200-901 Practice Exam 60 — 20 Questions

Question 1

A developer is writing unit tests for a Python function that interacts with a REST API. Which TWO practices are recommended to ensure tests are reliable and isolated? (Choose two.)

Accepted Answer

Mock external HTTP requests using a library like unittest.mock or responses.. Mocking external HTTP requests and asserting on the function's output are key to reliable unit tests. Mocking isolates the code under test from external dependencies, while assertions validate correct behavior. Together, they ensure tests are fast, deterministic, and focused on logic. The other practices either introduce dependencies or do not address isolation and reliability.

Answer

Include delays between test cases to simulate network latency.

Answer

Run tests in parallel to reduce execution time.

Answer

Use real API endpoints to ensure the function works with actual data.

Question 2

A company is deploying a containerized application to a Kubernetes cluster. The security team requires that the container runs as a non-root user and that the root filesystem is read-only. Which Kubernetes security context settings should be applied to the pod specification to meet these requirements?

Accepted Answer

securityContext: { runAsNonRoot: true, readOnlyRootFilesystem: true }. To enforce that a container runs as a non-root user, the securityContext must include runAsNonRoot: true. To make the root filesystem read-only, readOnlyRootFilesystem: true must be set. These can be combined in a single securityContext block. Other settings like allowPrivilegeEscalation or privileged do not guarantee non-root execution, so they are not sufficient.

Answer

securityContext: { runAsUser: 0, readOnlyRootFilesystem: true }

Answer

securityContext: { privileged: false, readOnlyRootFilesystem: true }

Answer

securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true }

Question 3

A developer is using Git for version control in a collaborative project and wants to ensure a clean, linear history. Which TWO practices help achieve a linear commit history? (Choose two.)

Accepted Answer

Use git rebase to integrate changes from the main branch into a feature branch before merging.. To maintain a linear commit history, developers should rebase feature branches onto the main branch before merging and use git pull --rebase when updating from a remote. These practices avoid merge commits and keep the commit graph as a straight line. They are widely adopted in teams that prioritize a clean, readable history.

Answer

Use git merge with the --no-ff flag to always create a merge commit.

Answer

Use git commit --amend to modify the most recent commit.

Answer

Use git cherry-pick to apply specific commits from one branch to another.

Question 4

A network engineer is evaluating configuration management tools for a Cisco environment. The engineer wants to describe the push-based model where a central server runs playbooks that connect to managed devices over SSH to apply changes. Which tool uses this architecture?

Accepted Answer

Ansible. Ansible's defining architecture is agentless and push-based: the control node runs playbooks and opens SSH sessions to managed devices to execute modules. Puppet and Chef rely on agents that pull configuration, and SaltStack's signature design uses minion agents, so only Ansible matches the described model.

Answer

Chef

Answer

Puppet

Answer

SaltStack

Question 5

A developer is preparing a Python script that will be committed to a shared Git repository used by a team of network automation engineers. The team wants to ensure that sensitive credentials and environment-specific files are never committed. Which TWO actions should the developer take? (Choose two.)

Accepted Answer

Use environment variables to supply credentials at runtime instead of hardcoding them.. The team needs to prevent sensitive files from entering Git. A .gitignore file excludes specified files and patterns from being tracked, and using environment variables for credentials means secrets never need to be stored in the repository. Committing credentials even temporarily, storing them in documentation, or relying on manual unstaging all risk exposing secrets and do not provide a reliable safeguard.

Answer

Store the credentials in a README.md file so the team can easily find them.

Answer

Run git add . to stage all files, then manually unstage credentials before committing.

Answer

Commit the credentials file once, then delete it in a later commit.

Question 6

A developer is building a container image for an application and wants to minimize the attack surface by ensuring the container does not run as root. The image is based on a Linux distribution. Which Dockerfile instruction should be used to specify a non-root user for the container process?

Accepted Answer

USER. The USER instruction changes the identity used for the container process and for later build steps. Creating a dedicated unprivileged account and switching to it before the final CMD or ENTRYPOINT ensures the application does not run as root. Other instructions affect networking, working directory, or the startup command, but none of them alter process privileges.

Answer

EXPOSE

Answer

ENTRYPOINT

Answer

WORKDIR

Question 7

A developer is testing a REST API with curl and wants the response to include only the HTTP status code and response headers, discarding the body. Which curl option accomplishes this?

Accepted Answer

curl -I https://api.example.com/devices. The -I option issues a HEAD request, which asks the server for the same headers it would send for a GET but without the body. This is ideal for checking status codes, content types, and rate-limit headers cheaply. It is a safe, idempotent inspection method that avoids transferring large payloads during API testing.

Answer

curl -o headers.txt https://api.example.com/devices

Answer

curl -d @payload.json https://api.example.com/devices

Answer

curl -X POST https://api.example.com/devices

Question 8

A developer is writing a Python script that uses the Cisco Meraki Dashboard API to update the VLAN configuration of a network. The script reads the API key from an environment variable and places it in the appropriate request header. Which header should the developer set, and what happens if the key is invalid?

Accepted Answer

Set X-Cisco-Meraki-API-Key; an invalid key produces an HTTP 401 Unauthorized response. The Meraki Dashboard API uses a purpose-built header for API key authentication rather than standard HTTP bearer tokens. Placing the organization key in X-Cisco-Meraki-API-Key authenticates the call, and an invalid or revoked key yields a 401 Unauthorized response. Reading the key from an environment variable keeps credentials out of source control while still populating the correct header.

Answer

Set Authorization to a Bearer token; an invalid key produces an HTTP 403 Forbidden response

Answer

Set X-Cisco-Meraki-API-Key; an invalid key produces an HTTP 404 Not Found response

Answer

Set X-Meraki-Token; an invalid key produces an HTTP 429 Too Many Requests response

Question 9

A developer is designing a REST API client that must handle rate limiting from a Cisco Webex API. The API returns HTTP 429 Too Many Requests with a 'Retry-After' header. Which two strategies should the developer implement to handle rate limiting gracefully? (Choose two.)

Accepted Answer

Implement exponential backoff, increasing the delay between retries after each 429 response.. To handle rate limiting gracefully, the client should respect the 'Retry-After' header and implement exponential backoff. These strategies reduce request frequency and align with server expectations. Immediate retries, switching endpoints, or indefinite caching do not properly address rate limiting and can worsen the situation.

Answer

Cache all responses indefinitely to avoid making repeated requests.

Answer

Switch to a different API endpoint that is not rate-limited.

Answer

Immediately retry the request without delay to ensure the data is retrieved as quickly as possible.

Question 10

A developer is writing unit tests for a Python function that interacts with a REST API. Which TWO practices are recommended to ensure tests are reliable and isolated? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use unittest.mock.patch to replace the file read with a mock that returns fixed configuration text. Mocking the file read with unittest.mock.patch and using pytest.mark.parametrize both improve testability: mocking removes external dependencies, and parametrization increases coverage with minimal code. Relying on live devices, merging assertions, or adding sleep delays all reduce reliability and speed, making them poor choices for unit tests.

Answer

Place all test assertions inside a single test function to minimize the number of test cases

Answer

Write tests that depend on a live Cisco device reachable over SSH to fetch real configuration

Answer

Use time.sleep to wait for the file read to complete before asserting results

Question 11

A developer is building a Python function that must parse a JSON payload returned by a Cisco DNA Center API. The function needs to gracefully handle cases where the JSON is malformed or the response body is empty, without crashing the calling script. Which approach best meets this requirement?

Accepted Answer

Wrap json.loads() in a try/except json.JSONDecodeError block and return a default value or raise a custom exception when parsing fails.. The function must isolate JSON parsing failures so the caller is not disrupted by malformed or empty responses. Catching json.JSONDecodeError around json.loads() and returning a default or raising a custom exception centralizes error handling and provides a predictable interface. The other choices either propagate exceptions, introduce security risks with eval(), or defer parsing without handling errors.

Answer

Use eval() to interpret the response body, since eval() can parse both JSON and Python literals.

Answer

Check if the response body is empty and, if not, pass it directly to the rest of the application as a string.

Answer

Call json.loads() on the response body and let any exception propagate to the caller.

Question 12

A network automation team is evaluating tools to manage the configuration of Cisco IOS XE devices. They need a solution that uses a declarative, agentless approach and can be extended with custom modules. Which two characteristics describe Ansible in this context? (Choose two.)

Accepted Answer

It uses a declarative playbook written in YAML to define the desired state of the network.. Ansible is an agentless automation tool that connects to managed nodes over SSH or other protocols, and it uses declarative YAML playbooks to define desired state. These two characteristics distinguish it from agent-based tools like Puppet or Chef, which require agents and use their own domain-specific languages. The team's need for agentless and declarative automation is met by these features.

Answer

It maintains a local database of device configurations and enforces them periodically.

Answer

It uses Ruby-based manifests to define infrastructure as code.

Answer

It requires a central server called a master and agents installed on each managed device.

Question 13

A developer runs the command `git clone https://github.com/example/netconfig.git` on a workstation, then edits a file named `vlans.yml`. Before editing, the developer wants to confirm which remote repository the local clone is tracking for push and fetch operations. Which command should be run?

Accepted Answer

git remote -v. The git remote -v command enumerates each configured remote and prints its fetch and push URLs, which directly confirms which repository the local clone is linked to. Other commands inspect working tree state, commit history, or local diffs, none of which expose remote configuration. Verifying remotes before pushing avoids accidentally sending commits to an unintended upstream repository.

Answer

git diff HEAD

Answer

git log --oneline

Answer

git status

Question 14

A network automation engineer is using `ncclient` to configure a Cisco IOS XE device via NETCONF. The engineer wants to retrieve the running configuration using the `` operation with a source of ``. Which XML element must be included in the RPC to specify the data store?

Accepted Answer

``. The NETCONF `` operation requires a `` element to identify the configuration datastore to retrieve. The `` element within `` selects the running configuration. Other elements like `` are used for editing, `` for edit payloads, and `` for narrowing results. The engineer must use `` to correctly specify the datastore for retrieval.

Answer

`<target><running/></target>`

Answer

`<config><running/></config>`

Answer

`<filter><running/></filter>`

Question 15

A developer is using the Cisco DNA Center Intent API to retrieve a list of network devices. The API requires a token obtained from the authentication endpoint. The developer's script successfully authenticates and receives a token, but subsequent GET requests to /dna/intent/api/v1/network-device return a 401 Unauthorized error. What is the most likely cause?

Accepted Answer

The token is not being sent in the X-Auth-Token header.. After authenticating to Cisco DNA Center, the returned token must be included in the X-Auth-Token header on all subsequent API requests. A missing or incorrectly named header causes a 401 Unauthorized response. The other options are less likely: token expiration would not occur immediately, the endpoint accepts GET, and Basic authentication is not used once a token is obtained.

Answer

The developer must include a Basic authentication header with username and password.

Answer

The API endpoint requires a POST request instead of GET.

Answer

The token has expired and must be refreshed.

Question 16

A network automation engineer is writing a Python script that calls the Cisco DNA Center API to retrieve device health scores. The API enforces rate limiting and returns HTTP 429 with a 'Retry-After' header when the limit is exceeded. The script must handle this gracefully without crashing. Which code pattern correctly implements the retry logic?

Accepted Answer

Check the response status code; if it is 429, read the 'Retry-After' header, sleep for the specified number of seconds, then retry the request.. When an API returns HTTP 429 Too Many Requests, it often includes a 'Retry-After' header specifying how long the client should wait before retrying. The script must check for this status code, extract the header, pause for the indicated duration, and then retry the request. This ensures compliance with rate limits and maintains the script's reliability without causing further throttling.

Answer

Ignore the 429 response and continue with the next API call, assuming the data will be fetched eventually.

Answer

Use a try-except block to catch requests.exceptions.HTTPError, then immediately retry the request in a loop until it succeeds.

Answer

Increase the request timeout value to 60 seconds and resend the request, hoping the rate limit resets.

Question 17

A network automation engineer must ensure that a Python script running on a management workstation can resolve internal service names such as `inventory.corp.local` and `billing.corp.local`. The workstation currently resolves public names correctly but fails on the internal ones. The engineer inspects `/etc/resolv.conf` and sees a single `nameserver 8.8.8.8` entry. Which change most directly resolves the problem?

Accepted Answer

Add a `search corp.local` line and point the nameserver at the internal DNS server.. The workstation is pointing at a public recursive resolver that has no authority over the private corp.local zone, so internal names return no answer. Pointing the client at the corporate DNS server that hosts the zone, plus adding the search domain for short-name expansion, restores resolution for all internal services rather than a hand-picked few.

Answer

Increase the DNS timeout value so the public resolver has more time to answer.

Answer

Enable DNSSEC validation on the workstation's resolver library.

Answer

Add static entries for both service names to the local hosts file.

Question 18

A developer is building a Python application that must discover the IP address of a service registered in DNS. The application needs to resolve a domain name to an IPv4 address. Which DNS record type should the application query?

Accepted Answer

A. To resolve a domain name to an IPv4 address, the correct DNS record type is A. AAAA records are for IPv6, CNAME records provide aliases, and PTR records are for reverse lookups. The application needs forward resolution to an IPv4 address, which is exactly what an A record provides.

Answer

AAAA

Answer

CNAME

Answer

PTR

Question 19

A developer is designing a Python application that consumes several Cisco REST APIs. To make the code maintainable and secure, the developer wants to implement reusable API request handling. Which two practices should be applied? (Choose two.)

Accepted Answer

Store API credentials in environment variables or a secrets manager rather than hard-coding them in source files.. Secure and maintainable API clients externalize secrets and centralize shared request logic. Storing credentials in environment variables or a secrets manager prevents accidental exposure, while a reusable client module ensures consistent authentication, headers, and error handling. Hard-coding keys, disabling TLS verification, or duplicating logic all undermine security or maintainability and should be avoided.

Answer

Disable TLS certificate verification to avoid errors when calling multiple APIs.

Answer

Write a separate copy of the authentication and request logic for each API endpoint to keep functions independent.

Answer

Hard-code the API key in each script so every team member can run it without configuration.

Question 20

A network automation engineer is using Cisco NX-OS with NX-API enabled. The engineer wants to send a JSON-RPC request to the device to retrieve the running configuration. Which URL format and HTTP method should be used to send the request to the NX-API endpoint?

Accepted Answer

POST to https://<device-ip>/ins with a JSON body containing the RPC parameters.. NX-API provides a JSON-RPC interface at the /ins endpoint over HTTPS. To run show commands and retrieve the running configuration, the client sends an HTTP POST with a JSON body specifying the command and parameters. Other endpoints such as RESTCONF or form-encoded requests are not part of the NX-API JSON-RPC mechanism.

Answer

POST to https://<device-ip>/ins with form-encoded parameters and a Content-Type of application/x-www-form-urlencoded.

Answer

GET to https://<device-ip>/api/v1/config with query parameters for the command.

Answer

PUT to https://<device-ip>/restconf/data/Cisco-NX-OS-device:config