200-901 Practice Exam 53 — 20 Questions

Question 1

A NETCONF RPC reply indicates a validation failure. Based on the exhibit, what is the most probable reason for the failure?

Accepted Answer

The MTU value provided is outside the allowed range.. The NETCONF RPC reply indicates a validation failure, which typically occurs when the data being configured does not conform to the YANG model's constraints. In this context, the MTU value provided is outside the allowed range defined in the YANG model for the interface, triggering a validation error before any configuration is applied.

Answer

The XML syntax in the edit operation was malformed.

Answer

The XML namespace 'Cisco-IOS-XE-native' is not supported.

Answer

The NETCONF session timed out before the operation completed.

Question 2

Drag and drop the steps to use Git to commit and push code changes to a remote repository into the correct order.

Accepted Answer

Stage changes, commit changes, pull the latest changes from remote, resolve any merge conflicts, then push.. The correct Git workflow for committing and pushing code changes is to first stage your changes, then commit them locally. Next, pull the latest changes from the remote repository to sync with upstream work. If there are any merge conflicts, resolve them during the pull or after. Finally, push your commits to the remote repository. This order ensures that your local repository is up-to-date and minimizes merge conflicts.

Answer

Commit changes, stage changes, pull from remote, push, then resolve conflicts.

Answer

Pull from remote, stage changes, commit changes, push, then resolve conflicts.

Answer

Stage changes, commit changes, push, pull from remote, then resolve conflicts.

Question 3

An automation script uses the Cisco IOS XE REST API to modify the running configuration. The script sends a PUT request to /restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=1/0/1/ip/address. The response returns 405 Method Not Allowed. What is the most likely reason?

Accepted Answer

PUT is not allowed on this resource; use PATCH instead.. The 405 Method Not Allowed response indicates that the HTTP method (PUT) is recognized but not supported for the specific resource. In RESTCONF, PUT is used for full resource replacement, but Cisco IOS XE often restricts PUT on certain configuration resources like interface IP addresses because they are nested leafs or lists that require partial updates. PATCH is the correct method for modifying specific fields without replacing the entire resource, aligning with RFC 8040 for partial resource modifications.

Answer

The request body is missing.

Answer

The interface does not exist.

Answer

The script is not authenticated.

Answer

The IP address format is incorrect.

Question 4

An engineer is writing a Python script using the Cisco DevNet sandbox to configure OSPF on a CSR1000v via RESTCONF. What authentication method is typically used for RESTCONF requests?

Accepted Answer

Basic authentication over HTTPS. RESTCONF typically uses Basic authentication over HTTPS (RFC 7235) because it is a lightweight, stateless mechanism that sends a base64-encoded username:password pair in the Authorization header. In the Cisco DevNet sandbox CSR1000v environment, this is the standard method for authenticating RESTCONF requests, as the sandbox provides a username and password for access.

Answer

No authentication

Answer

OAuth2

Answer

API token only

Question 5

Which two statements about the Cisco DevNet Sandbox are true?

Accepted Answer

Sandboxes can be reserved for a fixed time period. Cisco DevNet Sandboxes allow users to reserve a sandbox for a fixed time period, typically ranging from 2 to 4 hours, providing exclusive access to a pre-configured lab environment. This reservation model ensures that users have dedicated resources without contention, which is essential for testing APIs, automation scripts, or network configurations. The fixed-time reservation is a core feature of the DevNet Sandbox service, distinguishing it from always-on sandboxes.

Answer

Sandboxes cannot be used for learning APIs

Answer

Sandboxes require a paid subscription for basic access

Answer

Sandboxes only support Cisco IOS XE devices

Question 6

During a migration from legacy to SD-Access, a network team wants to use Cisco DNA Center to automate policy deployment. They have defined a macro-level intent but need to ensure that the fabric devices are correctly configured. Which API call should they use to validate the fabric configuration?

Accepted Answer

GET /dna/intent/api/v1/business/sda/fabric-site. The GET /dna/intent/api/v1/business/sda/fabric-site API call retrieves the current configuration of fabric sites, allowing the team to validate that fabric devices are correctly provisioned and associated with the intended site. This aligns with the intent-based API model where GET operations are used for validation and monitoring of deployed policies.

Answer

PUT /dna/intent/api/v1/business/sda/fabric-device

Answer

POST /dna/intent/api/v1/business/sda/fabric-site

Answer

GET /dna/intent/api/v1/business/sda/network-profile

Question 7

In a Kubernetes deployment, the container image pull policy is set to "Always". This causes performance issues during rollouts because the image registry is slow. What is the best practice to reduce pull time while maintaining security?

Accepted Answer

Set pullPolicy to "IfNotPresent" for stable releases and use image tags like v1.2.3.. Setting `pullPolicy` to `IfNotPresent` for stable releases (using immutable tags like `v1.2.3`) avoids unnecessary image pulls from a slow registry when the image already exists on the node. This reduces rollout time while maintaining security by ensuring that only explicitly versioned, verified images are used, preventing accidental use of stale or untagged images.

Answer

Use the ":latest" tag to ensure always fresh images.

Answer

Set pullPolicy to "Never" and pre-pull images on nodes.

Answer

Disable image verification to speed up pulls.

Question 8

A Python script using ncclient to configure a Cisco IOS XE device fails with an error that the capability 'urn:ietf:params:xml:ns:netconf:base:1.0' is missing. What is the most likely cause?

Accepted Answer

The device does not have NETCONF enabled. The error indicates that the NETCONF base capability (urn:ietf:params:xml:ns:netconf:base:1.0) is not advertised by the device. This capability is mandatory for any NETCONF server; its absence means the device is not running a NETCONF server or NETCONF is not enabled. On Cisco IOS XE, NETCONF must be explicitly enabled via the 'netconf-yang' feature, and the error occurs when the ncclient client attempts to establish a session but the device does not respond with the required capability.

Answer

The username or password is incorrect

Answer

The edit-config operation should be on candidate instead of running

Answer

The host key verification is disabled incorrectly

Question 9

Which TWO statements about VLAN trunking are true?

Accepted Answer

Trunk links carry traffic for multiple VLANs.. Trunk links carry traffic for multiple VLANs simultaneously by tagging each frame with a VLAN identifier. This allows a single physical link to transport traffic from different VLANs between switches or between a switch and a router. Option C is correct because the primary purpose of a trunk is to multiplex VLAN traffic over one link.

Answer

Trunk links can only carry one VLAN at a time.

Answer

Trunk links use access ports.

Answer

Trunk links are used to connect a switch to a single host.

Question 10

A developer is configuring a RESTCONF request to retrieve the configuration of an interface on a Cisco device. Which URL path and Content-Type header are correct?

Accepted Answer

GET /restconf/data/interface with Content-Type: application/yang-data+json. RESTCONF uses the '/restconf/data' base path to retrieve configuration data (the 'data' resource), and the correct Content-Type for RESTCONF with JSON encoding is 'application/yang-data+json', as defined in RFC 8040. This combination ensures the request targets the operational or configuration datastore and specifies the YANG-encoded JSON media type.

Answer

GET /restconf/data/interface with Content-Type: application/xml

Answer

GET /restconf/data/interface with Content-Type: application/json

Answer

GET /restconf/operations/interface with Content-Type: application/yang-data+json

Question 11

A DevOps team is deploying a containerized application across multiple hosts. They need to ensure that traffic between containers on the same host is isolated from other tenants. Which network implementation best meets this requirement?

Accepted Answer

VXLAN overlays with a distributed virtual switch. VXLAN overlays with a distributed virtual switch provide Layer 2 isolation across multiple hosts by encapsulating Ethernet frames in UDP packets (RFC 7348). This creates independent virtual networks (VXLAN segments) that can span hosts, ensuring traffic between containers on the same host is isolated from other tenants without relying on physical network topology.

Answer

Linux bridge with ebtables rules

Answer

NAT with port forwarding

Answer

802.1Q VLANs on the host switch

Question 12

Which TWO tools are commonly used for automated network compliance checking against a desired state? (Select two)

Accepted Answer

Ansible. B is correct because Ansible is an automation tool that uses playbooks (YAML-based) to define a desired network state and can enforce compliance by comparing the current device configuration against the defined state using modules like `ios_config` or `nxos_config`. It is widely used for network compliance checking due to its agentless architecture and idempotent behavior.

Answer

SolarWinds

Answer

Microsoft Visio

Answer

Chef

Question 13

A network administrator is managing a small office with 10 Cisco 9200 switches. They want to automate the deployment of a standard base configuration (VLANs, STP, management access) to all switches. They have a Linux server with Ansible installed. The administrator writes a playbook that uses the 'ios_config' module to apply configuration blocks. However, when they run the playbook against the first switch, it fails with an authentication error. The administrator can SSH to the switch manually using the same credentials. What is the most likely cause of the failure?

Accepted Answer

The Ansible playbook is missing the 'ansible_connection: network_cli' and 'ansible_network_os: ios' variables.. The most likely cause is that the playbook is missing the required connection and platform variables. When using Ansible's `ios_config` module, you must explicitly set `ansible_connection: network_cli` and `ansible_network_os: ios` in the host variables or playbook. Without these, Ansible defaults to the `smart` connection plugin, which attempts an SSH connection using the `paramiko` library but does not properly negotiate the network CLI session, leading to authentication failures even though manual SSH works.

Answer

The switch's SSH server does not support the key exchange algorithm used by Ansible.

Answer

The playbook is using the wrong username because the variable is not defined.

Answer

The switch is running an incompatible IOS version that does not support the commands in the playbook.

Question 14

A network engineer wants to automate the configuration of multiple Cisco IOS devices using Ansible. What is the minimum requirement on the control node to execute Ansible playbooks against these devices?

Accepted Answer

A Linux or macOS control node with Python installed. Ansible uses a push-based architecture where the control node must be a Linux or macOS system with Python installed to execute playbooks. Python is required because Ansible itself is written in Python and relies on it for modules, SSH connections, and Jinja2 templating. No additional database, license, or dedicated management server is needed for basic network automation against Cisco IOS devices.

Answer

Ansible Tower license for automated network configuration

Answer

A PostgreSQL database to store inventory and credentials

Answer

A dedicated management server with Ansible Tower installed

Question 15

Refer to the exhibit. A Meraki network has a group policy 'Block Social Media' that references a content filtering rule. The policy is applied to VLAN 1. Users in that VLAN cannot access instagram.com but can access facebook.com. What is the most likely reason?

Accepted Answer

The blocked URL patterns list does not include all social media sites.. The group policy 'Block Social Media' references a content filtering rule that likely uses a predefined or custom URL category list. If the rule blocks only specific URL patterns (e.g., 'instagram.com') but does not include all social media sites (e.g., 'facebook.com'), then users can still access unblocked sites. Meraki content filtering operates on URL category matching or explicit URL pattern lists; if the list is incomplete, the policy will not block all intended sites.

Answer

The content filtering rule blocks only a specific set of URLs, but not all social media sites.

Answer

The group policy is not applied to the VLAN.

Answer

The content filtering is not enabled on the MX appliance.

Question 16

A CI/CD pipeline is configured to build a Docker image, run unit tests, and push the image to a registry. To ensure that only successfully tested images are pushed, which stage order is correct?

Accepted Answer

Build image -> Run tests -> Push image. The correct order is: build the image, run tests, then push only if tests pass. Pushing before tests could push a broken image.

Answer

Run tests -> Build image -> Push image

Answer

Build image -> Push image -> Run tests

Answer

Push image -> Build image -> Run tests

Question 17

A developer needs to ensure that environment variables containing database credentials are not hardcoded in the application code. Which approach is most secure for managing secrets in a CI/CD pipeline?

Accepted Answer

Use a secrets management tool like Vault to inject secrets during deployment.. Secrets management tools like HashiCorp Vault provide a centralized, encrypted store for sensitive data such as database credentials, and they inject secrets into the CI/CD pipeline at deployment time via secure APIs (e.g., Vault's HTTP API with TLS). This approach avoids storing secrets in version control, eliminates hardcoding, and supports dynamic secrets, rotation, and audit logging, which aligns with security best practices for CI/CD.

Answer

Encrypt the .env file and commit it.

Answer

Store the credentials in a .env file committed to the repository.

Question 18

A network administrator is tasked with automating the deployment of a new VLAN configuration across a fabric of Cisco ACI switches. Which automation tool is best suited for interacting with the APIC REST API?

Accepted Answer

Ansible. Ansible is the best-suited tool because it provides a dedicated module (cisco.aci.aci_rest) that directly interacts with the APIC REST API, allowing declarative automation of VLAN and other ACI configurations. Unlike generic scripting, Ansible abstracts the HTTP requests and handles idempotency, authentication, and error handling natively for the ACI fabric.

Answer

Bash scripting with curl

Answer

Chef

Answer

Puppet

Question 19

A developer is building a Webex Teams bot that monitors network alerts from Cisco DNA Assurance. The bot must authenticate to the Webex API. Which authentication method should be used?

Accepted Answer

OAuth2 client credentials grant with bot token. Webex Teams bots require OAuth2 client credentials grant to obtain a bot token, which is a long-lived, scoped token that authenticates the bot without user interaction. This method is designed for server-to-server communication, matching the bot's need to post messages and listen for events via the Webex API. Basic authentication, session cookies, and API keys are not supported or appropriate for bot authentication in Webex.

Answer

Basic authentication with username/password

Answer

Session ID cookie

Answer

API key in query string

Question 20

A DevOps team uses Ansible to configure Cisco Nexus switches for a new data center. They have a playbook that uses the nxos_vlan module to create VLANs and nxos_interface module to assign access VLANs. The playbook runs successfully on the first Nexus switch but fails on the second with error: 'module_stderr: ntclib: error: unable to connect to switch'. Both switches are reachable via ping and SSH from the Ansible control node. The inventory file has the same SSH credentials for both switches. What is the most likely cause of the connection failure on the second switch?

Accepted Answer

The second switch does not have NX-API enabled.. The error 'module_stderr: ntclib: error: unable to connect to switch' indicates that the Ansible nxos modules are attempting to use NX-API (REST-like HTTP/HTTPS API) to communicate with the switch, not SSH. Even though SSH is reachable, the second switch likely has NX-API disabled or not configured, causing the connection failure. The nxos_vlan and nxos_interface modules in Ansible rely on NX-API by default when the connection type is set to 'network_cli' or 'httpapi', and without NX-API enabled, the modules cannot execute.

Answer

The Ansible control node has an incompatible version of the nxos collection.

Answer

The second switch has a different VLAN database that conflicts with the playbook.

Answer

The second switch's SSH key fingerprint has changed and is not accepted.