200-901 Practice Test 50 — 15 Questions

Question 1

A team is implementing a CI/CD pipeline using Jenkins. The pipeline must build a Docker image and push it to a private registry. Which Jenkins plugin is specifically designed to handle Docker builds and pushes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Docker Pipeline Plugin. The Docker Pipeline Plugin is the correct choice because it provides Jenkins Pipeline steps specifically for building and pushing Docker images, such as `docker.build()` and `docker.withRegistry()`. This plugin integrates Docker operations directly into Declarative or Scripted Pipelines, enabling seamless CI/CD workflows without requiring shell commands.

Answer

Credentials Plugin

Answer

Pipeline Plugin

Answer

Git Plugin

Question 2

A network administrator is configuring a new subnet for a branch office that requires 50 usable host addresses. The corporate network uses the 192.168.10.0/24 block. Which subnet mask should be used to meet the requirement with minimal waste?

Accepted Answer

255.255.255.192 (/26). A /26 subnet mask (255.255.255.192) provides 2^(32-26) = 64 total addresses, of which 62 are usable (subtracting network and broadcast addresses). This meets the requirement of 50 usable hosts with minimal waste, as the next smaller mask (/27) only offers 30 usable addresses, which is insufficient.

Answer

255.255.255.128 (/25)

Answer

255.255.255.0 (/24)

Answer

255.255.255.224 (/27)

Question 3

An engineer wants to verify that a switch port is configured as an access port in VLAN 10. Which command provides this information?

Accepted Answer

show running-config interface. The `show running-config interface` command displays the current operational configuration of a specific interface, including whether it is configured as an access port and which VLAN it is assigned to. For a switch port in VLAN 10, the output will show `switchport mode access` and `switchport access vlan 10`, directly confirming the desired configuration.

Answer

show interfaces status

Answer

show ip interface brief

Answer

show vlan brief

Question 4

Which header is used in an HTTP request to tell the server the format of the request body?

Accepted Answer

Content-Type. Content-Type header specifies the media type of the request body, e.g., application/json.

Answer

Authorization

Answer

Accept

Answer

Host

Question 5

A CI/CD pipeline for a microservice application includes stages: code commit, build Docker image, push to registry, deploy to staging, run integration tests, and deploy to production. The team wants to ensure that if integration tests fail, the pipeline stops and does not proceed to production. Which CI/CD concept is used to enforce this behavior?

Accepted Answer

Stage gates. Stage gates are conditional checkpoints in a CI/CD pipeline that evaluate predefined criteria before allowing the pipeline to proceed to the next stage. In this scenario, the integration test stage acts as a gate: if the tests fail, the gate blocks the pipeline from advancing to the production deployment stage, ensuring only validated code reaches production.

Answer

Rolling update

Answer

Container orchestration

Answer

Artifact management

Question 6

A security team wants to ensure that only signed Docker images are deployed in production. Which CI/CD pipeline step validates the image signature before deployment?

Accepted Answer

Use Docker Content Trust with Notary to verify signatures.. Docker Content Trust (DCT) integrates with Notary to provide a framework for signing and verifying Docker images. When DCT is enabled in the CI/CD pipeline, the Docker client verifies the image's signature against a trusted signing key before allowing the image to be pulled or deployed, ensuring only images signed by authorized parties are used in production.

Answer

Compare the image SHA with a known good hash.

Answer

Run a vulnerability scan on the image.

Answer

Check the image size on registry.

Question 7

A developer needs to securely store API keys for use in a CI/CD pipeline. Which best practice should be followed?

Accepted Answer

Use built-in pipeline secrets or environment variables.. CI/CD platforms (e.g., Jenkins, GitLab CI, GitHub Actions) provide built-in mechanisms to store secrets as encrypted environment variables or pipeline secrets. These values are masked in logs and never exposed in source code, ensuring API keys remain confidential throughout the pipeline execution.

Answer

Share the keys via email to the team.

Answer

Hardcode the keys in the source code.

Answer

Store the keys in a JSON file committed to the repository.

Question 8

Which of the following is a best practice for securing API keys in a CI/CD pipeline?

Accepted Answer

Use environment variables in build configuration. The best practice for securing API keys in a CI/CD pipeline is to use secrets management tools or environment variables with proper protection. While environment variables can be exposed if not handled carefully, they are more secure than sharing via email, which is susceptible to interception, phishing, and unauthorized access. Among the given choices, using environment variables in build configuration (with appropriate security controls) is the recommended approach. Options A, B, and C are all insecure practices.

Answer

Share via email

Answer

Hardcode in Dockerfile

Answer

Store them in source code

Question 9

A company uses a blue/green deployment strategy for their web application. The current live version is blue, and a new version green is ready. The load balancer currently routes all traffic to blue. What is the correct next step to switch traffic to green with minimal downtime?

Accepted Answer

Update the load balancer to route all traffic to green. In a blue/green deployment, the entire new version (green) is deployed alongside the current live version (blue). The correct next step to switch traffic with minimal downtime is to update the load balancer to route all traffic to green. This instant switch avoids the incremental risk of rolling updates and ensures a clean cutover that can be quickly reverted if issues arise.

Answer

Scale down blue pods and scale up green

Answer

Perform a rolling update from blue to green

Answer

Delete the blue deployment and create green

Question 10

Refer to the exhibit. What is the most effective action to eliminate both vulnerabilities in the container image?

Accepted Answer

Switch the base image to a distroless base image that does not include openssl and curl.. Switching to a distroless base image removes unnecessary packages like openssl and curl entirely, eliminating the vulnerabilities they introduce. Distroless images contain only the application and its runtime dependencies, reducing the attack surface by excluding OS package managers and shell utilities that are common sources of CVEs. This approach directly addresses both vulnerabilities by ensuring the vulnerable components are not present in the image at all.

Answer

Rebuild the image using the same base image but update the OS packages.

Answer

Add a .dockerignore file to exclude vulnerable libraries.

Answer

Only run the container with read-only root filesystem.

Question 11

An engineer uses the Cisco Webex Teams API to send a message to a room. The API returns HTTP 403 Forbidden. What is the most likely cause?

Accepted Answer

The token does not have permission to post to that room.. HTTP 403 Forbidden indicates the server understood the request but refuses to authorize it. In the context of the Cisco Webex Teams API, this status code most commonly means the access token provided does not have the required scopes or permissions to post messages to the specified room. The token may be valid and not expired, but it lacks the authorization (e.g., the `spark:rooms_write` scope) needed for the action.

Answer

The message payload is too large.

Answer

The bot token has expired.

Answer

The room ID is incorrect.

Question 12

A company has a web application running on Cisco DNA Center. The application uses OAuth 2.0 for authentication with an external identity provider (IdP). Recently, users have reported that they are being logged out unexpectedly after a few minutes of inactivity, even though the IdP token has a 1-hour expiration. The application developer wants to maintain usability while keeping security controls. What is the most likely cause and solution?

Accepted Answer

The application session timeout is shorter than the token lifetime; align the application session timeout to the token expiration or implement silent token refresh. The most likely cause is that the application's session timeout is set to a shorter duration than the OAuth 2.0 token's 1-hour expiration. When the application session expires, the user is logged out even though the IdP token is still valid. The solution is to align the application session timeout with the token expiration or implement silent token refresh using a refresh token, which allows the application to obtain a new access token without user interaction, maintaining usability while preserving security.

Answer

The application is not properly validating the token expiry and needs to refresh tokens proactively

Answer

The IdP is configured to log out users automatically after 5 minutes; reconfigure IdP session settings

Answer

The OAuth 2.0 access token is set to expire in 5 minutes; increase it to 1 hour

Question 13

A network engineer is using Cisco IOS XE RESTCONF to retrieve the hostname of a device. The device has already enabled netconf-yang and restconf. Which URL path should be used?

Accepted Answer

/restconf/data/Cisco-IOS-XE-native:native/hostname. The correct URL path for retrieving configuration data via RESTCONF is /restconf/data/{module-name}:{container-path}. In Cisco IOS XE, the hostname is modeled under the Cisco-IOS-XE-native module within the 'native' container, so the full path is /restconf/data/Cisco-IOS-XE-native:native/hostname. This follows RFC 8040, which defines the 'data' resource for accessing configuration and state data, and requires the module name prefix when the node is not in the default namespace.

Answer

/restconf/data/hostname

Answer

/restconf/operations/hostname

Answer

/restconf/config/Cisco-IOS-XE-native:native/hostname

Question 14

Which layer of the OSI model uses MAC addresses to deliver frames within the same network segment?

Accepted Answer

Layer 2 (Data Link). Layer 2 (Data Link) uses MAC addresses for local delivery.

Answer

Layer 1 (Physical)

Answer

Layer 3 (Network)

Answer

Layer 4 (Transport)

Question 15

A network automation team uses a CI/CD pipeline. Which practice best ensures that configuration changes are validated before deployment to production?

Accepted Answer

Deploying to a staging environment that mirrors production. Deploying to a staging environment that mirrors production allows comprehensive testing without risk. This is a key DevOps best practice.

Answer

Automated unit tests that verify syntax of configuration files

Answer

Peer review of code only

Answer

Manual testing by the network engineer after deployment