200-901 Practice Test 48 — 15 Questions

Question 1

A developer uses Cisco Intersight API to manage UCS servers. Which authentication method is required for Intersight API calls?

Accepted Answer

API key with HMAC signature. Cisco Intersight API requires API key authentication with HMAC (Hash-Based Message Authentication Code) signing for all REST API calls. The developer generates an API key pair (private and public) in the Intersight GUI, then uses the private key to create an HMAC-SHA256 signature over the request headers and payload. This signature is included in the Authorization header, ensuring request integrity and non-repudiation without transmitting the secret key over the network.

Answer

OAuth2 token from Webex

Answer

Session cookie

Answer

Basic authentication with username/password

Question 2

Which TWO statements accurately describe characteristics of infrastructure as code (IaC) in network automation?

Accepted Answer

IaC tools use declarative or imperative models to define the desired state of network infrastructure.. Infrastructure as Code (IaC) tools like Ansible, Terraform, and Cisco NSO allow network engineers to define the desired state of infrastructure using either declarative (what the end state should be) or imperative (step-by-step instructions) models. This abstraction enables consistent, repeatable deployments and reduces configuration drift across the network.

Answer

IaC eliminates the need for manual review of configuration changes before deployment.

Answer

IaC requires that all network devices be replaced with software-based equivalents.

Answer

IaC is only applicable to virtual network functions, not physical devices.

Question 3

Refer to the exhibit. An engineer applied this configuration to a Cisco switch port connected to an application server. The server runs a critical business application that should not be disrupted. However, after applying the configuration, the port goes into errdisable state. What is the most likely cause?

Accepted Answer

The server is generating BPDU frames, triggering BPDU guard.. BPDU guard is enabled on the switch port (implicitly or explicitly via spanning-tree bpduguard enable). When the application server sends BPDU frames—perhaps because it is running a software bridge, virtualization host, or has a misconfigured NIC—the switch detects these frames on a port configured with portfast and immediately errdisables the port to prevent a potential bridging loop. This matches the symptom of the port going into errdisable state after applying the configuration.

Answer

The VLAN 10 does not exist on the switch.

Answer

The spanning-tree portfast command is incompatible with access ports.

Answer

The switchport mode access command is incorrect for a server connection.

Question 4

An engineer wants to verify that a switch port is configured as an access port in VLAN 10. Which command provides this information?

Accepted Answer

show running-config interface. The `show running-config interface` command displays the current operational configuration of a specific interface, including whether it is configured as an access port and which VLAN it is assigned to. For a switch port in VLAN 10, the output will show `switchport mode access` and `switchport access vlan 10`, directly confirming the desired configuration.

Answer

show interfaces status

Answer

show ip interface brief

Answer

show vlan brief

Question 5

During an automation script run, a network device returns HTTP 429. What does this indicate?

Accepted Answer

Rate limiting. HTTP 429 (Too Many Requests) indicates the client has sent too many requests in a given amount of time, triggering rate limiting on the server. In network automation, devices like routers or switches enforce rate limits to prevent resource exhaustion, often based on RFC 6585. This is common when automation scripts exceed API call thresholds, requiring retry logic with exponential backoff.

Answer

Internal server error

Answer

Authentication failure

Answer

Resource not found

Question 6

A Python script uses a try/except block to handle API errors. If the API returns a 429 status code, which mechanism should the script implement to handle the error appropriately?

Accepted Answer

Wait for the time specified in the Retry-After header and then retry. A 429 status code indicates the client has sent too many requests in a given amount of time (rate limiting). The HTTP specification (RFC 6585) recommends including a Retry-After header in the response, which tells the client how long to wait before retrying. Implementing a wait based on this header and then retrying is the correct and respectful way to handle rate limiting, allowing the script to eventually succeed without overwhelming the server.

Answer

Switch to a different API endpoint

Answer

Log the error and continue without retrying

Answer

Immediately retry the same request without delay

Question 7

An engineer is tasked with automating the backup of running configurations from 50 routers. Which approach is most scalable?

Accepted Answer

Use an Ansible playbook with ios_config backup. An Ansible playbook with the ios_config module's backup option is the most scalable approach because it uses a push-based automation model that can manage all 50 routers from a single control node, leveraging SSH for secure transport and idempotent configuration management without requiring any agent on the routers.

Answer

SSH manually to each router and copy config

Answer

Schedule a cron job on each router to SCP config

Answer

Use SNMP to capture config

Question 8

An application sends a packet with destination IP 10.0.0.10. The sending host's routing table has a default gateway of 10.0.0.1. The host's ARP cache is empty. What is the next step after the host determines the packet should go to the default gateway?

Accepted Answer

Sends an ARP request for 10.0.0.1. When the host determines that the destination IP (10.0.0.10) is not on the same subnet and must be sent to the default gateway (10.0.0.1), it needs the gateway's MAC address to encapsulate the packet in a Layer 2 frame. Since the ARP cache is empty, the host must send an ARP request for the IP address of the default gateway (10.0.0.1) to obtain its MAC address before the packet can be forwarded.

Answer

Sends the packet to the DNS server

Answer

Sends the packet directly to 10.0.0.10

Answer

Sends an ARP request for 10.0.0.10

Question 9

Which TWO of the following are valid ways to handle errors in a Python program that uses the Cisco Meraki API?

Accepted Answer

Checking the response body for an 'errors' key and handling accordingly. The Cisco Meraki API commonly returns a JSON response body containing an 'errors' key when a request fails, even when the HTTP status code is not a traditional 4xx or 5xx. Checking this key allows the developer to extract specific error messages from the API, enabling precise handling of issues like invalid parameters or permission errors. This approach aligns with Meraki's documented error response format, where the 'errors' field provides an array of human-readable strings detailing what went wrong.

Answer

Assuming the API always returns 200 and logging success

Answer

Retrying the request indefinitely until success

Answer

Using a try-except block around the API call and catching generic Exception

Question 10

A Python script using the requests library to query the Cisco Meraki API returns a 403 Forbidden error. The API key is correctly set in the header. What is the most likely cause?

Accepted Answer

The API key does not have permission for the requested resource. A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. Since the API key is correctly set in the header, the most likely cause is that the API key lacks the necessary permissions (e.g., read-only key trying to modify resources, or key scoped to a different organization) for the specific resource being accessed. In Cisco Meraki, API keys are tied to specific organizations and roles, and a 403 is the standard response when the key does not have the required access rights.

Answer

The request URL is incorrect

Answer

The API endpoint is rate-limiting the request

Answer

The Content-Type header is missing

Question 11

Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?

Accepted Answer

Wrong SSH username or password. The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.

Answer

The device is unreachable

Answer

The playbook syntax is incorrect

Answer

The device is not running IOS

Question 12

Which THREE of the following are layers in the OSI model? (Select exactly three.)

Accepted Answer

Transport. The Transport layer (Layer 4) of the OSI model is correct because it provides end-to-end communication, error recovery, and flow control between hosts. Protocols such as TCP and UDP operate at this layer, ensuring reliable or connectionless data delivery as required by applications.

Answer

Internet

Answer

Network Access

Question 13

Refer to the exhibit. A developer needs to authenticate to this router via NETCONF using the devuser credentials. Why might authentication fail?

Accepted Answer

The devuser has privilege level 1, which is not enough for NETCONF access. NETCONF access requires a minimum privilege level of 15 on Cisco IOS/IOS-XE devices. The devuser has privilege level 1, which restricts the user to basic monitoring commands and prevents NETCONF operations. Even with correct SSH and authentication, the privilege level mismatch causes the NETCONF session to be rejected.

Answer

NETCONF requires AAA authentication

Answer

The password is encrypted with type 5

Answer

The username does not have SSH access

Question 14

Which three actions can an EEM applet perform when triggered? (Choose three.)

Accepted Answer

Execute a CLI command. EEM (Embedded Event Manager) applets can execute CLI commands when triggered by an event. This allows automation of operational tasks such as configuration changes or troubleshooting commands without manual intervention.

Answer

Modify a YANG data model

Answer

Create a new VLAN

Question 15

Which TWO of the following are common methods for authenticating to Cisco REST APIs? (Choose two.)

Accepted Answer

API Key. API Key authentication (Option A) is a common method for Cisco REST APIs, such as those on Cisco DNA Center and Meraki, where a pre-generated key is included in the HTTP header (e.g., 'X-Cisco-Meraki-API-Key') to identify the client. OAuth 2.0 (Option D) is widely used in Cisco platforms like Webex Teams and Cisco DNA Center for delegated access, issuing a bearer token after an authorization flow. Both methods are officially supported and documented for Cisco REST API authentication.

Answer

Certificate-based Authentication

Answer

NTLM Authentication

Answer

Basic Authentication