200-901 Practice Questions 1 — 50 Questions

Question 1

Which Meraki API response header provides information for paginating through a large result set?

Accepted Answer

Link. Meraki uses the Link header (LinkHeader) with 'next' and 'prev' URLs, or alternatively the startingAfter/endingBefore parameters. The Link header is standard for pagination.

Answer

Content-Range

Answer

X-RateLimit-Remaining

Answer

Retry-After

Question 2

An engineer is using EEM on an IOS XE device. They want to trigger an applet when a specific syslog message appears. Which event trigger type should they use?

Accepted Answer

event syslog pattern. The 'event syslog pattern' trigger in EEM (Embedded Event Manager) is specifically designed to fire an applet when a syslog message matching a regex pattern is logged. It watches the device's syslog stream and activates the applet when the pattern matches. This is the canonical trigger for reacting to specific log events on IOS XE.

Answer

event interface

Answer

event cli match

Answer

event timer

Question 3

A Python script uses the ncclient library to connect to a Cisco NX-OS device over NETCONF. After establishing the session, the script executes an editing operation with candidate datastore. Which additional step is required to make the changes take effect immediately on the running configuration?

Accepted Answer

Execute a commit operation on the candidate datastore. When using NETCONF with the candidate datastore on Cisco NX-OS, changes are staged in the candidate configuration and do not affect the running configuration until a commit operation is explicitly sent. The commit operation copies the candidate configuration to the running datastore, making the changes take effect immediately. Without this step, the candidate changes remain unapplied.

Answer

Execute a discard-changes operation on the candidate datastore

Answer

Execute a validate operation on the candidate datastore

Answer

No additional step is needed; candidate changes are automatically applied to running

Question 4

A network engineer is configuring EtherChannel between two switches. The switches are connected via four links. The engineer wants to load balance traffic based on source and destination IP addresses. Which configuration command should be used on Cisco IOS?

Accepted Answer

port-channel load-balance src-dst-ip. The command 'port-channel load-balance src-dst-ip' configures EtherChannel to use both the source and destination IP addresses in the hash algorithm, which is exactly what the engineer needs for load balancing based on source and destination IP addresses. This ensures traffic distribution across the four links by computing a hash on the combination of source and destination IPs, providing a balanced distribution for IP traffic.

Answer

port-channel load-balance src-ip

Answer

port-channel load-balance dst-ip

Answer

port-channel load-balance src-dst-mac

Question 5

A Python script used for network automation requires storing an API secret. Which approach is the most secure and recommended best practice?

Accepted Answer

Use environment variables. Storing secrets in environment variables decouples sensitive data from the source code, preventing accidental exposure in version control systems like Git. This approach follows the principle of least privilege and is recommended by security best practices such as the Twelve-Factor App methodology. Environment variables are managed outside the script, reducing the risk of credential leakage during code sharing or deployment.

Answer

Hardcode the secret in the Python script

Answer

Store the secret in a plain text file in the repository

Answer

Encrypt the secret and store it in the script

Question 6

A Python script uses a dictionary to store device configuration parameters. Which key, if any, will raise a KeyError if it does not exist in the dictionary?

Accepted Answer

config['timeout']. Using square bracket notation (config['timeout']) on a dictionary will raise a KeyError if the specified key does not exist. This is a fundamental behavior of Python dictionaries: direct key access without a fallback mechanism throws an exception when the key is missing.

Answer

config.setdefault('timeout', 30)

Answer

config.get('timeout')

Answer

config.pop('timeout', None)

Question 7

Which data structure in Python would be most appropriate for storing a collection of unique items and performing fast membership tests?

Accepted Answer

Set. A set is the correct choice because it is implemented as a hash table in Python, which provides O(1) average-time complexity for membership tests using the `in` operator. Sets automatically enforce uniqueness, meaning duplicate items are not allowed, making them ideal for storing a collection of distinct elements. This directly matches the requirement for fast membership testing and uniqueness.

Answer

Tuple

Answer

List

Answer

Dictionary

Question 8

An application uses UDP. Which characteristic is true about this application's communication?

Accepted Answer

It is connectionless. UDP is a connectionless transport protocol, meaning it does not establish a dedicated end-to-end connection before sending data. This characteristic allows for low-latency, best-effort delivery without the overhead of connection setup, which is ideal for applications like DNS queries or streaming media where speed is prioritized over reliability.

Answer

It guarantees packet delivery

Answer

It retransmits lost packets

Answer

It performs a three-way handshake

Question 9

A network automation engineer is evaluating options for model-driven programmability on Cisco devices. Which THREE are valid YANG model sources or tools? (Choose three.)

Accepted Answer

pyang. pyang is a YANG tool, yangcatalog.org is a repository, and Cisco native models are valid sources. OpenConfig is a standard, but oc-interfaces is a model, not a source/tool.

Answer

NETCONF

Answer

oc-interfaces

Question 10

Drag and drop the steps to set up a Python virtual environment for a DevNet project into the correct order.

Accepted Answer

Create virtual environment, Activate virtual environment, Install required packages, Deactivate virtual environment. Virtual environments isolate dependencies; creation, activation, package installation, and deactivation are standard steps.

Answer

Activate virtual environment, Create virtual environment, Install required packages, Deactivate virtual environment

Answer

Create virtual environment, Install required packages, Activate virtual environment, Deactivate virtual environment

Answer

Create virtual environment, Activate virtual environment, Deactivate virtual environment, Install required packages

Question 11

A network automation script uses the Cisco DNAC Python SDK (dnacentersdk) to retrieve devices. Which method correctly lists all devices?

Accepted Answer

dnac.devices.get_device_list(). The Cisco DNAC Python SDK (dnacentersdk) uses a hierarchical method structure where the `devices` resource is accessed via `dnac.devices`, and the `get_device_list()` method is the exact SDK call to retrieve all devices from the Cisco DNA Center. This matches the official SDK documentation and the REST API endpoint `/dna/intent/api/v1/network-device`.

Answer

dnac.get_devices()

Answer

dnac.sites.get_site_devices()

Answer

dnac.devices.list_devices()

Question 12

Match each HTTP status code to its meaning.

Accepted Answer

200 OK: Request succeeded.. The correct matches are: 200 OK = Request succeeded, 201 Created = Resource created successfully, 400 Bad Request = Malformed syntax or invalid request, 404 Not Found = Resource not found. Common confusions include swapping 200 and 201, as well as 400 and 404.

Answer

200 OK: Resource created.

Answer

404 Not Found: Bad request.

Question 13

A developer is troubleshooting a Cisco RESTCONF API call that returns a 409 Conflict error. Which two scenarios could cause this? (Choose two.)

Accepted Answer

The resource's current state conflicts with the requested change (e.g., trying to delete a resource that is in use).. Option B is correct because RESTCONF returns HTTP 409 Conflict when the server cannot complete the request due to a conflict with the resource's current state, such as attempting to delete a resource that is still referenced or in use by another object. Option C is correct because a 409 Conflict is also returned when a client attempts to create a resource that already exists, violating the uniqueness constraint of the target data node. Option A is incorrect because a missing authentication token produces HTTP 401 Unauthorized (or 403 Forbidden), not 409. Option D is incorrect because a nonexistent resource yields HTTP 404 Not Found. Option E is incorrect because invalid data types trigger HTTP 400 Bad Request due to schema or validation failure.

Answer

Authentication token is missing.

Answer

The resource does not exist.

Answer

The request contains invalid data types.

Question 14

A network engineer configures an HTTP/2 server. Which feature of HTTP/2 reduces overhead by compressing headers using HPACK?

Accepted Answer

HPACK. HPACK is the header compression mechanism specified for HTTP/2 (RFC 7541). It reduces overhead by encoding HTTP headers into a compact binary format using static and dynamic tables, eliminating redundant header data across requests. This directly addresses the question's focus on reducing overhead through header compression.

Answer

Server push

Answer

Binary framing layer

Answer

Multiplexed streams

Question 15

An IPv6-enabled host is trying to discover the MAC address of another host on the same link. The host knows the destination IPv6 address but does not have a corresponding entry in the neighbor cache. Which protocol and message type does the host use?

Accepted Answer

Neighbor Solicitation (ICMPv6 type 135). When an IPv6 host needs to resolve a known destination IPv6 address to its MAC address on the same link, it sends a Neighbor Solicitation (NS) message, which is ICMPv6 type 135. This message is multicast to the solicited-node multicast address of the target, and the host with that IPv6 address responds with a Neighbor Advertisement (ICMPv6 type 136) containing its MAC address. This process replaces ARP in IPv4 and is defined in RFC 4861.

Answer

Neighbor Advertisement (ICMPv6 type 136)

Answer

Router Solicitation (ICMPv6 type 133)

Answer

Address Resolution Protocol (ARP)

Question 16

A company uses a /24 subnet for its office LAN. The network must accommodate 30 hosts per VLAN. Which subnet mask would be most efficient for each VLAN while minimizing wasted IP addresses?

Accepted Answer

255.255.255.224. A /27 subnet mask (255.255.255.224) provides 32 total addresses per subnet, with 30 usable host addresses (2^5 - 2 = 30). This exactly meets the requirement of 30 hosts per VLAN without wasting IP addresses, as any larger subnet would leave unused addresses.

Answer

255.255.255.240

Answer

255.255.255.0

Answer

255.255.255.128

Answer

255.255.255.192

Question 17

A developer is using NETCONF to retrieve the running configuration of a network device. Which operation should be used?

Accepted Answer

. The operation retrieves configuration from a datastore (e.g., running).

Answer

<get>

Answer

<copy-config>

Answer

<edit-config>

Question 18

Which TWO are valid methods to secure a Docker container?

Accepted Answer

Use read-only filesystem. Option A (Use read-only filesystem) is correct because mounting a container's root filesystem with the --read-only flag prevents processes from writing to the filesystem, which blocks malware persistence, unauthorized file modification, and many privilege-escalation or tampering attacks. Option C (Set resource limits) is correct because constraining CPU, memory, and other resources via flags such as --memory, --cpus, or --pids-limit mitigates denial-of-service and resource-exhaustion attacks, and limits the blast radius if a container is compromised. The remaining options weaken security: exposing all ports (B) unnecessarily enlarges the attack surface, running containers as root (D) violates least privilege and increases the impact of a container breakout, and disabling network isolation (E) removes segmentation that normally restricts lateral movement between containers and hosts.

Answer

Expose all ports

Answer

Run containers as root

Answer

Disable network isolation

Question 19

Which TWO Ansible modules are commonly used for automating Cisco IOS devices?

Accepted Answer

ios_config. The `ios_config` module is correct because it is specifically designed to manage Cisco IOS device configurations by sending configuration commands via SSH or Telnet, using the CLI to apply changes to the running or startup configuration. This module is part of Ansible's `cisco.ios` collection and directly supports the IOS operating system, making it the standard choice for automating configuration tasks on Cisco IOS devices.

Answer

junos_config

Answer

nxos_command

Answer

eos_config

Question 20

Which TWO actions are best practices for managing secrets in a CI/CD pipeline?

Accepted Answer

Store secrets as environment variables from a .env file not committed to version control. Option B is correct because loading secrets as environment variables from a .env file that is excluded from version control (e.g., via .gitignore) keeps credentials out of the repository history and injects them only at runtime, reducing exposure. Option E is correct because a dedicated secrets manager like HashiCorp Vault centralizes storage, enforces access policies, supports dynamic/short-lived credentials, and provides auditing and encryption, which are core best practices for CI/CD secret handling. Option A is wrong because long-lived static passwords increase the blast radius if leaked and violate rotation and least-privilege principles. Option C is wrong because hardcoding secrets in source code exposes them to anyone with repository access and persists them in build artifacts and history. Option D is wrong because committing secrets to a configuration file in git stores them in plaintext within version control, where they can be cloned, forked, or leaked.

Answer

Use long-lived static passwords for service accounts

Answer

Hardcode secrets directly in application code for ease of access

Answer

Store secrets in a configuration file stored in the git repository