200-901 Practice Exam 53 — 20 Questions

Question 1

In Cisco DNA Center, which API endpoint is used to retrieve the site hierarchy?

Accepted Answer

GET /dna/intent/api/v1/site. Cisco DNA Center exposes the site hierarchy through the Intent API at GET /dna/intent/api/v1/site, which returns the list of sites with their hierarchy, parent-child relationships, and site IDs. This is the documented endpoint for retrieving site topology information.

Answer

POST /dna/intent/api/v1/site

Answer

GET /dna/intent/api/v1/network-device

Answer

GET /dna/intent/api/v1/topology

Question 2

A company uses Cisco DNA Center to manage their network. A developer wants to retrieve the overall health score of a specific site using the DNA Center REST API. Which API path should be used?

Accepted Answer

/dna/intent/api/v1/site-health. The correct API path to retrieve the overall health score of a specific site is /dna/intent/api/v1/site-health. This endpoint is part of the Cisco DNA Center Intent API and returns site-level health metrics, including overall health scores for network devices, clients, and applications at a given site. It is specifically designed to aggregate health data per site, unlike broader network-wide endpoints.

Answer

/dna/intent/api/v1/network-health

Answer

/dna/intent/api/v1/assurance/site

Answer

/dna/intent/api/v1/health-score

Question 3

In the context of Cisco Webex APIs, which mechanism allows an application to receive real-time notifications when a message is created in a space?

Accepted Answer

Registering a webhook with the resource 'messages' and event 'created'. Cisco Webex APIs support webhooks, which are user-defined HTTP callbacks that the Webex cloud invokes when a specified event occurs. Registering a webhook with resource 'messages' and event 'created' causes Webex to POST a notification to your target URL whenever a new message is created in a space, enabling real-time, event-driven integration without polling. This is the standard mechanism for receiving real-time notifications in Webex.

Answer

Enabling Server-Sent Events (SSE)

Answer

Polling the /messages endpoint every second

Answer

Using a long-lived HTTP connection

Question 4

When designing a RESTful API for a network automation tool, which status code indicates that a resource has been created successfully?

Accepted Answer

201 Created. (201 Created). According to HTTP semantics and RESTful API best practices, a successful POST request that creates a new resource should return the 201 Created status code. This indicates that the request has been fulfilled and a new resource has been created, often with a Location header pointing to the resource's URI. 204 No Content (option A) is used for successful requests that have no response body, such as DELETE or when an update returns no content, but not for creation.

Answer

204 No Content

Answer

200 OK

Answer

202 Accepted

Question 5

In gNMI, what is the difference between dial-in and dial-out streaming?

Accepted Answer

Dial-in: client initiates subscription and receives data; dial-out: device pushes data to a configured receiver. In gNMI, dial-in streaming refers to the client initiating a subscription request to the device, which then streams telemetry data back over the same gRPC session. Dial-out streaming, on the other hand, is a server-initiated model where the device (gNMI target) pushes telemetry data to a pre-configured receiver (collector) without waiting for a client request. Option C correctly captures this distinction: dial-in has the client subscribe and receive data, while dial-out has the device push data to a configured receiver.

Answer

Dial-in is for configuration, dial-out for telemetry

Answer

Dial-in: device initiates the connection; dial-out: client initiates

Answer

Dial-in uses gRPC, dial-out uses HTTP

Question 6

In Software-Defined Networking (SDN), which interface is used for communication between the controller and the network devices (e.g., switches) to forward traffic?

Accepted Answer

Southbound API. The southbound API (e.g., OpenFlow, NETCONF) is used to communicate between the SDN controller and the data plane devices.

Answer

Northbound API

Answer

Control plane

Answer

East-West API

Question 7

A network administrator uses the Cisco IOS XE CLI to configure a router. They want to use a Python script to automate this configuration via the guest shell. Which library should they use to interact with the CLI from within the guest shell?

Accepted Answer

cli. The `cli` library is a built-in Python module available within the Cisco Guest Shell that allows scripts to execute IOS XE CLI commands directly on the host device. This library provides functions like `cli.execute()` and `cli.configure()` to send commands and retrieve output, making it the correct choice for automating configuration via the Guest Shell without external dependencies.

Answer

requests

Answer

ncclient

Answer

paramiko

Question 8

A developer is writing a Python script using the Cisco Webex Teams API to send a message to a specific room. The script works for some rooms but fails for others with a 404 error. What is the most likely reason?

Accepted Answer

The bot is not a member of those rooms.. The 404 error indicates that the resource (the room) was not found by the API. In the Cisco Webex Teams API, a bot can only interact with rooms it has been added to as a member. If the bot is not a member of a room, the API cannot locate the room from the bot's perspective, resulting in a 404 error. This is the most common cause of intermittent 404 errors when the script works for some rooms but not others.

Answer

The API rate limit has been exceeded for those rooms.

Answer

The access token is invalid for those rooms.

Answer

The bot does not have permission to send messages in those rooms.

Question 9

A developer is building a chatbot that retrieves interface status from a Cisco Catalyst 9000 switch using RESTCONF. Which authentication method is most appropriate for programmatic access?

Accepted Answer

HTTP Basic Authentication over HTTPS.. RESTCONF on Cisco Catalyst 9000 switches supports HTTP Basic Authentication over HTTPS as a straightforward, standards-based method for programmatic access. Basic authentication sends the username and password in the HTTP Authorization header, and when combined with HTTPS, the credentials are encrypted in transit, providing adequate security for device management without requiring additional infrastructure like an OAuth provider or certificate authority.

Answer

API key passed in the HTTP header.

Answer

OAuth 2.0 with client credentials grant.

Answer

Client certificate authentication.

Question 10

In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?

Accepted Answer

Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests. Cisco DNA Center uses token-based authentication. The correct flow is to first send a POST request to the /dna/system/api/v1/auth/token endpoint with a valid username and password (typically using Basic Authentication over HTTPS). The response contains a JSON Web Token (JWT) that must be included in the X-Auth-Token header of all subsequent API requests. This token has a configurable expiry (default 60 minutes) and must be refreshed before it expires.

Answer

OAuth 2.0 client credentials grant with client ID and secret

Answer

Basic authentication with username and password in the header

Answer

API key passed in a query parameter

Question 11

An organization has a web server that needs to be reachable via both 'www.example.com' and 'example.com'. Which DNS record type should be used to make 'example.com' an alias for 'www.example.com'?

Accepted Answer

CNAME record. A CNAME record creates an alias that points to the canonical name. The A record points to an IP address, not another domain.

Answer

A record

Answer

MX record

Answer

NS record

Question 12

A Kubernetes administrator wants to use kubectl to troubleshoot a pod named 'my-pod' that is not starting. Which TWO commands are useful? (Choose two.)

Accepted Answer

kubectl describe pod my-pod. Option C, 'kubectl describe pod my-pod', is correct because it surfaces the pod's status conditions, events, and container state details (such as ImagePullBackOff, CrashLoopBackOff, or scheduling failures), which are essential for diagnosing why a pod is not starting. Option E, 'kubectl logs my-pod', is correct because it retrieves the container's stdout/stderr output, revealing application-level errors that prevent the process from running successfully. Option A is not directly useful since 'kubectl get deployment my-deployment' only shows deployment-level status and does not inspect the specific pod 'my-pod'. Option B, 'kubectl rollout status deployment my-deployment', reports rollout progress for a deployment, not the startup failure of an individual pod. Option D, 'kubectl delete pod my-pod', is a remediation action that removes the pod rather than a troubleshooting command to diagnose the failure.

Answer

kubectl get deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Answer

kubectl delete pod my-pod

Question 13

A CI/CD pipeline is configured to build a Docker image, run unit tests, and push the image to a registry. To ensure that only successfully tested images are pushed, which stage order is correct?

Accepted Answer

Build image -> Run tests -> Push image. The correct order is: build the image, run tests, then push only if tests pass. Pushing before tests could push a broken image.

Answer

Run tests -> Build image -> Push image

Answer

Build image -> Push image -> Run tests

Answer

Push image -> Build image -> Run tests

Question 14

An application needs to receive real-time notifications when a new message is posted in a Webex space. Which Webex API feature should be used?

Accepted Answer

Create a webhook that triggers on 'messages' events. Webex uses webhooks to push real-time event notifications to an external server. By creating a webhook that triggers on 'messages' events, the application receives an HTTP POST request whenever a new message is posted in the specified space, eliminating the need for polling or persistent connections.

Answer

Establish a WebSocket connection to the Webex API

Answer

Use Server-Sent Events (SSE) from the Webex API

Answer

Poll the messages endpoint every second

Question 15

A developer is creating a Dockerfile for a Python Flask application. The application runs on port 5000. Which directive should be used to document that the container listens on this port?

Accepted Answer

EXPOSE 5000. The EXPOSE directive informs Docker that the container listens on specified ports at runtime. It does not actually publish the port but serves as documentation.

Answer

PORT 5000

Answer

PUBLISH 5000

Answer

LISTEN 5000

Question 16

An application uses the Meraki Dashboard API and receives a 429 Too Many Requests error. What is the most likely cause, and how should the application adjust?

Accepted Answer

The application exceeded the rate limit of 5 calls per second; implement exponential backoff.. A 429 Too Many Requests error from the Meraki Dashboard API indicates that the application has exceeded the rate limit, which is 5 calls per second per organization. The correct adjustment is to implement exponential backoff to retry requests after increasing delays, respecting the Retry-After header if provided.

Answer

The request body is malformed; check JSON syntax.

Answer

The API key is invalid; regenerate the key.

Answer

The network is down; check connectivity.

Question 17

A company uses a centralized automation server that runs Ansible playbooks. What is the best security practice for storing SSH credentials?

Accepted Answer

Use Ansible Vault. Ansible Vault is the recommended security practice for encrypting sensitive data like SSH credentials. It allows you to store encrypted variables and files within your playbooks or inventory, protecting secrets at rest while enabling decryption at runtime via a password or key file. This avoids exposing credentials in plain text, which is critical for centralized automation servers that may be accessed by multiple users or integrated into CI/CD pipelines.

Answer

Store credentials in a public repository

Answer

Hardcode credentials in playbooks

Answer

Use plain text inventory files

Question 18

Which TWO of the following are characteristics of TLS (Transport Layer Security) used in HTTPS? (Choose two.)

Accepted Answer

It uses asymmetric encryption to exchange a symmetric session key.. Option B is correct because the TLS handshake uses asymmetric cryptography (e.g., RSA key transport or ECDHE for key agreement) to securely establish a shared symmetric session key, which is then used for bulk data encryption with algorithms like AES-GCM. Option E is correct because TLS authenticates the server via an X.509 certificate signed by a trusted CA, and can optionally authenticate the client through client certificates during mutual TLS. Option A is incorrect because stream multiplexing is a feature of HTTP/2 and QUIC, not TLS itself. Option C is incorrect because TLS is a session/presentation-layer security protocol that runs between TCP and application protocols like HTTP, not an application-layer protocol. Option D is incorrect because port 443 is the default port for HTTPS, not an inherent characteristic of TLS, which can run over any port.

Answer

It supports multiplexing of multiple streams.

Answer

It is an application layer protocol like HTTP.

Answer

It uses port 443 by default.

Question 19

A network engineer is writing a Python script to interact with Cisco DNA Center. After successfully authenticating and receiving a token, what header must be included in subsequent API requests?

Accepted Answer

In the Authorization header as Bearer. Cisco DNA Center uses token-based authentication following the OAuth 2.0 framework. After obtaining a token via the /dna/system/api/v1/auth/token endpoint, the token must be included in the Authorization header using the Bearer scheme (e.g., 'Authorization: Bearer <token>') for all subsequent API requests to prove the client's identity and authorization.

Answer

In a custom header

Answer

In the URL query string

Answer

In the request body

Question 20

A developer is building an automation script to retrieve network device details from Cisco DNA Center. The script needs to authenticate and then call the device list API. Which THREE steps are required in the correct sequence?

Accepted Answer

Send a GET request to /dna/intent/api/v1/network-device. The correct sequence begins with D: the script must POST to /dna/system/api/v1/auth/token using HTTP Basic Auth (base64-encoded username:password) to obtain a JWT token from Cisco DNA Center. Next, C is required because that token must be presented on every subsequent API call in the Authorization header using the Bearer scheme (Authorization: Bearer <token>), which is how DNA Center validates the caller. Finally, A is required because the device inventory is retrieved with a GET request to /dna/intent/api/v1/network-device, the Intent API endpoint that returns the network device list. Option B is incorrect because DNA Center's token-based authentication does not rely on HTTP cookies. Option E is incorrect because the token must be sent in the Authorization header, not as a query parameter, which would be insecure and unsupported.

Answer

Enable cookie-based authentication in the HTTP client

Answer

Include the token as a query parameter in the device list request