200-901 Practice Questions 2 — 50 Questions

Question 1

A DevOps team is deploying a containerized application across multiple hosts. They need to ensure that traffic between containers on the same host is isolated from other tenants. Which network implementation best meets this requirement?

Accepted Answer

VXLAN overlays with a distributed virtual switch. VXLAN overlays with a distributed virtual switch provide Layer 2 isolation across multiple hosts by encapsulating Ethernet frames in UDP packets (RFC 7348). This creates independent virtual networks (VXLAN segments) that can span hosts, ensuring traffic between containers on the same host is isolated from other tenants without relying on physical network topology.

Answer

Linux bridge with ebtables rules

Answer

NAT with port forwarding

Answer

802.1Q VLANs on the host switch

Question 2

An organization uses Cisco ISE for network access control. A user reports inability to access the network. The switch port shows the authenticator state as 'connecting'. What does this indicate?

Accepted Answer

The client is in the process of 802.1X authentication. In Cisco ISE and 802.1X, the authenticator state 'connecting' indicates that the switch (authenticator) has detected a new client on the port and has initiated the 802.1X authentication process. This state means the port is actively sending EAP-Request/Identity frames and waiting for the client to respond, so the client is in the process of authentication, not yet authenticated or failed.

Answer

The client has successfully authenticated

Answer

The port is in a held state due to multiple failures

Answer

Authentication has failed

Question 3

A technician needs to verify the IP address of a remote server using DNS. Which command should be used on a Cisco IOS device?

Accepted Answer

nslookup server.example.com. The `nslookup` command is used to query DNS servers to resolve a hostname to an IP address. On a Cisco IOS device, `nslookup` sends a DNS query for the specified hostname and returns the corresponding IP address, making it the correct tool for verifying a remote server's IP via DNS.

Answer

traceroute server.example.com

Answer

show hosts server.example.com

Answer

ping server.example.com

Question 4

An organization uses Cisco Intersight to manage UCS servers. They want to automate the firmware upgrade process. Which Intersight API should be used to trigger a firmware upgrade on a server?

Accepted Answer

POST /api/v1/compute/Physical. Option D is correct because the `/api/v1/compute/Physical` endpoint in Cisco Intersight is used to manage physical compute resources, including triggering firmware upgrades on UCS servers. By sending a POST request to this endpoint with the appropriate action payload (e.g., `"Action": "UpgradeFirmware"`), you can initiate a firmware upgrade on a specific server. This aligns with Intersight's RESTful API design for lifecycle management of UCS infrastructure.

Answer

POST /api/v1/ntp/Policies

Answer

POST /api/v1/equipment/Fex

Answer

POST /api/v1/fabric/EthNetworkPolicies

Question 5

Refer to the exhibit. A Python script using RESTCONF sends a GET request to retrieve the interface configuration. The response is shown. What is the VLAN assigned to GigabitEthernet1/0/1?

Accepted Answer

10. The correct answer is A (VLAN 10) because the RESTCONF GET response shows the native VLAN for GigabitEthernet1/0/1 is set to 10. In Cisco IOS-XE, the native VLAN is the VLAN assigned to an interface when it is in access mode, and the response explicitly includes the 'native-vlan' field with a value of 10 under the 'Cisco-IOS-XE-native:interface' hierarchy.

Answer

1

Answer

100

Answer

20

Question 6

A large enterprise operates a multi-vendor network with Cisco routers and switches, as well as Juniper devices. The network team uses Ansible for automation, with a centralized control node running RHEL. They have been using the 'ios_config' module for Cisco devices and 'junos_config' for Juniper devices. Recently, they added a new Cisco Catalyst 9300 switch to the network. They wrote a playbook to configure VLAN 100 on the switch, but the task fails with the error: 'module_stderr: Could not find platform module for Cisco IOS XE'. The playbook uses the 'cisco.ios.ios_config' module. The control node has the 'cisco.ios' collection installed (version 2.0.0). The target switch runs IOS XE 16.12.3. The control node can SSH to the switch successfully. Which action will most likely resolve the issue?

Accepted Answer

Upgrade the 'cisco.ios' Ansible collection to the latest version.. The error 'Could not find platform module for Cisco IOS XE' indicates that the installed 'cisco.ios' collection (version 2.0.0) does not include a module or plugin that supports the IOS XE platform for the target switch. Upgrading the collection to the latest version ensures compatibility with IOS XE 16.12.3, as newer releases add support for newer platforms and OS versions.

Answer

Configure the switch to allow SSH connections from the control node IP.

Answer

Use the 'raw' module instead of 'ios_config' to send CLI commands directly.

Answer

Install Python 3.8 on the control node and update the ansible.cfg to use it.

Question 7

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

Accepted Answer

docker run -p 443:443 myapp. Option C is correct because the `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.

Answer

docker run --port 443 myapp

Answer

docker run --net host myapp

Answer

docker run --expose 443 myapp

Question 8

During a security audit, an engineer discovers that a CI/CD pipeline is storing API keys in plain text in environment variables. Which best practice should be implemented to mitigate this risk?

Accepted Answer

Use a dedicated secrets management service like HashiCorp Vault or AWS Secrets Manager and retrieve secrets at runtime.. Option C is correct because dedicated secrets management services like HashiCorp Vault or AWS Secrets Manager provide secure storage, access control, and audit logging for sensitive data. They allow the CI/CD pipeline to retrieve API keys at runtime via authenticated API calls, ensuring secrets are never stored in plain text in environment variables or configuration files. This approach aligns with the principle of least privilege and eliminates the risk of exposure through source code or build logs.

Answer

Store secrets in a .env file and add it to the repository with restricted access.

Answer

Encrypt the environment variables using a tool like openssl and store the key elsewhere.

Answer

Remove the API keys from the pipeline and require manual entry each time a build runs.

Question 9

A DevOps engineer wants to automate the configuration of network devices using Ansible. Which file format is commonly used for Ansible playbooks?

Accepted Answer

YAML. Ansible playbooks are written in YAML (YAML Ain't Markup Language) because YAML is human-readable, supports complex data structures like lists and dictionaries, and is designed for configuration files. YAML's indentation-based syntax aligns with Ansible's declarative automation model, making it the default and recommended format for defining tasks, variables, and handlers in playbooks.

Answer

INI

Answer

XML

Answer

JSON

Question 10

A network administrator is configuring SNMPv3 on a router for secure monitoring. Which combination of parameters is required to ensure authentication and encryption?

Accepted Answer

SNMPv3 with authPriv. SNMPv3 with authPriv is the correct combination because it enables both authentication (via HMAC-MD5 or HMAC-SHA) and encryption (via DES or AES) to ensure secure monitoring. The authPriv security level provides message integrity, origin authentication, and data confidentiality, meeting the requirement for both authentication and encryption.

Answer

SNMPv3 with noAuthNoPriv

Answer

SNMPv3 with authNoPriv

Answer

SNMPv2c with a complex community string

Question 11

Which TWO functions are performed by the data plane in a network device? (Choose two.)

Accepted Answer

Forwarding packets based on destination MAC address. The data plane is responsible for forwarding packets based on information in the forwarding table, such as destination MAC address for Layer 2 switching. Applying ACLs is also a data plane function because ACL rules are evaluated in hardware or software during packet forwarding to permit or deny traffic.

Answer

Building the routing table using OSPF

Answer

Maintaining ARP cache entries

Answer

Establishing OSPF neighbor adjacencies

Question 12

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

Accepted Answer

Configure the bridge priority to 61440. Option B is correct because setting the bridge priority to 61440 (which is a valid priority value in increments of 4096) ensures the new switch has a higher numerical priority than the current root bridge, preventing it from becoming the root. In STP/RSTP, the switch with the lowest bridge priority becomes the root bridge; by configuring a high priority, the new switch will not disrupt the existing topology.

Answer

Enable root guard on the trunk ports

Answer

Enable BPDU guard on the trunk ports

Answer

Set the bridge priority to 0

Question 13

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

Accepted Answer

Ansible. Ansible is the correct tool because it is an agentless automation platform that uses SSH to push configuration changes, such as VLAN deployment, to network devices. It allows engineers to define the desired state of VLANs in YAML playbooks and apply them consistently across multiple switches without manual intervention.

Answer

NetFlow

Answer

Syslog

Answer

SNMP

Question 14

In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?

Accepted Answer

Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests. Cisco DNA Center uses token-based authentication. The correct flow is to first send a POST request to the /dna/system/api/v1/auth/token endpoint with a valid username and password (typically using Basic Authentication over HTTPS). The response contains a JSON Web Token (JWT) that must be included in the Authorization header of all subsequent API requests as 'Bearer <token>'. This token has a configurable expiry (default 60 minutes) and must be refreshed before it expires.

Answer

OAuth 2.0 client credentials grant with client ID and secret

Answer

Basic authentication with username and password in the header

Answer

API key passed in a query parameter

Question 15

Refer to the exhibit. A Python script uses the Cisco IOS-XE RESTCONF API to retrieve the device configuration. The returned JSON is shown. What must be done to enable the GigabitEthernet0/1 interface using the API?

Accepted Answer

Send a PATCH request to the interface resource with the JSON payload {"enabled": true}.. Option A is correct because RESTCONF uses PATCH for partial updates. To enable an interface, you only need to send the specific field that changes ({"enabled": true}) to the interface resource URI, which modifies the configuration without replacing the entire resource.

Answer

Send a DELETE request to the interface resource.

Answer

Send a GET request to the interface resource and parse the response.

Answer

Send a PUT request to the interface resource with the entire JSON payload.

Question 16

Refer to the exhibit. A developer is building a Docker image for a Node.js application. The Dockerfile contains:
```
FROM node:14
WORKDIR /usr/src/app
COPY package*.json ./
RUN npm install
COPY . .
CMD ["node", "app.js"]
```
When building, the error shown occurs. What is the most likely cause?

Accepted Answer

The application is running as a non-root user (e.g., node) that lacks write permission to the working directory.. The error occurs because the official Node.js Docker image (node:14) runs as a non-root user named 'node' by default. The WORKDIR /usr/src/app is owned by root, so the 'node' user lacks write permission to that directory. When npm install tries to create node_modules or write package-lock.json, it fails with a permission error. Option D correctly identifies this user-permission mismatch.

Answer

The Dockerfile should use the root user for running npm install.

Answer

The npm install command should be run with the --unsafe-perm flag.

Answer

The base image node:14 is outdated and contains a bug.

Question 17

Which TWO statements about Dockerfile best practices are correct? (Choose two.)

Accepted Answer

Use a .dockerignore file to exclude unnecessary files from the build context.. Option C is correct because a .dockerignore file prevents unnecessary files (e.g., node_modules, .git, logs) from being sent to the Docker daemon as part of the build context. This reduces build time, minimizes the risk of including sensitive data, and ensures a cleaner, more efficient image build.

Answer

Use the ADD instruction instead of COPY to copy local files into the image.

Answer

Combine multiple RUN commands into a single RUN statement to reduce image layers.

Answer

Use the EXPOSE instruction to secure the container by limiting exposed ports.

Question 18

An engineer is designing a CI/CD pipeline for a Python application. The pipeline should automatically run unit tests, build a Docker image, push it to a private registry, and deploy to a Kubernetes cluster. Which sequence of stages is correct?

Accepted Answer

Test -> Build -> Push -> Deploy. Option D is correct because a CI/CD pipeline for a Python application must first run unit tests to validate code quality, then build the Docker image from the tested code, push the image to a private registry, and finally deploy to Kubernetes. This sequence ensures that only tested and built artifacts are deployed, preventing deployment of broken or untested code.

Answer

Build -> Test -> Push -> Deploy

Answer

Test -> Push -> Deploy

Answer

Test -> Deploy -> Build -> Push

Question 19

Which THREE security measures should be implemented in a CI/CD pipeline to protect against supply chain attacks? (Choose three.)

Accepted Answer

Pin dependency versions to specific hashes.. Option B is correct because pinning dependency versions to specific hashes (e.g., using `integrity` attributes in npm’s package-lock.json or `sha256` checksums in pip’s requirements.txt) ensures that only the exact, verified content is downloaded. This prevents an attacker from substituting a malicious version of a dependency, even if the version tag remains the same, by validating the cryptographic hash of the artifact against a known good value.

Answer

Enable verbose logging for all build steps to detect anomalies.

Answer

Sign all build artifacts with a GPG key.

Question 20

Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?

Accepted Answer

Wrong SSH username or password. The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.

Answer

The device is unreachable

Answer

The playbook syntax is incorrect

Answer

The device is not running IOS