200-901 Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. An engineer uses NETCONF to configure an interface. After applying this configuration, the interface is administratively up. However, the interface does not pass traffic. What is the most likely cause?

Accepted Answer

The IP address configuration uses 'netmask' instead of 'prefix-length'. NETCONF uses YANG models that define IP address configuration with the leaf 'prefix-length' (an integer), not 'netmask'. The 'netmask' field is not a valid leaf in the standard ietf-interfaces or ietf-ip YANG model for IPv4 addresses, so the NETCONF server will either reject the configuration or apply it incorrectly, leaving the interface without a proper IP address and unable to pass traffic.

Answer

The interface type is misspelled

Answer

The 'enabled' field should be a string instead of a boolean

Answer

The interface name is invalid

Question 2

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

Accepted Answer

Use a secure secret store like HashiCorp Vault and retrieve secrets at runtime via API.. Option C is correct because it follows the principle of secret management by decoupling sensitive data from application code and container images. HashiCorp Vault provides a centralized, encrypted secret store with dynamic secrets, access policies, and audit logging, allowing the microservices to authenticate and retrieve credentials at runtime via its REST API, eliminating the need to hardcode secrets.

Answer

Embed secrets directly in the container image using COPY instructions.

Answer

Pass secrets as build arguments in the Docker build command.

Answer

Store secrets as environment variables in the Docker Compose file.

Question 3

Which TWO of the following are best practices when using REST APIs in Cisco networking environments?

Accepted Answer

Always handle HTTP error codes like 4xx and 5xx.. Option C is correct because handling HTTP error codes like 4xx (client errors) and 5xx (server errors) is essential for robust REST API integration. In Cisco environments, APIs such as those for DNA Center or Meraki return these codes to indicate issues like authentication failure (401), rate limiting (429), or server overload (503). Proper error handling allows the application to retry, log, or alert appropriately, preventing silent failures and ensuring reliable network automation.

Answer

Send credentials as plain text in every request.

Answer

Poll the API every second to get real-time updates.

Answer

Embed API keys directly in the URL query parameters.

Question 4

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

Accepted Answer

Use an idempotent Ansible module that checks for existing VLANs before creating them.. Option C is correct because Ansible's idempotent modules, such as `ios_vlan` for Cisco IOS devices, are designed to check the current state of the device before making changes. If the VLAN already exists, the module will report 'ok' and not attempt to create it again, preventing the error and ensuring the playbook completes successfully. This aligns with Ansible's best practice of writing idempotent playbooks that produce the same result regardless of how many times they are run.

Answer

Modify the playbook to skip switches where the VLAN already exists.

Answer

Remove the VLAN from all switches before creating it again.

Answer

Add ignore_errors: yes to the VLAN creation task.

Question 5

A developer is automating VLAN configuration on a Cisco switch using REST API. Which HTTP method should be used to create a new VLAN?

Accepted Answer

POST. To create a new VLAN resource on a Cisco switch via REST API, the POST method is correct because it is designed to create a subordinate resource under a parent collection. In RESTful APIs, POST is used to send data to the server to create a new entity, such as a VLAN, and the server assigns a unique identifier (e.g., VLAN ID) to the new resource. This aligns with the RESTful principle for resource creation, as specified in RFC 7231.

Answer

PUT

Answer

GET

Answer

PATCH

Answer

DELETE

Question 6

Which TWO of the following are valid security considerations when deploying an application to a Kubernetes cluster managed by Cisco Intersight? (Choose two.)

Accepted Answer

Define Network Policies to isolate pods and control traffic flow.. Option B is correct because Network Policies in Kubernetes act as a firewall at the pod level, using label selectors and namespace selectors to control ingress and egress traffic. In a Cisco Intersight-managed cluster, defining these policies is a critical security consideration to enforce micro-segmentation and prevent lateral movement of threats. Option E is correct because Pod Security Policies (PSPs) are a cluster-level resource that control security-sensitive aspects of pod specification, such as preventing privileged containers, which is a key security best practice in Kubernetes.

Answer

Store secrets in ConfigMaps for easy retrieval.

Answer

Disable RBAC to simplify management and reduce overhead.

Answer

Use default service accounts for all pods to avoid misconfiguration.

Question 7

Refer to the exhibit. A switch is configured with the shown trunk port. After connecting the uplink, the switch logs show repeated 'errdisable' state transitions on this port. The core switch is configured with the same allowed VLAN list. Which configuration change is most likely to resolve the issue?

Accepted Answer

Remove the spanning-tree portfast trunk command from the interface.. The 'errdisable' state transitions on a trunk port are typically caused by a spanning-tree BPDU guard violation when PortFast is enabled. The 'spanning-tree portfast trunk' command enables PortFast on the trunk, which bypasses the normal listening/learning states and can cause the port to be placed into errdisable state if a BPDU is received from the core switch. Removing this command allows the trunk port to participate in standard spanning-tree convergence, preventing the repeated errdisable transitions.

Answer

Change the switchport mode to dynamic desirable.

Answer

Add VLAN 1 to the allowed VLAN list.

Answer

Add the spanning-tree bpduguard enable command to the interface.

Question 8

Refer to the exhibit. An engineer applied this configuration to a Cisco switch port connected to an application server. The server runs a critical business application that should not be disrupted. However, after applying the configuration, the port goes into errdisable state. What is the most likely cause?

Accepted Answer

The server is generating BPDU frames, triggering BPDU guard.. The correct answer is D because BPDU guard is enabled on the switch port (implicitly or explicitly via spanning-tree bpduguard enable). When the application server sends BPDU frames—perhaps because it is running a software bridge, virtualization host, or has a misconfigured NIC—the switch detects these frames on a port configured with portfast and immediately errdisables the port to prevent a potential bridging loop. This matches the symptom of the port going into errdisable state after applying the configuration.

Answer

The VLAN 10 does not exist on the switch.

Answer

The spanning-tree portfast command is incompatible with access ports.

Answer

The switchport mode access command is incorrect for a server connection.

Question 9

Which TWO statements accurately describe characteristics of infrastructure as code (IaC) in network automation?

Accepted Answer

IaC tools use declarative or imperative models to define the desired state of network infrastructure.. Option D is correct because Infrastructure as Code (IaC) tools like Ansible, Terraform, and Cisco NSO allow network engineers to define the desired state of infrastructure using either declarative (what the end state should be) or imperative (step-by-step instructions) models. This abstraction enables consistent, repeatable deployments and reduces configuration drift across the network.

Answer

IaC eliminates the need for manual review of configuration changes before deployment.

Answer

IaC requires that all network devices be replaced with software-based equivalents.

Answer

IaC is only applicable to virtual network functions, not physical devices.

Question 10

An engineer wants to verify that a switch port is configured as an access port in VLAN 10. Which command provides this information?

Accepted Answer

show running-config interface. The `show running-config interface` command displays the current operational configuration of a specific interface, including whether it is configured as an access port and which VLAN it is assigned to. For a switch port in VLAN 10, the output will show `switchport mode access` and `switchport access vlan 10`, directly confirming the desired configuration.

Answer

show interfaces status

Answer

show ip interface brief

Answer

show vlan brief

200-901 Practice Test 9 — 10 Questions

Exhibit

200-901 Practice Test 9 — 10 Questions

Exhibit