200-901 Practice Exam 62 — 20 Questions

Question 1

Refer to the exhibit. A Python script parses this JSON response to check if NetFlow is enabled on the network. Which code snippet correctly checks the NetFlow status?

Accepted Answer

if response['netflow'].get('enabled', False):. It uses the `.get()` method with a default value of `False` to safely access the `enabled` key within the `netflow` dictionary. This handles cases where the key might be missing or the value is `False`, avoiding a `KeyError` and correctly evaluating the boolean condition. In JSON, the `enabled` field is typically a boolean, so checking truthiness directly is the proper approach.

Answer

if response['netflow']['enabled'] == 'true':

Answer

if response.netflow.enabled:

Answer

if response['netflow']['enabled']:

Question 2

A network administrator is troubleshooting a connectivity issue. A PC with IP address 192.168.1.10/24 cannot ping a server at 192.168.1.20/24. Both are on the same VLAN and connected to the same switch. What is the most likely cause of the issue?

Accepted Answer

The server has a firewall blocking ICMP echo requests.. Since both devices are on the same subnet (192.168.1.0/24) and same VLAN, Layer 2 connectivity should work without a default gateway. The PC can ARP for the server's IP and send frames directly. If the server has a firewall blocking ICMP echo requests (ping), the PC's ARP request succeeds, but the server drops the ICMP packets, causing a ping failure while other services might still work.

Answer

The ARP cache on the PC needs to be cleared.

Answer

The subnet mask on the PC is incorrect.

Answer

The switch port is in the wrong VLAN.

Answer

The default gateway is misconfigured on the PC.

Question 3

A developer wants to send a message to a Webex room using the API. Which HTTP method and endpoint should they use?

Accepted Answer

POST /v1/messages. To send a message, use POST to /v1/messages with roomId or toPersonEmail.

Answer

POST /v1/rooms

Answer

PUT /v1/messages

Answer

GET /v1/messages

Question 4

Refer to the exhibit. A developer is trying to access the REST API on a Cisco IOS XE device but receives a 401 Unauthorized error. What is the most likely cause?

Accepted Answer

Authentication requires local credentials, but none were provided. A 401 Unauthorized error specifically indicates that authentication is required but was either missing or invalid. For Cisco IOS XE REST API access, the device requires local credentials (username and password) to be provided in the request, typically via HTTP Basic Authentication. Without these credentials, the server rejects the request with a 401 status.

Answer

The device does not support REST API

Answer

HTTPS is not configured

Answer

HTTP server is not enabled

Question 5

Based on the routing table, what type of OSPF route is the default route (0.0.0.0/0)?

Accepted Answer

OSPF external type 2 route. The default route (0.0.0.0/0) in OSPF is typically redistributed from another routing protocol or statically configured and then advertised into OSPF. When a default route is injected via the 'default-information originate' command, it is advertised as an OSPF external type 2 (E2) route by default, meaning the metric does not change as it traverses OSPF areas. This matches option D.

Answer

OSPF inter-area route

Answer

OSPF NSSA external type 1 route

Answer

OSPF intra-area route

Question 6

Refer to the exhibit. Both switches are configured with EtherChannel. Which statement is true about VLAN traffic across the trunk?

Accepted Answer

VLAN 100 traffic is allowed across the trunk.. The exhibit shows that VLAN 100 is configured on both switches and is included in the allowed VLAN list on the trunk. EtherChannel does not affect VLAN filtering; the trunk's allowed VLAN list determines which VLANs can traverse the link. Since VLAN 100 is explicitly permitted, its traffic is allowed across the trunk.

Answer

VLAN 150 traffic is allowed across the trunk.

Answer

VLAN 50 traffic is blocked across the trunk.

Answer

VLAN 200 traffic is allowed across the trunk.

Question 7

A developer wants to use Cisco Modeling Labs (CML) API to control a lab session. Which base URL structure is correct for the CML REST API?

Accepted Answer

https://cml-server/api/v0. The correct base URL for the Cisco Modeling Labs (CML) REST API is `https://cml-server/api/v0`. This is the documented and stable endpoint for interacting with CML lab sessions, including starting, stopping, and managing topologies. The `/api/v0` path is specific to CML and reflects its API versioning scheme, which differs from other Cisco platforms like DNA Center or Meraki.

Answer

https://cml-server/labapi/v1

Answer

https://cml-server/api/v2

Answer

https://cml-server/rest/v1

Question 8

Refer to the exhibit. A Python script uses the Cisco IOS-XE RESTCONF API to retrieve the device configuration. The returned JSON is shown. What must be done to enable the GigabitEthernet0/1 interface using the API?

Accepted Answer

Send a PATCH request to the interface resource with the JSON payload {"enabled": true}.. RESTCONF uses PATCH for partial updates. To enable an interface, you only need to send the specific field that changes ({"enabled": true}) to the interface resource URI, which modifies the configuration without replacing the entire resource.

Answer

Send a DELETE request to the interface resource.

Answer

Send a GET request to the interface resource and parse the response.

Answer

Send a PUT request to the interface resource with the entire JSON payload.

Question 9

A docker-compose.yml defines a web service with environment variables. Which key in the service definition should be used to set environment variables?

Accepted Answer

environment. The `environment` key in a Docker Compose service definition is the standard way to set environment variables directly within the YAML file. This key accepts a list of key-value pairs (e.g., `- KEY=VALUE`) or a mapping, and the variables are injected into the container at runtime, overriding any default values in the Docker image.

Answer

args

Answer

volumes

Answer

env_file

Question 10

During a security audit of a microservices application deployed on Cisco Container Platform, the auditor discovers that some containers are running with privileged access. The development team argues that certain containers need to modify kernel parameters. Which security best practice should be recommended to minimize risk while allowing necessary kernel adjustments?

Accepted Answer

Set the container security context to add only the necessary Linux capabilities, e.g., CAP_SYS_ADMIN. It follows the principle of least privilege by granting only the specific Linux capability (CAP_SYS_ADMIN) needed to modify kernel parameters, rather than full privileged access. In Kubernetes (used by Cisco Container Platform), a security context with `capabilities.add: ['SYS_ADMIN']` allows the container to perform privileged operations like sysctl modifications without exposing the host or other containers to the broader risks of privileged mode.

Answer

Set the container to privileged: false and add the SYS_ADMIN capability only for containers that need it

Answer

Run the container as root user but remove the CAP_SYS_ADMIN capability

Answer

Drop all Linux capabilities and run the container as a non-root user

Question 11

During a CI/CD pipeline, a security scan reveals that a Docker image contains a vulnerability in a base layer. Which action BEST addresses the issue?

Accepted Answer

Rebuild the image using an updated base image from a trusted registry.. The vulnerability exists in the base layer of the Docker image, which is immutable once built. The only way to eliminate the vulnerability is to rebuild the image using an updated base image from a trusted registry (e.g., Docker Hub official images or a private registry with patched images). This ensures the vulnerable packages are replaced with patched versions at the OS or application level, directly addressing the root cause.

Answer

Disable the security scanner to avoid false positives.

Answer

Implement run-time security monitoring to detect exploitation.

Answer

Add an exception to the vulnerability report.

Question 12

Which TWO of the following are characteristics of Model-Driven Programmability with YANG models?

Accepted Answer

YANG models define a hierarchical data tree.. YANG models define a hierarchical data tree structure that organizes configuration and state data in a parent-child relationship, mirroring the structure of the device's operational and configuration data. This hierarchical representation allows for precise, path-based access to individual data nodes, which is fundamental to model-driven programmability.

Answer

YANG models are only used with the Python library ncclient.

Answer

The controller directly pushes configurations to network devices without validation.

Answer

NETCONF requires JSON encoding for configuration data.

Question 13

A NETCONF manager sends a get-config request to a Cisco device and receives the above reply. The automation script expected the interface to be enabled. Which of the following is the best course of action to remediate the issue?

Accepted Answer

Send an edit-config request with true for the interface. NETCONF uses the edit-config operation to modify device configuration programmatically. Since the automation script detected that the interface is disabled (enabled state is false), sending an edit-config request with true for that interface directly remediates the issue by setting the operational state to enabled, aligning with the expected state without manual intervention.

Answer

Send an rpc to reboot the device

Answer

Use CLI to enable the interface manually

Answer

Send a get request again

Question 14

A DevOps engineer is configuring a CI/CD pipeline that uses Cisco DNA Center API to deploy network configurations. Which two best practices should be followed? (Choose two.)

Accepted Answer

Store API credentials in environment variables. Storing API credentials in environment variables (Option C) is a security best practice because it prevents hardcoding secrets in source code, which could be exposed in version control. This approach aligns with the principle of least privilege and is recommended for CI/CD pipelines interacting with Cisco DNA Center API, as it allows credentials to be managed externally and rotated without code changes.

Answer

Use a single API call for all changes

Answer

Disable SSL verification for faster execution

Answer

Use hardcoded API keys in scripts

Question 15

A team is building a CI/CD pipeline for network automation. They want to use Cisco Modeling Labs (CML) to validate configuration changes before production. What is the best approach to integrate CML into the pipeline?

Accepted Answer

Use CML's REST API to start a simulation, apply changes, run tests, then tear down. D is correct because CML provides a REST API that allows programmatic lifecycle management of simulations. Integrating this API into a CI/CD pipeline enables the pipeline to dynamically create an isolated test environment, apply configuration changes, run validation tests, and then tear down the simulation to free resources. This approach ensures repeatability, isolation, and efficient resource usage, which are critical for automated network validation.

Answer

Use the pyATS framework to connect to CML and run tests

Answer

Create a permanent topology in CML for each branch

Answer

Use Ansible to provision CML nodes directly

Question 16

A developer is integrating a Webex Teams bot with an external system using the Webex API. The bot receives an HTTP POST callback from Webex every time a message is posted in a monitored space. The developer notices that sometimes the callback includes a 'data' object with 'actorId', but other times the 'actorId' is missing. The bot needs to log the identity of the person who posted the message. What should the developer do to reliably obtain the sender's identity?

Accepted Answer

Check the 'resource' field in the callback to determine if it is a 'messages' event; only messages events include actorId.. The Webex API callback payload includes the 'actorId' only for certain event types. Specifically, when the 'resource' field is 'messages' and the 'event' field is 'created', the 'actorId' is guaranteed to be present, representing the user who posted the message. Filtering by the 'resource' field ensures the bot processes only message creation events, reliably obtaining the sender's identity.

Answer

Request additional OAuth scopes to include the actorId in the callback payload.

Answer

Filter callbacks by the verb 'posted' to ensure the actorId is included.

Answer

Use the 'createdBy' field from the message details API as a fallback when 'actorId' is missing.

Question 17

Which THREE of the following are direct benefits of using version control in software development?

Accepted Answer

Traceability of changes. Version control systems (VCS) like Git track every commit with a unique SHA-1 hash, author, timestamp, and commit message. This creates a complete audit trail, allowing developers to trace exactly when, why, and by whom a specific change was introduced, which is critical for debugging and compliance.

Answer

Automated testing integration

Answer

Eliminates syntax errors

Question 18

A network engineer is analyzing traffic and needs to identify which applications use UDP. Which three applications commonly use UDP as their transport protocol? (Choose three.)

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) uses UDP as its transport protocol because it relies on connectionless, best-effort delivery for broadcasting IP configuration requests and offers. DHCP clients send discovery messages to UDP port 67 (server) and servers respond to UDP port 68 (client), avoiding the overhead of TCP's connection establishment, which is unnecessary for transient broadcast-based transactions.

Answer

SSH

Answer

SMTP

Question 19

A university campus network uses Cisco switches with 802.1X for wired authentication. Recently, users in a dormitory report intermittent connectivity: they can connect initially but are disconnected after a few minutes. The network team checks the switch logs and sees messages like 'Authentication failure for MAC address xxxx.xxxx.xxxx on port GigabitEthernet1/0/5' but the users claim they are using valid credentials. The same users can connect from other ports without issues. The port configuration for Gi1/0/5 is: switchport mode access, authentication port-control auto, dot1x pae authenticator, authentication periodic, authentication timer reauthenticate 3600. The team suspects a misconfiguration. What is the most likely cause of the intermittent disconnections?

Accepted Answer

The 'authentication periodic' command forces reauthentication every 3600 seconds, and the client fails to reauthenticate. The 'authentication periodic' command enables periodic reauthentication, and the 'authentication timer reauthenticate 3600' sets the interval to 3600 seconds (1 hour). However, the logs show authentication failures occurring much sooner than 3600 seconds, indicating that the client is failing reauthentication attempts triggered by other events (e.g., a new supplicant attempt or a reauthentication due to a port state change). The intermittent disconnections are caused by the client failing to reauthenticate when the switch initiates a new authentication exchange, likely due to a mismatch in EAP method or credential caching issues.

Answer

The port is a trunk port but configured as access, causing VLAN mismatch

Answer

The port is configured in multi-auth host mode, causing conflicts

Answer

The switch is using MAC authentication bypass (MAB) as a fallback, which fails for some devices

Question 20

A developer is writing a Python script that processes a large CSV file. The script uses 'with open(file, 'r') as f' to read the file. Why is this approach preferred over calling f = open(file) and then f.close()?

Accepted Answer

It automatically closes the file when the block exits, even if an exception is raised.. The 'with' statement in Python implements a context manager that automatically calls the file object's __exit__ method when the block exits, ensuring the file is closed even if an exception occurs. This prevents resource leaks and is the recommended pattern for file I/O in Python, as explicitly calling f.close() may be skipped if an exception is raised before the close call.

Answer

It allows the file to be opened in both read and write mode simultaneously.

Answer

It reduces memory usage by loading the file in chunks.

Answer

It increases the speed of file operations.