200-901 Practice Exam 59 — 20 Questions

Question 1

An application authenticates to Cisco Webex API using OAuth2 client credentials grant. Which three pieces of information must the application include in the token request?

Accepted Answer

Client ID. In the OAuth2 client credentials grant flow, the application authenticates directly as itself (not on behalf of a user) to obtain an access token. The token request must include the client ID (B) to identify the application, the client secret (D) to prove its identity, and the grant type (E) set to 'client_credentials' to indicate the flow being used. These three fields are mandatory per RFC 6749 Section 4.4.2.

Answer

Authorization Code

Answer

Redirect URI

Question 2

Refer to the exhibit. A service engineer runs a 'check-sync' action on the NSO service 'vpn1'. The result shows 'out-of-sync' for device 'pe1'. What does this indicate?

Accepted Answer

The configuration on pe1 differs from the service model defined in NSO.. The 'check-sync' action in NSO compares the actual device configuration (retrieved via NETCONF or CLI) against the configuration that NSO's service model expects. An 'out-of-sync' result for device 'pe1' means the running configuration on pe1 does not match the configuration defined by the NSO service model for that device. This is a standard NSO feature to detect configuration drift.

Answer

The device pe1 is unreachable via NETCONF.

Answer

The service model in NSO does not have a configuration for pe1.

Answer

The device pe1 has a hardware failure.

Question 3

A developer needs to retrieve interface configuration from a Cisco IOS XE device using NETCONF. Which operation should be used?

Accepted Answer

with filter. To retrieve interface configuration from a Cisco IOS XE device using NETCONF, the operation with a filter is the correct choice. retrieves the running configuration datastore, and the filter (typically an XML subtree filter) narrows the response to only the interface subtree, avoiding unnecessary data. This is the standard NETCONF operation for reading configuration data, as defined in RFC 6241.

Answer

<get> with filter

Answer

<delete-config>

Answer

<edit-config>

Question 4

Which TWO of the following are functions of the transport layer in the OSI model? (Choose two.)

Accepted Answer

Segmentation and reassembly of data.. Segmentation and reassembly of data is a core function of the transport layer. The transport layer (e.g., TCP) takes data from the session layer, breaks it into smaller segments (segmentation), assigns sequence numbers, and then reassembles these segments in the correct order at the destination. This allows large data streams to be transmitted efficiently over the network layer, which has a maximum transmission unit (MTU) size.

Answer

Adding a trailer for error detection.

Answer

Encrypting data for secure transmission.

Answer

Determining the best path to a destination.

Question 5

A network automation engineer is using a Python script with the requests library to configure VLAN 100 on a Cisco Catalyst 9300 switch via the REST API. The script sends a PUT request to https://switch-ip/restconf/data/Cisco-IOS-XE-native:native/vlan. The response returns a 201 Created, but subsequent checks show VLAN 100 is not present in the running configuration. The switch's management interface is in VLAN 99 with IP 10.10.99.10/24, and the engineer's workstation is on a different subnet (10.10.88.0/24). The switch has the following relevant configuration: ip default-gateway 10.10.99.1, and a route for 10.10.88.0/24 via 10.10.99.1. The engineer also verified that the REST API credentials are correct and that the switch's HTTP server is enabled. Which action should the engineer take to resolve the issue?

Accepted Answer

Send a commit operation to the RESTCONF API using the 'cisco-ia:commit' RPC to apply the candidate datastore changes.. The switch is using the candidate datastore model (Cisco-IOS-XE-native), which requires an explicit commit operation to apply changes from the candidate to the running configuration. A 201 Created response indicates the configuration was accepted into the candidate datastore, but it is not active until committed via the 'cisco-ia:commit' RPC. Option C correctly identifies this missing step.

Answer

Resend the PUT request with the VLAN configuration nested under 'Cisco-IOS-XE-native:native/vlan' in YANG format.

Answer

Reboot the switch to force the candidate configuration to become active.

Answer

Check the MTU on the switch's management interface to ensure it can accept the configuration payload.

Question 6

A network engineer is automating the deployment of a new VLAN across multiple Cisco switches using Ansible. The engineer has written a playbook that uses the ios_vlan module to create VLAN 100 with name 'Users'. The playbook runs successfully on the first switch but fails on the second switch with the error message: 'VLAN name is already in use'. The engineer checks the second switch and confirms that VLAN 100 does not exist, but a different VLAN with the name 'Users' exists. The engineer wants to ensure that the playbook creates VLAN 100 with the exact name 'Users' only if it does not already exist, and without conflicting with existing VLANs. Which approach should the engineer take?

Accepted Answer

First use the ios_command module to run 'show vlan name Users' and then conditionally create VLAN 100 if no output is returned.. The correct approach is to first verify that the VLAN name 'Users' is not already in use on the switch before attempting to create VLAN 100. Using the ios_command module to execute 'show vlan name Users' returns output only if a VLAN with that name exists. If no output is returned, the name is available, and the engineer can then proceed to create VLAN 100 with the name 'Users' using the ios_vlan module. This conditional approach avoids the 'VLAN name is already in use' error and ensures idempotency without conflicts. Option A incorrectly assumes the ios_vlan module will update an existing VLAN's name, but actually it will fail if the name is assigned to a different VLAN ID. Options C and D do not solve the name conflict or meet the requirement.

Answer

Use the ios_vlan module with parameters vlan_id=100 and name='Users' and set state=present. The module will create the VLAN if it does not exist or update the name if it exists with a different name.

Answer

Use the ios_config module to directly apply the configuration 'vlan 100
 name Users' and then use the 'parents' directive to ensure idempotency.

Answer

Use the ios_vlan module with vlan_id=100 and state=present, but omit the name parameter.

Question 7

You are a network automation engineer at a large enterprise. The network consists of 200 Cisco Catalyst switches distributed across five data centers. Each switch runs IOS-XE and supports NETCONF. Your team uses a centralized Ansible control node to manage configurations. Recently, the security team mandated that all management access must use SSH keys instead of passwords. You updated the Ansible inventory to use SSH keys and tested on a few switches successfully. However, when you run the playbook against all switches, about 30 switches fail with the error: 'Authentication failed.' You verify that the SSH public key is correctly deployed on those switches via the console. What is the most likely cause of the failure?

Accepted Answer

The private key file on the Ansible control node has permissions 644, which SSH rejects. SSH strictly requires private key files to have permissions no more permissive than 600 (owner read/write) or 640 (owner read/write, group read) on Unix-like systems. A permission of 644 allows group and others to read the key, which SSH interprets as insecure and refuses to use, causing 'Authentication failed' even though the public key is correctly deployed on the switches.

Answer

The public key on the switches is not in the correct format

Answer

The Ansible become method is misconfigured

Answer

The switches are not reachable over the network

Question 8

When designing a RESTful API for a network automation tool, which status code indicates that a resource has been created successfully?

Accepted Answer

201 Created. (201 Created). According to HTTP semantics and RESTful API best practices, a successful POST request that creates a new resource should return the 201 Created status code. This indicates that the request has been fulfilled and a new resource has been created, often with a Location header pointing to the resource's URI. 204 No Content (option A) is used for successful requests that have no response body, such as DELETE or when an update returns no content, but not for creation.

Answer

204 No Content

Answer

200 OK

Answer

202 Accepted

Question 9

You are a DevNet engineer responsible for automating configuration management across a Cisco SD-WAN fabric. You have been using the vManage REST API to retrieve device inventory and template lists. You generate an API token with read/write scope and successfully execute GET requests to /dataservice/device and /dataservice/template/device to list devices and templates. Now you want to attach a specific template to a device using POST /dataservice/template/device/config/attach. Your Python script uses the correct URL and includes the token in the Authorization header. The request body contains the device UUID and template UUID retrieved earlier. However, the API returns an HTTP 403 Forbidden error. You have verified that the device UUID and template UUID are correct and that the template exists. The vManage server logs indicate no high resource usage. What is the most likely cause of the 403 error?

Accepted Answer

The template is already attached to the device.. The HTTP 403 Forbidden error in Cisco SD-WAN vManage API occurs when attempting to attach a template that is already attached to the device. The API enforces idempotency and prevents duplicate attachments, returning 403 instead of 409 or 400 to indicate a state-based rejection. This is a known behavior, not a permission issue.

Answer

The vManage version does not support the attach API.

Answer

The device is not part of any template group.

Answer

The API token has been issued only with read scope for the attach operation.

Question 10

A developer needs to retrieve a list of all networks in a Meraki organization using the Dashboard API. Which API call should be made?

Accepted Answer

GET /organizations/{organizationId}/networks. The correct API call to retrieve a list of all networks in a Meraki organization is GET /organizations/{organizationId}/networks. Option A shows this endpoint. Option B uses the wrong HTTP method (POST is for creating). Option C is missing the organization scope, and option D retrieves a single network.

Answer

POST /organizations/{organizationId}/networks

Answer

GET /networks

Answer

GET /organizations/{organizationId}/networks/{networkId}

Question 11

Which TWO functions are performed by the data plane in a network device? (Choose two.)

Accepted Answer

Forwarding packets based on destination MAC address. The data plane is responsible for forwarding packets based on information in the forwarding table, such as destination MAC address for Layer 2 switching. Applying ACLs is also a data plane function because ACL rules are evaluated in hardware or software during packet forwarding to permit or deny traffic.

Answer

Building the routing table using OSPF

Answer

Maintaining ARP cache entries

Answer

Establishing OSPF neighbor adjacencies

Question 12

A network engineer needs to allow HTTPS traffic from the internet to an internal web server. Which type of firewall rule should be applied on the perimeter firewall?

Accepted Answer

Inbound ACL on the outside interface. An inbound ACL on the outside interface allows traffic from the internet to reach internal servers while blocking unauthorized access. Option A (routing protocol configuration) does not control traffic filtering. Option B (outbound ACL on inside interface) controls traffic leaving the network, not incoming HTTPS. Option D (static NAT) translates addresses but does not filter traffic.

Answer

Routing protocol configuration

Answer

Outbound ACL on the inside interface

Answer

Static NAT configuration

Question 13

You are deploying a new data center network using Cisco Nexus switches. The design uses Virtual Port Channel (vPC) to provide redundancy and increased bandwidth to servers with dual-homed NICs. The two vPC peer switches are NX1 and NX2, and they are connected via a peer-link. The servers are configured with active/standby NIC teaming. After the deployment, you notice that some ARP requests from servers are not being responded to, leading to connectivity issues. Analysis shows that when a server sends an ARP request for its default gateway (which is a virtual IP on the vPC), only one of the peer switches responds, but the response does not reach the server intermittently. The vPC is correctly configured, and the peer-gateway feature is enabled. What is the most likely cause?

Accepted Answer

The server's NIC teaming is sending ARP requests to the standby switch, which forwards them over the peer-link, and the peer-gateway feature does not respond to ARP requests received over the peer-link.. With active/standby NIC teaming, the server sends ARP requests for the default gateway from the active NIC. If the active NIC is connected to NX2 (the standby vPC peer for that server's MAC), NX2 receives the ARP request and forwards it over the peer-link to NX1. The peer-gateway feature allows a vPC peer to respond to ARP requests for the virtual gateway IP, but it does not respond to ARP requests received over the peer-link (only to those received on a vPC member port). Therefore, NX1 does not respond, and the ARP request times out, causing intermittent connectivity.

Answer

The virtual gateway IP is misconfigured with HSRP, causing split-brain.

Answer

STP is blocking the vPC peer-link, preventing ARP responses.

Answer

The server's MAC address is not pinned to the correct vPC member port.

Question 14

During a security audit, it is found that a microservice exposes its internal IP address in error responses. This could help attackers map the network. What is the BEST remediation?

Accepted Answer

Configure the application to return generic error messages without internal details.. Exposing internal IP addresses in error responses violates the principle of least information disclosure. The best remediation is to configure the application to return generic error messages (e.g., HTTP 500 with a generic body) that strip out internal details like IP addresses, stack traces, or debug data. This prevents attackers from using error responses to map the internal network topology, a common information-gathering technique.

Answer

Use a service mesh to encrypt traffic.

Answer

Log the errors and monitor them.

Answer

Add a firewall to block external access to the service.

Question 15

A developer commits code to a GitHub repository and wants automated tests to run, followed by building a Docker image and pushing it to Docker Hub only if tests pass. Which CI/CD tool can be configured using a YAML file placed in the .github/workflows directory?

Accepted Answer

GitHub Actions. GitHub Actions is the only CI/CD tool among the options that uses a YAML workflow file placed in the `.github/workflows` directory within the repository. This allows developers to define automated triggers (e.g., on push) to run tests, build a Docker image, and push it to Docker Hub only if tests pass, all natively integrated with GitHub.

Answer

Jenkins

Answer

CircleCI

Answer

GitLab CI

Question 16

An automation script using Ansible tries to configure IP address 192.168.1.2 on GigabitEthernet0/1. After running, the interface remains administratively down. What is the first thing to check?

Accepted Answer

The 'no shutdown' command was not included in the configuration. The 'no shutdown' command is required to administratively enable an interface on Cisco IOS devices. Without it, the interface remains in an administratively down state regardless of IP configuration. Ansible automation scripts must include this command in the task or playbook to bring the interface up.

Answer

The VLAN configuration

Answer

The IP address is a duplicate

Answer

The interface is faulty

Question 17

Refer to the exhibit. Which key-value pair indicates whether this Meraki MR is currently connected to the cloud?

Accepted Answer

"status": "online". The 'status' key with the value 'online' directly indicates that the Meraki MR access point is currently connected to the Meraki cloud. In the Meraki dashboard API response, the 'status' field reflects the device's cloud connectivity state, where 'online' means the device has an active connection to the Meraki cloud controller.

Answer

"serial": "Q2XX-XXXX-XXXX"

Answer

"lanIp": "192.168.1.100"

Answer

"model": "MR42"

Question 18

A developer needs to run a temporary container that executes a command and then exits. Which Docker command should be used?

Accepted Answer

docker run --rm. The `docker run --rm` command creates a container, runs the specified command, and automatically removes the container filesystem after it exits. This is the correct approach for a temporary, disposable container that should not persist after execution. The `--rm` flag ensures cleanup without manual intervention.

Answer

docker exec

Answer

docker run -d

Answer

docker start

Question 19

A network engineer writes a Python script to handle exceptions when making REST API calls. Which exception type should be caught to handle network connectivity issues (e.g., DNS failure, refused connection)?

Accepted Answer

requests.exceptions.ConnectionError. `requests.exceptions.ConnectionError` is specifically raised when the underlying TCP connection fails, which includes scenarios like DNS resolution failures, refused connections, or the remote host being unreachable. This exception is a subclass of `RequestException` and directly maps to network-level issues at the transport layer, making it the precise exception to catch for connectivity problems.

Answer

requests.exceptions.RequestException

Answer

requests.exceptions.HTTPError

Answer

requests.exceptions.Timeout

Question 20

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

Accepted Answer

Configure the bridge priority to 61440. Setting the bridge priority to 61440 (which is a valid priority value in increments of 4096) ensures the new switch has a higher numerical priority than the current root bridge, preventing it from becoming the root. In STP/RSTP, the switch with the lowest bridge priority becomes the root bridge; by configuring a high priority, the new switch will not disrupt the existing topology.

Answer

Enable root guard on the trunk ports

Answer

Enable BPDU guard on the trunk ports

Answer

Set the bridge priority to 0