200-901 Practice Exam 52 — 20 Questions

Question 1

What is the primary benefit of using HTTP/2 over HTTP/1.1?

Accepted Answer

It supports multiplexing. HTTP/2 introduces multiplexed streams, allowing multiple requests/responses in parallel over a single connection.

Answer

It is connectionless

Answer

It uses plain text for headers

Answer

It eliminates the need for TLS

Question 2

Which IP address is a valid host address in the 192.168.1.0/24 network?

Accepted Answer

192.168.1.128. /24 means subnet mask 255.255.255.0. Network address is 192.168.1.0, broadcast is 192.168.1.255. Usable hosts range from .1 to .254.

Answer

192.168.2.1

Answer

192.168.1.255

Answer

192.168.1.0

Question 3

Which of the following is a private IPv4 address range as defined by RFC 1918?

Accepted Answer

10.0.0.0/8. Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Answer

172.32.0.0/12

Answer

172.15.0.0/12

Answer

192.167.0.0/16

Question 4

A web application uses HTTPS to secure communications between client and server. What does HTTPS add on top of HTTP to provide encryption and authentication?

Accepted Answer

SSL/TLS. HTTPS uses TLS (Transport Layer Security) to encrypt HTTP traffic and verify server identity.

Answer

SSH

Answer

IPsec

Answer

VPN

Question 5

Which transport protocol is connection-oriented and ensures reliable delivery through acknowledgments and retransmissions?

Accepted Answer

TCP. TCP is connection-oriented and provides reliability.

Answer

IP

Answer

HTTP

Answer

UDP

Question 6

A software-defined networking (SDN) controller is being deployed to manage network devices. Which two components are part of the SDN architecture? (Choose two.)

Accepted Answer

Data plane. The control plane (decides traffic flow) and data plane (forwards traffic) are the two key planes in SDN, with the controller centralizing the control plane.

Answer

Application plane

Answer

Forwarding plane

Answer

Management plane

Question 7

In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?

Accepted Answer

Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests. Cisco DNA Center uses token-based authentication. The correct flow is to first send a POST request to the /dna/system/api/v1/auth/token endpoint with a valid username and password (typically using Basic Authentication over HTTPS). The response contains a JSON Web Token (JWT) that must be included in the X-Auth-Token header of all subsequent API requests. This token has a configurable expiry (default 60 minutes) and must be refreshed before it expires.

Answer

OAuth 2.0 client credentials grant with client ID and secret

Answer

Basic authentication with username and password in the header

Answer

API key passed in a query parameter

Question 8

Which DNS record type is used to verify domain ownership for email security (SPF) and is stored as a text string?

Accepted Answer

TXT record. TXT records store arbitrary text, commonly used for SPF, DKIM, and domain verification.

Answer

CNAME record

Answer

A record

Answer

MX record

Question 9

An engineer notices that a switch port configured as an access port in VLAN 10 is not forwarding traffic. The switch shows the port is up/up. What is the most likely cause?

Accepted Answer

The connected device is sending 802.1Q tagged frames. An access port expects to receive and send only untagged frames, as it belongs to a single VLAN (VLAN 10). If the connected device sends 802.1Q tagged frames, the switch will drop them because the access port does not process VLAN tags. This explains why the port is up/up but not forwarding traffic.

Answer

Spanning Tree Protocol blocking the port

Answer

Speed/duplex mismatch

Answer

VLAN 10 does not exist in the VLAN database

Question 10

During a CI/CD pipeline for network changes, a Jenkins job runs an Ansible playbook that applies configuration to a device. The playbook fails with a timeout error. What is the most likely cause?

Accepted Answer

The device is under heavy CPU load causing slow responses. A timeout error in an Ansible playbook during a CI/CD pipeline typically indicates that the network device is responding too slowly to complete the SSH or API session within the configured timeout period. Heavy CPU load on the device can cause delayed responses to Ansible's control node, triggering the timeout before the playbook finishes applying the configuration. This is distinct from connectivity failures or authentication issues, which produce different error messages.

Answer

The playbook syntax is invalid

Answer

Incorrect credentials

Answer

Device is unreachable

Question 11

Which THREE of the following are constraints of the REST architectural style (as defined by Roy Fielding)?

Accepted Answer

Client-server architecture. The client-server constraint is a fundamental principle of REST, as defined by Roy Fielding in his doctoral dissertation. It separates the user interface concerns from data storage concerns, improving portability across multiple platforms and scalability by simplifying server components. This separation allows each side to evolve independently, which is a core architectural benefit.

Answer

Session management on the server

Answer

Code-on-demand

Question 12

Which TWO Cisco platforms provide comprehensive REST APIs for network configuration and monitoring?

Accepted Answer

Cisco IOS XE. Cisco IOS XE provides comprehensive REST APIs through its RESTCONF and NETCONF interfaces, enabling programmatic configuration and monitoring of network devices. Cisco DNA Center offers a rich set of REST APIs for intent-based networking, allowing automation of network design, provisioning, policy, and assurance tasks. Both platforms are designed for modern network programmability and are key components of Cisco's DevNet ecosystem.

Answer

Cisco ASA

Answer

Cisco ISE

Answer

Cisco Prime Infrastructure

Question 13

A company has two Cisco Catalyst switches, SW1 and SW2, connected via a trunk link using port GigabitEthernet0/1 on both switches. SW1 is the root bridge for all VLANs spanning tree. VLAN 10 users on SW1 report they can access the internet and resources in VLAN 10 on SW2, but cannot reach a critical server in VLAN 20 connected to SW2. The server in VLAN 20 has a static IP address and can communicate with other VLAN 20 devices on SW2. SW2's configuration for the trunk port includes 'switchport trunk allowed vlan 10,20'. SW1's trunk port configuration is 'switchport trunk allowed vlan 10'. The network administrator has verified that both switches have VLANs 10 and 20 created and that the default gateways are correct. What is the most likely cause of the issue?

Accepted Answer

SW1's trunk port is not configured to allow VLAN 20.. SW1's trunk port is configured with 'switchport trunk allowed vlan 10', which explicitly permits only VLAN 10 traffic. Since VLAN 20 is not in the allowed list, frames from VLAN 20 (including traffic to the server) are dropped at the trunk egress on SW1. This prevents SW1 hosts in VLAN 10 from reaching the VLAN 20 server on SW2, even though the trunk is up and both VLANs exist on both switches.

Answer

SW1 is the root bridge for VLAN 20, causing traffic to be blocked.

Answer

The trunk link between SW1 and SW2 is down.

Answer

The server in VLAN 20 has an incorrect IP address configuration.

Question 14

A DevOps team is automating network configuration using Ansible. They want to push a new VLAN configuration to a switch but ensure that only one switch is updated at a time to avoid network disruption. Which Ansible strategy or feature should they use?

Accepted Answer

Set 'serial: 1' in the playbook.. Setting `serial: 1` in an Ansible playbook forces the play to execute against only one host at a time, even if the play targets multiple switches. This ensures that VLAN configuration is pushed to exactly one switch before moving to the next, preventing network disruption from simultaneous changes.

Answer

Use 'strategy: free' to manage execution order.

Answer

Set 'forks: 1' in the playbook.

Answer

Use 'throttle: 1' on each task.

Question 15

Refer to the exhibit. What is the most effective action to eliminate both vulnerabilities in the container image?

Accepted Answer

Switch the base image to a distroless base image that does not include openssl and curl.. Switching to a distroless base image removes unnecessary packages like openssl and curl entirely, eliminating the vulnerabilities they introduce. Distroless images contain only the application and its runtime dependencies, reducing the attack surface by excluding OS package managers and shell utilities that are common sources of CVEs. This approach directly addresses both vulnerabilities by ensuring the vulnerable components are not present in the image at all.

Answer

Rebuild the image using the same base image but update the OS packages.

Answer

Add a .dockerignore file to exclude vulnerable libraries.

Answer

Only run the container with read-only root filesystem.

Question 16

Which HTTP status code indicates that a POST request successfully created a new resource on the server?

Accepted Answer

201 Created. The 201 Created status code is the correct response for a POST request that successfully creates a new resource. According to RFC 7231, the server should respond with 201 and include a Location header pointing to the newly created resource's URI. This is the standard behavior for RESTful APIs when a POST operation results in resource creation.

Answer

200 OK

Answer

204 No Content

Answer

202 Accepted

Question 17

Which protocol is commonly used to retrieve real-time telemetry data from network devices in a streaming fashion?

Accepted Answer

gRPC. gRPC is correct because it is designed for high-performance, real-time streaming of telemetry data using HTTP/2 and Protocol Buffers. Network devices like Cisco IOS XR and NX-OS use gRPC to push telemetry data to collectors in a continuous stream, eliminating the need for polling and reducing latency.

Answer

SNMP polling

Answer

NETCONF

Answer

HTTP

Question 18

A company runs a microservices application on a Kubernetes cluster with 10 worker nodes. The application consists of 3 services: frontend, backend, and database. The database service is stateful and uses persistent volumes. Recently, the operations team noticed that the backend service is experiencing intermittent failures with 'Connection refused' errors when trying to connect to the database. The database service is exposed via a ClusterIP service named 'database-service'. The backend service uses environment variable DB_HOST=database-service to connect. The pod logs show that the connection is attempted to an IP address that does not correspond to any database pod. Further investigation reveals that the database pod has been restarted multiple times due to OOMKilled errors. The backend service is configured with a liveness probe that checks the health endpoint every 10 seconds, and a readiness probe that checks the same endpoint every 5 seconds. The database pod has resource limits set to 512Mi memory and 500m CPU. The node running the database pod has 4Gi memory and 2 CPU cores. What is the most likely cause of the intermittent connection failures?

Accepted Answer

The database pod is being killed due to memory limits, causing frequent restarts and temporary unavailability; the backend's connection attempts fail during the restart window.. The intermittent 'Connection refused' errors are caused by the database pod being repeatedly killed due to exceeding its memory limit (512Mi), which triggers OOMKilled restarts. During the restart window, the database pod is unavailable, and the backend's connection attempts to the ClusterIP service (which resolves to the pod's IP) fail because no pod is ready to accept connections. The frequent restarts create a pattern of temporary unavailability that aligns with the observed symptoms.

Answer

The backend service is using a hardcoded IP address instead of the service DNS name.

Answer

The backend service's readiness probe is failing, so it is not receiving traffic, but the backend still tries to connect.

Answer

The DNS entry for database-service is cached and pointing to the old pod IP after the database pod restarts.

Question 19

An engineer is troubleshooting a NETCONF session that fails to establish with a Cisco IOS XE device. The SSH connection succeeds, but NETCONF capabilities are not exchanged. What is the most likely cause?

Accepted Answer

The device's NETCONF server is not enabled.. NETCONF uses a client-server model where the server (the Cisco IOS XE device) must have the NETCONF server explicitly enabled. If the SSH transport succeeds but capabilities are not exchanged, it indicates the NETCONF subsystem is not active on the device. The `netconf-yang` feature must be enabled via `netconf-yang` in global configuration mode to start the NETCONF server and allow capability exchange.

Answer

The device requires authentication via SSH keys but password was used.

Answer

The firewall is blocking port 830.

Answer

The device is running an older IOS version that does not support NETCONF.

Question 20

A developer is automating VLAN configuration on a Cisco switch using REST API. Which HTTP method should be used to create a new VLAN?

Accepted Answer

POST. To create a new VLAN resource on a Cisco switch via REST API, the POST method is correct because it is designed to create a subordinate resource under a parent collection. In RESTful APIs, POST is used to send data to the server to create a new entity, such as a VLAN, and the server assigns a unique identifier (e.g., VLAN ID) to the new resource. This aligns with the RESTful principle for resource creation, as specified in RFC 7231.

Answer

PUT

Answer

GET

Answer

PATCH

Answer

DELETE