200-901 Practice Exam 63 — 20 Questions

Question 1

A developer needs to retrieve the list of all networks in a specific Cisco Meraki organization. The developer has the organization ID and a valid API key. Which HTTP method and endpoint should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GET /api/v1/organizations/{organizationId}/networks. To list networks in a Meraki organization, the developer must use GET /api/v1/organizations/{organizationId}/networks. The organization ID is required in the path, and the API key authenticates the request. The response contains an array of network objects. Other methods like POST are for creating networks, and incorrect paths will fail.

Answer

GET /api/v1/organizations/{organizationId}/network

Answer

GET /api/v1/networks

Answer

POST /api/v1/organizations/{organizationId}/networks

Question 2

A developer is designing a Python application that interacts with multiple Cisco REST APIs. They need to implement robust error handling for common HTTP status codes. Which TWO of the following status codes indicate that the client should retry the request after a delay? (Choose two.)

Accepted Answer

503 Service Unavailable. Status codes 429 and 503 indicate temporary conditions where retrying after a delay can succeed. 429 is rate limiting, and 503 is service unavailability. Both often include Retry-After headers. The other codes (401, 404, 400) represent client errors that require corrective action, not retries, because they will persist until the request or credentials are fixed.

Answer

400 Bad Request

Answer

404 Not Found

Answer

401 Unauthorized

Question 3

A security engineer is configuring a CI/CD pipeline that builds container images. The pipeline must fail the build if the image contains a package with a known critical vulnerability. The scanner runs as a separate step after the image is built. Which approach correctly integrates vulnerability scanning into the pipeline?

Accepted Answer

Configure the scanner step to exit with a non-zero status when a critical vulnerability is detected, so the pipeline stage fails.. To enforce a security gate, the scanner must cause the pipeline to fail when it finds a critical vulnerability. A non-zero exit code from the scanner step is the standard mechanism CI/CD systems use to stop the pipeline. Notification-only or source-only approaches do not block deployment of the vulnerable image, so they do not satisfy the requirement.

Answer

Run the scanner with a flag that only prints findings to the log, then rely on the developer to review the log before merging.

Answer

Add the scanner as a post-build notification that sends an email to the security team, then allow the pipeline to continue to deployment.

Answer

Run the scanner before the image is built, scanning only the source code repository for vulnerable dependencies.

Question 4

A developer is writing a Python application that interacts with a REST API. The API requires authentication using an API key. The developer wants to avoid hardcoding the API key in the source code. Which approach should be used to securely provide the API key to the application?

Accepted Answer

Use environment variables to pass the API key at runtime.. Using environment variables keeps the API key out of source code and version control, allowing it to be injected securely at runtime. This practice supports separation of configuration from code and is recommended for secrets management. Hardcoding, committing to Git, or using public storage all risk exposing the key.

Answer

Embed the API key directly in the source code as a constant.

Answer

Store the API key in a configuration file that is committed to the Git repository.

Answer

Store the API key in a public cloud storage bucket and retrieve it at runtime.

Question 5

A developer is troubleshooting a REST API integration that intermittently returns HTTP 429 responses. Which TWO practices help the client handle rate limiting correctly? (Choose two.)

Accepted Answer

Implement exponential backoff with jitter so successive retries are spaced further apart and randomized.. Handling 429 responses well means cooperating with the server's throttling signals. Reading Retry-After gives an explicit wait time, while exponential backoff with jitter provides a robust fallback when no such header exists. Tight retry loops, transport downgrades, and abandoning the integration all fail because they either worsen the throttling or give up on recoverable conditions.

Answer

Treat the 429 as a permanent failure and stop all further API calls from the application.

Answer

Switch the request from HTTPS to HTTP to bypass the rate limiter.

Answer

Immediately resend the failed request in a tight loop until a non-429 response is received.

Question 6

A network engineer is using Ansible to automate configuration changes on a group of Cisco IOS XE devices. The engineer wants to ensure that the playbook only makes changes if the device configuration differs from the desired state, and that the playbook reports whether any changes were made. Which Ansible feature should the engineer rely on?

Accepted Answer

Idempotent modules that report changed status. Ansible network modules like ios_config are idempotent and report a changed status. They compare the desired configuration with the running configuration and only apply differences, then indicate whether any change occurred. This satisfies both the need to avoid unnecessary changes and to know when changes were made. Handlers, tags, and conditionals serve different purposes and do not provide this behavior on their own.

Answer

Conditionals using the when clause

Answer

Tags that limit which tasks run

Answer

Handlers that run only when notified

Question 7

A developer is building an application that needs to retrieve information from a REST API that uses cursor-based pagination. The response includes a 'next_cursor' field when more results are available. How should the developer structure the requests to retrieve all pages of data?

Accepted Answer

Send the first request without any pagination parameters, then use the 'next_cursor' value as a query parameter in subsequent requests until it is absent.. Cursor-based pagination requires using the cursor provided by the API to fetch the next set of results. The developer should start with a request without pagination parameters, then iteratively use the 'next_cursor' value as a parameter in subsequent requests until the cursor is no longer returned, ensuring all data is retrieved in order.

Answer

Send multiple requests in parallel, each with a different page number, until all pages are retrieved.

Answer

Increment an 'offset' parameter by a fixed page size until no more results are returned.

Answer

Use the 'Link' header from the response to find the URL for the next page and follow it.

Question 8

A developer is writing a Python unit test for a function that parses interface status from a network device. The function raises a custom exception called InterfaceDownError when an interface is administratively down. Which unittest assertion correctly verifies that calling parse_interface('down') raises InterfaceDownError?

Accepted Answer

self.assertRaises(InterfaceDownError, parse_interface, 'down'). The unittest framework provides assertRaises specifically for verifying that a callable raises a particular exception when invoked with given arguments. It calls parse_interface('down') and succeeds only if InterfaceDownError is raised. The other assertions either compare values, invoke the function outside an exception context, or check types incorrectly, so they do not validate the exception behavior.

Answer

self.assertTrue(parse_interface('down') == InterfaceDownError)

Answer

self.assertEqual(parse_interface, 'down')

Answer

self.assertIsInstance(parse_interface, InterfaceDownError)

Question 9

A developer is reviewing a CI/CD pipeline that builds a Python application and pushes a Docker image to a registry. The pipeline currently runs as a single stage that installs dependencies, runs tests, and pushes the image. The team wants to ensure that the image is not pushed if any test fails. Which change should be made to the pipeline?

Accepted Answer

Split the pipeline into separate build, test, and push stages, and configure the push stage to run only if the test stage succeeds.. A quality gate is enforced by ordering pipeline stages and making the push conditional on test success. Splitting the pipeline into build, test, and push stages with a dependency between test and push ensures that a failed test stops the pipeline before the image is published. Retries, early pushes, or registry-side checks do not provide the same guarantee.

Answer

Add a retry loop around the test command so transient failures do not stop the pipeline.

Answer

Move the image push to the beginning of the pipeline so the registry is updated as early as possible.

Answer

Configure the registry to reject images that do not include a passing test report as a label.

Question 10

A developer is building a microservice that must call an internal API. The API uses mutual TLS (mTLS), and the service must validate the server certificate against a private CA. Which configuration should the client use to verify the server identity?

Accepted Answer

Load the private CA certificate into the client's trust store and set the server name for hostname verification.. Verifying a server certificate against a private CA requires the client to trust that CA and to check the server name against the certificate's identity. Presenting a client certificate alone only authenticates the client, and disabling validation or pinning the leaf certificate does not provide the required chain validation. Trusting the private CA and enforcing hostname verification satisfies the requirement.

Answer

Present the client certificate and private key, and skip server certificate validation because mTLS is mutual.

Answer

Disable certificate verification and rely on the private network boundary for trust.

Answer

Pin the server's leaf certificate by comparing its fingerprint on every connection.

Question 11

A network engineer is troubleshooting a connectivity issue between two hosts on different subnets. The engineer suspects a problem with the default gateway configuration. Which two statements about default gateways are correct? (Choose two.)

Accepted Answer

The default gateway is used to forward packets destined for remote networks.. The default gateway must be on the same subnet as the host so that the host can reach it via ARP. It is used to forward packets destined for remote networks. Layer 3 switches can act as gateways, and multiple gateways require redundancy protocols for automatic failover. The gateway is not limited to DNS traffic.

Answer

The default gateway is only used for DNS resolution.

Answer

A host can have multiple default gateways configured for redundancy without any additional protocols.

Answer

The default gateway must be a router; a Layer 3 switch cannot serve as a default gateway.

Question 12

An automation engineer needs to retrieve the current running configuration from a Cisco IOS XE device using RESTCONF over HTTPS. The device supports the ietf-netconf-monitoring YANG module. Which HTTP method and URI should be used to fetch the configuration data represented by a specific YANG model?

Accepted Answer

GET https:///restconf/data/:. RESTCONF exposes YANG-modeled data under the /restconf/data URI, and the colon-delimited path identifies the module and node. A GET is the safe, idempotent method for reading that resource. POST and PUT are write-oriented, and /restconf/operations is reserved for RPC invocation, so none of them retrieves configuration data. The engineer should issue a GET against the data path.

Answer

POST https:///restconf/data/:

Answer

GET https:///restconf/operations/:

Answer

PUT https:///restconf/data/:

Question 13

A developer is using the Cisco DNA Center API to retrieve device details. The API requires authentication using a token obtained from the /dna/system/api/v1/auth/token endpoint. The token has an expiration time. Which HTTP status code indicates that the token has expired and a new one must be obtained?

Accepted Answer

401 Unauthorized. An expired or invalid token results in a 401 Unauthorized response. This tells the client that authentication credentials are missing or invalid, prompting the client to obtain a new token. 403 indicates insufficient permissions, 404 means resource not found, and 500 is a server error. Only 401 specifically addresses authentication failure.

Answer

500 Internal Server Error

Answer

404 Not Found

Answer

403 Forbidden

Question 14

A network engineer is writing a Python script that uses the requests library to call a REST API. The API requires an API key to be passed in the header. Which HTTP header field is commonly used to transmit an API key for authentication?

Accepted Answer

Authorization. Authentication credentials, including API keys, are transmitted using the Authorization header. This header is designed to carry credentials such as Bearer tokens or Basic authentication strings. Other headers like Content-Type, Accept, and User-Agent serve different purposes related to content negotiation and client identification, so they are not appropriate for authentication.

Answer

Content-Type

Answer

User-Agent

Answer

Accept

Question 15

A developer is building a Python client that calls a REST API returning JSON. The client must detect authentication failures, rate limiting, and server errors so it can retry or alert appropriately. Which coding practice should be applied?

Accepted Answer

Inspect the response status code and branch on categories such as 401/403 for authentication, 429 for rate limiting, and 5xx for server errors before processing the body.. HTTP status codes carry the outcome of each request, so a robust client branches on them: refresh credentials on 401, respect Retry-After and back off on 429, and alert on 5xx. Parsing the body is meaningful only after the status indicates success. This ordering lets the client retry the conditions that are transient and escalate the ones that are not.

Answer

Call response.json() immediately after every request and catch only json.JSONDecodeError, since valid JSON indicates success.

Answer

Set a long socket timeout and retry indefinitely on any exception until the request succeeds.

Answer

Wrap every request in a bare try/except that logs the exception and returns an empty list so the caller never fails.

Question 16

An engineer is comparing TCP and UDP for a new telemetry service that sends small, frequent datagrams from thousands of IoT sensors to a collector. The design prioritizes low overhead and does not require retransmission of lost readings. Which two characteristics apply to UDP in this scenario? (Choose two.)

Accepted Answer

It provides no delivery guarantee, so lost datagrams are simply not retransmitted.. UDP's value in high-volume telemetry is its minimal overhead and connectionless, best-effort model. The small fixed header reduces cost per datagram, and the absence of acknowledgments and retransmissions means lost readings are simply dropped, which the design accepts. Ordering, reliability, and congestion control are all absent and would have to be added at the application layer if required.

Answer

It guarantees in-order delivery of datagrams to the application.

Answer

It performs a three-way handshake before data transmission to establish state.

Answer

It automatically adjusts its congestion window in response to network loss.

Question 17

A developer is designing unit tests for a Python function that calls a Cisco Meraki Dashboard API endpoint to retrieve organization inventory. The tests must run quickly in CI without making real network calls, and must verify that the function builds the correct request. Which TWO practices should the developer implement? (Choose two.)

Accepted Answer

Assert on the recorded request's URL, HTTP method, and the presence of the API key header.. Unit tests for API-calling code should isolate the function from the network and assert on the request it constructs. Mocking the HTTP client provides deterministic responses, while checking the method, URL, and authentication header verifies the contract with the Meraki Dashboard API. Together these keep the suite fast, repeatable, and meaningful in CI.

Answer

Insert a fixed sleep of thirty seconds before each assertion to let the API respond.

Answer

Disable all assertions and rely on the test passing if no exception is raised during the call.

Answer

Point the function at the live Meraki Dashboard API and compare the response to a previously saved response body.

Question 18

A developer is writing a Python script that calls the Cisco Webex Rooms API to create a new team room. The script must send JSON data in the request body and receive JSON responses. Which HTTP header should be set to ensure the API interprets the request body as JSON and returns JSON?

Accepted Answer

Content-Type: application/json. To send JSON data in a request body, the client must set the Content-Type header to application/json. This tells the server that the payload is JSON, enabling correct parsing. The Accept header is for response format, Authorization is for authentication, and Content-Length is for size. Only Content-Type directly addresses the request body format.

Answer

Content-Length: <length>

Answer

Accept: application/json

Answer

Authorization: Bearer <token>

Question 19

A developer is reviewing a Python script that makes a REST API call using the requests library. The script must set a custom HTTP header 'X-Auth-Token' with a value from an environment variable. Which code snippet correctly adds this header to the request?

Accepted Answer

requests.get(url, headers={'X-Auth-Token': os.environ['TOKEN']}). The requests library accepts a headers parameter as a dictionary to set custom HTTP headers. Passing {'X-Auth-Token': os.environ['TOKEN']} correctly adds the token header while keeping the secret out of source code. The auth parameter is for basic authentication, params adds query strings, and data sets the request body, none of which fulfill the need for a custom header.

Answer

requests.get(url, auth=('X-Auth-Token', os.environ['TOKEN']))

Answer

requests.get(url, params={'X-Auth-Token': os.environ['TOKEN']})

Answer

requests.get(url, data={'X-Auth-Token': os.environ['TOKEN']})

Question 20

An engineer must push a configuration change to a Cisco IOS XE router using NETCONF. The engineer wants to stage the change so it can be previewed and later committed or discarded, rather than applying it immediately to the running configuration. Which NETCONF capability enables this behavior?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. NETCONF advertises supported capabilities during hello exchange. The candidate datastore capability creates a staging area separate from running, letting an engineer apply edits, inspect them, and then commit or discard. Writable-running applies changes immediately, rollback-on-error only handles failed transactions, and notification streams events, so none of those provide the preview-then-commit workflow.

Answer

urn:ietf:params:netconf:capability:notification:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0