200-901 Practice Test 6 — 10 Questions

Question 1

A DevOps team is deploying a containerized application across multiple hosts. They need to ensure that traffic between containers on the same host is isolated from other tenants. Which network implementation best meets this requirement?

Accepted Answer

VXLAN overlays with a distributed virtual switch. VXLAN overlays with a distributed virtual switch provide Layer 2 isolation across multiple hosts by encapsulating Ethernet frames in UDP packets (RFC 7348). This creates independent virtual networks (VXLAN segments) that can span hosts, ensuring traffic between containers on the same host is isolated from other tenants without relying on physical network topology.

Answer

Linux bridge with ebtables rules

Answer

NAT with port forwarding

Answer

802.1Q VLANs on the host switch

Question 2

An organization uses Cisco ISE for network access control. A user reports inability to access the network. The switch port shows the authenticator state as 'connecting'. What does this indicate?

Accepted Answer

The client is in the process of 802.1X authentication. In Cisco ISE and 802.1X, the authenticator state 'connecting' indicates that the switch (authenticator) has detected a new client on the port and has initiated the 802.1X authentication process. This state means the port is actively sending EAP-Request/Identity frames and waiting for the client to respond, so the client is in the process of authentication, not yet authenticated or failed.

Answer

The client has successfully authenticated

Answer

The port is in a held state due to multiple failures

Answer

Authentication has failed

Question 3

A technician needs to verify the IP address of a remote server using DNS. Which command should be used on a Cisco IOS device?

Accepted Answer

nslookup server.example.com. The `nslookup` command is used to query DNS servers to resolve a hostname to an IP address. On a Cisco IOS device, `nslookup` sends a DNS query for the specified hostname and returns the corresponding IP address, making it the correct tool for verifying a remote server's IP via DNS.

Answer

traceroute server.example.com

Answer

show hosts server.example.com

Answer

ping server.example.com

Question 4

An organization uses Cisco Intersight to manage UCS servers. They want to automate the firmware upgrade process. Which Intersight API should be used to trigger a firmware upgrade on a server?

Accepted Answer

POST /api/v1/compute/Physical. Option D is correct because the `/api/v1/compute/Physical` endpoint in Cisco Intersight is used to manage physical compute resources, including triggering firmware upgrades on UCS servers. By sending a POST request to this endpoint with the appropriate action payload (e.g., `"Action": "UpgradeFirmware"`), you can initiate a firmware upgrade on a specific server. This aligns with Intersight's RESTful API design for lifecycle management of UCS infrastructure.

Answer

POST /api/v1/ntp/Policies

Answer

POST /api/v1/equipment/Fex

Answer

POST /api/v1/fabric/EthNetworkPolicies

Question 5

Refer to the exhibit. A Python script using RESTCONF sends a GET request to retrieve the interface configuration. The response is shown. What is the VLAN assigned to GigabitEthernet1/0/1?

Accepted Answer

10. The correct answer is A (VLAN 10) because the RESTCONF GET response shows the native VLAN for GigabitEthernet1/0/1 is set to 10. In Cisco IOS-XE, the native VLAN is the VLAN assigned to an interface when it is in access mode, and the response explicitly includes the 'native-vlan' field with a value of 10 under the 'Cisco-IOS-XE-native:interface' hierarchy.

Answer

1

Answer

100

Answer

20

Question 6

A large enterprise operates a multi-vendor network with Cisco routers and switches, as well as Juniper devices. The network team uses Ansible for automation, with a centralized control node running RHEL. They have been using the 'ios_config' module for Cisco devices and 'junos_config' for Juniper devices. Recently, they added a new Cisco Catalyst 9300 switch to the network. They wrote a playbook to configure VLAN 100 on the switch, but the task fails with the error: 'module_stderr: Could not find platform module for Cisco IOS XE'. The playbook uses the 'cisco.ios.ios_config' module. The control node has the 'cisco.ios' collection installed (version 2.0.0). The target switch runs IOS XE 16.12.3. The control node can SSH to the switch successfully. Which action will most likely resolve the issue?

Accepted Answer

Upgrade the 'cisco.ios' Ansible collection to the latest version.. The error 'Could not find platform module for Cisco IOS XE' indicates that the installed 'cisco.ios' collection (version 2.0.0) does not include a module or plugin that supports the IOS XE platform for the target switch. Upgrading the collection to the latest version ensures compatibility with IOS XE 16.12.3, as newer releases add support for newer platforms and OS versions.

Answer

Configure the switch to allow SSH connections from the control node IP.

Answer

Use the 'raw' module instead of 'ios_config' to send CLI commands directly.

Answer

Install Python 3.8 on the control node and update the ansible.cfg to use it.

Question 7

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

Accepted Answer

docker run -p 443:443 myapp. Option C is correct because the `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.

Answer

docker run --port 443 myapp

Answer

docker run --net host myapp

Answer

docker run --expose 443 myapp

Question 8

During a security audit, an engineer discovers that a CI/CD pipeline is storing API keys in plain text in environment variables. Which best practice should be implemented to mitigate this risk?

Accepted Answer

Use a dedicated secrets management service like HashiCorp Vault or AWS Secrets Manager and retrieve secrets at runtime.. Option C is correct because dedicated secrets management services like HashiCorp Vault or AWS Secrets Manager provide secure storage, access control, and audit logging for sensitive data. They allow the CI/CD pipeline to retrieve API keys at runtime via authenticated API calls, ensuring secrets are never stored in plain text in environment variables or configuration files. This approach aligns with the principle of least privilege and eliminates the risk of exposure through source code or build logs.

Answer

Store secrets in a .env file and add it to the repository with restricted access.

Answer

Encrypt the environment variables using a tool like openssl and store the key elsewhere.

Answer

Remove the API keys from the pipeline and require manual entry each time a build runs.

Question 9

A DevOps engineer wants to automate the configuration of network devices using Ansible. Which file format is commonly used for Ansible playbooks?

Accepted Answer

YAML. Ansible playbooks are written in YAML (YAML Ain't Markup Language) because YAML is human-readable, supports complex data structures like lists and dictionaries, and is designed for configuration files. YAML's indentation-based syntax aligns with Ansible's declarative automation model, making it the default and recommended format for defining tasks, variables, and handlers in playbooks.

Answer

INI

Answer

XML

Answer

JSON

Question 10

A network administrator is configuring SNMPv3 on a router for secure monitoring. Which combination of parameters is required to ensure authentication and encryption?

Accepted Answer

SNMPv3 with authPriv. SNMPv3 with authPriv is the correct combination because it enables both authentication (via HMAC-MD5 or HMAC-SHA) and encryption (via DES or AES) to ensure secure monitoring. The authPriv security level provides message integrity, origin authentication, and data confidentiality, meeting the requirement for both authentication and encryption.

Answer

SNMPv3 with noAuthNoPriv

Answer

SNMPv3 with authNoPriv

Answer

SNMPv2c with a complex community string