200-901 Practice Exam 57 — 20 Questions

Question 1

A DevOps engineer is deploying a containerized application to a Kubernetes cluster. The application needs to read a database password at runtime, and the team wants the value to be injected as an environment variable without storing it in the container image or the Deployment manifest. Which Kubernetes resource should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Secret referenced by the container's envFrom or valueFrom field.. Kubernetes Secrets are designed to hold sensitive data and can be consumed as environment variables through envFrom or valueFrom, which keeps the password out of the image and the Deployment manifest. ConfigMaps, volumes, and initContainers do not provide the same separation of sensitive data from application artifacts, so they fail the scenario's security and injection requirements.

Answer

An initContainer that writes the password into the main container's filesystem.

Answer

A ConfigMap mounted as a volume and read by the application at startup.

Answer

A PersistentVolumeClaim that stores the password in a file on shared storage.

Question 2

A developer is building a Python application that uses the Cisco Meraki Dashboard API to update VLAN settings on a network. The application must handle API errors gracefully and avoid being rate-limited. The developer wants to implement logic that inspects the response status code and the Retry-After header. Which two actions should the developer take when the API returns HTTP 429? (Choose two.)

Accepted Answer

Read the Retry-After response header and pause requests for the specified number of seconds before retrying.. Meraki's Dashboard API enforces rate limits and returns HTTP 429 with a Retry-After header when exceeded. The robust client reads that header, waits the indicated time, and then retries using exponential backoff with jitter to avoid synchronized retries. Rotating keys or switching protocols does not change the per-organization limit and can introduce security or reliability problems.

Answer

Immediately resend the same request with an incremented X-Retry-Count header to bypass the rate limit.

Answer

Switch the request from HTTPS to HTTP to reduce overhead and avoid rate limiting.

Answer

Rotate to a different API key for the same organization to reset the rate-limit counter.

Question 3

A developer is integrating a Python application with the Cisco Webex API. The application must act on behalf of users to create messages in Webex spaces. The developer wants to avoid storing user credentials. Which OAuth 2.0 flow is most appropriate for this scenario?

Accepted Answer

Authorization Code Grant. The Authorization Code Grant is the most secure and appropriate OAuth 2.0 flow for applications that need to act on behalf of users without handling their credentials. It involves redirecting the user to Webex for authentication, receiving an authorization code, and exchanging it for an access token. This flow supports refresh tokens and fine-grained scopes, making it ideal for integrations that create messages on behalf of users.

Answer

Implicit Grant

Answer

Resource Owner Password Credentials Grant

Answer

Client Credentials Grant

Question 4

A network engineer is using Ansible to automate the configuration of a Cisco IOS XE device. The playbook must ensure that a specific banner is present on the device. Which Ansible module should the engineer use to accomplish this task in a vendor-supported way?

Accepted Answer

ios_banner. Ansible provides vendor-specific modules for Cisco IOS, and the ios_banner module is designed to manage banner configurations. It ensures idempotency and handles the proper syntax for banners. While ios_config could push banner lines, it is less specialized and may not be idempotent without additional logic. Using ios_banner is the recommended and supported approach for this task.

Answer

ios_user

Answer

ios_command

Answer

ios_config

Question 5

A developer is writing a Python script that authenticates to Cisco DNA Center using the token-based authentication API. The script must obtain a token and reuse it for subsequent REST calls until it expires. Which HTTP header should the script include in each subsequent API request to pass the token?

Accepted Answer

X-Auth-Token: <token>. Cisco DNA Center's token-based authentication flow returns a token from the /auth/token endpoint, and that token must be presented in the X-Auth-Token header for all subsequent API requests. Other common authentication headers like Authorization: Bearer or custom cookie schemes are not recognized by DNA Center. Using the correct header ensures the script can reuse the token until it expires, avoiding repeated authentication calls.

Answer

Cookie: session=<token>

Answer

Authorization: Bearer <token>

Answer

X-Cisco-Token: <token>

Question 6

A developer is writing a Python script that calls a REST API. The script currently contains the API key as a string literal. The team wants to move the key out of source control and inject it at runtime in a CI/CD pipeline. Which approach best meets this requirement?

Accepted Answer

Read the API key from an environment variable populated by the pipeline's secret store. Injecting secrets through environment variables supplied by the pipeline's secret store keeps credentials out of the codebase and version history. The application reads the value at runtime, and the CI/CD system can mask it in logs and restrict access. This is the recommended pattern for automated deployments.

Answer

Store the API key in a configuration file committed to the repository

Answer

Base64-encode the API key and place it in the script as a constant

Answer

Have the script prompt the user for the API key on each execution

Question 7

A developer is using the Cisco Meraki Dashboard API to update the configuration of a wireless SSID. The API requires a PUT request to /networks/{networkId}/wireless/ssids/{number}. Which HTTP header is mandatory to include the API key for authentication?

Accepted Answer

X-Cisco-Meraki-API-Key. The Meraki Dashboard API requires the API key to be sent in the X-Cisco-Meraki-API-Key header. This custom header is the only accepted method for authentication. Other headers like Authorization or X-Auth-Token are used by different Cisco APIs and will not work with Meraki. Content-Type is for the request body, not authentication.

Answer

Content-Type: application/json

Answer

X-Auth-Token

Answer

Authorization: Bearer <token>

Question 8

A security team is reviewing a CI/CD pipeline that builds container images and pushes them to a registry. They want to reduce the attack surface of the resulting images and ensure that only trusted images are deployed. Which TWO practices should be implemented? (Choose two.)

Accepted Answer

Sign images with a tool such as Docker Content Trust or cosign and enforce signature verification in the admission controller before workloads are scheduled.. Reducing image attack surface comes from shipping only what the application needs, which multi-stage builds and minimal base images accomplish by stripping compilers, shells, and unused packages. Ensuring only trusted images deploy requires cryptographic signing plus enforcement, so verification happens before scheduling. Together these controls address both halves of the requirement, while root execution, embedded secrets, and disabled scanning all weaken the posture.

Answer

Run the container as the root user inside the image so that package installation and file permission changes succeed during startup.

Answer

Disable the registry's vulnerability scanning feature to speed up pipeline execution and avoid false-positive build failures.

Answer

Bake environment-specific secrets into the image at build time using ARG values so the container is self-contained.

Question 9

A network automation engineer needs to retrieve the current interface configuration from a Cisco IOS XE device using RESTCONF. The device has RESTCONF enabled and the engineer wants to read the configuration data for interfaces in the 'ietf-interfaces' model. Which HTTP method and URL format should the engineer use?

Accepted Answer

GET https://device/restconf/data/ietf-interfaces:interfaces. RESTCONF maps YANG models to HTTP resources. To read configuration or state data, use GET with a URL rooted at /restconf/data/, followed by the module name and a colon, then the data node path. The ietf-interfaces module defines the interfaces container, so the correct URL is GET https://device/restconf/data/ietf-interfaces:interfaces.

Answer

GET https://device/restconf/operational/ietf-interfaces:interfaces

Answer

POST https://device/restconf/data/ietf-interfaces:interfaces

Answer

GET https://device/restconf/config/ietf-interfaces/interfaces

Question 10

A network administrator is configuring a switch and needs to segment traffic into multiple broadcast domains while also allowing communication between them. Which device or feature should be used to achieve this?

Accepted Answer

VLANs on a switch. VLANs are used to logically segment a switch into multiple broadcast domains. Each VLAN represents a separate broadcast domain, and devices within a VLAN can communicate at Layer 2. To enable communication between VLANs, inter-VLAN routing is needed. STP, EtherChannel, and port mirroring do not create broadcast domains; they serve other purposes.

Answer

Port mirroring on a switch

Answer

STP on a switch

Answer

EtherChannel on a switch

Question 11

A developer is building a Python script to configure a Cisco IOS XE device using NETCONF. The script must send an <edit-config> RPC that places the target datastore in candidate mode, changes the description of GigabitEthernet0/0, and commits the change. Which NETCONF capability must the device advertise for the script to use the candidate datastore?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. The candidate capability is required because the script edits a candidate datastore and then commits the change to running. NETCONF capabilities are advertised in the server's message; a client must check for the candidate capability before using with a candidate target and . Rollback-on-error, validate, and writable-running serve different purposes and do not enable the candidate datastore workflow.

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:validate:1.0

Question 12

A developer is writing a unit test for a Python function that calls the Cisco Meraki Dashboard API to retrieve a list of organizations. The test must run without making real HTTP requests to the Meraki cloud. Which technique should be used to isolate the function under test?

Accepted Answer

Use the unittest.mock library to patch the requests.get call and return a canned JSON response.. Unit tests for API clients should isolate the code under test from external services. Patching the HTTP call with unittest.mock lets the test supply a fixed JSON payload and verify how the function handles it, including success and error paths. This keeps the test fast, repeatable, and independent of the Meraki Dashboard API's availability or rate limits.

Answer

Run the test only on a developer workstation that has a valid Meraki API key configured.

Answer

Replace the API call with a print statement that outputs the expected organization list.

Answer

Increase the test timeout to 60 seconds so the real Meraki API call has time to complete.

Question 13

A development team runs a Python Flask API in a Docker container. The image was built with the Flask development server bound to 0.0.0.0:5000, and the container is started with the published port mapping 8080:5000. Users report that requests to the host on port 5000 are refused, while port 8080 works. Which statement explains this behaviour?

Accepted Answer

The published mapping forwards host port 8080 to container port 5000, so nothing is listening on host port 5000.. Port publishing follows the host:container form, so 8080:5000 binds the host to 8080 and forwards into the container's 5000. Host port 5000 is not bound at all, which is why connections there are refused while 8080 succeeds. EXPOSE is purely informational, and the in-container bind address determines which interfaces inside the container accept the forwarded packets.

Answer

The host firewall is dropping traffic on port 5000 because Docker only opens ports that are declared with EXPOSE.

Answer

The Dockerfile EXPOSE instruction must match the host port, so EXPOSE 8080 is required for host port 5000 to work.

Answer

Binding Flask to 0.0.0.0 inside the container prevents Docker from forwarding traffic, so the app must bind to localhost instead.

Question 14

A developer is using the Cisco Meraki Dashboard API to update the VLAN configuration on a switch port. The API call returns a 404 Not Found error. The developer has verified that the API key is valid and the organization ID and network ID are correct. What is the most likely cause of the 404 error?

Accepted Answer

The API endpoint URL is incorrect or the resource does not exist.. A 404 Not Found error means the server cannot locate the requested resource. Common causes include an incorrect endpoint URL, a non-existent resource ID (such as a port that does not exist on the switch), or a typo in the path. Authentication issues yield 401, permission issues yield 403, bad request bodies yield 400, and rate limits yield 429. Therefore, the developer should verify the URL and resource identifiers.

Answer

The API key does not have write permissions for the network.

Answer

The request body is missing required parameters.

Answer

The Meraki Dashboard API rate limit has been exceeded.

Question 15

A developer is using Git to contribute to a shared repository. After making several commits on a local feature branch, the developer wants to integrate the latest changes from the remote main branch into the feature branch while keeping a linear history. Which Git command should be used?

Accepted Answer

git rebase main. To integrate upstream changes while keeping a linear history, the feature branch commits must be replayed on top of the updated main. git rebase main performs exactly this operation, moving the branch pointer and rewriting commits so that the history appears as if the feature was developed after the latest main. Merging or pulling would create a merge commit, and cherry-pick does not apply the full set of changes.

Answer

git merge main

Answer

git pull origin main

Answer

git cherry-pick main

Question 16

A security review of a CI/CD pipeline finds that build jobs run with credentials that have far more privilege than needed, and that the same long-lived token is reused across repositories. Which TWO changes reduce the blast radius if a pipeline credential is compromised? (Choose two.)

Accepted Answer

Grant the pipeline identity the minimum permissions required for its deployment tasks.. Blast radius is governed by how much a credential can do and how long it remains valid. Issuing short-lived, per-job credentials and constraining the pipeline identity to least privilege both directly reduce the impact of theft. Encryption at rest, verbose logging, and runner placement improve hygiene or visibility but leave the credential's power and lifetime intact, so they do not shrink the damage an attacker can inflict.

Answer

Run all pipeline jobs on self-hosted runners located inside the corporate network.

Answer

Store the shared token in the CI platform's encrypted secret store instead of in the repository.

Answer

Enable verbose debug logging for all pipeline jobs so credential usage can be audited after an incident.

Question 17

A developer is designing a Python script that interacts with a REST API. The script must handle common HTTP methods appropriately. Which TWO of the following statements correctly describe the use of HTTP methods in RESTful APIs? (Choose two.)

Accepted Answer

GET requests should be idempotent and safe, meaning they do not modify server state.. In REST, GET is safe and idempotent, and PUT is idempotent and used for full updates or replacements. POST is neither safe nor idempotent, DELETE is idempotent despite possible error responses, and PATCH is not guaranteed to be idempotent or safe. Understanding these properties helps developers choose the correct method and handle retries appropriately.

Answer

POST requests are idempotent, so sending the same POST request multiple times has the same effect as sending it once.

Answer

PATCH requests must always be idempotent and safe.

Answer

DELETE requests are not idempotent because deleting a resource twice will cause an error the second time.

Question 18

A developer is writing a Python script that will authenticate to a Cisco DNA Center controller and then call multiple REST API endpoints. The script must handle authentication securely and manage the token lifecycle. Which two practices should the developer follow? (Choose two.)

Accepted Answer

Store the username and password in environment variables or a secrets manager rather than in the script.. Secure automation requires protecting credentials and managing tokens efficiently. Storing secrets outside the code prevents leaks, and reusing a valid token until expiration avoids unnecessary authentication calls. The other options either weaken security or add avoidable overhead that can trigger rate limits.

Answer

Disable TLS certificate verification to simplify HTTPS calls to the controller.

Answer

Call the authentication endpoint before every API request to guarantee a fresh token.

Answer

Hardcode the token in the script to avoid repeated authentication calls during development.

Question 19

A network automation engineer needs to ensure that a Python script can securely store and retrieve API credentials for Cisco DNA Center without hardcoding them in the script. Which method is the most appropriate?

Accepted Answer

Use environment variables to hold the credentials and access them via os.environ in the script.. Using environment variables keeps credentials out of source code and allows them to be managed securely by the deployment environment. This is a widely accepted practice for handling secrets in automation scripts. It avoids the risks of hardcoding or storing secrets in version control, and it supports different credentials per environment.

Answer

Embed the credentials directly in the Python script as constants.

Answer

Store the credentials in a YAML file that is committed to the same Git repository as the script.

Answer

Store the credentials in a plain text file on the local filesystem and read them at runtime.

Question 20

A developer is writing a Python unit test for a function that makes an HTTP request to an external API. To avoid network calls during testing, the developer wants to mock the requests.get function. Which Python library is specifically designed for mocking in unit tests and is part of the standard library?

Accepted Answer

unittest.mock. The unittest.mock module, part of the Python standard library, provides the patch function and Mock class to replace objects during tests. It can mock requests.get to return a controlled response, preventing actual network calls. This is the standard way to isolate unit tests from external dependencies without third-party libraries.

Answer

requests-mock

Answer

mock

Answer

pytest-mock