200-901 Practice Test 41 — 15 Questions

Question 1

Which TWO are benefits of using model-driven programmability (e.g., NETCONF/RESTCONF) over traditional CLI scripting for network automation?

Accepted Answer

Data is structured and machine-readable (e.g., XML/JSON).. Option D is correct because NETCONF/RESTCONF exchange structured, schema-defined data encoded in XML or JSON (YANG-modeled), so automation tools can parse and manipulate configuration and state programmatically rather than screen-scraping unstructured CLI text. Option E is correct because RESTCONF exposes a standards-based HTTP/HTTPS interface, letting any language with an HTTP client library (Python requests, Go net/http, curl, etc.) manage devices without vendor-specific CLI expect scripts. Option A is wrong: NETCONF/RESTCONF are not inherently lower-latency than CLI; transport overhead (SSH/HTTP, XML/JSON encoding) can even be higher, and latency is not the benefit being claimed. Option B is wrong: model-driven programmability requires learning YANG models, RPC operations (get-config, edit-config), and protocol semantics, which is additional learning beyond CLI commands. Option C is wrong: NETCONF/RESTCONF use XML/JSON payloads and RPC semantics, not CLI syntax, so debugging involves protocol and data-model knowledge rather than reusing CLI syntax.

Answer

Reduces network latency because it uses a lighter protocol.

Answer

Requires no additional learning beyond CLI commands.

Answer

Easier to debug because it uses the same syntax as CLI.

Question 2

A developer is automating VLAN configuration on a Cisco switch using REST API. Which HTTP method should be used to create a new VLAN?

Accepted Answer

POST. To create a new VLAN resource on a Cisco switch via REST API, the POST method is correct because it is designed to create a subordinate resource under a parent collection. In RESTful APIs, POST is used to send data to the server to create a new entity, such as a VLAN, and the server assigns a unique identifier (e.g., VLAN ID) to the new resource. This aligns with the RESTful principle for resource creation, as specified in RFC 7231.

Answer

PUT

Answer

GET

Answer

PATCH

Answer

DELETE

Question 3

A Python script uses the Cisco Meraki API to fetch the list of organizations. The script fails with a 401 HTTP status. What is the most likely cause?

Accepted Answer

The API key is invalid or missing.. A 401 HTTP status indicates 'Unauthorized', which in the context of the Meraki API means the request lacks valid authentication credentials. The most common cause is an invalid or missing API key, as the Meraki API requires a valid API key in the `X-Cisco-Meraki-API-Key` header for all requests.

Answer

The API request exceeded the rate limit.

Answer

The API key does not have permission to list organizations.

Answer

The API endpoint URL is incorrect.

Question 4

A developer is writing a Python script to interact with a REST API. The API requires a JSON payload to create a new resource. Which HTTP method should be used?

Accepted Answer

POST. POST is correct because the HTTP POST method is used to create a new resource on the server, with the resource representation sent in the request body as JSON. POST is neither safe nor idempotent, meaning repeated identical requests may create multiple resources. This matches the requirement to create a new resource via a REST API.

Answer

PATCH

Answer

PUT

Answer

GET

Question 5

In Postman, what feature allows you to reuse a value like a base URL or token across multiple requests?

Accepted Answer

Environments. Environments store variables that can be referenced across requests.

Answer

Mock Servers

Answer

Workspaces

Answer

Collections

Question 6

In the context of SDN, which API is used between the SDN controller and the network devices to configure forwarding behavior?

Accepted Answer

Southbound API. The southbound API is the interface between the SDN controller and the underlying network devices (switches, routers), used to program forwarding tables and configure behavior. Protocols like OpenFlow, NETCONF, and P4 are typical southbound interfaces. The controller translates northbound application intent into southbound device instructions.

Answer

Northbound API

Answer

Eastbound API

Answer

REST API

Question 7

A developer commits code to a GitHub repository and wants automated tests to run, followed by building a Docker image and pushing it to Docker Hub only if tests pass. Which CI/CD tool can be configured using a YAML file placed in the .github/workflows directory?

Accepted Answer

GitHub Actions. GitHub Actions is the only CI/CD tool among the options that uses a YAML workflow file placed in the `.github/workflows` directory within the repository. This allows developers to define automated triggers (e.g., on push) to run tests, build a Docker image, and push it to Docker Hub only if tests pass, all natively integrated with GitHub.

Answer

Jenkins

Answer

CircleCI

Answer

GitLab CI

Question 8

A junior developer is writing a Python script to gather interface statistics from a Cisco IOS-XE device using NETCONF. They use the 'ncclient' library and successfully connect. They want to retrieve the operational status of all interfaces. Which YANG model and XPATH expression should they use to get the operational data?

Accepted Answer

Model: ietf-interfaces, XPATH: /interfaces-state/interface. The 'ietf-interfaces' YANG model defines the '/interfaces-state' container specifically for operational state data (e.g., status, counters), as per RFC 7223. The XPATH '/interfaces-state/interface' retrieves the list of all interfaces with their operational status, which is exactly what the developer needs. The 'ncclient' library can filter using this XPATH to get read-only operational data from a NETCONF-enabled Cisco IOS-XE device.

Answer

Model: cisco-native, XPATH: /native/interface

Answer

Model: ietf-interfaces, XPATH: /interfaces/interface

Answer

Model: ietf-interfaces, XPATH: /interfaces-state

Question 9

Which THREE are best practices for securing a CI/CD pipeline?

Accepted Answer

Use dynamic application security testing (DAST) tools. Option A is correct because DAST tools test the running application from the outside, simulating real attacks against deployed staging or production-like environments to uncover runtime vulnerabilities such as injection flaws, authentication issues, and misconfigurations that static analysis cannot detect. Option B is correct because requiring manual approval before production deployments creates a human gate that prevents unreviewed or malicious code from being automatically promoted to production, supporting change control and separation of duties. Option E is correct because SAST tools analyze source code, bytecode, or binaries early in the pipeline to detect insecure coding patterns like hardcoded secrets, SQL injection, and buffer overflows before the artifact is built or deployed. Option C is wrong because storing credentials in the source code repository exposes secrets to anyone with repo access and to history leaks; secrets should be kept in a dedicated secrets manager or vault. Option D is wrong because running all pipeline steps as the same user violates least privilege and allows a compromised step to escalate across the entire pipeline; each stage should use isolated, minimally privileged identities.

Answer

Store credentials in the source code repository

Answer

Run all pipeline steps as the same user

Question 10

A Kubernetes pod contains two containers that need to share a local filesystem. Which volume type should be used to enable this?

Accepted Answer

emptyDir. An emptyDir volume is created empty when a pod is assigned to a node and exists as long as the pod runs; it can be mounted by multiple containers within the same pod.

Answer

hostPath

Answer

configMap

Answer

persistentVolumeClaim

Question 11

A developer needs to prevent SQL injection in a web application. Which coding practice should be used when constructing database queries?

Accepted Answer

Parameterized queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders (e.g., `?` in MySQLi or `:name` in PDO). This ensures user input is always treated as data, never as executable SQL code, effectively neutralizing SQL injection attacks regardless of the input content.

Answer

CSRF tokens

Answer

Output encoding

Answer

Input validation

Question 12

A CI/CD pipeline uses GitLab CI. The pipeline must build a Docker image and then run security scans on the image before pushing. Which GitLab CI keyword allows defining a sequence of jobs that must run in order?

Accepted Answer

stages. In GitLab CI, the `stages` keyword defines an ordered list of stages, and jobs assigned to those stages run in sequence — all jobs in stage 1 must complete before any job in stage 2 begins. This is exactly how you enforce that a build job finishes before security scan jobs run, and scans finish before the push job.

Answer

before_script

Answer

only

Answer

image

Question 13

A developer is building a real-time video streaming application that must minimize delay, even if some packets are lost. Which transport protocol is most appropriate, and why?

Accepted Answer

UDP, because it has lower overhead and no retransmission delay.. UDP is the correct choice because it has minimal overhead (8-byte header vs TCP's 20+ bytes), no handshake, and no retransmission logic, so lost packets do not stall the stream. For real-time video, a late packet is worse than a lost one, so UDP's fire-and-forget model minimizes delay. Application-layer protocols like RTP/WebRTC build on UDP to handle ordering and loss recovery selectively.

Answer

TCP, because it provides flow control to avoid congestion.

Answer

UDP, because it guarantees packet delivery.

Answer

TCP, because it ensures all packets arrive in order.

Question 14

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

Accepted Answer

Use an idempotent Ansible module that checks for existing VLANs before creating them.. Ansible's idempotent modules, such as `ios_vlan` for Cisco IOS devices, are designed to check the current state of the device before making changes. If the VLAN already exists, the module will report 'ok' and not attempt to create it again, preventing the error and ensuring the playbook completes successfully. This aligns with Ansible's best practice of writing idempotent playbooks that produce the same result regardless of how many times they are run.

Answer

Modify the playbook to skip switches where the VLAN already exists.

Answer

Remove the VLAN from all switches before creating it again.

Answer

Add ignore_errors: yes to the VLAN creation task.

Question 15

A developer needs to register a Webex webhook that triggers when a new message is posted in any room the bot is a member of. Which resource and event should be specified?

Accepted Answer

resource: 'messages', event: 'created'. To listen for new messages in any room the bot is in, use the 'messages' resource and 'created' event.

Answer

resource: 'rooms', event: 'created'

Answer

resource: 'messages', event: 'updated'

Answer

resource: 'memberships', event: 'created'