200-901 Practice Questions 1 — 50 Questions

Question 1

A company uses a CI/CD pipeline to deploy network configurations. The pipeline includes a stage that runs automated tests against a simulated network environment. Which testing strategy does this represent?

Accepted Answer

Integration testing. Option C is correct because running automated tests against a simulated network environment validates how multiple network components (e.g., routers, switches, firewalls) interact as a whole. This is integration testing, which focuses on detecting interface and communication failures between integrated units, not on individual components or end-to-end system behavior. In a CI/CD pipeline for network configurations, this stage ensures that the combined changes work together before deployment to production.

Answer

Regression testing

Answer

Unit testing

Answer

Smoke testing

Question 2

Which TWO statements about REST API design best practices are correct?

Accepted Answer

Resources should be represented using nouns in the URI. Option C is correct because REST API best practices dictate that URIs should represent resources (nouns), not actions. For example, '/users' or '/orders' clearly identifies the resource being manipulated, while verbs like '/getUsers' or '/createOrder' are discouraged as they conflate the resource with the operation.

Answer

API versioning should be implemented using query parameters only

Answer

HTTP PUT method should be used for partial updates to a resource

Answer

Responses should return only HTTP status codes without a body

Question 3

A network engineer is using the Cisco Meraki API to retrieve a list of SSIDs for a specific network. The API returns an HTTP 200 status but an empty array for the SSIDs. Which of the following is the most likely cause?

Accepted Answer

The network exists but has no SSIDs configured.. An HTTP 200 status indicates the request was successfully processed by the Meraki API, meaning the API key, network ID, and request format were all valid. An empty array for SSIDs specifically means the network exists and the API queried it correctly, but no SSIDs have been configured on that network. This is the expected behavior when a network has no wireless profiles defined.

Answer

The network ID is incorrect.

Answer

The API key is invalid.

Answer

The request body is malformed.

Question 4

When designing a REST API client for a Cisco DNA Center deployment, which authentication method should be used to obtain a token for subsequent API calls?

Accepted Answer

HTTP Basic authentication to obtain a token.. Cisco DNA Center uses HTTP Basic authentication to obtain a token. The client sends a POST request to the /dna/system/api/v1/auth/token endpoint with a Base64-encoded string of the username and password in the Authorization header. The server returns a token that must be included in subsequent API calls via the X-Auth-Token header.

Answer

OAuth 2.0 client credentials grant.

Answer

API key in the request header.

Answer

Client certificate in the request.

Question 5

A Python script uses the Cisco Meraki API to create a new network and then immediately attempts to configure an SSID on that network. The SSID creation fails with a 400 error indicating 'network is not ready'. What is the most likely cause?

Accepted Answer

The network is not fully provisioned yet; a delay is needed.. The Meraki API returns a 400 error with 'network is not ready' because creating a network is an asynchronous operation. The network's underlying infrastructure (e.g., virtual LANs, DHCP scopes, firewall rules) must be fully provisioned before it can accept SSID configurations. Attempting to configure an SSID immediately after creation fails because the network is still in a 'pending' or 'provisioning' state, requiring a polling delay or retry logic.

Answer

The API rate limit has been exceeded.

Answer

The API key does not have write access to networks.

Answer

The SSID name contains invalid characters.

Question 6

A DevOps team manages a multi-site Cisco Meraki network with 50 MX appliances and 200 MR access points. They use a Python script that calls the Meraki API to collect device utilization data every hour and stores it in a CSV file. Recently, the script started failing intermittently with HTTP 429 status codes. The team suspects rate limiting but notices that the failures occur even when only one script instance runs. The script uses a single API key and makes requests to the /devices/{serial}/uplink endpoint for each MX and the /devices/{serial}/wireless/status endpoint for each MR. The script is scheduled via cron and runs sequentially. The team wants to resolve the rate limiting while minimizing changes to the script. Which course of action should the team take?

Accepted Answer

Introduce a delay between API calls to stay within the rate limit.. The intermittent HTTP 429 errors indicate the script is exceeding the Meraki API rate limit, which applies per API key. Since the script runs sequentially with a single key, introducing a delay between API calls (e.g., using time.sleep()) is the simplest fix that stays within the rate limit without requiring architectural changes. This directly addresses the root cause while minimizing modifications to the existing script.

Answer

Distribute the API requests across multiple API keys.

Answer

Switch to a webhook-based approach to receive data instead of polling.

Answer

Use the bulk API request feature to collect data in fewer calls.

Question 7

Refer to the exhibit. A network engineer applies this JSON-based QoS policy to a Cisco device using NETCONF/YANG. Which statement best describes the expected behavior for traffic from 10.0.0.0/24 with DSCP EF?

Accepted Answer

Traffic from 10.0.0.0/24 with DSCP EF is re-marked to AF41 and limited to 100 Mbps; excess is dropped.. Option C is correct because the JSON-based QoS policy uses a class map matching traffic from source 10.0.0.0/24 with DSCP EF, then applies a police action that re-marks exceeding traffic to AF41 and drops it when the rate exceeds 100 Mbps. This is a standard two-rate policer behavior in Cisco IOS QoS, where conforming traffic is transmitted unchanged and exceeding traffic is re-marked and dropped.

Answer

Traffic with DSCP EF from any source is re-marked to AF41 and dropped if exceeding 100 Mbps.

Answer

The policy is invalid because DSCP values cannot be changed in a QoS policy.

Answer

Traffic from 10.0.0.0/24 is re-marked to DSCP EF, then policed at 100 Mbps.

Question 8

Which TWO of the following are characteristics of Model-Driven Programmability with YANG models?

Accepted Answer

YANG models define a hierarchical data tree.. Option A is correct because YANG models define a hierarchical data tree structure that organizes configuration and state data in a parent-child relationship, mirroring the structure of the device's operational and configuration data. This hierarchical representation allows for precise, path-based access to individual data nodes, which is fundamental to model-driven programmability.

Answer

YANG models are only used with the Python library ncclient.

Answer

The controller directly pushes configurations to network devices without validation.

Answer

NETCONF requires JSON encoding for configuration data.

Question 9

Refer to the exhibit. A developer sends a PUT request to the RESTCONF endpoint with the above JSON payload. The device already has interface GigabitEthernet1/0/1 configured with IP address 10.10.10.1/24. What is the expected outcome?

Accepted Answer

The request succeeds and the interface configuration remains unchanged.. D is correct because the PUT request to the RESTCONF endpoint with the provided JSON payload is an idempotent operation. Since the interface GigabitEthernet1/0/1 already exists with the exact same configuration (IP address 10.10.10.1/24), the PUT request effectively replaces the resource with the same data, resulting in no change. RESTCONF uses the HTTP PUT method to create or replace a resource, and if the resource already exists and the payload matches, the operation succeeds without modification.

Answer

The request fails because the interface already exists.

Answer

The request creates a new interface with the same configuration.

Answer

The request fails because the JSON is malformed.

Question 10

A network engineer is troubleshooting slow connectivity between two sites connected via a WAN link. The engineer suspects packet loss due to collisions. Which interface counter should be examined to confirm this?

Accepted Answer

CRC errors. CRC (Cyclic Redundancy Check) errors indicate that frames received on an interface have failed the integrity check, which is often caused by physical-layer issues such as collisions, faulty cabling, or signal degradation. In the context of a WAN link, collisions are not typical (since full-duplex is standard), but if the link is misconfigured as half-duplex, collisions can occur and will manifest as CRC errors. Thus, examining the CRC errors counter is the correct way to confirm packet loss due to collisions.

Answer

Runts

Answer

Output errors

Answer

Giants

Question 11

A Python script used for network automation requires storing an API secret. Which approach is the most secure and recommended best practice?

Accepted Answer

Use environment variables. Option D is correct because storing secrets in environment variables decouples sensitive data from the source code, preventing accidental exposure in version control systems like Git. This approach follows the principle of least privilege and is recommended by security best practices such as the Twelve-Factor App methodology. Environment variables are managed outside the script, reducing the risk of credential leakage during code sharing or deployment.

Answer

Hardcode the secret in the Python script

Answer

Store the secret in a plain text file in the repository

Answer

Encrypt the secret and store it in the script

Question 12

A company has a three-tier data center architecture with access, aggregation, and core layers. The network team is migrating to a leaf-spine architecture to support increasing east-west traffic. The current network uses STP for loop prevention, and the team wants to eliminate STP in the new design. They plan to use VXLAN overlays with BGP EVPN for control plane. During a pilot deployment, the team notices that some legacy servers that rely on traditional VLANs are not reachable across the new fabric. The servers are connected to access switches that are part of the leaf layer. The access switches are configured as VXLAN tunnel endpoints (VTEPs) but the legacy servers are still using traditional VLANs. The team needs to ensure connectivity between the legacy VLAN-based servers and the new VXLAN-based network. What is the best approach to integrate these legacy servers without changing their configuration?

Accepted Answer

Implement a Layer 2 gateway (L2GW) on the leaf switches to bridge VLANs to VXLAN using IRB. Option B is correct because an Integrated Routing and Bridging (IRB) interface on the leaf switch acts as a Layer 2 gateway (L2GW), bridging the legacy VLAN to a VXLAN segment. This allows the legacy server, which still uses traditional VLAN tagging, to communicate with the VXLAN-based fabric without any configuration changes on the server. The IRB interface performs the VLAN-to-VXLAN mapping and handles ARP suppression, enabling seamless integration.

Answer

Create a separate VRF for legacy VLANs and redistribute into BGP EVPN

Answer

Configure the same VLAN on all leaf switches and use VXLAN to stretch the VLAN across the fabric

Answer

Reconfigure the legacy servers to use VXLAN encapsulation

Question 13

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 14

Drag and drop the steps to troubleshoot a network connectivity issue using the OSI model from bottom to top.

Question 15

Drag and drop the steps to deploy a Python script to a Cisco device via RESTCONF into the correct order.

Question 16

Drag and drop the steps to set up a Python virtual environment for a DevNet project into the correct order.

Question 17

An engineer configures a trunk port as shown. A device connected to this port sends an untagged frame. Which VLAN will the switch associate the frame with?

Accepted Answer

VLAN 99. The switchport trunk native vlan 99 command configures VLAN 99 as the native VLAN for the trunk port. When an untagged frame arrives on a trunk port, the switch associates it with the native VLAN. Therefore, the frame is placed into VLAN 99.

Answer

VLAN 1

Answer

The frame is dropped

Answer

VLAN 10

Question 18

Based on the routing table, what type of OSPF route is the default route (0.0.0.0/0)?

Accepted Answer

OSPF external type 2 route. The default route (0.0.0.0/0) in OSPF is typically redistributed from another routing protocol or statically configured and then advertised into OSPF. When a default route is injected via the 'default-information originate' command, it is advertised as an OSPF external type 2 (E2) route by default, meaning the metric does not change as it traverses OSPF areas. This matches option D.

Answer

OSPF inter-area route

Answer

OSPF NSSA external type 1 route

Answer

OSPF intra-area route

Question 19

An engineer notices that a switch port configured as an access port in VLAN 10 is not forwarding traffic. The switch shows the port is up/up. What is the most likely cause?

Accepted Answer

The connected device is sending 802.1Q tagged frames. An access port expects to receive and send only untagged frames, as it belongs to a single VLAN (VLAN 10). If the connected device sends 802.1Q tagged frames, the switch will drop them because the access port does not process VLAN tags. This explains why the port is up/up but not forwarding traffic.

Answer

Spanning Tree Protocol blocking the port

Answer

Speed/duplex mismatch

Answer

VLAN 10 does not exist in the VLAN database

Question 20

Which TWO statements are true about VXLAN? (Choose two.)

Accepted Answer

VXLAN encapsulates Ethernet frames in UDP packets. Option B is correct because VXLAN (Virtual Extensible LAN) encapsulates the original Layer 2 Ethernet frame inside a UDP packet (typically UDP destination port 4789). This allows the Layer 2 frame to be transported over a Layer 3 IP network, enabling network virtualization and overlay networking without requiring changes to the physical underlay.

Answer

VXLAN requires MPLS in the underlay

Answer

VXLAN uses IP-in-IP encapsulation

Answer

VXLAN operates at Layer 2 only