200-901 Practice Exam 58 — 20 Questions

Question 1

A developer is using the Cisco Webex Teams API to create a room and add members. The API returns a 400 error. What is the most likely cause?

Accepted Answer

Missing required fields. A 400 Bad Request error from the Cisco Webex Teams API indicates that the server cannot process the request due to a client-side error, most commonly missing required fields in the request body. When creating a room, the API requires a 'title' field; omitting it or sending an empty value triggers a 400 response. This is distinct from authentication or network issues, which produce different HTTP status codes.

Answer

Invalid access token

Answer

Network connectivity issue

Answer

Room name already exists

Question 2

A large enterprise is migrating to a DevOps model and needs to automate the provisioning of network devices. The team has chosen Ansible for configuration management and is using a Git repository for version control. The network includes Cisco IOS routers, Catalyst switches running IOS-XE, and ASA firewalls. The team has written Ansible playbooks for each device type. The goal is to have a CI/CD pipeline that automatically deploys configuration changes to the production network after the changes are merged into the main branch. However, during a recent deployment, a misconfiguration was pushed to a core router, causing a 10-minute outage. The root cause was that the playbook that was executed was not the correct one for that device model. The team wants to implement a mechanism to prevent similar incidents. Which approach should the team adopt?

Accepted Answer

Implement a CI/CD pipeline that runs playbooks against a staging environment with similar devices, and only deploy to production after successful validation. A staging environment with similar devices allows the team to validate playbooks against representative hardware before production deployment. This catches model-specific incompatibilities (e.g., a playbook written for IOS-XE being applied to a classic IOS router) without risking production outages. The CI/CD pipeline can run the same playbooks in staging, verify the resulting device state, and only promote changes to production after successful validation.

Answer

Require all changes to be approved by a change advisory board before merging

Answer

Require two-person peer review for all playbook changes

Answer

Use a pre-commit hook that checks the playbook syntax and device compatibility

Question 3

A developer is designing a microservices-based network management system. One requirement is that when a new device is discovered, multiple other services must be notified asynchronously to perform tasks like inventory update, monitoring setup, and log collection. Which architectural pattern best fits this requirement?

Accepted Answer

Event-driven architecture. The event-driven architecture is correct because it enables asynchronous, decoupled communication between services. When a new device is discovered, an event (e.g., a message on a message broker like Kafka or RabbitMQ) is published, and multiple subscriber services (inventory, monitoring, logging) react independently without blocking the discovery service. This pattern directly supports the requirement for loose coupling and asynchronous notification.

Answer

Model-View-Controller (MVC)

Answer

RESTful API

Answer

Monolithic architecture

Question 4

In the context of microservices for network automation, which pattern ensures that each service has a separate database to avoid tight coupling?

Accepted Answer

Database per service. The Database per service pattern ensures each microservice owns its private database, preventing tight coupling by eliminating shared schema dependencies. This aligns with the bounded context principle in domain-driven design, where each service manages its own data model independently, enabling autonomous deployments and scaling.

Answer

Circuit breaker

Answer

API gateway

Answer

Shared database

Question 5

A developer is writing a Python script to interact with the Cisco DNA Center REST API. Which HTTP method should be used to retrieve a list of network devices?

Accepted Answer

GET. The GET method is the correct HTTP verb for retrieving data from a REST API without modifying server state. In Cisco DNA Center, the endpoint /dna/intent/api/v1/network-device is accessed via GET to fetch a list of network devices, as this operation is idempotent and read-only, aligning with RESTful principles.

Answer

PUT

Answer

POST

Answer

DELETE

Question 6

A network engineer attempts to use RESTCONF to retrieve the running configuration of a Cisco IOS XE device. The GET request to '/restconf/data/Cisco-IOS-XE-native:native' returns a 405 Method Not Allowed error. What is the most likely cause?

Accepted Answer

RESTCONF is not enabled or the YANG module is not supported.. A 405 Method Not Allowed error indicates that the HTTP method (GET) is not supported for the requested resource. In RESTCONF, this typically occurs when the RESTCONF service is not enabled on the device or the specific YANG module (Cisco-IOS-XE-native) is not supported or loaded. Without the service or module, the server cannot process the GET request for the running configuration.

Answer

The API key provided is invalid.

Answer

The request body was malformed.

Answer

The device does not support HTTPS.

Question 7

A Webex bot needs to receive real-time notifications when a new message is posted in a Webex space. Which Webex API feature should the bot implement?

Accepted Answer

Webhooks. Webhooks allow the bot to receive HTTP callbacks for events like message creation.

Answer

Long polling

Answer

Polling the messages API every second

Answer

Server-Sent Events

Question 8

A network engineer wants to use model-driven programmability on IOS XE devices. Which two YANG model types are commonly used? (Choose two.)

Accepted Answer

OpenConfig YANG models. OpenConfig YANG models (Option D) are vendor-neutral, community-driven models that provide a consistent way to manage network devices across multiple vendors, including Cisco IOS XE. Cisco native YANG models (Option E) are Cisco-specific models that expose the full set of device features and are directly supported on IOS XE. Both are commonly used for model-driven programmability with NETCONF/RESTCONF.

Answer

MIB files

Answer

IETF YANG models

Answer

CLI commands

Question 9

A developer is using the Cisco DNA Center API and receives a token. How is this token typically used in subsequent API requests?

Accepted Answer

In the X-Auth-Token header. The Cisco DNA Center API uses token-based authentication where the token is passed in the X-Auth-Token HTTP header for subsequent requests. This is the standard method specified in the Cisco DNA Center API documentation, ensuring the server can validate the session without relying on cookies or query parameters.

Answer

As a query parameter named token

Answer

In the request body

Answer

In the Authorization header as Bearer <token>

Question 10

A network administrator is configuring a new subnet for a branch office that requires at least 50 usable host addresses. Which subnet mask would meet this requirement while minimizing address waste?

Accepted Answer

255.255.255.192 (/26). A /26 subnet provides 62 usable hosts (2^6 - 2 = 62), which is the smallest subnet meeting the requirement of 50 hosts.

Answer

255.255.255.0 (/24)

Answer

255.255.255.128 (/25)

Answer

255.255.255.224 (/27)

Question 11

A developer is building a dashboard that displays the health status of network devices managed by Cisco ACI. The developer uses the ACI REST API to query the APIC (Application Policy Infrastructure Controller). The developer sends a GET request to https://apic-ip/api/class/fabricHealthInst.json returns a JSON object with health scores. The dashboard works for a small set of devices, but when scaled to 500 devices, the API responses become slower and sometimes time out. The developer needs to optimize the data retrieval to keep the dashboard responsive. Which approach should the developer use?

Accepted Answer

Use the ACI event subscription mechanism to receive health updates only when changes occur.. The ACI REST API supports an event subscription mechanism (e.g., WebSocket-based subscriptions) that pushes updates only when the health score of a device changes, rather than requiring the dashboard to poll the APIC repeatedly. This drastically reduces network overhead and server load, especially when scaling to 500 devices, as it eliminates the need for frequent full GET requests to /api/class/fabricHealthInst.json.

Answer

Break the request into multiple smaller requests, each fetching a subset of devices.

Answer

Add a query parameter to sort the results by health score to reduce processing time.

Answer

Switch from JavaScript to Python for the backend to handle larger responses more efficiently.

Question 12

An engineer is using the Cisco Intersight API to manage UCS servers. The API response returns a paginated list. What is the proper way to retrieve all items?

Accepted Answer

Loop through pages using the 'next' link in the response. The Cisco Intersight API uses cursor-based pagination, where each page response includes a 'next' link pointing to the next page of results. To retrieve all items, you must follow that link in a loop until the 'next' field is null or absent, ensuring you get every page without assuming a fixed offset or page size.

Answer

Increase the page size limit to maximum

Answer

Send multiple requests with different offsets manually

Answer

Use a single request with a filter to get all

Question 13

A network engineer is automating the deployment of new branch offices using Cisco DNA Center REST API. The script creates a new site under a parent site using the POST /dna/intent/api/v1/site API endpoint. The script runs successfully but when checking the DNA Center UI, the new site appears under the incorrect parent site. The script uses the following JSON payload:

{
  "parentId": "0a1b2c3d-4e5f-6789-0ab1-2c3d4e5f6789",
  "name": "Branch-Office-42",
  "type": "area",
  "latitude": 34.0522,
  "longitude": -118.2437
}

The parentId is obtained from a GET request to /dna/intent/api/v1/site that returns a list of all sites. The engineer verified that the parentId matches the UUID of a site named 'HQ', which the engineer believes is an area. However, 'HQ' is actually a building site. The engineer is not aware that the site type is different because the GET response does not display the type field prominently. What is the most likely cause of the new site being placed under the wrong parent?

Accepted Answer

The type field is set to 'area' but the parent site is of type 'building'. The POST /dna/intent/api/v1/site API endpoint requires the parent site's type to be compatible with the child site's type. In Cisco DNA Center, an 'area' site cannot be created under a 'building' site because the hierarchy mandates that buildings are created under areas, not the reverse. The engineer used a parentId from a site named 'HQ' that is actually a building, so the API either places the new site under a different parent or fails to enforce the hierarchy correctly, resulting in the incorrect placement.

Answer

The script is using the wrong API endpoint for creating sites

Answer

The API is ignoring the parentId because the request is missing the 'siteId' header

Answer

The script is not including the 'address' field which is required for site creation

Question 14

You are a junior network developer tasked with automating device inventory retrieval using the Cisco Meraki Dashboard API. You have already generated an API key with the appropriate scopes and have tested it successfully with simple GET requests. However, when you attempt to retrieve the list of all devices in your organization via the 'GET /organizations/{organizationId}/devices' endpoint, you receive a 403 Forbidden error. You verify that the API key is correctly included in the request header as 'X-Cisco-Meraki-API-Key'. You also confirm that the organization ID is correct. You are able to reach the Meraki Dashboard API server from your environment, as other endpoints (e.g., 'GET /organizations') work fine. What is the most likely cause of the 403 error, and what should you do to resolve it?

Accepted Answer

The API key lacks the required permissions; regenerate the API key with full read access for devices.. A 403 Forbidden error specifically indicates that the server understood the request but refuses to authorize it. Since other endpoints like 'GET /organizations' work, network connectivity and API key validity are confirmed. The most likely cause is that the API key lacks the required scope or permission to access the 'GET /organizations/{organizationId}/devices' endpoint. Regenerating the API key with full read access (including device inventory) resolves this, as Meraki API keys are scoped at creation time and cannot be modified after generation.

Answer

The network firewall is blocking the request; check firewall logs and allow outbound traffic to the Meraki API.

Answer

The request should use POST instead of GET; change the HTTP method to POST to retrieve device data.

Answer

The API endpoint URL is incorrect; verify the exact path and version in the API documentation.

Question 15

A network engineer needs to automate the deployment of a new VLAN on multiple Cisco switches using RESTCONF. Which URL structure should be used to create a VLAN with ID 100?

Accepted Answer

PUT /restconf/data/Cisco-IOS-XE-vlan:vlans/vlan=100. RESTCONF uses the HTTP PUT method to create or replace a specific data resource, and the URL path follows the YANG module structure. Here, 'Cisco-IOS-XE-vlan:vlans/vlan=100' targets the VLAN list entry with ID 100, creating it if it does not exist. This aligns with RESTCONF's resource-oriented design, where PUT on a specific data node performs a create or replace operation.

Answer

POST /restconf/operations/Cisco-IOS-XE-vlan:create-vlan

Answer

POST /restconf/data/Cisco-IOS-XE-vlan:vlans/vlan=100

Answer

PUT /restconf/config/vlan/100

Question 16

A network administrator needs to verify that a switch port is configured as an access port and assigned to VLAN 30. Which command should be used on a Cisco IOS switch?

Accepted Answer

show interfaces status. The 'show interfaces status' command displays the operational status, VLAN assignment, and duplex/speed settings for all switch ports. When verifying an access port, the output includes the VLAN ID under the 'Vlan' column, confirming the port is assigned to VLAN 30 and operating in access mode (trunk ports show 'trunk' instead). This command directly answers the question without requiring interpretation of running configuration or MAC address tables.

Answer

show running-config interface GigabitEthernet0/1

Answer

show mac address-table interface GigabitEthernet0/1

Answer

show vlan brief

Question 17

Refer to the exhibit. A developer builds this Docker image and runs it. The container starts but cannot be accessed on port 5000 from the host. What is the most likely cause?

Accepted Answer

The EXPOSE instruction does not publish the port; the container was run without -p.. The EXPOSE instruction in a Dockerfile is documentation only; it does not actually publish the container's port to the host. For the container to be accessible on port 5000 from the host, the container must be run with the `-p` (or `--publish`) flag (e.g., `docker run -p 5000:5000 ...`). Without this, the container's port 5000 is only reachable from within the Docker network, not from the host.

Answer

The requirements.txt is missing Flask.

Answer

The Python application is not listening on 0.0.0.0.

Answer

The container is using a different port inside.

Question 18

When making API calls to Cisco DNA Center, a developer receives a 401 Unauthorized error. The token was obtained using the token API endpoint. What is the most likely reason?

Accepted Answer

The token has expired. A 401 Unauthorized error when using a token obtained from the token API endpoint most commonly indicates that the token has expired. Cisco DNA Center tokens have a configurable Time-To-Live (TTL), typically defaulting to 1 hour, after which the token becomes invalid and must be refreshed via the /dna/system/api/v1/auth/token endpoint.

Answer

The request body contains invalid JSON

Answer

The API base URL is incorrect

Answer

The HTTP header for Accept is missing

Question 19

Drag and drop the steps to set up a Python virtual environment for a DevNet project into the correct order.

Accepted Answer

Create virtual environment, Activate virtual environment, Install required packages, Deactivate virtual environment. Virtual environments isolate dependencies; creation, activation, package installation, and deactivation are standard steps.

Answer

Activate virtual environment, Create virtual environment, Install required packages, Deactivate virtual environment

Answer

Create virtual environment, Install required packages, Activate virtual environment, Deactivate virtual environment

Answer

Create virtual environment, Activate virtual environment, Deactivate virtual environment, Install required packages

Question 20

A Python script used for network automation requires storing an API secret. Which approach is the most secure and recommended best practice?

Accepted Answer

Use environment variables. Storing secrets in environment variables decouples sensitive data from the source code, preventing accidental exposure in version control systems like Git. This approach follows the principle of least privilege and is recommended by security best practices such as the Twelve-Factor App methodology. Environment variables are managed outside the script, reducing the risk of credential leakage during code sharing or deployment.

Answer

Hardcode the secret in the Python script

Answer

Store the secret in a plain text file in the repository

Answer

Encrypt the secret and store it in the script