200-901 Practice Exam 61 — 20 Questions

Question 1

Refer to the exhibit. A router has the routing table shown. A packet arrives at GigabitEthernet0/0 with destination IP 8.8.8.8. What will the router do?

Accepted Answer

Forward the packet out GigabitEthernet0/0 via 10.0.0.1.. The routing table shows a default route (0.0.0.0/0) pointing to next-hop 10.0.0.1 via GigabitEthernet0/0. Since destination 8.8.8.8 does not match any more specific prefix, the router uses this default route and forwards the packet out GigabitEthernet0/0 to 10.0.0.1. Option E correctly describes this behavior.

Answer

Look up the destination in the ARP cache and then forward.

Answer

Send an ICMP unreachable message back to the source.

Answer

Forward the packet out GigabitEthernet0/1 to the default gateway.

Answer

Drop the packet because there is no route to 8.8.8.8.

Question 2

A company uses Cisco NSO to manage multiple network devices. They want to ensure that before deploying a configuration change, all devices are in sync with NSO's CDB. Which approach is the best practice?

Accepted Answer

Configure NSO to automatically sync devices when changes are detected. NSO's automatic sync capability (via the 'devices sync' or 'sync-from' action triggered by device changes) ensures that the Configuration Database (CDB) remains the authoritative source of truth without manual intervention. This best practice eliminates the risk of deploying a change to devices that are out of sync, which could cause configuration drift or operational failures. NSO's NETCONF-based synchronization allows it to detect and reconcile differences between CDB and device running configurations automatically.

Answer

Run 'devices sync-from' on all devices before each deployment

Answer

Schedule a periodic sync every hour

Answer

Use the 'check-sync' action and only deploy if all devices are in sync

Question 3

A developer is designing a REST API for managing network devices. Which three best practices should be followed for the API design? (Choose three.)

Accepted Answer

Use nouns for resource names (e.g., /devices) rather than verbs.. REST APIs should use nouns to represent resources (e.g., /devices) rather than verbs, which aligns with the uniform interface constraint of REST. Using verbs like /getDevices or /deleteDevice violates REST principles and mixes action semantics with resource identification, making the API less intuitive and harder to maintain.

Answer

Use POST for all state-changing operations to ensure idempotency.

Answer

Always send the entire resource representation in all responses to reduce client requests.

Question 4

A developer is writing a Python script that uses the Cisco Meraki API to retrieve a list of networks for an organization. The API returns a JSON array. The developer wants to filter networks where the 'tags' field contains 'production'. Which code snippet correctly filters the results?

Accepted Answer

filtered = [net for net in networks if 'production' in net['tags']]. The Meraki API returns the 'tags' field as a list of strings (e.g., ['production', 'critical']). The Python `in` operator directly checks membership in a list, so `'production' in net['tags']` efficiently filters networks where the exact string 'production' appears as an element in the list.

Answer

filtered = [net for net in networks if 'production' in str(net['tags'])]

Answer

filtered = [net for net in networks if 'production' in net['tags'].split(',')]

Answer

filtered = [net for net in networks if any('production' in t for t in net['tags'])]

Question 5

An organization uses Cisco Intersight to manage UCS servers. They want to automate the firmware upgrade process. Which Intersight API should be used to trigger a firmware upgrade on a server?

Accepted Answer

POST /api/v1/compute/Physical. The `/api/v1/compute/Physical` endpoint in Cisco Intersight is used to manage physical compute resources, including triggering firmware upgrades on UCS servers. By sending a POST request to this endpoint with the appropriate action payload (e.g., `"Action": "UpgradeFirmware"`), you can initiate a firmware upgrade on a specific server. This aligns with Intersight's RESTful API design for lifecycle management of UCS infrastructure.

Answer

POST /api/v1/ntp/Policies

Answer

POST /api/v1/equipment/Fex

Answer

POST /api/v1/fabric/EthNetworkPolicies

Question 6

A network engineer is developing a Python script to automate the collection of interface statistics from multiple Cisco Catalyst switches using NETCONF. The engineer uses the 'ncclient' library to connect to each switch. The script works for most switches, but for one switch, the connection consistently fails with an authentication error. The engineer has verified that the username and password are correct and that the switch has NETCONF enabled. The engineer suspects the issue might be related to SSH host key checking. The engineer wants to modify the script to bypass host key checking for this specific switch. Which approach should the engineer use?

Accepted Answer

Set the 'hostkey_verify' parameter to False in the connect method. The 'ncclient' library's connect method accepts a 'hostkey_verify' parameter. Setting it to False disables SSH host key checking, which bypasses the verification of the switch's host key against the known_hosts file. This resolves authentication errors caused by host key mismatches, such as when the switch's host key has changed or is not present in the known_hosts file.

Answer

Disable SSH key-based authentication by setting 'look_for_keys=False'

Answer

Use the 'allow_agent' parameter set to False

Answer

Set the 'known_hosts' parameter to an empty file in the connect method

Question 7

Refer to the exhibit. An application is deployed on a server at 192.168.1.10, listening on TCP port 8080. The ACL is applied inbound on the server's network interface. Which clients will be able to access the application?

Accepted Answer

No clients, because the deny statement blocks all TCP traffic to port 8080. The ACL is applied inbound on the server's network interface, meaning it filters traffic before it reaches the server. The second ACE explicitly denies all TCP traffic to port 8080, which is the port the application listens on. Since ACLs are processed sequentially and the deny statement matches the application's traffic, no TCP clients can access the application, regardless of their source IP.

Answer

Clients from any network, because the permit statement overrides the deny

Answer

Only clients from the 192.168.1.0/24 network

Answer

Only clients sending UDP traffic to port 53

Question 8

A company has a microservices application deployed on Kubernetes. There are three services: frontend, backend, and database. The frontend is exposed via an Ingress. The API gateway is used for authentication. Recently, after updating the backend service, users are experiencing 401 Unauthorized errors when accessing endpoints that previously worked. The authentication mechanism uses JWT tokens issued by an external identity provider. The JWT tokens are validated by the API gateway. The backend service itself does not validate tokens; it relies on the gateway to forward user identity via headers. The development team checked the logs and found that the backend is receiving requests with the correct JWT from the gateway but still returning 401. What is the most likely cause?

Accepted Answer

The backend service code now attempts to validate the JWT itself and fails.. The scenario states that the backend service relies on the gateway to forward user identity via headers and does not validate JWT tokens itself. If the new backend version now attempts to validate the JWT, it would likely fail because the backend lacks the necessary signing key or validation logic, causing 401 errors even though the gateway correctly forwards the token. This matches option D, as the change in backend behavior introduces a new validation step that was not present before.

Answer

The Ingress controller is stripping the Authorization header before forwarding to the backend.

Answer

The API gateway's JWT signing key has changed and the backend is using the old key.

Answer

The new backend version uses a different HTTP method for the affected endpoints.

Question 9

Refer to the exhibit. A security audit reveals that the authentication mechanism is vulnerable. Which attack is most likely possible?

Accepted Answer

Token forgery if the secret key is weak.. The exhibit shows a JSON Web Token (JWT) being used for authentication. If the secret key used to sign the JWT is weak or easily guessable, an attacker can forge a valid token by brute-forcing the secret and then crafting a token with arbitrary claims (e.g., elevated privileges). This is a classic token forgery attack, not a cross-site scripting or injection attack, because the vulnerability lies in the signing mechanism, not in input handling or transport security.

Answer

Cross-site scripting (XSS) via the token.

Answer

Man-in-the-middle attack due to missing HTTPS.

Answer

SQL injection through the login endpoint.

Question 10

Which THREE of the following are characteristics of HTTP/2 compared to HTTP/1.1?

Accepted Answer

Header compression using HPACK. HPACK compression reduces header overhead by encoding header fields, which is a key improvement over HTTP/1.1's uncompressed headers. This minimizes latency and bandwidth usage, especially for repeated headers like cookies and user-agent.

Answer

Plaintext headers for debugging

Answer

Requires multiple TCP connections for parallel requests

Question 11

A developer is working with Meraki API to list all clients on a network. The response is paginated. Which parameter allows the developer to specify the starting point for the next page?

Accepted Answer

startingAfter. Meraki uses startingAfter and endingBefore parameters for cursor-based pagination.

Answer

nextToken

Answer

page

Answer

offset

Question 12

Refer to the exhibit. A developer receives this response when attempting to send a PATCH request to modify a YANG data node via RESTCONF. What is the most likely cause?

Accepted Answer

The JSON payload is malformed. A PATCH request to modify a YANG data node via RESTCONF returns a 400 Bad Request status when the JSON payload is malformed. RESTCONF (RFC 8040) requires the request body to conform to the YANG module's data model; if the JSON syntax is invalid or the data does not match the schema (e.g., missing required fields, incorrect data types), the server rejects the request with a 400 error. The 400 status code specifically indicates a client-side error in the request payload, not an authentication or resource existence issue.

Answer

The resource does not exist

Answer

The authentication token is expired

Answer

The YANG model is not supported

Question 13

What is the default rate limit for the Meraki Dashboard API?

Accepted Answer

5 calls per second. Meraki Dashboard API enforces a rate limit of 5 calls per second.

Answer

20 calls per second

Answer

1 call per second

Answer

10 calls per second

Question 14

A developer wants to use Cisco Webex Teams API to send a message to a specific room. Which of the following request JSON body fields is required?

Accepted Answer

"roomId". The Cisco Webex Teams API requires the 'roomId' field in the request body to identify the specific room where the message will be sent. Without this field, the API cannot determine the destination, and the request will fail with a 400 Bad Request error. The 'roomId' is a mandatory parameter for sending messages to a room, as documented in the Webex API reference.

Answer

"toPersonId"

Answer

"toPersonEmail"

Answer

"text"

Question 15

Which THREE statements about RESTful APIs are true?

Accepted Answer

They use HTTP methods to perform CRUD operations.. RESTful APIs use standard HTTP methods (GET, POST, PUT, PATCH, DELETE) to map directly to CRUD (Create, Read, Update, Delete) operations. For example, POST creates a resource, GET retrieves it, PUT/PATCH updates it, and DELETE removes it, aligning with the REST architectural constraint of uniform interface.

Answer

They require WebSockets for communication.

Answer

They use SOAP as the message format.

Question 16

A DevOps engineer is designing a REST API for a custom network automation tool. Which principle is essential for a RESTful design?

Accepted Answer

Use HTTP methods to perform CRUD operations on resources.. RESTful APIs are designed around resources, and HTTP methods (GET, POST, PUT, DELETE, PATCH) directly map to CRUD operations (Create, Read, Update, Delete). This stateless, resource-oriented approach is a core principle of REST as defined by Roy Fielding's dissertation, enabling uniform interfaces and predictable interactions.

Answer

Maintain session state on the server between requests.

Answer

Use a single URI for all operations with different method names.

Answer

Return XML responses by default for compatibility.

Question 17

A developer is using the Meraki Dashboard API and needs to handle paginated responses. Which TWO ways does Meraki indicate pagination? (Choose two.)

Accepted Answer

Link header with rel="next". Meraki uses Link header for pagination (rel="next") and also supports query parameters like perPage and startingAfter (cursor-based). Offset is not used by Meraki.

Answer

Offset and limit query parameters

Answer

Multiple pages returned in a single response

Answer

Total count in response body

Question 18

A network engineer wants to programmatically enable an interface using the YANG model shown. Which XPath expression correctly targets the 'shutdown' leaf for GigabitEthernet0/1?

Accepted Answer

/interfaces/GigabitEthernet[name='0/1']/shutdown. It uses the correct XPath syntax to target the 'shutdown' leaf under a specific GigabitEthernet interface instance. The path starts from the root, navigates to the 'interfaces' container, selects the 'GigabitEthernet' list entry where the 'name' key equals '0/1', and then accesses the 'shutdown' leaf. This matches the YANG model structure where list entries are filtered using a predicate with the key leaf.

Answer

//shut

Answer

/Cisco-IOS-XE-interface:interfaces/GigabitEthernet[0/1]/shutdown

Answer

/native/interface/GigabitEthernet0/1/shutdown

Question 19

In a Python script using the 'requests' library to interact with Cisco DNA Center API, which function call is used to send a POST request with JSON data?

Accepted Answer

requests.post(url, json=data). The `requests.post()` function is specifically designed to send HTTP POST requests, and passing the `json=data` parameter automatically serializes the Python dictionary to JSON and sets the `Content-Type` header to `application/json`. This is the standard way to create a resource via Cisco DNA Center's REST API endpoints that expect JSON payloads.

Answer

requests.patch(url, json=data)

Answer

requests.get(url, json=data)

Answer

requests.put(url, json=data)

Question 20

A developer needs to retrieve the hostname of a Cisco IOS XE device using RESTCONF. Which URI path is correct?

Accepted Answer

/restconf/data/Cisco-IOS-XE-native:native/hostname. RESTCONF uses the YANG module namespace. The native hostname is at /restconf/data/Cisco-IOS-XE-native:native/hostname.

Answer

/restconf/data/Cisco-IOS-XE-native:hostname

Answer

/api/v1/device/hostname

Answer

/restconf/data/hostname