200-901 Practice Test 45 — 15 Questions

Question 1

A DevOps team is securing a CI/CD pipeline that deploys containerized applications to Kubernetes. Which THREE practices enhance security?

Accepted Answer

Implementing network policies to restrict pod communication.. Option A is correct because Kubernetes NetworkPolicies provide pod-level segmentation, restricting ingress and egress traffic so a compromised pod cannot freely reach other workloads, which enforces least-privilege communication in the cluster. Option C is correct because scanning container images for known CVEs before deployment shifts vulnerability detection into the CI stage, preventing flawed images from ever reaching the registry or cluster. Option E is correct because Kubernetes Secrets store sensitive data such as credentials and API keys separately from image and pod specs, allowing RBAC-controlled access and avoiding hardcoded plaintext values in manifests or environment files. Option B does not belong because privileged containers disable key isolation controls and grant near-host-level capabilities, greatly expanding the attack surface. Option D does not belong because running containers as root violates least privilege and means a container escape or exploit yields root-level access on the host.

Answer

Allowing containers to run with privileges.

Answer

Running containers as root.

Question 2

An application is secured using OAuth 2.0 for Cisco Webex API access. Which three components are involved in the authorization code grant flow? (Choose three.)

Accepted Answer

Client Secret. In the OAuth 2.0 authorization code grant flow used for Cisco Webex API access, the Client ID (B) is the public identifier the application presents to the Webex authorization server to identify itself during the authorization request, making it a required component. The Client Secret (A) is the confidential credential the application uses when exchanging the authorization code at the token endpoint, authenticating the client to the Webex authorization server. The Authorization Code (C) is the short-lived credential returned to the redirect URI after the user grants consent, which the client then exchanges for access and refresh tokens, so it is central to this grant type. The Refresh Token (D) is not part of the initial authorization code grant exchange itself—it is an optional token that may be issued alongside the access token for later use to obtain new access tokens. An API Key (E) is a separate static credential mechanism and is not a component of the OAuth 2.0 authorization code grant flow.

Answer

Refresh Token

Answer

API Key

Question 3

A developer is creating a REST API client that needs to authenticate using credentials passed in the HTTP header. Which header should be used?

Accepted Answer

Authorization. The Authorization header is the standard HTTP header used to transmit credentials (such as Basic, Bearer, or Digest tokens) to authenticate a REST API client. RFC 7235 defines this header as the mechanism for carrying authentication information from the client to the server, making it the correct choice for passing credentials in the HTTP header.

Answer

Host

Answer

Content-Type

Answer

Cookie

Question 4

A developer is designing a REST API for managing network devices. The API should support idempotent operations for updating device configuration. Which HTTP method should be used for the update operation?

Accepted Answer

PUT. PUT is the correct HTTP method for idempotent updates because it replaces the entire resource at a given URI with the request body. Idempotency means that multiple identical PUT requests produce the same result as a single request, which is essential for safely retrying configuration updates without side effects. This aligns with RFC 7231, which defines PUT as idempotent.

Answer

DELETE

Answer

PATCH

Answer

POST

Question 5

A developer writes a Python script to read a configuration file. Which code snippet correctly opens the file 'config.json' for reading and ensures the file is closed after use?

Accepted Answer

with open('config.json', 'r') as f:
    data = f.read(). It uses the `with` statement, which is a context manager that automatically calls `f.close()` when the block exits, ensuring the file is properly closed even if an exception occurs. The `'r'` mode opens the file for reading, and `f.read()` reads the entire contents into the `data` variable.

Answer

open('config.json', 'r') as f:
    data = f.read()

Answer

with open('config.json', 'r') as f, data = f.read()

Answer

file = open('config.json', 'r')
data = file.read()
file.close()

Question 6

Which IPv6 address type is equivalent to a private IPv4 address?

Accepted Answer

Unique local. Unique local addresses (ULA) in IPv6, defined in RFC 4193, are the equivalent of private IPv4 addresses (RFC 1918) because they are intended for local communication within a site or organization and are not routable on the global internet. They use the prefix fc00::/7, with the L bit set to 1 (fd00::/8) for locally assigned addresses, ensuring uniqueness within a site without requiring global registration.

Answer

Multicast

Answer

Global unicast

Answer

Link-local

Question 7

A company has multiple subnets. A device in subnet 192.168.1.0/24 needs to communicate with a device in subnet 192.168.2.0/24. What is required for this communication?

Accepted Answer

A router or Layer 3 switch. Devices in different subnets (192.168.1.0/24 and 192.168.2.0/24) are on separate Layer 3 networks. To forward packets between these subnets, a router or Layer 3 switch is required to perform IP routing, using the destination IP address to determine the next hop. Without a Layer 3 device, the frames cannot leave the local broadcast domain.

Answer

A DNS server

Answer

A VLAN

Answer

A bridge

Question 8

Which Python list comprehension correctly creates a list of squares for even numbers from 0 to 10?

Accepted Answer

[x**2 for x in range(11) if x % 2 == 0]. It uses list comprehension syntax with `x**2` to square each number, iterates over `range(11)` to include numbers 0 through 10, and applies the condition `if x % 2 == 0` to filter only even numbers. This produces the list `[0, 4, 16, 36, 64, 100]` as required.

Answer

[x*2 for x in range(11) if x % 2 == 0]

Answer

[x**2 for x in range(10) if x % 2]

Answer

[x**2 for x in range(10) if x % 2 == 0]

Question 9

A Kubernetes pod needs to read configuration data such as database hostname, which is non-sensitive and may change across environments. Which resource should be used to store this data and inject it into the pod?

Accepted Answer

ConfigMap. ConfigMap stores non-sensitive configuration data. Secret stores sensitive data. Deployment and Service are for workload and networking.

Answer

Deployment

Answer

Secret

Answer

Service

Question 10

Which TWO of the following are best practices when using REST APIs in Cisco networking environments?

Accepted Answer

Always handle HTTP error codes like 4xx and 5xx.. Option C is correct because robust REST API clients must inspect and handle HTTP status codes, treating 4xx responses (e.g., 400 Bad Request, 401 Unauthorized, 404 Not Found) as client-side errors and 5xx responses (e.g., 500 Internal Server Error, 503 Service Unavailable) as server-side failures, so the application can retry, back off, or surface meaningful errors instead of silently failing. Option E is correct because caching responses (honoring headers such as Cache-Control, ETag, and Last-Modified) reduces redundant API calls, which lowers latency and CPU load on Cisco controllers and switches that have limited management-plane resources. Option A is not a best practice because sending credentials as plain text exposes them to interception; credentials should be sent over HTTPS using tokens or Basic Auth only within TLS. Option B is not a best practice because polling every second creates excessive load and is inefficient; webhooks, streaming telemetry, or longer polling intervals with conditional requests should be used. Option D is not a best practice because embedding API keys in URL query parameters leaks them into logs, browser history, and proxies; keys should be sent in headers or stored in a secrets manager.

Answer

Send credentials as plain text in every request.

Answer

Poll the API every second to get real-time updates.

Answer

Embed API keys directly in the URL query parameters.

Question 11

A DevOps engineer is implementing Infrastructure as Code (IaC) for network devices. Which of the following practices is most critical to ensure that the environment state matches the desired configuration defined in code?

Accepted Answer

Ensuring that the automation tool is idempotent.. Idempotency ensures that applying the same configuration multiple times always results in the same desired state, regardless of the current state of the device. This is the most critical practice for IaC because it prevents configuration drift and guarantees that the environment state matches the code-defined configuration. Without idempotency, repeated runs of the automation tool could introduce unintended changes or fail to correct deviations.

Answer

Using Jinja2 templates to generate device configurations.

Answer

Using version control for all configuration files.

Answer

Implementing rollback procedures for failed deployments.

Question 12

A web application is vulnerable to SQL injection. Which secure coding practice should the developer implement in the code to prevent this?

Accepted Answer

Use parameterised queries for database access.. Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

Answer

Escape all user input with htmlspecialchars.

Answer

Use a CAPTCHA on the login form.

Question 13

A developer wants to ensure that a containerized application restarts automatically if it exits with a non-zero code. The application is run using Docker. Which flag should be used?

Accepted Answer

--restart on-failure. The --restart flag with 'on-failure' restarts the container only if it exits with a non-zero code, which indicates an error.

Answer

--restart always

Answer

--restart unless-stopped

Answer

--restart no

Question 14

A Cisco SD-WAN vManage API call to retrieve device inventory returns a 401 error. Which step is most likely missing?

Accepted Answer

The authentication token is expired or invalid. A 401 Unauthorized error in Cisco SD-WAN vManage API indicates that the request lacks valid authentication credentials. The vManage API uses token-based authentication (typically a JSON Web Token, JWT) obtained via a POST to /j_security_check or /authenticate. If the token is expired, malformed, or not included in the Authorization header, the API returns 401. This is the most likely cause because the other options would produce different HTTP status codes (e.g., 400 for missing fields, 502 for unreachable device, 404 for incorrect endpoint).

Answer

The request body is missing required fields

Answer

The device is unreachable

Answer

The API endpoint is incorrect

Question 15

A developer is building a REST API client in Python using the requests library. They need to send a JSON payload with authentication. Which code snippet correctly sends a POST request with a JSON body and a Bearer token?

Accepted Answer

requests.post(url, json=payload, headers={'Authorization': f'Bearer {token}'}). The correct way is to use json parameter for JSON body and headers for authorization.

Answer

requests.post(url, data=payload, auth=token)

Answer

requests.post(url, data=json.dumps(payload), headers={'Authorization': token})

Answer

requests.post(url, params=payload, auth=('Bearer', token))