200-901 Practice Exam 56 — 20 Questions

Question 1

An engineer is configuring Cisco IOS XE device programmability using RESTCONF. Which THREE of the following are required to enable and use RESTCONF on the device?

Accepted Answer

Enable the HTTP/HTTPS server on the device. To enable RESTCONF on Cisco IOS XE, the following are required: enable the HTTP/HTTPS server (option B) to allow RESTCONF communication; enable the 'restconf' feature (option C) to activate RESTCONF services; and enable the 'netconf-yang' feature (option E) because RESTCONF relies on the YANG infrastructure provided by netconf-yang. Option A is incorrect because RESTCONF can use any YANG model, not only Cisco native models. Option D is incorrect because the RESTCONF API endpoint is '/restconf', not '/rest'.

Answer

Use only Cisco native YANG models

Answer

Send requests to /rest/ API endpoint

Question 2

A network administrator wants to use Cisco Webex APIs to automate sending messages to a specific room. Which THREE pieces of information are required to send a message using POST /v1/messages?

Accepted Answer

Message body as plain text or markdown. The POST /v1/messages endpoint requires authentication via a bearer token in the Authorization header (option E). To specify the recipient, you must provide either a roomId or toPersonEmail (option C). The message body must be included as text or markdown (option B). Therefore, options B, C, and E are required. Options A and D are incorrect because A uses a Meraki API key (not used in Webex) and D requires a user ID (not needed for sending messages to a room or person).

Answer

X-Cisco-Meraki-API-Key header

Answer

User ID of the recipient

Question 3

A developer is building a chatbot that needs to send a direct message to a user on Webex. Which TWO fields are required in the POST /v1/messages request? (Choose TWO.)

Accepted Answer

toPersonId. To send a direct message via the Webex API, you must provide exactly one recipient identifier (either toPersonId or toPersonEmail) and exactly one message content field (either markdown or text). Therefore, the two required fields are a recipient field and a content field. Option B (toPersonId) and Option C (markdown) form such a pair. Option D (toPersonEmail) is a valid recipient but is not required if toPersonId is used; it is not needed as a second field since only one recipient is needed.

Answer

roomId

Answer

toPersonEmail

Answer

files

Question 4

Which TWO Docker network drivers allow a container to communicate with the host's network stack directly?

Accepted Answer

host. Host mode shares the host's network stack directly with the container, allowing it to use the host's IP and ports. Macvlan assigns a MAC address to the container, making it appear as a separate device on the host's network, thus enabling direct communication with the host's network stack. Overlay is for multi-host communication, bridge provides isolation, and none disables networking.

Answer

bridge

Answer

none

Answer

overlay

Question 5

A company is adopting DevSecOps practices. Which THREE practices should be implemented to secure application deployment?

Accepted Answer

Dependency scanning with tools like Snyk or Dependabot. The correct answers (B, C, D) are key DevSecOps practices for securing application deployment. Dependency scanning (B) identifies vulnerabilities in third-party packages. HTTPS and CORS (C) are essential for secure communication and access control. Secure coding practices (D) prevent common exploits like injection. Option A is wrong because committing .env files to git exposes secrets; secrets should be managed via vaults or CI/CD variables, not in repos. Option E is wrong because disabling security tools increases risk.

Answer

Secrets management using environment variables stored in .env files committed to git

Answer

Disabling all security tools to reduce deployment time

Question 6

Refer to the exhibit. A DevOps engineer is using NETCONF to retrieve the OSPF configuration. The <get> response is missing the network statements. What is the most likely cause?

Accepted Answer

The filter used in the NETCONF request did not include the correct path for network commands.. The most likely cause is that the NETCONF <get> request used an incorrect or incomplete XML filter that did not specify the correct XPath for the OSPF network statements. NETCONF relies on YANG-defined data paths; if the filter omits the subtree for network commands, the device will not return those configuration elements, even though they exist in the running configuration.

Answer

The YANG model for OSPF does not include the network statement.

Answer

The device does not support NETCONF for OSPF.

Answer

The NETCONF username does not have sufficient privileges.

Question 7

A network automation engineer is writing an Ansible playbook to configure interface descriptions on Cisco IOS-XE devices. The playbook uses the ios_config module. Which attribute should be used to ensure idempotency and only apply changes when the interface does not already have the desired description?

Accepted Answer

lines. The `lines` attribute in the `ios_config` module specifies the exact configuration lines to be applied. Ansible's `ios_config` module inherently checks the current device configuration against the desired state defined in `lines`; if the interface already has the matching description, the module skips the task, ensuring idempotency. This prevents unnecessary configuration changes and maintains network stability.

Answer

src

Answer

parents

Answer

before

Question 8

An engineer retrieves the list of devices in a Meraki network via the Dashboard API. The API returns HTTP 200 OK with an empty array. What is the most likely reason?

Accepted Answer

The network exists but has no devices.. An HTTP 200 OK with an empty array indicates the API request was successfully processed and the target resource (the network) exists, but there are no devices associated with it. This is the expected response when the network is valid but has no devices provisioned.

Answer

The organization has no networks.

Answer

The network ID provided is incorrect.

Answer

The API key has expired.

Question 9

A company has multiple subnets. A device in subnet 192.168.1.0/24 needs to communicate with a device in subnet 192.168.2.0/24. What is required for this communication?

Accepted Answer

A router or Layer 3 switch. Devices in different subnets (192.168.1.0/24 and 192.168.2.0/24) are on separate Layer 3 networks. To forward packets between these subnets, a router or Layer 3 switch is required to perform IP routing, using the destination IP address to determine the next hop. Without a Layer 3 device, the frames cannot leave the local broadcast domain.

Answer

A DNS server

Answer

A VLAN

Answer

A bridge

Question 10

A developer wants to process a list of server hostnames and create a new list containing only hostnames that start with 'web'. Which Python list comprehension correctly accomplishes this?

Accepted Answer

[hostname for hostname in servers if hostname.startswith('web')]. The list comprehension filters items based on the condition and produces a new list.

Answer

[hostname.startswith('web') for hostname in servers]

Answer

[hostname for hostname in servers if 'web' in hostname]

Answer

[hostname if hostname.startswith('web') for hostname in servers]

Question 11

A network engineer is developing a Python application that uses the Cisco Meraki Dashboard API. The API responses are in JSON format. Which Python module is most commonly used to parse JSON responses?

Accepted Answer

json. The `json` module is the standard Python library for parsing JSON data, which is the format used by the Cisco Meraki Dashboard API responses. It provides `json.loads()` to convert a JSON string into a Python dictionary and `json.load()` to read from a file, making it the correct and most commonly used choice for handling API responses in JSON format.

Answer

csv

Answer

yaml

Answer

xml

Question 12

In the context of SDN, which API allows a network controller to communicate with the forwarding plane of network devices?

Accepted Answer

Southbound API. Southbound APIs (e.g., OpenFlow, NETCONF, gRPC) enable communication from the controller to the network devices.

Answer

Eastbound API

Answer

Northbound API

Answer

REST API

Question 13

A developer is writing a Dockerfile for a Node.js application. The application uses environment variables for configuration. Which Dockerfile instruction should be used to set a default value for the NODE_ENV variable?

Accepted Answer

ENV NODE_ENV=production. The ENV instruction sets environment variables that persist in the container at runtime, making it the appropriate way to define a default value for NODE_ENV that can be overridden later with `docker run -e`. Unlike shell-level exports or build-time-only ARGs, ENV ensures the variable is available to the Node.js process when the container starts.

Answer

RUN export NODE_ENV=production

Answer

ARG NODE_ENV=production

Answer

CMD NODE_ENV=production

Question 14

A developer is designing a microservices architecture where services need to discover each other using DNS. The team wants to map a service name 'payment-service.example.com' to its IPv6 address. Which DNS record type should be used?

Accepted Answer

AAAA record. The AAAA record (Quad-A) is the correct DNS record type for mapping a hostname to an IPv6 address, as defined in RFC 3596. Since the requirement is specifically to resolve 'payment-service.example.com' to an IPv6 address, the AAAA record is the appropriate choice.

Answer

PTR record

Answer

A record

Answer

CNAME record

Question 15

A large enterprise uses Cisco DNA Center to manage their campus network. They have deployed fabric technology for SD-Access. The network team wants to use the DNA Center REST API to automate the addition of new wireless users to a specific virtual network (VN) based on their location (building). They have identified the API endpoint for creating a user device in the fabric. However, when they send a POST request with the appropriate JSON body, they receive a 400 Bad Request error. The JSON payload includes the mandatory fields for hostname, MAC address, and VN name. What is the most likely cause of the error?

Accepted Answer

The virtual network name provided does not exist in the fabric.. The 400 Bad Request error indicates that the server cannot process the request due to a client-side issue, such as invalid data in the payload. Since the mandatory fields (hostname, MAC address, VN name) are provided, the most likely cause is that the virtual network (VN) name does not match any existing VN in the fabric. DNA Center validates the VN name against its fabric configuration; if the VN is not defined, the API rejects the request with a 400 error.

Answer

The API call requires an authentication token that is missing or expired.

Answer

The MAC address format is incorrect (e.g., lowercase vs uppercase).

Answer

The user making the API call does not have sufficient privileges.

Question 16

A network automation engineer is using the Cisco DNA Center intent API to retrieve a list of network devices. Which API endpoint should be used?

Accepted Answer

GET /dna/intent/api/v1/network-device. The correct endpoint is GET /dna/intent/api/v1/network-device because the Cisco DNA Center intent API uses this path to retrieve a list of all network devices managed by the controller. The 'network-device' resource is specifically designed for device inventory operations, returning details such as hostname, IP address, platform ID, and software version. This aligns with the intent API's purpose of abstracting underlying complexities into business-relevant resources.

Answer

GET /dna/intent/api/v1/site

Answer

GET /dna/intent/api/v1/topology

Answer

GET /dna/intent/api/v1/issue

Question 17

An organization uses a private Docker registry with TLS. A developer attempts to pull an image and receives the error: "x509: certificate signed by unknown authority". What is the most likely cause and solution?

Accepted Answer

Add the CA certificate to the client's trust store. The error 'x509: certificate signed by unknown authority' occurs because the Docker client does not recognize the certificate authority (CA) that signed the registry's TLS certificate. The correct solution is to add the CA certificate to the client's trust store, typically by placing it in /etc/docker/certs.d/:/ca.crt on Linux or the equivalent Docker certs directory on other platforms. This allows the Docker daemon to validate the registry's certificate during the TLS handshake.

Answer

Use the registry's IP address instead of hostname

Answer

Disable TLS verification on the client

Answer

Use HTTP instead of HTTPS

Question 18

A DevOps engineer is using the Cisco Meraki API to retrieve a list of networks. Which HTTP method should be used?

Accepted Answer

GET. The GET method is the correct HTTP verb for retrieving a list of networks from the Cisco Meraki API because it is a read-only operation that fetches existing resources without modifying server state. The Meraki API follows RESTful conventions where GET requests are used to query collections or individual resources, and the endpoint for listing networks is typically a GET to /organizations/{organizationId}/networks.

Answer

PUT

Answer

POST

Answer

DELETE

Question 19

A Kubernetes cluster is configured with a NetworkPolicy that allows ingress traffic only from pods with label 'app: frontend'. A new backend service needs to communicate with the database pod. What must be done to allow this?

Accepted Answer

Modify the NetworkPolicy to include an additional rule allowing from pods with label 'app: backend'. The existing NetworkPolicy only allows ingress from pods with label 'app: frontend'. To allow the backend service (which presumably has label 'app: backend') to communicate with the database pod, the best practice is to modify the existing NetworkPolicy to include an additional ingress rule that allows pods with label 'app: backend'. This preserves the existing security restrictions while permitting the new traffic. Deleting the policy (option A) would remove all ingress restrictions, which is less secure and not necessary unless explicitly required. Option B only adds a label to the database pod and does not affect the NetworkPolicy's source selection. Option D creates a new policy, but because NetworkPolicies are additive, the existing policy still denies traffic from the backend, so a new policy alone would not work unless it selects the same pod and explicitly allows the traffic; modifying the existing policy is simpler and more appropriate.

Answer

Delete the existing NetworkPolicy

Answer

Add label 'app: backend' to the database pod

Answer

Create a new NetworkPolicy for the database

Question 20

A network engineer notices that after a link failure, traffic to a server on a different VLAN is intermittent. The network uses Rapid PVST+. The switch connecting the server is a root bridge for that VLAN. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The server port is not configured as an edge port, causing STP convergence delay.. When a link fails in a Rapid PVST+ network, the switch that is the root bridge for the VLAN must reconverge. If the server port is not configured as an edge port (using the 'spanning-tree portfast' command), the switch will transition the port through the listening and learning states (even with Rapid PVST+, non-edge ports still undergo a brief convergence delay). This delay causes intermittent connectivity until the port reaches the forwarding state.

Answer

The server is sending BPDUs with a higher priority.

Answer

The root bridge is flapping due to a configuration mismatch.

Answer

OSPF hold-down timers are preventing route updates.