200-901 Practice Exam 54 — 20 Questions

Question 1

A network engineer wants to retrieve a list of all network devices from Cisco DNA Center using REST API. Which URL and HTTP method should be used?

Accepted Answer

GET /dna/intent/api/v1/network-device. Cisco DNA Center provides the GET /dna/intent/api/v1/network-device endpoint to list all network devices.

Answer

POST /dna/intent/api/v1/network-device

Answer

GET /dna/system/api/v1/auth/token

Answer

GET /dna/intent/api/v1/topology/l2/{vlanID}

Question 2

A developer is working with Meraki API to list all clients on a network. The response is paginated. Which parameter allows the developer to specify the starting point for the next page?

Accepted Answer

startingAfter. Meraki uses startingAfter and endingBefore parameters for cursor-based pagination.

Answer

nextToken

Answer

page

Answer

offset

Question 3

A network engineer wants to retrieve the list of organizations associated with their API key from the Cisco Meraki Dashboard API. The API base URL is https://api.meraki.com/api/v1. Which HTTP request should the engineer send?

Accepted Answer

GET https://api.meraki.com/api/v1/organizations with the X-Cisco-Meraki-API-Key header set to the API key.. The Meraki Dashboard API lists organizations at GET /api/v1/organizations and authenticates via the X-Cisco-Meraki-API-Key request header. Using the correct path and header ensures the API key is recognized and the list of accessible organizations is returned. Alternative methods such as POST, Basic auth, or query-parameter keys are not supported for this operation.

Answer

POST https://api.meraki.com/api/v1/organizations with the API key in the request body.

Answer

GET https://api.meraki.com/api/v1/organization with the API key as a query parameter.

Answer

GET https://api.meraki.com/api/v1/organizations with Basic authentication using the API key as the password.

Question 4

A developer is writing a Python script that uses the requests library to call a REST API. The API requires an API key in the header 'X-API-Key'. The developer wants to ensure the key is not hardcoded in the script and is instead read from an environment variable. Which code snippet correctly implements this?

Accepted Answer

import os
import requests
api_key = os.environ['API_KEY']
headers = {'X-API-Key': api_key}
response = requests.get('https://api.example.com/data', headers=headers). The correct approach reads the API key from an environment variable and includes it in the 'X-API-Key' header as required. Using os.environ or os.getenv is secure. Passing the key as a query parameter, in Basic Auth, or in the Authorization header does not meet the API's authentication scheme.

Answer

import os
import requests
api_key = os.getenv('API_KEY')
headers = {'Authorization': api_key}
response = requests.get('https://api.example.com/data', headers=headers)

Answer

import os
import requests
api_key = os.environ['API_KEY']
response = requests.get('https://api.example.com/data', params={'X-API-Key': api_key})

Answer

import os
import requests
api_key = os.getenv('API_KEY')
response = requests.get('https://api.example.com/data', auth=(api_key, ''))

Question 5

A developer is using the Cisco Webex Teams API to manage memberships in a space. Which two HTTP methods and corresponding endpoints are used to add a new member and to remove an existing member? (Choose two.)

Accepted Answer

POST /v1/memberships to add a member. Adding a member to a Webex space is done with POST /v1/memberships, providing roomId and personEmail. Removing a member is done with DELETE /v1/memberships/{membershipId}. These are the standard methods for managing memberships. Other methods like PUT are for updates, and the room-based endpoints do not exist.

Answer

PUT /v1/memberships/{membershipId} to update a member

Answer

DELETE /v1/rooms/{roomId}/members/{personId} to remove a member

Answer

POST /v1/rooms/{roomId}/members to add a member

Question 6

A network engineer is configuring a switch and needs to assign an IP address to a VLAN interface for management purposes. The engineer wants to ensure that devices on different VLANs can communicate through the switch. Which feature must be enabled on the switch to allow inter-VLAN routing?

Accepted Answer

IP routing. Inter-VLAN routing requires a Layer 3 device to forward packets between subnets. On a Layer 3 switch, enabling IP routing allows the switch to route between VLAN interfaces (SVIs). Each SVI is configured with an IP address and acts as the gateway for hosts in that VLAN. Without IP routing, the switch would only forward frames within the same VLAN.

Answer

Link Aggregation Control Protocol (LACP)

Answer

Spanning Tree Protocol (STP)

Answer

Port mirroring

Question 7

A developer is using the Cisco DNA Center API to manage devices. The developer needs to perform operations that are part of the 'Site Management' API category. (Choose two.)

Accepted Answer

Assign a device to a site. The Site Management API category in Cisco DNA Center includes operations for creating, updating, and deleting sites, as well as associating devices with sites. Creating a new site and assigning a device to a site are both part of this category. Other operations like retrieving device health or configuring SNMP belong to different API categories.

Answer

Retrieve device health

Answer

Configure SNMP settings on a device

Answer

Create a new network profile

Question 8

A developer writes a Python script that calls the Cisco DNA Center Intent API. The script must authenticate once and reuse the returned token on subsequent requests instead of sending credentials with every call. Which HTTP header should the script include on each API request to present the token?

Accepted Answer

X-Auth-Token: <token>. After authenticating to the DNA Center Intent API, clients receive a token that must be sent in the X-Auth-Token header on every subsequent request. Basic credentials, cookies, and content type headers serve different purposes and do not carry the issued token. Reusing the token reduces credential exposure and matches how the controller expects stateless API calls to be authorized.

Answer

Content-Type: application/json

Answer

Authorization: Basic <base64-credentials>

Answer

Cookie: session=<token>

Question 9

A developer is building a CI/CD pipeline that must securely manage secrets such as API keys and database passwords. Which two practices should be implemented to protect these secrets throughout the pipeline? (Choose two.)

Accepted Answer

Store secrets in a dedicated secrets manager and inject them at runtime.. To protect secrets in a CI/CD pipeline, they should be stored in a dedicated secrets manager and injected at runtime, avoiding persistent storage in code or configuration. Additionally, using environment variables with masking ensures secrets are not exposed in logs. These practices minimize the attack surface and align with the principle of least privilege. Encrypting and committing secrets or hardcoding them are insecure, and disabling all logging is impractical.

Answer

Encrypt secrets and commit them to the repository for versioning.

Answer

Disable logging for all pipeline stages to prevent secret leakage.

Answer

Hardcode secrets in the pipeline configuration file for simplicity.

Question 10

A developer is writing a Python script to interact with a Cisco IOS XE device using the NETCONF protocol. The script uses the ncclient library to establish a connection and retrieve the running configuration. Which method should the developer use to retrieve the configuration?

Accepted Answer

manager.get_config(source='running'). The ncclient library provides the get_config method to retrieve configuration from a NETCONF server. The source parameter specifies the datastore, such as 'running' for the running configuration. The get method is for state data, edit_config is for modifying configuration, and dispatch is for custom RPCs. Therefore, the correct method is manager.get_config(source='running').

Answer

manager.edit_config(target='running')

Answer

manager.get(filter=('subtree', 'running'))

Answer

manager.dispatch(rpc='get-config')

Question 11

A network engineer is configuring a new Cisco switch and needs to assign an IP address to a VLAN interface so that the switch can be managed remotely over the network. The engineer enters the commands: interface vlan 10, then ip address 192.168.10.2 255.255.255.0, then no shutdown. However, the interface remains down. What is the most likely cause?

Accepted Answer

The switch does not have any physical ports assigned to VLAN 10, so the VLAN interface is down.. A VLAN interface (SVI) on a Cisco switch remains down until the VLAN is active, which requires at least one physical port to be up and assigned to that VLAN. Simply creating the SVI and assigning an IP address is not enough. The engineer must assign an access port to VLAN 10 and ensure it is operational to bring the SVI up.

Answer

The no shutdown command must be issued from global configuration mode, not interface configuration mode.

Answer

The IP address is incorrectly configured because the subnet mask should be in CIDR notation.

Answer

VLAN 10 has not been created on the switch.

Question 12

A DevNet engineer is building a Python script that calls the Cisco Webex Teams API to post a message. The script currently stores the access token in a plain text variable at the top of the file, which is committed to a Git repository. The team wants to keep the token out of source control while still allowing the script to authenticate. Which approach should be used?

Accepted Answer

Move the token to a .env file and add that file to .gitignore, then load it with python-dotenv.. Keeping secrets out of source control requires storing them in an environment-specific location that is excluded from version control and loading them at runtime. A .env file ignored by Git, combined with python-dotenv, achieves this for local development while allowing the Webex Teams API call to authenticate normally. Encoding or hiding the token in the same file does not remove it from the repository.

Answer

Base64-encode the token and assign it to the variable so it is not readable as plain text.

Answer

Encrypt the token with a symmetric key stored in the same Python file and decode it at runtime.

Answer

Store the token in a comment above the function that uses it so only developers reading the code can see it.

Question 13

A developer is writing a Python script that interacts with a REST API. The API requires authentication using a token. Which HTTP header should the developer include in the request to pass the token?

Accepted Answer

Authorization: Bearer <token>. For REST API authentication using a token, the standard method is to include the token in the Authorization header with the Bearer scheme. This is defined in RFC 6750 for OAuth 2.0 Bearer Tokens. Other headers like X-API-Key or custom headers may be used for API keys, but when the requirement is a token, Bearer is the correct choice. Cookies are for browser sessions.

Answer

Cookie: session=<token>

Answer

X-API-Key: <token>

Answer

Authentication: Token <token>

Question 14

A developer is writing a Python function that accepts a list of interface names and returns a dictionary mapping each interface name to the number of characters in that name. The function should also verify that the input is a list and raise a TypeError otherwise. Which approach correctly implements the described behavior?

Accepted Answer

def map_lengths(names):
    if not isinstance(names, list):
        raise TypeError('names must be a list')
    return {n: len(n) for n in names}. The requirement is twofold: validate that the argument is a list and raise TypeError when it is not, then return a dictionary of name to length. Only the implementation using isinstance with a TypeError raise and a dictionary comprehension satisfies both constraints in a single, correct function.

Answer

def map_lengths(names):
    if type(names) != list:
        raise ValueError('names must be a list')
    return {n: n.__len__() for n in names}

Answer

def map_lengths(names):
    assert isinstance(names, list)
    return dict(zip(names, map(len, names)))

Answer

def map_lengths(names): return {n: len(n) for n in names}

Question 15

A development team is using Docker Compose to run a multi-container application. They need to ensure that the web service can resolve the hostname 'db' to the database container's IP address. Which network configuration in the docker-compose.yml file achieves this?

Accepted Answer

Define both services under the same custom network.. Docker Compose automatically creates a default network for the application, and all services join it unless configured otherwise. On a user-defined bridge network, Docker provides automatic DNS resolution so that service names become valid hostnames. Therefore, ensuring both the web and db services are on the same custom network allows the web service to connect to 'db' by its service name, which is the cleanest and most reliable method.

Answer

Use the 'links' directive to link the web service to the db service.

Answer

Publish the database port on the host and use 'host.docker.internal' as the hostname.

Answer

Set the 'network_mode' of the web service to 'service:db'.

Question 16

A developer is writing a script that uses the Cisco SD-WAN vManage REST API to retrieve a list of devices. The script uses the GET method to https://vmanage.example.com/dataservice/device. The API returns a 401 Unauthorized status code. Which of the following should the developer do to resolve the issue?

Accepted Answer

Include a valid authentication token in the request header.. The 401 Unauthorized status code indicates that the request lacks valid authentication credentials. For the Cisco SD-WAN vManage API, developers must authenticate first, usually by obtaining a session token, and then include that token in subsequent requests. Without it, the API rejects the request. The other options address different issues such as method, TLS, or query parameters, which would produce different error codes.

Answer

Ensure the request URL includes the correct query parameters for device filtering.

Answer

Verify that the vManage server's TLS certificate is trusted by the client.

Answer

Change the HTTP method to POST.

Question 17

A developer is working on a Python script that must read a JSON configuration file containing device credentials. The script needs to parse the file and access the value of the key 'username'. Which Python standard library module and function should be used?

Accepted Answer

json.load(). The json.load() function is the correct choice because it reads a file object and returns a Python dictionary, allowing immediate access to the 'username' key. The other options either parse strings, handle different formats, or are not part of the standard library for JSON parsing.

Answer

configparser.ConfigParser().read()

Answer

json.loads()

Answer

yaml.safe_load()

Question 18

A developer maintains a Python library that calls a REST API and currently stores the API token in a module-level constant. The team wants to follow twelve-factor app principles so the same build artifact can be deployed to lab and production without code changes. Which change should the developer make?

Accepted Answer

Read the token from an environment variable, such as os.environ['API_TOKEN'], at runtime.. Twelve-factor configuration is stored in the environment, not in code or committed files. Reading the API token from an environment variable allows the identical build artifact to run in lab and production with different credentials, keeps secrets out of source control, and requires no code edits between deployments.

Answer

Move the token into a config.ini file that is committed to the repository and read at import time.

Answer

Encrypt the token with a symmetric key and store both the ciphertext and key in the repository for decryption at runtime.

Answer

Detect the deployment environment by hostname and select a hardcoded token for each environment.

Question 19

A security team is reviewing a Python application that integrates with Cisco DNA Center. The application authenticates with a username and password and stores them in a configuration file that is deployed to multiple servers. The team wants to reduce the risk of credential exposure while keeping the application functional. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Store the configuration file with restrictive file permissions and exclude it from version control.. Reducing credential exposure involves both limiting how long secrets live and limiting who can read them. Short-lived tokens from the Cisco DNA Center authentication API shrink the useful lifetime of a stolen secret, while restrictive file permissions and exclusion from version control protect the configuration file itself. Together these controls address the risk without breaking the integration.

Answer

Disable TLS verification for Cisco DNA Center API calls to simplify certificate management.

Answer

Embed the credentials in the Python source code so the configuration file can be deleted.

Answer

Log the credentials at startup so operators can confirm the configuration is correct.

Question 20

A developer is preparing a Python script that authenticates to a Cisco DNA Center controller, retrieves a list of network devices, and writes the inventory into a reusable module consumed by other teams. The team lead requires that the credentials never be stored in the source code. Which TWO practices satisfy that requirement? (Choose two.)

Accepted Answer

Load the credentials from a separate configuration file that is listed in .gitignore and provisioned on each host.. Secrets must be injected from outside the repository so that committed code never contains them. Environment variables and an ignored, per-host configuration file both achieve this, letting each consumer supply its own values while the module itself holds only the logic that reads them. Encoding or renaming secrets inside the source leaves the values in version history.

Answer

Encode the credentials with base64 inside the module so they are unreadable to anyone browsing the source.

Answer

Commit the credentials in an encrypted form and keep the decryption key in the same repository branch for convenience.

Answer

Hard-code the credentials as module-level constants but rename the variables so they are not obviously credentials.