200-901 Practice Exam 60 — 20 Questions

Question 1

Which Cisco platform provides an Intent API for network automation, including endpoints for network-device, topology, and site hierarchy?

Accepted Answer

Cisco Catalyst Center. Cisco Catalyst Center (formerly DNA Center) provides an Intent API that abstracts network intent into RESTful endpoints. This API includes specific endpoints for managing network devices, retrieving topology views, and interacting with site hierarchy, enabling declarative network automation without low-level device configuration.

Answer

Cisco Webex

Answer

Cisco IOS XE

Answer

Meraki Dashboard

Question 2

In Python, which of the following is a valid way to define a function that accepts a variable number of positional arguments?

Accepted Answer

def func(*args):. In Python, the `*args` syntax in a function definition allows the function to accept a variable number of positional arguments. The asterisk (`*`) collects all extra positional arguments into a tuple named `args`, enabling flexible argument handling.

Answer

def func(args):

Answer

def func(args*):

Answer

def func(**kwargs):

Question 3

Which THREE security measures should be implemented in a CI/CD pipeline to protect against supply chain attacks? (Choose three.)

Accepted Answer

Pin dependency versions to specific hashes.. Pinning dependency versions to specific hashes (e.g., using `integrity` attributes in npm’s package-lock.json or `sha256` checksums in pip’s requirements.txt) ensures that only the exact, verified content is downloaded. This prevents an attacker from substituting a malicious version of a dependency, even if the version tag remains the same, by validating the cryptographic hash of the artifact against a known good value.

Answer

Enable verbose logging for all build steps to detect anomalies.

Answer

Sign all build artifacts with a GPG key.

Question 4

A developer needs to prevent SQL injection in a web application. Which coding practice should be used when constructing database queries?

Accepted Answer

Parameterized queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders (e.g., `?` in MySQLi or `:name` in PDO). This ensures user input is always treated as data, never as executable SQL code, effectively neutralizing SQL injection attacks regardless of the input content.

Answer

CSRF tokens

Answer

Output encoding

Answer

Input validation

Question 5

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

Accepted Answer

docker run -p 443:443 myapp. The `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.

Answer

docker run --port 443 myapp

Answer

docker run --net host myapp

Answer

docker run --expose 443 myapp

Question 6

A Python script using the ncclient library connects to a Cisco IOS-XE device to retrieve the running configuration. The script raises an exception: 'TimeoutError: Session timed out'. Which is the most likely cause?

Accepted Answer

The SSH port (830) is blocked by a firewall. The ncclient library uses NETCONF over SSH, which by default connects to TCP port 830. A 'TimeoutError: Session timed out' indicates that the TCP connection to the device could not be established within the timeout period. The most likely cause is that a firewall is blocking port 830, preventing the SSH session from being initiated.

Answer

The device does not support NETCONF

Answer

The device's running configuration is too large

Answer

The XML payload is malformed

Question 7

An application developer is designing a microservice that communicates over HTTP. The service must guarantee that the request is processed exactly once. Which HTTP method should be used to ensure idempotency?

Accepted Answer

PUT. PUT is idempotent, meaning multiple identical requests produce the same result as a single request, which guarantees that the request is processed exactly once. In HTTP, idempotency ensures that if a client sends the same PUT request multiple times (e.g., due to network retries), the server state remains consistent. This is defined in RFC 7231, where PUT is explicitly listed as an idempotent method, making it suitable for the requirement.

Answer

PATCH

Answer

GET

Answer

DELETE

Answer

POST

Question 8

A developer is deploying a Python web application on Cisco UCS servers using a CI/CD pipeline that runs on Jenkins. The application uses a PostgreSQL database. The security team mandates that all database credentials must be rotated every 30 days. Currently, credentials are stored as plaintext in a configuration file in the application repository. Which approach should the developer take to meet the rotation requirement without storing secrets in the repository?

Accepted Answer

Integrate with HashiCorp Vault to dynamically generate credentials for each deployment. Integrating with HashiCorp Vault allows the CI/CD pipeline to dynamically generate short-lived database credentials for each deployment, eliminating the need to store secrets in the repository. Vault can be configured to automatically rotate credentials every 30 days (or less) and inject them into the application at runtime via sidecar containers or API calls, meeting the security mandate without manual intervention.

Answer

Set the credentials as environment variables in the Jenkins pipeline and generate a new set every month manually

Answer

Store the credentials in Jenkins credentials store and reference them in the pipeline

Answer

Store the credentials in a Kubernetes ConfigMap and update it every 30 days

Question 9

A network administrator is deploying a new application that requires high availability and load balancing across multiple servers. The servers are connected to a pair of switches that use StackWise virtual technology. The application team requests that the servers be configured with NIC teaming in active-active mode. Which two requirements must be met for this configuration to work correctly? (Choose two.)

Accepted Answer

The two switches must be part of a single stack or virtual switch fabric.. StackWise virtual technology logically combines two physical switches into a single control plane, allowing NIC teaming in active-active mode to treat the pair as one logical switch. This ensures that both NIC team members can forward traffic simultaneously without loops, as the stack provides a unified Layer 2 topology and prevents MAC flapping between the two switches.

Answer

Spanning-tree PortFast must be enabled on the switch ports connected to the servers.

Answer

The NIC team must use LACP for load balancing.

Answer

Both NIC team members should connect to the same switch module for consistency.

Question 10

A developer needs to retrieve the list of devices from a Meraki network using the Meraki Dashboard API. Which HTTP method and endpoint should be used?

Accepted Answer

GET /networks/{networkId}/devices. The Meraki Dashboard API uses RESTful conventions: to retrieve a list of devices within a specific network, you send a GET request to the endpoint `/networks/{networkId}/devices`. This follows the standard pattern of using GET for read operations and scoping the resource under the network identifier.

Answer

POST /networks/{networkId}/devices

Answer

GET /devices

Answer

GET /organizations/{organizationId}/networks

Question 11

A developer is designing a Python script that uses the NSO (Network Services Orchestrator) northbound API. Which data format is natively supported by NSO's RESTCONF API?

Accepted Answer

JSON and XML. NSO's RESTCONF API natively supports both JSON and XML data formats, as defined by RFC 8040. RESTCONF uses HTTP methods to manipulate YANG-defined data, and the API can serialize data in either JSON (application/yang-data+json) or XML (application/yang-data+xml) based on the Accept header or Content-Type in the request. This dual-format support allows developers to choose the format that best fits their application's ecosystem.

Answer

YAML only

Answer

JSON only

Answer

XML only

Question 12

A developer is using the Meraki Dashboard API and receives an HTTP 429 status code with a Retry-After header. What is the correct interpretation?

Accepted Answer

The rate limit has been exceeded; the client should wait the number of seconds specified in Retry-After before retrying.. HTTP 429 status code indicates 'Too Many Requests', meaning the client has exceeded the rate limit imposed by the Meraki Dashboard API. The Retry-After header specifies the number of seconds the client must wait before sending a new request to avoid further throttling. This is a standard rate-limiting mechanism defined in RFC 6585.

Answer

The API key is invalid and the request should be re-authenticated.

Answer

The server is temporarily unavailable; the client should retry immediately.

Answer

The request was successful but the response is too large.

Question 13

An engineer is using the Cisco Meraki Dashboard API to retrieve a list of all network clients for a specific network. Which TWO of the following are required to successfully make this API call?

Accepted Answer

Network ID in the URL path. The Meraki Dashboard API endpoint for listing network clients (GET /networks/{networkId}/clients) requires the network ID as a path parameter to identify the specific network from which to retrieve client data. Without the network ID in the URL, the API cannot determine which network's clients to return, making it a mandatory component of the request.

Answer

Bearer token in the Authorization header

Answer

Organization ID in the URL path

Answer

API key as a query parameter

Question 14

A company is designing a new branch network. They want to segment traffic into separate broadcast domains to improve security and reduce broadcast traffic. Which technology should be used to achieve this?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) segment a physical network into multiple logical broadcast domains at Layer 2. By assigning different VLANs to different groups of devices, broadcast traffic is confined to the VLAN, reducing unnecessary propagation and improving security by isolating traffic between segments.

Answer

Spanning Tree Protocol

Answer

Subnetting

Answer

EtherChannel

Question 15

A developer is designing a data model for network device configurations using YANG. They need to represent a list of interfaces where each interface has a name (string) and speed (enumeration). Which YANG statement correctly defines this structure?

Accepted Answer

list interface { key name; leaf name { type string; } leaf speed { type enumeration; } }. YANG requires a `list` statement to define a collection of entries with multiple leafs, and a `key` statement to uniquely identify each list entry. The `list interface` with `key name` allows multiple interfaces, each having both a `name` (string) and `speed` (enumeration), matching the requirement exactly.

Answer

leaf interface-list { type string; }

Answer

leaf-list interface { type string; }

Answer

list interface { leaf name { type string; } leaf speed { type enumeration; } }

Question 16

A network engineer needs to automate the configuration of VLANs across 50 switches. Which approach best follows Cisco’s recommended practices for programmability?

Accepted Answer

Write an Ansible playbook using the ios_vlan module to configure VLANs on all switches.. Ansible's ios_vlan module is purpose-built for automating VLAN configuration on Cisco IOS devices, aligning with Cisco's recommended practices for programmability by using a declarative, agentless automation tool that abstracts the underlying CLI and ensures idempotent configuration across multiple switches.

Answer

Use a REST API on each switch to push the VLAN configuration individually.

Answer

Use a Python script that manually SSHes into each switch and applies CLI commands.

Answer

Configure all VLANs via SNMP MIBs.

Question 17

A developer is writing a Postman test to verify that a Meraki API response returns HTTP status 200 and contains a list of networks. Which code snippet correctly implements this test?

Accepted Answer

pm.test("Check networks", function() { pm.expect(pm.response.json()).to.have.property('networks'); pm.response.to.have.status(200); });. pm.test with pm.response.to.have.status and pm.expect checks the status and response body.

Answer

pm.response.to.have.status(200);

Answer

pm.test("Status 200", function() { pm.response.to.have.status(200); });

Answer

pm.test("Success", function() { pm.expect(pm.response.code).to.equal(200); });

Question 18

In gNMI, what is the difference between dial-in and dial-out streaming?

Accepted Answer

Dial-in: client initiates subscription and receives data; dial-out: device pushes data to a configured receiver. In gNMI, dial-in streaming refers to the client initiating a subscription request to the device, which then streams telemetry data back over the same gRPC session. Dial-out streaming, on the other hand, is a server-initiated model where the device (gNMI target) pushes telemetry data to a pre-configured receiver (collector) without waiting for a client request. Option C correctly captures this distinction: dial-in has the client subscribe and receive data, while dial-out has the device push data to a configured receiver.

Answer

Dial-in is for configuration, dial-out for telemetry

Answer

Dial-in: device initiates the connection; dial-out: client initiates

Answer

Dial-in uses gRPC, dial-out uses HTTP

Question 19

A Python script uses the requests library to authenticate to Cisco DNA Center. The script receives a 401 Unauthorized error even though the credentials are correct. Which of the following is a likely cause?

Accepted Answer

The token has expired. In Cisco DNA Center, API authentication uses a token-based mechanism. The script first obtains a token via POST to /dna/system/api/v1/auth/token, then uses that token in subsequent requests. A 401 error with correct credentials typically means the token has expired (default lifetime is 1 hour) or was not included in the Authorization header. Option D is correct because the token, not the credentials, is being validated for each API call.

Answer

The request is using HTTP instead of HTTPS

Answer

The Content-Type header is not set to application/json

Answer

The API endpoint is incorrect

Question 20

An organization is planning to implement HTTPS for their web services. Which three statements accurately describe the HTTPS protocol? (Choose three.)

Accepted Answer

HTTPS uses TLS to encrypt HTTP traffic.. HTTPS uses TLS for encryption, involves certificate verification, and negotiates a symmetric session key. It does not use UDP typically (TCP is used) and it is not stateless after the handshake.

Answer

HTTPS uses UDP as the transport protocol.

Answer

HTTPS is stateless after the initial handshake.