200-901 Practice Test 44 — 15 Questions

Question 1

When using the Cisco Meraki Dashboard API to create an HTTP webhook for network alerts, which authentication method is required in the request header?

Accepted Answer

X-Cisco-Meraki-API-Key: <your_api_key>. The Cisco Meraki Dashboard API requires authentication via a custom HTTP header named `X-Cisco-Meraki-API-Key`, where the value is your API key. This is the only supported method for authenticating requests to the Meraki API, as documented in the official API reference. Option D correctly specifies this header, making it the required authentication method for creating an HTTP webhook for network alerts.

Answer

Authorization: Bearer <token>

Answer

Include the API key as a query parameter.

Answer

Authorization: Basic <base64>

Question 2

A network engineer is configuring a new switch and needs to ensure that frames from VLAN 10 and VLAN 20 are isolated on the same trunk link to another switch. Which IEEE standard should be configured on the trunk interfaces?

Accepted Answer

802.1Q. C is correct because 802.1Q is the IEEE standard that defines VLAN tagging, allowing multiple VLANs (such as VLAN 10 and VLAN 20) to be carried over a single trunk link while maintaining isolation between them. By inserting a 4-byte VLAN tag into the Ethernet frame, 802.1Q enables the receiving switch to identify which VLAN a frame belongs to, ensuring traffic from different VLANs remains separate.

Answer

802.3

Answer

802.11

Answer

802.1X

Question 3

In Cisco DNA Center, which API category includes the ability to deploy a configuration template to devices?

Accepted Answer

Change your network. The 'Change your network' category includes template deployment, plug and play, and other configuration changes.

Answer

Run your network

Answer

Know your network

Answer

Platform

Question 4

When using the Cisco Meraki Dashboard API to create an HTTP webhook for network alerts, which authentication method is required in the request header?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The API uses cursor-based pagination; the next page can be retrieved using the provided URL.. The Link header with rel="next" provides the URL for the next page of results; cursor-based pagination is used via startingAfter.

Answer

The API uses offset-based pagination and the next offset is 123.

Answer

The request should be retried after 123 seconds.

Answer

The response is limited to 10 items, and 123 items remain.

Question 5

A Python script using the requests library to query the Cisco Meraki API returns a 403 Forbidden error. The API key is correctly set in the header. What is the most likely cause?

Accepted Answer

The API key does not have permission for the requested resource. A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. Since the API key is correctly set in the header, the most likely cause is that the API key lacks the necessary permissions (e.g., read-only key trying to modify resources, or key scoped to a different organization) for the specific resource being accessed. In Cisco Meraki, API keys are tied to specific organizations and roles, and a 403 is the standard response when the key does not have the required access rights.

Answer

The request URL is incorrect

Answer

The API endpoint is rate-limiting the request

Answer

The Content-Type header is missing

Question 6

A developer needs to retrieve interface configuration from a Cisco IOS XE device using NETCONF. Which operation should be used?

Accepted Answer

with filter. To retrieve interface configuration from a Cisco IOS XE device using NETCONF, the operation with a filter is the correct choice. retrieves the running configuration datastore, and the filter (typically an XML subtree filter) narrows the response to only the interface subtree, avoiding unnecessary data. This is the standard NETCONF operation for reading configuration data, as defined in RFC 6241.

Answer

<get> with filter

Answer

<delete-config>

Answer

<edit-config>

Question 7

Which TWO Kubernetes resources are used to provide configuration data to pods? (Choose TWO.)

Accepted Answer

Secret. Secret (A) is correct because it stores sensitive configuration data such as passwords, tokens, and TLS keys, which pods can consume as environment variables or mounted files. ConfigMap (C) is correct because it stores non-sensitive configuration data as key-value pairs or configuration files that pods can inject via environment variables, command-line arguments, or volume mounts. PersistentVolumeClaim (B) is incorrect because it requests persistent storage for a pod, not configuration data. Deployment (D) is incorrect because it manages the desired state and rollout of replicated pods, not their configuration values. Service (E) is incorrect because it provides stable network access and load balancing to a set of pods, not configuration data.

Answer

PersistentVolumeClaim

Answer

Deployment

Answer

Service

Question 8

A DevOps team is implementing a CI/CD pipeline for network services using Cisco NSO (Network Services Orchestrator). They have a Python script that uses the NSO RESTCONF API to create a new VPN service instance. The script passes all integration tests in the staging environment, but when deployed to production, the 'POST' request to /api/run/vpn-service returns a 500 Internal Server Error. The team checks the NSO logs and finds the error 'Error: No such device: device-xr-1'. The production NSO instance manages multiple devices, and device-xr-1 is one of them. The team confirms device-xr-1 is reachable and managed by NSO in the production environment. What is the most likely cause of this error?

Accepted Answer

The YANG service model expects a device name that does not match the device's name in NSO's device list.. The error 'No such device: device-xr-1' indicates that the YANG service model references a device name that does not match the actual device name configured in NSO's device list. Even though device-xr-1 is reachable and managed by NSO, the service model's 'device' leaf expects a specific name (e.g., 'xr-1' or 'device-xr-1-prod'), and the mismatch causes NSO to fail when trying to map the service to the device. This is a common issue when service YANG models are developed with hardcoded or environment-specific device names that differ between staging and production.

Answer

The production NSO instance uses a different authentication method for device-xr-1.

Answer

The device configuration in NSO is out of sync; a sync-from is needed before service creation.

Answer

The production NSO instance has insufficient memory to handle the request.

Question 9

Which THREE are common best practices for implementing CI/CD in network automation?

Accepted Answer

Use version control for all automation scripts and playbooks. Version control (e.g., Git) is a fundamental CI/CD best practice: it tracks changes, enables rollbacks, and supports collaboration on automation scripts and playbooks. Without version control, you lose auditability and the ability to reliably reproduce network states, which violates the principle of infrastructure as code.

Answer

Perform manual testing after every deployment

Answer

Store credentials and secrets in code repositories

Question 10

A network engineer needs to retrieve a list of all network devices from Cisco DNA Center. Which API endpoint should they use?

Accepted Answer

GET /dna/intent/api/v1/network-device. The correct endpoint to retrieve the device list in Cisco DNA Center is GET /dna/intent/api/v1/network-device.

Answer

POST /dna/system/api/v1/auth/token

Answer

GET /dna/intent/api/v1/issues

Answer

GET /dna/intent/api/v1/topology/l2/{vlanID}

Question 11

A network administrator is configuring a wireless network and wants to minimize interference. In the 2.4 GHz band, which set of channels are non-overlapping?

Accepted Answer

1, 6, 11. In the 2.4 GHz ISM band, the available channels are spaced 5 MHz apart, but each Wi-Fi channel is 20 MHz wide, so adjacent channels overlap. Only channels 1, 6, and 11 are spaced far enough apart (25 MHz between centers) to avoid overlapping in North America, making them the standard non-overlapping set. Using these three channels allows multiple access points to operate in close proximity with minimal co-channel interference.

Answer

1, 5, 9, 13

Answer

1, 3, 5, 7, 9, 11

Answer

2, 7, 12

Question 12

Which TWO of the following Git commands modify the commit history? (Select TWO)

Accepted Answer

git commit --amend. git commit --amend is correct because it rewrites the most recent commit, replacing it with a new commit object that includes staged changes and/or an edited commit message, thereby altering commit history. git rebase -i is correct because interactive rebase lets you reorder, edit, squash, split, or drop existing commits, which rewrites the branch's commit history and produces new commit SHAs. The other options are read-only inspection commands: git diff shows unstaged or staged changes between working tree, index, and commits, git log displays the commit history, and git status reports working tree and index state — none of them modify commit history.

Answer

git diff

Answer

git log

Answer

git status

Question 13

Which THREE of the following are key characteristics of a RESTful API? (Choose three.)

Accepted Answer

Resource-based URLs. Option A (Resource-based URLs) is correct because REST models everything as a resource identified by a URI, such as /users/123, so each endpoint represents a distinct resource rather than an action. Option B (Stateless communication) is correct because each REST request must contain all information needed to process it, and the server does not retain client session state between requests. Option E (Uses standard HTTP methods (GET, POST, PUT, DELETE)) is correct because REST leverages HTTP verbs to perform CRUD operations on resources, with GET for retrieval, POST for creation, PUT for update/replace, and DELETE for removal. Option C (Uses SOAP protocol) is incorrect because SOAP is a separate XML-based messaging protocol, whereas REST is an architectural style that typically uses HTTP and can return JSON or XML. Option D (Relies on session cookies for state) is incorrect because REST is stateless and does not depend on server-side sessions or cookies to maintain client state.

Answer

Uses SOAP protocol

Answer

Relies on session cookies for state

Question 14

Which THREE of the following are common security vulnerabilities listed in the OWASP Top 10? (Choose three.)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) (A) is correct because it is a long-standing OWASP Top 10 category (A03:2021 Injection, and previously A07:2017), covering flaws where untrusted input is rendered to browsers without proper output encoding. Broken Access Control (B) is correct because it is ranked A01:2021 in the OWASP Top 10, encompassing failures such as missing authorization checks, IDOR, and privilege escalation. SQL Injection (D) is correct because it is a classic OWASP Top 10 vulnerability, now folded into A03:2021 Injection, arising when untrusted input is concatenated into SQL queries instead of using parameterized statements. Multi-Factor Authentication (C) is not a vulnerability but a security control that mitigates credential-based attacks, so it does not belong. DNS Cache Poisoning (E) is a real attack technique against DNS resolvers, but it is not one of the categories listed in the OWASP Top 10, which focuses on web application security risks.

Answer

Multi-Factor Authentication

Answer

DNS Cache Poisoning

Question 15

A company is implementing an API gateway for its microservices. Which TWO security features should be enabled at the gateway to protect backend services?

Accepted Answer

JWT validation.. JWT validation (C) is correct because the API gateway should authenticate and authorize requests by verifying the signature, issuer, audience, and expiry of JSON Web Tokens before forwarding traffic to backend microservices, offloading this concern from each service. Rate limiting (E) is correct because throttling requests per client, API key, or IP at the gateway mitigates abuse, brute-force attempts, and denial-of-service traffic before it reaches backend services. In-depth packet inspection (A) is a network-layer/IDS-IPS function, not a typical API gateway security feature, and is unnecessary here. Database connection pooling (B) is a performance/scalability concern, not a security control, and gateways do not manage backend database connections. CORS configuration (D) is a browser-origin policy mechanism for controlling cross-origin requests; while often configured at a gateway, it is not primarily a backend-protection security feature for microservice APIs.

Answer

In-depth packet inspection.

Answer

Database connection pooling.

Answer

CORS configuration.