200-901 Practice Exam 55 — 20 Questions

Question 1

A network engineer is preparing an Ansible playbook that will configure VLANs on a fleet of Cisco IOS XE switches. The playbook must authenticate to each device securely and must be able to reference the device-specific variables that the playbook expects. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define host and group variables for each switch in the inventory so tasks can reference the expected variable names.. Secure authentication in Ansible is achieved by encrypting secrets with Ansible Vault and letting the playbook load them at runtime, while per-device values are supplied through inventory host_vars and group_vars. Together these satisfy both requirements: credentials stay protected, and the playbook can reference the variables it expects for each switch.

Answer

Hard-code the enable password directly inside each task's ios_config module arguments.

Answer

Pass the credentials as extra variables on the ansible-playbook command line and rely on shell history being cleared.

Answer

Create a separate playbook for every switch and store the credentials only in that switch's playbook.

Question 2

An automation team wants to build a custom Slack bot that receives a message when a Cisco IOS XE device sends a syslog event indicating an interface went down. Which combination of technologies should the team use to implement this event-driven workflow?

Accepted Answer

Configure the device to send syslog to a collector, and have the collector trigger a webhook to the Slack API.. Syslog is inherently push-based, so configuring the device to send events to a collector is the most direct way to detect an interface-down event. The collector can then invoke the Slack API webhook, creating an event-driven pipeline. Polling approaches add latency and may miss transient events.

Answer

Use Ansible to run a playbook on a schedule that checks interface status and posts to Slack.

Answer

Subscribe to model-driven telemetry on the device and have the bot pull data from the telemetry receiver.

Answer

Poll the device every minute with NETCONF get_config to detect interface state changes, then call the Slack API.

Question 3

A developer is building a Python application that uses the Webex Teams API to send a message to a specific room. The developer has the room ID and a valid access token. Which HTTP method and endpoint should be used?

Accepted Answer

POST /v1/messages with roomId and text in the JSON body. To send a message to a Webex Teams room, the developer must use POST /v1/messages with the roomId and text in the JSON body. The access token is provided in the Authorization header. Other methods like GET are for listing messages, and PUT is for updating existing messages. The endpoint must be exactly as documented.

Answer

GET /v1/messages with roomId as a query parameter

Answer

PUT /v1/messages with roomId and text in the JSON body

Answer

POST /v1/rooms/{roomId}/messages with text in the JSON body

Question 4

A developer is writing a Python script using requests to retrieve a large JSON payload from an API. The server responds with headers including Content-Encoding: gzip, and the response body appears as binary data. The script must automatically decompress the payload to parse it as JSON. Which requests library behavior should the developer rely on?

Accepted Answer

The requests library automatically decompresses gzip-encoded responses when accessing response.text or response.json().. The requests library automatically decompresses gzip-encoded responses when the developer accesses response.text or response.json(). This behavior is driven by the Content-Encoding header and allows seamless parsing of JSON payloads without manual gzip handling. Using response.content returns raw compressed bytes, so the higher-level accessors are necessary for this scenario.

Answer

The developer must set the Accept-Encoding header to identity to force the server to send uncompressed JSON.

Answer

The response.content attribute automatically decodes gzip-encoded bodies before returning them.

Answer

The response.json() method requires the developer to pass a decompression parameter set to True.

Question 5

A developer must write a script that retrieves the running configuration from a Cisco IOS XE device using NETCONF. The script establishes an SSH session and begins the NETCONF capability exchange. Which XML element must the client send to request the device's running configuration using the standard NETCONF data model?

Accepted Answer

with a of . NETCONF defines specifically for reading configuration from a named datastore, and identifies the active configuration. The broader returns state data too, while and modify data. Therefore with a running source is the correct, standards-based request for retrieving the running configuration.

Answer

<edit-config> with a <target> of <candidate/>

Answer

<copy-config> with a <target> of <startup/>

Answer

with a of type subtree

Question 6

A developer is writing a Python script that calls the Cisco DNA Center Intent API. The API returns HTTP 429 responses during peak hours. The developer wants the script to retry failed requests automatically using exponential backoff. Which approach should be used?

Accepted Answer

Use the requests library with a Retry object configured with backoff_factor and status_forcelist mounted on an HTTPAdapter.. HTTP 429 indicates the client exceeded the API rate limit. The requests library integrates urllib3's Retry mechanism, which can be configured with backoff_factor and status_forcelist to automatically retry on 429 with exponential delays. Mounting the adapter on a session applies this behavior to all requests, providing a clean, standard solution.

Answer

Increase the requests timeout parameter to 300 seconds so the API has more time to respond before returning a 429.

Answer

Wrap the request in a while loop that sleeps for a fixed 60 seconds after every 429 response until the request succeeds.

Answer

Switch the script to use the ncclient library because it handles HTTP 429 responses natively for REST APIs.

Question 7

A developer writes a script that calls a Cisco DNA Center intent API to create a new site. The first call returns HTTP 401 Unauthorized. The script already retrieved a token earlier in the same run. Which action should the script take next?

Accepted Answer

Re-authenticate to obtain a fresh token and resend the request with the new token in the header.. HTTP 401 means the authentication credential was not accepted, and the most common cause in DNA Center automation is a token that expired between acquisition and use. Re-authenticating to get a fresh token and resending the request with the updated X-Auth-Token header resolves the failure at its source and completes the site creation.

Answer

Change the HTTP method from POST to GET and resubmit the site creation payload.

Answer

Assume the site already exists and stop the script without further action.

Answer

Retry the identical request in a tight loop until it succeeds.

Question 8

A developer is troubleshooting a Python function that parses device configuration returned by a REST API. The function receives a JSON string and must convert it into native Python dictionaries and lists before iterating over the device entries. Which standard-library approach performs that conversion?

Accepted Answer

Call json.loads() on the response text to transform the JSON string into Python dictionaries and lists.. The json module separates file-based and string-based operations. Deserializing in-memory API text requires json.loads(), which turns JSON text into dicts, lists, strings, numbers, booleans, and None. The serializing counterpart json.dumps() moves in the other direction, and json.load() requires a file-like object rather than a string.

Answer

Call json.load() on the response text to read the JSON content directly from the string variable.

Answer

Call str() on the response text so Python can interpret the JSON braces and brackets as native container syntax.

Answer

Call json.dumps() on the response text to transform the JSON string into Python dictionaries and lists.

Question 9

A network administrator is configuring a switch and needs to ensure that devices connected to the same VLAN can communicate with each other. The administrator wants to verify that the switch is correctly forwarding frames within the VLAN. Which of the following best describes the switch's primary function in this scenario?

Accepted Answer

It forwards frames based on MAC addresses within the same VLAN.. A switch's primary function is to forward frames based on MAC addresses within a VLAN. It learns source MAC addresses and builds a MAC address table, then forwards frames only to the port where the destination MAC is known, enabling efficient communication within the same VLAN while isolating traffic from other VLANs.

Answer

It translates IP addresses to MAC addresses for communication.

Answer

It routes packets between different VLANs using IP addresses.

Answer

It broadcasts all frames to every port to ensure delivery.

Question 10

A developer is building a Python application that must connect to a REST API hosted on a server. The API requires a persistent connection and the ability to send multiple requests without re-establishing a TCP handshake each time. The developer wants to minimize latency. Which HTTP feature should the application leverage?

Accepted Answer

HTTP persistent connections (keep-alive). Persistent connections, enabled by the Connection: keep-alive header in HTTP/1.1, allow a client to reuse an existing TCP connection for multiple requests. This reduces latency by eliminating repeated TCP and TLS handshakes. While HTTP/2 multiplexing also improves efficiency, it requires server support and is not the basic feature described. The other options do not directly address the need for connection reuse.

Answer

HTTP pipelining

Answer

HTTP/2 multiplexing

Answer

HTTP cookies

Question 11

A developer is working on a Git repository and needs to temporarily save changes that are not ready to be committed, switch to another branch to fix a bug, and then return to the original branch and reapply the saved changes. Which Git command should be used to accomplish this?

Accepted Answer

git stash. git stash is designed to temporarily save uncommitted changes, allowing a clean working directory to switch branches. After handling the urgent bug fix, the developer can return and reapply the stashed changes. The other options either commit, discard, or misconfigure branches, none of which preserve work-in-progress.

Answer

git checkout -- .

Answer

git branch --set-upstream-to

Answer

git commit -m "WIP"

Question 12

A developer is troubleshooting an application that uses HTTP/2. The developer notices that multiple requests are being sent concurrently over a single TCP connection, and the responses are being received out of order. Which HTTP/2 feature allows this behavior?

Accepted Answer

Multiplexing. HTTP/2 multiplexing allows multiple request and response messages to be interleaved on a single TCP connection. Each stream is independent, and responses can be received out of order, eliminating head-of-line blocking at the HTTP level and improving performance by enabling parallel transfers without opening multiple connections.

Answer

Binary framing

Answer

Server push

Answer

Header compression

Question 13

A developer is writing a Python script that must authenticate to the Cisco DNA Center REST API and create a new site. The script stores the controller hostname, username, and password in environment variables. Which approach correctly obtains the authentication token required for subsequent API calls?

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with HTTP Basic authentication using the username and password, then read the 'Token' field from the JSON response.. Cisco DNA Center authenticates API clients by exchanging HTTP Basic credentials for a time-limited token. The client posts to /dna/system/api/v1/auth/token, and the controller returns a JSON object whose 'Token' field is then used in the X-Auth-Token header. This is the only supported pattern among the choices, so the script must follow it to create sites successfully.

Answer

Send a POST request to /api/v1/token with the username and password in a JSON body, then read the 'access_token' field from the JSON response.

Answer

Send a POST request to /dna/system/api/v1/auth/token with the username and password in a JSON body, then read the 'Token' field from the JSON response.

Answer

Send a GET request to /dna/system/api/v1/auth/token with the username and password as query parameters, then read the 'Token' field from the JSON response.

Question 14

A developer is designing a Python class to model a network device. The class should prevent direct modification of the device's IP address after it is set, while still allowing the address to be read. Which implementation achieves this encapsulation requirement?

Accepted Answer

Define the IP address as a private attribute named __ip_address and provide only a getter method.. Using a double-underscore prefix triggers name mangling, which discourages direct external access, and exposing only a getter method allows reading the address without providing a way to change it. A public attribute, a single-underscore convention, or a class variable all permit modification or do not represent per-instance state, so they fail the encapsulation requirement.

Answer

Define the IP address as a public attribute named ip_address.

Answer

Define the IP address as a protected attribute named _ip_address and document that it should not be changed.

Answer

Define the IP address as a class variable shared by all instances.

Question 15

A developer is integrating with a REST API that returns a 429 Too Many Requests status code along with a Retry-After header. The developer's script currently retries immediately upon receiving a 429. What should the developer do to correctly handle rate limiting?

Accepted Answer

Parse the Retry-After header and wait for the specified number of seconds before retrying the request.. The correct approach is to parse the Retry-After header and wait the specified time before retrying. This respects the server's rate limit and increases the chance of a successful request. Other options either ignore the header, switch endpoints unnecessarily, or use arbitrary delays. Honoring Retry-After is the standard and most effective way to handle 429 responses.

Answer

Immediately retry the request with an exponential backoff starting at 1 second, ignoring the Retry-After header.

Answer

Reduce the request rate by adding a fixed delay of 60 seconds between all subsequent requests.

Answer

Switch to a different API endpoint that is not rate-limited and continue the operation there.

Question 16

A developer is using the Cisco DNA Center Intent API to manage network devices. The developer needs to programmatically retrieve a list of all devices that match a specific hostname pattern. Which two actions must be performed to accomplish this? (Choose two.)

Accepted Answer

Send a GET request to the /dna/intent/api/v1/network-device endpoint and filter the response by hostname using query parameters or client-side processing.. To retrieve devices by hostname pattern via the DNA Center Intent API, the developer must first authenticate to obtain a token, then issue a GET request to the network-device endpoint and filter the results. Authentication is always required, and the GET method is used for read operations. The other options involve incorrect HTTP methods, unnecessary device configuration, or actions that do not contribute to the retrieval task.

Answer

Send a POST request to the /dna/intent/api/v1/network-device endpoint with a JSON body containing the hostname pattern.

Answer

Configure SNMPv3 on all devices to allow DNA Center to poll them for hostname information.

Answer

Use the PUT method to update the device hostname before retrieving the list.

Question 17

A developer's integration must call a Cisco Webex API on behalf of users across many customer organizations. Each organization administers its own users and consents independently, and the integration must refresh access without user interaction after initial consent. Which OAuth 2.0 grant type should the integration use?

Accepted Answer

Authorization code grant. Delegated access across many organizations requires each user to authenticate and consent at Cisco Webex, which the authorization code grant accomplishes. Exchanging the returned code yields both an access token and a refresh token, so the integration can renew access silently afterward. The other grants either lack refresh capability, require unsafe password handling, or represent the app rather than the user.

Answer

Implicit grant

Answer

Resource owner password credentials grant

Answer

Client credentials grant

Question 18

A platform team is hardening a containerized application before production. They want to reduce the attack surface of the running containers themselves. Which two practices directly reduce the privileges available to a compromised container process? (Choose two.)

Accepted Answer

Run the container process as a non-root user via the USER instruction or --user flag. Privilege reduction focuses on what the process is allowed to do at runtime. Running as a non-root user removes the broad powers of uid 0, and dropping Linux capabilities strips specific kernel-level abilities even from processes that retain elevated identity. Read-only filesystems, smaller images, and health checks improve other properties such as immutability, vulnerability count, and availability, but none of them lower the privilege ceiling of a compromised process.

Answer

Set the read-only flag on the container filesystem with --read-only

Answer

Add a HEALTHCHECK instruction to the Dockerfile so the orchestrator can restart unhealthy containers

Answer

Use a smaller base image such as alpine to reduce the image size

Question 19

A developer is writing a REST API client in Python that authenticates to a controller using HTTP Basic authentication over the network. The developer wants to ensure credentials are never exposed on the wire in readable form. Which implementation detail is required?

Accepted Answer

Send the request only over HTTPS so the TLS session encrypts the Authorization header in transit.. HTTP Basic authentication provides no confidentiality of its own; it merely encodes the credentials. Protecting them requires an encrypted transport, which TLS provides for the whole request and response. Encoding, relocating, or hashing the credential on the client changes its representation without hiding it from an observer, so only a TLS-protected connection keeps credentials unreadable in transit.

Answer

Send the credentials in a custom request header that the server is configured to read.

Answer

Hash the password with SHA-256 and send the digest in place of the password.

Answer

Base64-encode the username and password and place the result in the Authorization header.

Question 20

A developer is building a Python script that authenticates to the Cisco DNA Center REST API. The script must avoid hardcoding credentials in source control and must run unattended in a CI pipeline. The team already stores secrets in environment variables on the build agent. Which approach best meets these requirements?

Accepted Answer

Read the credentials with os.environ at runtime and pass them to the DNA Center authentication endpoint to obtain a token.. Credentials supplied through environment variables let the same script run locally and in CI without modification, and they never land in the repository. The script authenticates against the DNA Center token service and reuses the resulting token for the API calls it needs, satisfying both the secrecy and unattended-execution constraints.

Answer

Store the credentials in a plaintext YAML file in the repository and load it with a relative path.

Answer

Embed the username and password as string literals in the script and commit it to a private Git repository.

Answer

Prompt the operator for credentials with input() each time the pipeline executes.