200-901 Practice Exam 59 — 20 Questions

Question 1

A developer needs to retrieve a secret stored in HashiCorp Vault from a CI job. The Vault administrator has enabled the AppRole auth method. Which sequence correctly authenticates and reads the secret using the Vault HTTP API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

POST to `/v1/auth/approle/login` with `role_id` and `secret_id` to obtain a client token, then GET the secret path with the `X-Vault-Token` header set to that token.. AppRole is a machine-oriented auth method that exchanges a `role_id` and `secret_id` for a short-lived Vault token. That token must then be supplied on the secret read. The other options either skip authentication, misuse the `secret_id` as a token, or misunderstand how Vault secret reads work, so only the login-then-read sequence succeeds.

Answer

Use the `secret_id` as the value of the `X-Vault-Token` header and GET the secret path.

Answer

GET the secret path directly with a `role_id` query parameter and no token header.

Answer

POST the `secret_id` to the secret path to unwrap it, then read the response body for the secret value.

Question 2

A developer is writing a script that must resolve a hostname to an IPv4 address before making an HTTP request. The script uses a DNS resolver library and needs to query for the appropriate record type. Which DNS record type should the script query to obtain the IPv4 address?

Accepted Answer

A. The A record is the DNS record type that maps a hostname to an IPv4 address. When a script needs to resolve a hostname to an IPv4 address for an HTTP request, it should query for an A record. Other record types serve different purposes, such as AAAA for IPv6, CNAME for aliases, and MX for mail routing.

Answer

CNAME

Answer

MX

Answer

AAAA

Question 3

A developer is writing a Python script that calls the Cisco Webex API. The script must handle the case where the API returns a 429 Too Many Requests response. Which HTTP response header should the script inspect to determine how long to wait before retrying the request?

Accepted Answer

Retry-After. When a REST API throttles a client with 429 Too Many Requests, the standard way to communicate the required backoff is the Retry-After response header, which contains either a number of seconds or an HTTP date. Cisco Webex returns this header, so a well-behaved client reads it and delays the next attempt accordingly, rather than retrying immediately and remaining throttled.

Answer

X-RateLimit-Limit

Answer

Cache-Control

Answer

Link

Question 4

A developer is writing a Python script that consumes a REST API which returns JSON error bodies. The script must distinguish client mistakes from server-side problems and react accordingly. Which TWO HTTP status code ranges or codes indicate conditions the client should handle as errors caused by the request or by the server rather than success? (Choose two.)

Accepted Answer

4xx client error status codes. The 4xx class identifies requests the client got wrong, and the 5xx class identifies server-side failures. Together they form the error conditions a consuming script must branch on: 4xx usually requires fixing the request, while 5xx usually warrants retries with backoff. Success codes, redirections, and informational responses belong to different handling paths.

Answer

3xx redirection status codes

Answer

200 OK

Answer

101 Switching Protocols

Question 5

A network engineer is analyzing a packet capture of a TCP session establishment between a client and a server. The engineer observes a packet with the SYN flag set and another with both the SYN and ACK flags set. Which flag will be set in the next packet sent by the client to complete the three-way handshake?

Accepted Answer

ACK. The three-way handshake is a fundamental TCP connection establishment process. The client sends a SYN packet, the server responds with a SYN-ACK packet, and the client completes the handshake by sending an ACK packet. This final ACK acknowledges the server's SYN and confirms that both sides are ready to exchange data.

Answer

RST

Answer

PSH

Answer

FIN

Question 6

A developer is writing a Python script that uses the requests library to call a REST API. The API occasionally returns a 429 status code. Which approach best handles this situation?

Accepted Answer

Implement exponential backoff and respect the Retry-After header if present.. Exponential backoff with respect to Retry-After is the recommended way to handle 429 responses. It allows the client to recover from rate limiting without overwhelming the server. The other options either ignore the error, retry too aggressively, or avoid the endpoint, none of which are robust solutions. This approach balances persistence with respect for API limits.

Answer

Ignore the 429 and continue with the next request.

Answer

Retry the request immediately in a tight loop until it succeeds.

Answer

Switch to a different API endpoint that is not rate-limited.

Question 7

A developer needs to configure a Cisco IOS XE device using NETCONF and wants to ensure the session supports candidate configuration and confirmed commit. Which capability must the device advertise in its NETCONF hello message?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. NETCONF defines capabilities in the hello exchange, and candidate configuration is advertised via the candidate capability URN. When a device supports it, clients can edit the candidate datastore, validate it, and commit atomically. Confirmed commit builds on this by requiring an explicit confirmation within a timeout, otherwise the device reverts. The candidate capability is therefore the prerequisite for the described workflow.

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:startup:1.0

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Question 8

A developer is writing a Python script to interact with a REST API. The script must handle HTTP responses correctly. Which two HTTP status code ranges indicate a successful request and a client error, respectively? (Choose two.)

Accepted Answer

2xx. HTTP status codes are grouped into five classes. 2xx codes indicate successful request handling, such as 200 OK. 4xx codes indicate client errors, such as 404 Not Found or 400 Bad Request. 1xx, 3xx, and 5xx represent informational, redirection, and server error responses, respectively. Therefore, the correct ranges for success and client error are 2xx and 4xx.

Answer

3xx

Answer

1xx

Answer

5xx

Question 9

A developer is reviewing a CI/CD pipeline that builds and deploys a containerized application. The team wants to protect sensitive values such as API keys and registry passwords used during the pipeline. Which TWO practices should be used? (Choose two.)

Accepted Answer

Store secrets in the CI/CD platform's encrypted secret store and reference them as masked variables in pipeline steps.. Protecting pipeline secrets requires both keeping them out of source and pipeline definitions and retrieving them from controlled stores at the moment they are needed. Encrypted secret stores with masking prevent accidental disclosure in logs, while runtime retrieval from a secrets manager limits exposure and supports rotation. Practices that persist secrets in repositories or logs defeat these protections.

Answer

Commit the secrets to a private repository branch so only team members can read them.

Answer

Reuse the same secret value across all environments and rotate it only when a team member leaves.

Answer

Print the decrypted secrets to the build log so the team can verify they are correct.

Question 10

A network engineer is using the Cisco DNA Center Intent API to retrieve a list of all sites. Which HTTP method and endpoint should be used?

Accepted Answer

GET /dna/intent/api/v1/site. To retrieve a list of sites in Cisco DNA Center, the correct API call is a GET request to /dna/intent/api/v1/site. This endpoint is part of the Intent API and returns all sites. Authentication is required using a token from the authentication API. Other methods or paths do not perform this function.

Answer

GET /dna/system/api/v1/site

Answer

GET /dna/intent/api/v1/sites

Answer

POST /dna/intent/api/v1/site

Question 11

A developer is testing a REST API using curl. The API returns a JSON response with a status code of 201. What does this status code indicate about the request?

Accepted Answer

The request was successful and a new resource was created.. The 201 Created status code indicates that the request was successful and a new resource was created. It is commonly returned after a POST request to a collection endpoint. The response may include a Location header and a body with the new resource. Other status codes like 200, 202, and 204 have different meanings. Understanding these distinctions is essential for API testing and development.

Answer

The request was successful and the response contains a representation of the modified resource.

Answer

The request was accepted for processing but has not been completed.

Answer

The request was successful but the response body is empty.

Question 12

A developer is writing a script to interact with a REST API. The API documentation states that the base URL is https://api.example.com/v1/ and that the resource for users is /users. The developer needs to retrieve a list of all users. Which HTTP request should the developer send to the correct endpoint?

Accepted Answer

GET https://api.example.com/v1/users. RESTful APIs use HTTP methods semantically: GET for retrieval, POST for creation, PUT for update, DELETE for removal. To list users, a GET request to the users collection endpoint is correct. The base URL and resource path must be concatenated properly, and the plural form /users indicates the collection. The other methods would cause unintended actions or target the wrong resource.

Answer

PUT https://api.example.com/v1/users

Answer

GET https://api.example.com/v1/user

Answer

POST https://api.example.com/v1/users

Question 13

A developer's application opens a TCP connection to a REST API, sends a request, and receives a response. The developer then wants to reuse the same connection for several subsequent requests to the same host instead of opening a new socket each time. Which HTTP behavior makes this reuse possible?

Accepted Answer

Persistent connections keep the TCP socket open for multiple request/response exchanges.. Persistent connections, the default in HTTP/1.1, let a client send multiple requests over one TCP socket. This avoids re-establishing the connection and re-entering TCP slow start for every call, which is the reuse the developer wants. Cookies, protocol upgrades, and HTTP/1.0 behavior do not provide this transport-level efficiency.

Answer

The server sends a 101 Switching Protocols response to upgrade the socket.

Answer

The client multiplexes requests by interleaving them in a single HTTP/1.0 stream.

Answer

HTTP cookies are exchanged so the server can correlate successive sockets.

Question 14

A security team requires that a web application's API calls to an internal service use mutual TLS. The application runs in a Kubernetes pod and the team wants the certificate and private key mounted as files without embedding them in the container image. Which Kubernetes resource should be used to provide the certificate and key to the pod?

Accepted Answer

A Secret of type kubernetes.io/tls mounted as a volume. Kubernetes Secrets are designed for sensitive data and the kubernetes.io/tls type specifically holds a certificate and key. Mounting the Secret as a volume projects the data into files inside the pod, allowing the application to load them for mutual TLS without baking credentials into the image. This satisfies both the security and file-mount requirements.

Answer

A ConfigMap containing the certificate and key in data fields

Answer

An environment variable defined in the pod spec referencing a Secret

Answer

A PersistentVolumeClaim bound to a network file share

Question 15

A developer is designing a Python script that interacts with multiple Cisco APIs, including Cisco Webex and Cisco DNA Center. The script must authenticate to each API and handle tokens securely. Which TWO of the following practices are recommended for securely managing API credentials and tokens? (Choose two.)

Accepted Answer

Store API keys and tokens in environment variables or a secure vault, and retrieve them at runtime.. The recommended practices are to store credentials securely (e.g., environment variables or vault) and to implement token refresh logic. These reduce the risk of credential leakage and ensure uninterrupted API access. Hard-coding, logging tokens, and sharing via email are insecure and should be avoided.

Answer

Share API tokens with team members via email to facilitate collaboration.

Answer

Log the full API request and response, including Authorization headers, to aid in debugging.

Answer

Hard-code API keys directly in the Python script for simplicity and ease of deployment.

Question 16

A developer is building a Python script that must resolve a hostname to an IPv4 address and then connect to a specific TCP port. The script uses `socket.getaddrinfo(host, port, family=socket.AF_INET, type=socket.SOCK_STREAM)`. What does the returned list contain?

Accepted Answer

Tuples of (family, type, proto, canonname, sockaddr) for each address that matches the criteria.. `socket.getaddrinfo` resolves a host and service into a list of 5-tuples containing family, type, protocol, canonical name, and socket address. When filtered with `AF_INET` and `SOCK_STREAM`, the results are IPv4 TCP endpoints ready for socket creation. This design supports multiple addresses and protocol independence, which is why developers use it instead of the simpler but less flexible `gethostbyname`.

Answer

A dictionary mapping address families to lists of IPv4 addresses.

Answer

A single string containing the IPv4 address in dotted-decimal notation.

Answer

A list of `ipaddress.IPv4Address` objects representing resolved addresses.

Question 17

A developer is building a Python application that integrates with Cisco DNA Center. The application needs to authenticate and then retrieve a list of network devices. The developer decides to use the DNA Center Intent API. Which two steps are required to successfully authenticate and make an API call? (Choose two.)

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with Basic Auth credentials to obtain a token.. To authenticate with the DNA Center Intent API, the developer must first obtain a token by sending a POST request with Basic Auth credentials to the token endpoint. Then, that token must be included in the 'X-Auth-Token' header for all subsequent API calls. This two-step process ensures secure authentication and authorization. The other options describe incorrect or insecure methods that are not supported by DNA Center.

Answer

Generate a JWT token using the DNA Center certificate and sign each request with it.

Answer

Use OAuth 2.0 with the client credentials grant to obtain an access token from the /token endpoint.

Answer

Pass the username and password as query parameters in each API request.

Question 18

A developer is writing a Python script that uses the requests library to interact with a REST API. The script must handle common HTTP status codes appropriately. Which two actions should the developer take to ensure robust error handling? (Choose two.)

Accepted Answer

Check the response.status_code attribute and branch logic based on the code.. To robustly handle HTTP errors, the developer should check the status code and branch logic accordingly, and use raise_for_status() to raise exceptions for 4xx and 5xx responses. These practices allow the script to respond appropriately to different error conditions, such as retrying or logging. Other options either introduce risks or do not address error handling effectively.

Answer

Always assume the response is JSON and parse it without checking the Content-Type header.

Answer

Disable SSL verification to avoid certificate errors.

Answer

Set the timeout parameter to a very high value to avoid connection errors.

Question 19

A developer is building a Python script that calls a REST API which returns a JSON payload containing a list of interfaces. The script must parse the response and extract the 'name' field from each interface object. Which approach correctly uses the requests library to parse the JSON and iterate over the interfaces?

Accepted Answer

response = requests.get(url); interfaces = response.json(); for intf in interfaces['interfaces']: print(intf['name']). The requests library's Response object provides a .json() method that deserializes the JSON response body into Python objects. After calling .json(), the result is typically a dictionary or list that can be indexed and iterated. Using response.json() is the idiomatic way to parse JSON in requests, and the subsequent iteration extracts the 'name' field from each interface dictionary.

Answer

response = requests.get(url); interfaces = json.loads(response); for intf in interfaces['interfaces']: print(intf['name'])

Answer

response = requests.get(url); interfaces = response.json; for intf in interfaces['interfaces']: print(intf['name'])

Answer

response = requests.get(url); interfaces = response.text; for intf in interfaces['interfaces']: print(intf['name'])

Question 20

A network engineer is troubleshooting a connectivity issue between two subnets. The engineer uses the traceroute command and observes that packets are reaching the destination but with high latency. Which of the following is the most likely cause of the high latency?

Accepted Answer

Network congestion causing packets to be queued at intermediate devices.. Network congestion causes packets to be queued at intermediate devices, increasing latency. Traceroute would show higher round-trip times at the congested hop, but packets still reach the destination. This is a common cause of high latency without packet loss.

Answer

Incorrect subnet mask configuration on the source device.

Answer

A routing loop causing packets to traverse multiple hops repeatedly.

Answer

A firewall blocking ICMP packets, causing retransmissions.