supports both JSON and XML encoding of YANG-modeled data, making option B correct, whereas NETCONF uses XML only. Option E is correct because RESTCONF, like NETCONF, is built on YANG data models to define the data and operations exposed by the device. Option C is not a RESTCONF characteristic: XML-based RPCs are the core mechanism of NETCONF, not RESTCONF, which uses HTTP methods (GET, POST, PUT, PATCH, DELETE). Option D is also incorrect because SSH transport is a defining feature of NETCONF, while RESTCONF relies on HTTP/HTTPS.

Answer

Employs XML Remote Procedure Calls (RPCs)

Answer

Uses SSH for secure transport

Question 7

A network engineer is configuring a Cisco switch to support LLDP-MED for VoIP phones. Which command is required to enable LLDP globally on the switch?

Accepted Answer

lldp run. The command 'lldp run' is required to enable LLDP globally on a Cisco switch. LLDP is disabled by default on most Cisco switches, and 'lldp run' activates the protocol at the global configuration level, allowing LLDP-MED (which extends LLDP for VoIP and other endpoint devices) to function. Without this global enablement, LLDP frames are not transmitted or received, even if per-interface commands like 'lldp transmit' or 'lldp receive' are configured.

Answer

lldp transmit

Answer

cdp run

Answer

lldp enable

Answer

lldp med

Question 8

A company uses Ansible to automate network configuration. They have an Ansible control node that must reach all network devices. Which transport protocol does Ansible use by default to connect to Cisco IOS devices?

Accepted Answer

SSH. Ansible uses SSH as its default transport protocol to connect to Cisco IOS devices because SSH provides encrypted, secure remote access and is the standard for network device management in modern environments. Ansible's native architecture relies on SSH for agentless communication, executing modules and playbooks over this secure channel without requiring additional software on the target devices.

Answer

HTTP

Answer

Telnet

Answer

SNMP

Question 9

A network administrator wants to use Cisco Webex APIs to automate sending messages to a specific room. Which THREE pieces of information are required to send a message using POST /v1/messages?

Accepted Answer

Message body as plain text or markdown. Option B is correct because POST /v1/messages requires a message payload, and the Webex Messages API accepts the content as either plain text or markdown in the request body. Option C is correct because the API requires a target destination, specified as either the roomId of the room or the toPersonEmail of the recipient. Option E is correct because every Webex API request must be authenticated with an OAuth Bearer token in the Authorization header. Option A is incorrect because X-Cisco-Meraki-API-Key is used for the Meraki Dashboard API, not Webex messaging. Option D is incorrect because the Messages API does not require the recipient's user ID; it targets a room ID or recipient email instead.

Answer

X-Cisco-Meraki-API-Key header

Answer

User ID of the recipient

Question 10

Which TWO of the following are categories of Cisco DNA Center APIs? (Choose two.)

Accepted Answer

Run your network. DNA Center API categories include 'Know your network', 'Run your network', 'Change your network', and 'Platform'.

Answer

Automate your network

Answer

Secure your network

Answer

Monitor your network

Question 11

An EEM applet is triggered when a specific syslog message pattern appears. Which action should be used to send a custom syslog message?

Accepted Answer

action 1.0 syslog msg "Custom event occurred". In an EEM applet, to send a custom syslog message, the correct action is 'action 1.0 syslog msg "Custom event occurred"'. This action explicitly generates a syslog message with the specified text. It is the standard way to emit a custom syslog from EEM.

Answer

action 1.0 cli command "show logging"

Answer

action 1.0 info type routername

Answer

action 1.0 set 1.0 _syslog_msg "Custom event"

Question 12

Refer to the exhibit. A DevOps engineer is using NETCONF to retrieve the OSPF configuration. The <get> response is missing the network statements. What is the most likely cause?

Accepted Answer

The filter used in the NETCONF request did not include the correct path for network commands.. The most likely cause is that the NETCONF <get> request used an incorrect or incomplete XML filter that did not specify the correct XPath for the OSPF network statements. NETCONF relies on YANG-defined data paths; if the filter omits the subtree for network commands, the device will not return those configuration elements, even though they exist in the running configuration.

Answer

The YANG model for OSPF does not include the network statement.

Answer

The device does not support NETCONF for OSPF.

Answer

The NETCONF username does not have sufficient privileges.

Question 13

A development team is adopting container security practices for their Docker-based microservices. They want to reduce the attack surface of their running containers. Which TWO practices should they implement? (Choose two.)

Accepted Answer

Use minimal base images such as distroless or Alpine to reduce installed packages. Running as a non-root user and using minimal base images both reduce what an attacker can do inside a compromised container and how many components could contain vulnerabilities. Together they shrink the attack surface without breaking normal application function. The other listed practices either grant excessive privileges or weaken supply chain verification.

Answer

Mount the Docker socket into every container to simplify orchestration

Answer

Disable the Docker content trust feature to allow unsigned images

Answer

Set the container to privileged mode so it can access all host devices

Question 14

An engineer is troubleshooting a connectivity issue between two devices on different VLANs. The switch connecting the devices is configured with 802.1Q trunking. At which OSI layer do VLANs operate?

Accepted Answer

Layer 2. VLANs operate at Layer 2 (the Data Link layer) of the OSI model because they segment a single physical switch into multiple logical broadcast domains using 802.1Q tags inserted into Ethernet frames. The 802.1Q tag adds a 12-bit VLAN ID field to the Ethernet frame header, which is a Layer 2 construct. Routing between VLANs requires a Layer 3 device (router or Layer 3 switch), but the VLAN membership and tagging itself is strictly a Layer 2 function.

Answer

Layer 4

Answer

Layer 1

Answer

Layer 3

Question 15

During a CI/CD pipeline, a security scan reveals that a Docker image contains a vulnerability in a base layer. Which action BEST addresses the issue?

Accepted Answer

Rebuild the image using an updated base image from a trusted registry.. The vulnerability exists in the base layer of the Docker image, which is immutable once built. The only way to eliminate the vulnerability is to rebuild the image using an updated base image from a trusted registry (e.g., Docker Hub official images or a private registry with patched images). This ensures the vulnerable packages are replaced with patched versions at the OS or application level, directly addressing the root cause.

Answer

Disable the security scanner to avoid false positives.

Answer

Implement run-time security monitoring to detect exploitation.

Answer

Add an exception to the vulnerability report.