200-901 Practice Test 43 — 15 Questions

Question 1

A network engineer is using Cisco DNA Center to automate network changes. Which THREE operations are part of the 'Change your network' API category? (Choose three.)

Accepted Answer

Create and assign a site to a device. The 'Change your network' API category in Cisco DNA Center includes operations that actively modify the network state. Creating and assigning a site to a device is a configuration change that associates a physical location with a device, which directly alters the network's logical topology and is part of the site management workflow under this API category.

Answer

Run a command on a device via Command Runner

Answer

Retrieve the list of network devices

Question 2

A developer is integrating with Cisco SD-WAN vManage using REST APIs. After successfully submitting credentials, the API returns a 401 Unauthorized error for subsequent requests. What is the most likely missing step?

Accepted Answer

The session token (X-XSRF-TOKEN) must be obtained and included in subsequent requests.. Cisco SD-WAN vManage uses a two-step authentication process: first, credentials are submitted to obtain a session token (X-XSRF-TOKEN) and a JSESSIONID cookie. If subsequent API requests do not include the X-XSRF-TOKEN in the HTTP header, vManage rejects them with a 401 Unauthorized error, as the token is required for CSRF protection and session validation.

Answer

The request URL must include an API key parameter.

Answer

The API call must use the HTTPS protocol.

Answer

The password must be sent in base64 encoding.

Question 3

An engineer is configuring a new IPv4 subnet with the address 172.16.5.0/25. Which three statements are true about this subnet? (Choose three.)

Accepted Answer

There are 126 usable host addresses.. A /25 prefix length corresponds to a subnet mask of 255.255.255.128, which provides 2^(32-25) - 2 = 128 - 2 = 126 usable host addresses. The network address is 172.16.5.0, and the broadcast address is 172.16.5.127, leaving addresses 172.16.5.1 through 172.16.5.126 for hosts.

Answer

The subnet mask is 255.255.255.192.

Answer

The network address is 172.16.5.128.

Question 4

A developer is implementing a Cisco Intersight API solution to manage multiple UCS domains. They receive an HTTP 403 Forbidden response when trying to create an organization. What is the most likely issue?

Accepted Answer

The user account does not have sufficient privileges. An HTTP 403 Forbidden response indicates that the server understood the request but is refusing to authorize it. In the context of Cisco Intersight, this typically means the API key or user account associated with the request lacks the required privileges to perform the action, such as creating an organization. Only accounts with administrative or appropriate role-based access control (RBAC) permissions can create organizations.

Answer

The request body is malformed

Answer

The API key is invalid

Answer

The organization already exists

Question 5

A large enterprise uses Cisco DNA Center to manage its campus network. The network team has automated wireless SSID provisioning using the Intent API. Recently, a new SSID was created but it does not appear on the wireless LAN controllers. The Python script that calls the API returns a 200 OK response, but the SSID is not deployed. The script uses the POST /dna/intent/api/v1/ssid endpoint with a JSON body containing the SSID name and security settings. A day later, the SSID is still missing. The engineer checks the DNA Center GUI and sees the SSID in the 'Design' section but with a 'Provisioning Failed' status. Which step should the engineer take next to resolve the issue?

Accepted Answer

Use the 'Provision' API endpoint to deploy the SSID to the targeted sites. The 200 OK response from the POST /dna/intent/api/v1/ssid endpoint only confirms that the API request was accepted and the SSID configuration was created in the DNA Center design database. It does not automatically trigger deployment to the wireless LAN controllers. The 'Provisioning Failed' status in the GUI indicates that the SSID was designed but not successfully deployed to the targeted sites. To complete the deployment, the engineer must use the Intent API's 'Provision' endpoint (e.g., POST /dna/intent/api/v1/provision) to push the SSID configuration to the specific sites or devices, which is the missing step.

Answer

Re-run the same API call and ignore the 200 response

Answer

Delete the SSID and recreate it with a different name

Answer

Wait for the next scheduled provisioning cycle

Question 6

An engineer is troubleshooting a network issue where a client cannot reach a server. The client uses HTTPS. Which TWO factors are essential for a successful TLS handshake?

Accepted Answer

The server must have a valid digital certificate. The server must present a valid digital certificate during the TLS handshake to prove its identity to the client. This certificate contains the server's public key and is signed by a trusted Certificate Authority (CA), enabling the client to verify the server's authenticity before proceeding with encrypted communication.

Answer

The handshake uses UDP for faster negotiation

Answer

The client must present a certificate to the server

Answer

The client must have a public key to encrypt the session

Question 7

A developer is working on a Python application that automates the configuration of multiple Cisco IOS-XE devices using RESTCONF. The application uses the requests library. The developer notices that sometimes the PUT request to update the interface description returns a 409 Conflict error. Upon investigation, the developer finds that the issue occurs when two instances of the application are running concurrently and attempt to update the same interface. The developer wants to implement a strategy to avoid conflicts. Which approach is most effective?

Accepted Answer

Use a distributed lock mechanism to ensure exclusive access. A distributed lock mechanism (Option B) is the most effective approach because it ensures exclusive access to the shared resource (the interface configuration) across multiple application instances. In a concurrent environment, retries (Option A) cannot prevent the fundamental race condition—both instances may still attempt conflicting writes. A distributed lock, such as one based on Redis or ZooKeeper, serializes access, guaranteeing that only one instance modifies the interface at a time, which directly resolves the 409 Conflict error from RESTCONF.

Answer

Implement a retry mechanism with exponential backoff and random jitter

Answer

Change the PUT to PATCH and hope for partial updates

Answer

Use a timestamp in the request to force overwrite

Question 8

A network automation engineer is using Ansible to manage Cisco IOS devices. The playbook includes a task that executes a 'show version' command and registers the output. The engineer then wants to parse the output to extract the IOS version. Which approach should be used?

Accepted Answer

Use the 'cisco.ios.ios_facts' module to get structured facts. The 'cisco.ios.ios_facts' module retrieves structured data from Cisco IOS devices, including the IOS version as a key-value pair in the Ansible facts dictionary. This eliminates the need for manual parsing, as the module uses the device's CLI or NETCONF to gather structured output, making it the most efficient and reliable approach for extracting specific device attributes.

Answer

Use the 'cisco.ios.ios_command' module and parse the output with regex

Answer

Use the 'cisco.ios.ios_command' module and the 'parse' option

Answer

Use the 'cisco.ios.ios_config' module to retrieve the version

Question 9

An engineer configures a trunk port as shown. A device connected to this port sends an untagged frame. Which VLAN will the switch associate the frame with?

Accepted Answer

VLAN 99. The switchport trunk native vlan 99 command configures VLAN 99 as the native VLAN for the trunk port. When an untagged frame arrives on a trunk port, the switch associates it with the native VLAN. Therefore, the frame is placed into VLAN 99.

Answer

VLAN 1

Answer

The frame is dropped

Answer

VLAN 10

Question 10

A network administrator is deploying a custom container application on a Cisco Catalyst 9300 switch running IOS XE 16.12. The application is packaged as a .tar file and installed using 'app-hosting install app myapp flash:myapp.tar'. The administrator configures the app-hosting context as follows:

app-hosting app myapp
 app-default-gateway 192.168.1.1
 app-vnic gateway0 guest-interface 0
  guest-ipaddress 192.168.1.10 netmask 255.255.255.0
 app-resource profile custom
  cpu 1000
  memory 2048
  storage 5000

The administrator also creates a virtual port group 'vg0' and assigns it to the management interface. The application fails to start with the error: 'Application failed to start: guest interface not ready'. The administrator verifies that the .tar file is valid, the resources are sufficient, and the gateway is reachable. What is the most likely cause of the failure?

Accepted Answer

The guest-interface is not bound to the virtual port group.. The error 'guest interface not ready' indicates that the virtual network interface defined in the app-hosting configuration is not properly linked to a virtual port group on the switch. In IOS XE, the 'app-vnic gateway0 guest-interface 0' command must be associated with a virtual port group (e.g., 'vpg vg0') using the 'guest-interface 0' binding under the virtual port group configuration. Without this binding, the guest interface remains uninitialized, preventing the container from starting.

Answer

The application requires a DHCP server, but the configuration uses a static IP address.

Answer

The .tar file is corrupt despite appearing valid.

Answer

The CPU allocation of 1000 units is insufficient for the application.

Question 11

A developer is creating a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. Which HTTP method should be used to get the data?

Accepted Answer

GET. RESTCONF uses standard HTTP methods to perform CRUD operations on YANG-defined data. To retrieve interface statistics without modifying any resource, the GET method is correct, as it maps directly to the NETCONF or operation for reading data.

Answer

POST

Answer

PUT

Answer

DELETE

Question 12

An application uses UDP. Which characteristic is true about this application's communication?

Accepted Answer

It is connectionless. UDP is a connectionless transport protocol, meaning it does not establish a dedicated end-to-end connection before sending data. This characteristic allows for low-latency, best-effort delivery without the overhead of connection setup, which is ideal for applications like DNS queries or streaming media where speed is prioritized over reliability.

Answer

It guarantees packet delivery

Answer

It retransmits lost packets

Answer

It performs a three-way handshake

Question 13

An application sends many requests to the Meraki API and receives HTTP 429 errors. The response includes a 'Retry-After' header. What does this status code indicate?

Accepted Answer

The client has exceeded the rate limit. HTTP 429 means too many requests; rate limiting is in effect. Retry-After indicates the wait time.

Answer

The requested resource was not found

Answer

The server encountered an internal error

Answer

The API key is invalid

Question 14

A developer is building a web application and wants to implement security best practices. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use CSRF tokens in forms. B is correct because CSRF tokens are a standard defense against Cross-Site Request Forgery attacks. By embedding a unique, unpredictable token in each form and validating it on the server, the application ensures that requests originate from the legitimate user session, not from a malicious third-party site. This is a fundamental security best practice for web applications handling state-changing requests.

Answer

Use parameterized queries for SQL

Answer

Store passwords in plaintext

Answer

Disable HTTPS to improve performance

Question 15

A company uses Ansible to automate configuration of its Cisco IOS XE routers. The network team recently upgraded the routers' software from IOS 15.x to IOS XE 17.x. Since the upgrade, the Ansible playbook fails intermittently with the message: 'Failed to connect to the host via ssh: timed out'. However, the team can SSH manually to the routers from the Ansible control node without issues. The playbook uses the 'cisco.ios.ios_config' module with default SSH options. The routers have been configured with SSH version 2 and local authentication. The Ansible control node runs Red Hat Enterprise Linux 8. Which action should the network engineer take to resolve the issue?

Accepted Answer

Increase the SSH timeout in the Ansible configuration file (ansible.cfg) to 60 seconds.. The intermittent SSH timeout after upgrading to IOS XE 17.x is likely due to slower key exchange algorithms (e.g., diffie-hellman-group-exchange-sha256) that increase connection setup time. Increasing the SSH timeout in ansible.cfg (e.g., setting timeout=60) gives the SSH handshake enough time to complete, avoiding the timeout. Forcing SSHv1 is not recommended as it is deprecated and may not be supported. Host key checking (option C) does not affect timeout, and using a different module (option D) does not solve the underlying connectivity issue.

Answer

Configure the routers to use SSH version 1 only.

Answer

Set the 'host_key_checking' option to False in ansible.cfg.

Answer

Use the 'ios_command' module instead of 'ios_config' to perform the tasks.