200-901 Practice Exam 58 — 20 Questions

Question 1

A developer is building a Python application that consumes the Cisco Meraki Dashboard API. The application must store the API key securely and include it on every request. Which HTTP request header should the application set to authenticate each call?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

X-Cisco-Meraki-API-Key: <API_KEY>. Cisco Meraki Dashboard API authentication uses a proprietary request header, X-Cisco-Meraki-API-Key, populated with a key created under the organization's dashboard profile. Unlike OAuth-based Cisco APIs that expect an Authorization Bearer token, Meraki requires this specific header on each call, and the application must also send appropriate Content-Type and Accept headers for JSON.

Answer

Authorization: Bearer <API_KEY>

Answer

Authorization: Basic <base64(API_KEY:)>

Answer

X-Auth-Token: <API_KEY>

Question 2

An engineer is troubleshooting an application running in a Docker container. The container is running but the application is not responding. The Dockerfile EXPOSE instruction lists port 8080, and the container was started with the command: docker run -d -p 8080:80 myapp. Which command should the engineer use to verify the application's actual listening port inside the container?

Accepted Answer

docker exec <container_id> netstat -tuln. The application's actual listening port can differ from the EXPOSE instruction in the Dockerfile. EXPOSE is metadata and does not publish the port or dictate where the app listens. To see the real listening ports inside the container, one must execute a network inspection command inside the container's namespace, such as netstat or ss. This reveals whether the app is bound to the expected port, helping diagnose connectivity issues.

Answer

docker inspect <container_id>

Answer

docker port <container_id>

Answer

docker logs <container_id>

Question 3

A developer clones a shared repository and creates a feature branch, but a teammate pushes a commit to the main branch that conflicts with local edits. The developer wants to bring those upstream changes into the feature branch and resolve conflicts before opening a pull request. Which Git operation should be used?

Accepted Answer

git merge main while the feature branch is checked out. Merging main into the checked-out feature branch brings the upstream commits into the feature branch and presents conflicts in the working tree for resolution. The feature branch retains its own commits, and the resulting state can be pushed for review. This is the conventional pre-pull-request integration step when a teammate has advanced the main branch.

Answer

git stash pop after fetching main

Answer

git revert main while the feature branch is checked out

Answer

git reset --hard main while the feature branch is checked out

Question 4

A developer is using the Cisco NX-OS REST API (NX-API) to configure a Cisco Nexus switch. The developer wants to send a JSON payload to create a new VLAN. Which HTTP method and headers are required to use the NX-API REST interface?

Accepted Answer

POST with Content-Type: application/json and a JSON body containing the VLAN configuration.. NX-API REST uses HTTP POST to send configuration payloads. When sending JSON, the Content-Type header must be application/json. The body contains the JSON representation of the configuration, such as the VLAN object. Other methods or content types do not match the requirement to send a JSON payload for configuration.

Answer

POST with Content-Type: application/xml and an XML body containing the VLAN configuration.

Answer

PUT with Content-Type: application/json and a JSON body containing the VLAN configuration.

Answer

GET with Content-Type: application/json and a JSON body containing the VLAN configuration.

Question 5

A developer is writing a Python function that accepts a variable number of interface names and returns them as a tuple. Which function definition correctly allows an arbitrary number of positional arguments?

Accepted Answer

def list_interfaces(*interfaces):. The function must accept a variable number of positional arguments. Using *interfaces packs all positional arguments into a tuple, which is exactly what the scenario requires. The other definitions either accept a single argument, collect keyword arguments into a dictionary, or use a mutable default that introduces bugs and still does not support multiple positional arguments.

Answer

def list_interfaces(interfaces):

Answer

def list_interfaces(**interfaces):

Answer

def list_interfaces(interfaces=[]):

Question 6

A developer is writing a Python script that calls a REST API protected by OAuth 2.0. The script runs unattended on a server and must obtain an access token without any user interaction. The authorization server supports the client credentials grant. Which flow should the developer implement?

Accepted Answer

Client credentials grant. When an application authenticates as itself rather than on behalf of a user, the client credentials grant is the correct OAuth 2.0 flow. The server script presents its client ID and secret to the token endpoint and receives an access token, with no browser redirect or user consent step. Flows requiring a user, such as authorization code with PKCE or implicit, and flows requiring user passwords do not match unattended machine-to-machine access.

Answer

Implicit grant

Answer

Authorization code grant with PKCE

Answer

Resource owner password credentials grant

Question 7

A developer pushes a container image to Docker Hub and then discovers that the image layers contain an .env file with production API keys. The team wants future builds to fail automatically in the CI pipeline when secrets are detected in the image before any push occurs. Which approach best addresses this requirement?

Accepted Answer

Run a container image scanning tool against the built image in the pipeline and fail the stage when secret findings are reported.. The requirement is detection with an automatic pipeline failure before pushing. Scanning the built image examines the exact artifacts destined for the registry, so secrets leaked through any path are found. Wiring the scanner to exit non-zero on findings turns that detection into a hard gate. Preventive measures like .dockerignore or signing policies reduce risk but cannot guarantee that no secret exists in the image.

Answer

Enable Docker Content Trust so that only signed images can be pushed to Docker Hub.

Answer

Store the API keys in Docker Hub repository secrets and reference them from the Dockerfile at build time.

Answer

Add a .dockerignore entry for .env and rely on developers to never commit secrets.

Question 8

A developer is using the Cisco NX-OS API on a Nexus switch. The developer wants to retrieve the running configuration using a Python script that sends an HTTP POST request. Which command must be configured on the switch to enable this capability?

Accepted Answer

feature nxapi. To enable the NX-API on a Cisco NX-OS device, the 'feature nxapi' command must be configured. This allows the switch to accept HTTP/HTTPS requests for CLI commands. Other features like NETCONF or RESTCONF are separate protocols and do not enable NX-API.

Answer

ip http server

Answer

feature netconf

Answer

feature restconf

Question 9

A developer is building a Python script that calls the Cisco Webex API to retrieve a list of rooms. The API returns a maximum of 100 items per page and includes a 'Link' response header with a rel="next" URL. The script must automatically fetch all pages until no 'next' link remains. Which approach should the developer implement?

Accepted Answer

Parse the Link header, extract the URL with rel="next", and issue a GET request to that URL in a loop until the header is absent.. The Webex API provides pagination through Link headers containing a rel="next" URL. Following that URL in a loop ensures all pages are retrieved. Other methods like page numbers, large max values, or offset parameters are not supported by this API and would fail to return the complete dataset.

Answer

Set the 'max' query parameter to 1000 and make a single GET request to retrieve all rooms at once.

Answer

Use the 'offset' query parameter, increasing it by 100 on each request until the response body is empty.

Answer

Increment a 'page' query parameter starting at 0 and continue until an empty JSON array is returned.

Question 10

A developer is testing a REST API with curl and receives a response body containing JSON. They want to confirm that the payload is JSON before parsing it in code. Which HTTP response header should they check?

Accepted Answer

Content-Type. The Content-Type response header is the server's declaration of the media type of the returned body. When it is application/json, the developer can safely hand the body to a JSON parser; when it is something else, such as text/html for an error page, parsing as JSON would fail. Checking this header is a standard defensive step before decoding API responses.

Answer

User-Agent

Answer

Accept

Answer

Content-Length

Question 11

A developer is writing a Python script to interact with a Cisco Meraki Dashboard API. The script retrieves a list of organizations and then, using the organization ID, retrieves the networks for that organization. The API returns a 200 OK with a JSON body and a Link header containing a URL for the next page. The developer wants to ensure all networks are retrieved. Which approach should the developer take?

Accepted Answer

Parse the Link header and follow the URL for the next page until no Link header is present.. The Meraki Dashboard API implements pagination using the Link header, which contains a URL for the next page of results. To retrieve all networks, the developer must follow the 'next' link until it is absent. Other methods like using a 'page' parameter, increasing 'perPage', or looking for an 'offset' field do not align with the API's design and will not work.

Answer

Parse the response for an 'offset' field and use it in subsequent requests until the offset equals the total count.

Answer

Use the 'perPage' query parameter set to 1000 to retrieve all networks in a single request.

Answer

Send the same GET request with an increased 'page' query parameter until an empty array is returned.

Question 12

A developer is writing a Python script that calls the Cisco Webex Teams API to create a new space. The API returns the new space object, including a Location header pointing to the newly created resource. Which HTTP status code should the developer expect from a successful space creation?

Accepted Answer

201 Created. The correct status code for a successful resource creation via POST in the Webex API is 201 Created. This status indicates that the request has been fulfilled and has resulted in one or more new resources being created. The response typically includes a Location header with the URI of the new resource and a body containing the representation of the created space. Understanding this helps developers correctly handle API responses and extract necessary identifiers.

Answer

204 No Content

Answer

200 OK

Answer

202 Accepted

Question 13

A developer is designing a CI/CD pipeline that deploys to production. The team wants to ensure that a failed security scan blocks the deployment automatically. Which pipeline design element should be implemented?

Accepted Answer

Make the security scan stage a required dependency of the deploy stage and fail the pipeline on non-zero exit. A security gate must be part of the pipeline flow and able to fail the build. Making the deploy stage depend on a successful scan, with the scanner exiting non-zero on violations, ensures vulnerable artifacts never reach production. Parallel or advisory scans cannot enforce this requirement.

Answer

Schedule the security scan as a nightly job separate from the pipeline

Answer

Run the security scan in parallel with deployment to save time

Answer

Configure the scan to only warn and continue on findings

Question 14

A developer is integrating with a REST API that returns JSON error responses. The team needs to handle failures robustly in code. Which TWO practices are appropriate when processing API responses? (Choose two.)

Accepted Answer

Check the HTTP status code before attempting to parse the response body.. Robust API clients branch on the HTTP status code first, then guard JSON parsing by checking the content type and body presence. This ordering prevents schema mismatches when error payloads differ from success payloads and avoids parser exceptions on empty or non-JSON responses. These two practices together form a reliable foundation for error handling in any REST integration.

Answer

Retry every failed request immediately in a tight loop until it succeeds.

Answer

Ignore the status code and rely solely on whether the body parses as valid JSON.

Answer

Assume any response containing the word "error" in the body indicates a failure and raise an exception.

Question 15

A developer is writing a Python script to interact with a Cisco IOS XE device using the NETCONF protocol. The script must retrieve the running configuration and then modify it. Which two actions must the script perform to establish a NETCONF session and retrieve the running configuration? (Choose two.)

Accepted Answer

Open an SSH session to the device on port 830 and exchange messages.. To establish a NETCONF session, the client opens an SSH connection to port 830 and exchanges messages with the server. Once the session is established, the client can send RPCs. To retrieve the running configuration, the client sends a RPC with . The other options either use the wrong RPC, the wrong transport, or an operation that does not read configuration into the session.

Answer

Send a RPC with a filter of to retrieve the running configuration.

Answer

Authenticate using the NETCONF username and password over HTTPS on port 443.

Answer

Use the <copy-config> RPC to copy the running datastore to a local file.

Question 16

A developer is preparing a Python script that will be shared with a team and run in multiple environments. The script relies on several third-party libraries. Which TWO practices should be followed to ensure reproducible dependency management? (Choose two.)

Accepted Answer

Pin exact versions of dependencies in a requirements.txt file using the == operator.. Reproducible dependency management requires isolating project packages and recording exact versions. A virtual environment prevents interference from system-wide packages, while pinning versions in requirements.txt ensures that every installation uses the same releases. Together they allow any team member or CI system to recreate the exact environment. Global installs, unpinned versions, and committing the virtual environment all introduce variability and are not recommended.

Answer

Install packages globally with pip install --user to avoid permission issues.

Answer

Commit the entire virtual environment directory to the Git repository.

Answer

Rely on the latest versions of dependencies by omitting version specifiers in requirements.txt.

Question 17

A developer maintains a Python library that is published to a package index and consumed by other teams. The build pipeline should ensure that a compromised maintainer account cannot publish a malicious version under the project's name. Which control should be configured on the pipeline?

Accepted Answer

Sign release artifacts with a key held in the CI system's trusted identity and have consumers verify the signature.. Preventing a compromised account from publishing malicious code requires a control that does not depend solely on that account's credentials. Artifact signing with a key controlled by the trusted pipeline ties each release to a verifiable identity, and consumers who check the signature will reject anything not signed by that key. Account hardening, dependency pinning, and source analysis improve security elsewhere but cannot stop an authorized-but-malicious publish.

Answer

Pin dependency versions in requirements.txt so downstream installs are reproducible.

Answer

Enable two-factor authentication on the publishing account and use API tokens scoped to the project.

Answer

Run a linter and static analysis over the source before each publish step.

Question 18

A developer is integrating a Python script with the Cisco Webex API. The script needs to read the value of the HTTP status code returned by the API to decide whether to retry a request. Using the requests library, which attribute of the response object should the developer inspect?

Accepted Answer

response.status_code. The requests library parses the HTTP status line of the server response and stores the numeric code in the status_code attribute. A client integrating with the Webex API reads that integer to detect conditions such as 401 for bad tokens or 429 for rate limiting, then decides whether to retry, refresh credentials, or fail. The boolean ok, the reason phrase, and header lookups do not provide the exact numeric value needed.

Answer

response.headers['Status']

Answer

response.reason

Answer

response.ok

Question 19

A network automation team wants to run a Python script that uses the ncclient library to retrieve configuration from a Cisco IOS XE device over NETCONF. The device is reachable on TCP port 830. Which transport and port combination must the script use?

Accepted Answer

SSH transport on TCP port 830. NETCONF on Cisco IOS XE is exposed as an SSH subsystem on TCP port 830. The ncclient library negotiates the SSH transport and then exchanges XML capabilities and RPCs. Using SSH on the NETCONF port is the documented combination, so the script must target TCP 830 rather than the standard CLI port or a TLS-based alternative.

Answer

HTTP transport on TCP port 80

Answer

SSH transport on TCP port 22

Answer

TLS transport on TCP port 6513

Question 20

A developer is writing a Python script that uses the ncclient library to configure a Cisco IOS XE device over NETCONF. The script must push a candidate configuration, validate it, and then commit it atomically. Which sequence of NETCONF operations should the script use to guarantee the configuration is only applied if it passes validation?

Accepted Answer

edit-config with the candidate datastore, validate, then commit. NETCONF separates staging from activation through the candidate datastore and the commit operation. Loading the candidate with edit-config, validating it, and then committing ensures the configuration is syntactically and semantically correct before it becomes active, and the commit is atomic. This is the standard approach for safe, transactional configuration changes on devices that support the candidate capability.

Answer

get-config, edit-config with the candidate datastore, then discard-changes

Answer

edit-config with the running datastore, validate, then commit

Answer

lock the running datastore, edit-config with the running datastore, then unlock