200-901 Practice Exam 56 — 20 Questions

Question 1

A developer is building a Python application that uses the Cisco Webex API to send messages. The application must authenticate on behalf of a user without storing the user's password. Which OAuth 2.0 grant type should be used to obtain an access token?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization Code Grant. To authenticate on behalf of a user without handling their password, the Authorization Code Grant is the correct OAuth 2.0 flow. It redirects the user to the authorization server, where they authenticate directly. The application receives an authorization code, which it exchanges for an access token. This method is secure, supports refresh tokens, and is widely recommended for server-side applications like the Python app described.

Answer

Resource Owner Password Credentials Grant

Answer

Client Credentials Grant

Answer

Implicit Grant

Question 2

A developer is building a Python script that calls the Cisco Webex REST API. The API requires an OAuth 2.0 access token that expires after 14 days. The script will run unattended on a server every hour. Which OAuth 2.0 grant type should the developer use to obtain tokens without user interaction?

Accepted Answer

Client Credentials grant. The Client Credentials grant is the correct choice because it allows the application to authenticate itself directly with the authorization server using its client ID and secret, without any user involvement. This is ideal for server-to-server automation where the script acts on its own behalf and needs to run unattended.

Answer

Resource Owner Password Credentials grant

Answer

Authorization Code grant

Answer

Implicit grant

Question 3

A developer is writing a Python script to interact with a REST API that returns JSON. The script must handle rate limiting gracefully. The API returns a 429 status code with a Retry-After header when the limit is exceeded. Which approach should the developer take to ensure the script continues to function without being blocked?

Accepted Answer

Parse the Retry-After header and sleep for the specified number of seconds before retrying.. Respecting the Retry-After header is the correct way to handle 429 responses. It tells the client exactly how long to wait before retrying, allowing the script to back off appropriately and avoid overwhelming the API. This approach ensures compliance with the API's rate limiting policy and maintains reliable operation.

Answer

Switch to a different HTTP method to bypass the rate limit.

Answer

Ignore the 429 response and continue with the next request.

Answer

Immediately retry the request in a tight loop until it succeeds.

Question 4

A team is reviewing its CI/CD pipeline for security weaknesses. The pipeline builds and deploys a containerized application. Which TWO practices best reduce the risk of a compromised build environment affecting the deployed application? (Choose two.)

Accepted Answer

Run the build in an isolated, ephemeral environment that is destroyed after each pipeline run.. Isolated, ephemeral build environments and short-lived scoped credentials both limit the impact of a compromised build. The ephemeral environment prevents persistence, while short-lived credentials reduce the value of any stolen secrets. Persistent agents and long-lived credentials increase risk because a compromise can persist and be reused, and unsigned images remove verification of the deployed artifact.

Answer

Allow the build to push directly to the production registry without any image signing or verification.

Answer

Store long-lived cloud credentials as environment variables in the CI/CD platform for all pipeline runs.

Answer

Reuse the same build agent for all pipelines to save time and avoid environment setup.

Question 5

A network engineer is writing a Python script to interact with a Cisco Catalyst Center (formerly DNA Center) REST API. They need to authenticate and obtain a token that will be used in subsequent API calls. Which HTTP header should be included in the authentication request to specify the expected response format?

Accepted Answer

Accept: application/json. To request a JSON response from the Catalyst Center authentication endpoint, the client must include the Accept header with application/json. This header informs the server of the desired response format. Other headers serve different purposes: Content-Type describes the request body, Authorization provides credentials, and X-Auth-Token is used after authentication.

Answer

Authorization: Basic <credentials>

Answer

Content-Type: application/xml

Answer

X-Auth-Token: <token>

Question 6

A developer is using the Cisco Meraki Dashboard API to retrieve the list of organizations associated with an API key. The script must handle the response and avoid exposing the API key. Which HTTP header should be used to supply the API key?

Accepted Answer

X-Cisco-Meraki-API-Key: <API_KEY>. The Meraki Dashboard API authenticates each request with the X-Cisco-Meraki-API-Key header. Placing the key in a header rather than a URL keeps it out of server logs and browser history. Other header names belong to different Cisco platforms or authentication schemes and would not authenticate against Meraki.

Answer

Cookie: meraki_api_key=<API_KEY>

Answer

Authorization: Bearer <API_KEY>

Answer

X-Auth-Token: <API_KEY>

Question 7

A developer is writing unit tests for a Python function that parses JSON responses from a Cisco Meraki API. The function takes a JSON string and returns a dictionary. The developer wants to follow best practices for unit testing. Which TWO of the following are recommended practices when writing these tests? (Choose two.)

Accepted Answer

Include at least one test case for invalid JSON input to verify error handling.. Best practices for unit testing include isolating the code under test from external dependencies using test doubles, and covering edge cases such as invalid input. These practices ensure tests are fast, reliable, and comprehensive. The other options describe anti-patterns like order dependence and monolithic tests, which reduce test effectiveness.

Answer

Assert only on the final output of the function, ignoring intermediate states.

Answer

Write tests that depend on the order of execution to save time.

Answer

Use a single test function that covers all possible edge cases to reduce the number of tests.

Question 8

A developer is deploying an application to a Kubernetes cluster and must ensure that the application's configuration values, such as a database hostname and port, are injected as environment variables without storing them in the container image. Which Kubernetes resource should be used?

Accepted Answer

ConfigMap. A ConfigMap is designed for non-sensitive configuration data and can be referenced by a pod to populate environment variables. This decouples configuration from the image and allows the same image to run in different environments. Secrets are for confidential values, while storage and identity resources serve entirely different purposes.

Answer

ServiceAccount

Answer

Secret

Answer

PersistentVolumeClaim

Question 9

A developer is writing a Python script that must call a Cisco DNA Center REST API. The script must authenticate with a username and password over HTTPS and receive a token that is valid for subsequent API calls. The developer wants to avoid embedding the credentials in the script. Which approach should be used?

Accepted Answer

Read the username and password from environment variables and POST them to the DNA Center authentication endpoint to obtain a token.. DNA Center issues a time-limited token when valid credentials are POSTed to its authentication endpoint. Supplying those credentials through environment variables keeps them out of source control and supports rotation across environments. The token is then supplied on subsequent requests, which is exactly the behavior the scenario requires without embedding secrets in the script.

Answer

Hardcode the credentials in a configuration file and commit the file to the Git repository so the script can read it at runtime.

Answer

Use an OAuth 2.0 authorization code flow with a browser-based redirect to obtain an access token for the DNA Center API.

Answer

Send the username and password as query parameters on every API call instead of obtaining a token first.

Question 10

A developer runs a Python script that uses the requests library to call a REST API endpoint. The script receives an HTTP 401 Unauthorized response. The developer confirms the URL is correct and the server is reachable. Which action should the developer take to resolve the issue?

Accepted Answer

Include a valid authentication token in the request's Authorization header.. An HTTP 401 Unauthorized status means the request lacks valid authentication credentials. The developer must provide a valid token or credentials, typically in the Authorization header. Changing the method, query parameters, or timeout does not address the authentication failure, so including a valid token is the correct resolution.

Answer

Verify that the API endpoint URL includes the correct query parameters.

Answer

Change the HTTP method from GET to POST.

Answer

Increase the request timeout value in the Python script.

Question 11

A developer runs `python -c "import requests; r=requests.get('https://api.example.com/v1/status'); print(r.json())"` on a Linux host. The command returns a JSON payload instantly, but when the same request is sent to `http://api.example.com/v1/status` the client hangs and later times out with no response. Which network-layer behavior best explains why the HTTPS URL succeeds while the HTTP URL fails?

Accepted Answer

TCP port 80 is filtered by an intermediate device, while TCP port 443 is permitted.. The only difference between the two attempts is the destination port: 443 succeeds and 80 times out. When a TCP connection times out rather than receiving an immediate RST, an intermediate firewall or ACL is silently discarding the SYN. Because the hostname resolved and the encrypted session completed, name resolution and routing are functioning, leaving port-level filtering as the cause.

Answer

HTTP/1.1 requires a three-way handshake that TCP port 443 avoids by using UDP.

Answer

The server's default gateway is missing, so replies to port 80 are dropped.

Answer

The DNS A record for api.example.com resolves only for TLS connections.

Question 12

A developer is integrating a Python script with Cisco Webex Teams. The script must create a new space and then immediately post a message to that space. After the POST to /v1/rooms, the API returns HTTP 200 with a JSON body containing the new room's id. The script then needs to send a message. Which approach correctly uses the API response to post the message to the newly created room?

Accepted Answer

Extract the 'id' field from the JSON response and use it as the 'roomId' in a subsequent POST to /v1/messages.. When creating a resource via a REST API, the response typically includes the unique identifier of the new resource. For the Webex Teams API, the POST to /v1/rooms returns a JSON object with an 'id' field. To post a message to that room, the developer must pass that 'id' as the 'roomId' in the message creation request. This demonstrates understanding of API chaining and resource identification.

Answer

Parse the 'Link' header from the response and use its URL as the 'roomId' in a subsequent POST to /v1/messages.

Answer

Use the HTTP status code 200 as the 'roomId' in a subsequent POST to /v1/messages.

Answer

Use the 'title' of the room as the 'roomId' in a subsequent POST to /v1/messages.

Question 13

A developer is writing a Python script that uses the Cisco SD-WAN (vManage) API to create a device template. The API requires the request body to include the template configuration and the device model. Which HTTP method and resource path should the developer use?

Accepted Answer

POST /dataservice/template/device. Creating a device template in Cisco SD-WAN vManage requires an HTTP POST to the /dataservice/template/device resource. The request body must contain the device model and the configuration. GET retrieves, PUT updates, and DELETE removes, so only POST aligns with the create operation described in the scenario.

Answer

PUT /dataservice/template/device/feature

Answer

DELETE /dataservice/template/device

Answer

GET /dataservice/template/device

Question 14

A developer is integrating with the Cisco Meraki Dashboard API. They need to update the name of an existing network. Which HTTP method should they use to modify only the name attribute without affecting other attributes?

Accepted Answer

PATCH. PATCH is the correct HTTP method for partial updates. It allows sending only the changed attribute, such as the network name, without affecting other fields. PUT replaces the entire resource, POST creates, and GET retrieves. In Cisco Meraki API, PATCH is used to update specific attributes of a network.

Answer

GET

Answer

PUT

Answer

POST

Question 15

A developer is preparing a Python application for deployment to a Kubernetes cluster. The application reads configuration values such as the database host and API endpoint from a file mounted at /etc/config/app.conf. The values differ between the staging and production clusters. Which Kubernetes resource should the developer use to inject these values into the pod without baking them into the container image?

Accepted Answer

ConfigMap. Configuration that varies between clusters but is not sensitive should live outside the container image. A ConfigMap holds non-confidential key-value pairs and can be mounted as a file or consumed as environment variables, allowing the same image to run in staging and production with different settings. Secrets, volumes, and service accounts serve different purposes and do not address plain configuration injection.

Answer

ServiceAccount

Answer

Secret

Answer

PersistentVolumeClaim

Question 16

A developer is building a Python application that uses the Cisco Webex API to send messages. The application must authenticate on behalf of a user without storing the user's password. Which OAuth 2.0 grant type should be used to obtain an access token?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Read the Retry-After header and wait that many seconds before retrying the request.. When an API returns 429, the client must back off according to the server's Retry-After header rather than retrying aggressively or trying to evade the limit. Immediate retries, transport downgrades, and token rotation do not address the throttling and can worsen it. Respecting Retry-After is the standard, reliable way to recover from rate limiting against the Cisco DNA Center Intent API.

Answer

Switch from HTTPS to HTTP to bypass the rate limiting mechanism.

Answer

Delete the existing authentication token and request a new one to reset the rate limit counter.

Answer

Immediately resend the same request in a tight loop until a 200 response is received.

Question 17

A developer is building a container image for a Node.js API. The Dockerfile currently starts with FROM node:18, copies source code, and runs npm install. Builds are slow because dependencies are reinstalled on every code change. The developer wants to leverage Docker layer caching so that npm install runs only when package.json changes. Which change should be made to the Dockerfile?

Accepted Answer

Place COPY package*.json ./ and RUN npm install before COPY . .. Docker builds images layer by layer, and a layer is rebuilt only when its instruction or the content it depends on changes. Copying only the dependency manifests and running npm install before copying application source keeps the install layer stable across code edits. This ordering minimizes rebuild time and is the recommended pattern for Node.js images.

Answer

Use a multi-stage build with a builder stage that runs npm install

Answer

Add a .dockerignore file that excludes the node_modules directory

Answer

Add RUN npm cache clean --force before npm install

Question 18

A developer is building a Python application that uses the Cisco Webex API to send messages. The application must authenticate on behalf of a user without storing the user's password. Which OAuth 2.0 grant type should be used to obtain an access token?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement exponential backoff, doubling the wait time after each consecutive 429 response.. When encountering a 429 Too Many Requests, the client should respect the Retry-After header if present, or implement exponential backoff to gradually increase wait times. These strategies prevent further rate limit violations and allow successful retries. Immediate retries, ignoring the error, or switching endpoints do not address the root cause and can lead to continued failures.

Answer

Ignore the 429 error and continue sending requests as fast as possible.

Answer

Immediately retry the request without any delay.

Answer

Switch to a different API endpoint that is not rate limited.

Question 19

A network automation engineer is using the NETCONF protocol to configure a Cisco IOS XE device. The engineer sends an RPC with a candidate datastore, but the configuration does not take effect until a operation is performed. Which NETCONF capability must be supported by the device to allow this workflow?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. The candidate datastore capability enables a two-step configuration process where changes are made to a candidate datastore and then applied to the running datastore via a commit. This is exactly the workflow described. The other capabilities provide additional features like confirmed commit, direct running edits, or error rollback, but they are not the fundamental requirement for using a candidate datastore.

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Answer

urn:ietf:params:netconf:capability:confirmed-commit:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Question 20

A network engineer is analyzing a packet capture and notices that a host is sending a TCP segment with the SYN flag set and the ACK flag not set. The destination port is 443. Which of the following best describes what the host is attempting to do?

Accepted Answer

The host is initiating a TCP connection to a server on port 443.. The SYN flag without ACK is used to initiate a TCP connection. When a host sends a segment with SYN set and ACK not set to port 443, it is starting the three-way handshake to establish a connection to an HTTPS server. The server would respond with a SYN-ACK, and the client would complete the handshake with an ACK. This is fundamental TCP behavior.

Answer

The host is terminating an existing TCP connection to port 443.

Answer

The host is acknowledging a previous SYN-ACK and completing the three-way handshake.

Answer

The host is responding to an incoming connection request on port 443.