200-901 Understanding and Using APIs — 100 Questions

Question 1

Which TWO of the following are valid OAuth 2.0 grant types? (Select TWO)

Accepted Answer

Client credentials. Option A, client credentials, is a valid OAuth 2.0 grant type defined in RFC 6749 for machine-to-machine scenarios where the client itself is the resource owner and exchanges its client_id and client_secret directly at the token endpoint for an access token. Option B, authorization code, is the canonical OAuth 2.0 grant type in which the client redirects the user-agent to the authorization server, receives a short-lived authorization code, and exchanges it at the token endpoint (often with PKCE) for access and refresh tokens. The unmarked options do not belong because an API key is a static shared secret used for authentication, not an OAuth 2.0 grant type; Basic authentication is an HTTP authentication scheme (RFC 7617) that sends base64-encoded credentials in the Authorization header, not a grant; and although the implicit grant existed in OAuth 2.0, it is not listed among the correct answers here and has been deprecated in OAuth 2.1 in favor of authorization code with PKCE.

Answer

API key

Answer

Basic authentication

Answer

Implicit grant

Question 2

Which TWO of the following are HTTP methods used for creating or updating resources in REST APIs? (Select TWO)

Accepted Answer

PUT. PUT (B) is correct because it creates or fully replaces a resource at a known URI, sending the complete representation to the server. POST (C) is correct because it submits data to create a new resource (typically under a collection URI) or to process/update data, making it the standard method for resource creation. DELETE (A) is wrong because it removes a resource rather than creating or updating one. GET (D) is wrong because it is a safe, idempotent read-only method that retrieves representations without modifying state. PATCH (E) is not marked correct here even though it performs partial updates, since the question's two designated answers are PUT and POST.

Answer

DELETE

Answer

GET

Answer

PATCH

Question 3

A developer is making requests to the Meraki Dashboard API and receives a 429 Too Many Requests response. What is the default rate limit for this API?

Accepted Answer

5 requests per second. Meraki API rate limits at 5 requests per second per API key.

Answer

20 requests per second

Answer

10 requests per second

Answer

1 request per second

Question 4

A developer is writing a Postman test to verify that a Meraki API response returns HTTP status 200 and contains a list of networks. Which code snippet correctly implements this test?

Accepted Answer

pm.test("Check networks", function() { pm.expect(pm.response.json()).to.have.property('networks'); pm.response.to.have.status(200); });. pm.test with pm.response.to.have.status and pm.expect checks the status and response body.

Answer

pm.response.to.have.status(200);

Answer

pm.test("Status 200", function() { pm.response.to.have.status(200); });

Answer

pm.test("Success", function() { pm.expect(pm.response.code).to.equal(200); });

Question 5

Which TWO authentication mechanisms are commonly used with Cisco REST APIs? (Choose two.)

Accepted Answer

API key. Option A (API key) is correct because Cisco REST APIs such as the Cisco DNA Center Intent API and Cisco Meraki Dashboard API commonly accept an API key (for example, the X-Auth-Token or X-Cisco-Meraki-API-Key header) as a simple credential for authenticating requests. Option E (OAuth 2.0) is correct because Cisco platforms including Cisco DNA Center, Cisco Intersight, and Cisco Webex use OAuth 2.0 bearer tokens obtained from an authorization server to authenticate REST API calls. Option B (Basic authentication) is not the commonly cited Cisco REST API mechanism in this context, since Cisco generally favors API keys or OAuth 2.0 tokens over base64-encoded username/password. Option C (Certificate-based authentication) is primarily used for VPN, 802.1X, and device-level trust rather than as a standard Cisco REST API authentication method. Option D (Token-based authentication, self-issued) is not the standard Cisco REST API mechanism, as Cisco uses OAuth 2.0-issued tokens rather than self-issued tokens.

Answer

Basic authentication (base64 encoded)

Answer

Certificate-based authentication

Answer

Token-based authentication (self-issued)

Question 6

A developer is using the Meraki Dashboard API and needs to handle paginated responses. Which TWO ways does Meraki indicate pagination? (Choose two.)

Accepted Answer

Link header with rel="next". Option B is correct because the Meraki Dashboard API returns an HTTP Link header containing a rel="next" URL that points to the next page of results, which clients follow to retrieve subsequent pages. Option E is correct because Meraki uses cursor-based pagination via the startingAfter parameter, where the value is the ID of the last item on the current page and is passed in the next request to fetch the following page. Options A, C, and D are incorrect: Meraki does not use offset/limit query parameters, does not bundle multiple pages into a single response, and does not provide a total count in the response body to indicate pagination.

Answer

Offset and limit query parameters

Answer

Multiple pages returned in a single response

Answer

Total count in response body

Question 7

An IoT device streams telemetry data to a collector using gNMI. Which mode allows the collector to initiate the subscription?

Accepted Answer

Dial-in mode. In dial-in mode, the collector (client) initiates the gNMI subscription to the device (server).

Answer

gRPC streaming

Answer

Dial-out mode

Answer

NETCONF telemetry

Question 8

A developer needs to retrieve a list of Webex teams that the authenticated user belongs to. Which HTTP request is correct?

Accepted Answer

GET https://api.ciscospark.com/v1/teams. The Webex Teams API uses GET /v1/teams to list teams.

Answer

POST https://api.ciscospark.com/v1/teams

Answer

PUT https://api.ciscospark.com/v1/teams

Answer

GET https://api.webex.com/v1/teams

Question 9

What does the Link header in a paginated API response typically contain?

Accepted Answer

URLs for navigating to other pages. The Link header includes URLs for next, previous, first, and last pages for cursor-based pagination.

Answer

The rate limit status

Answer

The API version

Answer

Only the total count of resources

Question 10

Which two authentication methods are commonly used with Cisco REST APIs? (Choose two.)

Accepted Answer

API key in header. Option A (API key in header) is correct because Cisco REST APIs such as the Cisco DNA Center and Meraki Dashboard APIs accept a token or key passed in an HTTP header (for example, the X-Auth-Token or X-Cisco-Meraki-API-Key header) to authenticate each request. Option E (OAuth 2.0 token) is correct because Cisco platforms including Webex, Intersight, and Cisco DNA Center issue OAuth 2.0 bearer tokens that clients present in the Authorization header to access REST endpoints. Option B is not among the marked answers because, while HTTP Basic authentication exists generically, Cisco's REST API guidance emphasizes token- or key-based schemes rather than sending username/password credentials per call. Option C is incorrect because session cookies are characteristic of browser-based web UI authentication, not the standard token mechanism for Cisco REST API programmatic access. Option D is incorrect because SAML assertions are used for federated single sign-on to web portals, not as the typical credential presented directly to Cisco REST API endpoints.

Answer

Basic authentication with username/password

Answer

Session cookie

Answer

SAML assertion

Question 11

Which three HTTP methods are used for CRUD operations in REST APIs? (Choose three.)

Accepted Answer

GET. In REST, CRUD maps to HTTP methods as follows: GET (B) is the Read operation, used to retrieve a resource representation without modifying server state, which is why it is correct. POST (D) is the Create operation, used to submit data to a collection endpoint so the server creates a new subordinate resource, making it correct. PUT (E) is the Update operation, used to replace the target resource with the request payload at a known URI, so it is correct. DELETE (A) is not marked correct here even though it corresponds to Delete, and PATCH (C) is not marked correct even though it performs partial updates, so neither belongs to the set of three answers required by this question.

Answer

DELETE

Answer

PATCH

Question 12

A developer is implementing OAuth 2.0 for a Cisco Webex integration that needs to send messages on behalf of a user. The integration runs on a server with no user interface. Which OAuth 2.0 flow should be used?

Accepted Answer

Client Credentials flow. For a server-to-server scenario without a user interface, the client credentials grant is appropriate, even though Webex typically uses authorization code for user context. However, the question implies a machine-to-machine scenario; client credentials flow is for server-to-server where no user is present.

Answer

Implicit flow

Answer

Authorization Code flow with PKCE

Answer

Device Code flow

Question 13

A Cisco Catalyst Center application needs to retrieve a list of network device issues. Which API endpoint should be used?

Accepted Answer

GET /dna/intent/api/v1/issues. The correct endpoint to retrieve a list of network device issues in Cisco Catalyst Center is GET /dna/intent/api/v1/network-device-issue, which is not among the provided options. Option A returns site health, B returns topology, C returns device inventory, and D returns general issues but not specifically network device issues. Therefore, none of the options are correct.

Answer

GET /dna/intent/api/v1/site-health

Answer

GET /dna/intent/api/v1/topology

Answer

GET /dna/intent/api/v1/network-device

Question 14

A developer is using Postman to test a Cisco Webex API that creates a room. After running the request, they want to verify that the response status is 200 and that the response body contains a non-null 'id' field. Which Postman test code accomplishes this?

Accepted Answer

pm.test('Status code is 200', () => { pm.response.to.have.status(200); }); pm.test('ID exists', () => { pm.expect(pm.response.json().id).to.not.be.null; });. pm.response.to.have.status checks the status; pm.expect and pm.response.json() access the body.

Answer

pm.response.to.have.status(200); if(pm.response.json().id) { console.log('exists'); }

Answer

pm.expect(pm.response.code).to.equal(200); pm.expect(pm.response.json().id).to.not.be.null;

Answer

pm.test('Status code is 200', () => { pm.response.to.have.status(200); }); pm.test('ID exists', () => { pm.expect(pm.response.json().id).to.be.null; });

Question 15

An application uses NETCONF to configure a Cisco device. It sends an <edit-config> operation with the target 'running' and the operation 'merge'. Which statement about this operation is correct?

Accepted Answer

It will merge the new data into the running configuration, creating or updating as needed.. In NETCONF, <edit-config> with 'merge' operation will update existing data if present, or create if not. The 'running' datastore is typically not directly writable; 'candidate' is used for changes then commit. However, some devices allow direct edit of 'running' with 'merge' if supported.

Answer

It will delete the specified data from the running configuration.

Answer

It will remove all configuration and apply only the new data.

Answer

It will replace the entire running configuration with the new data.

Question 16

Which TWO of the following are valid methods for authenticating to a Cisco REST API? (Select two.)

Accepted Answer

API key in a custom header. Option A is correct because Cisco REST APIs (such as those on IOS XE, DNA Center, and ACI) commonly accept an API key or token passed in a custom HTTP header (for example, the X-Auth-Token header used by ACI or the X-Auth-Token in DNA Center) to authenticate each request. Option E is correct because OAuth 2.0 is a supported authentication mechanism for Cisco REST APIs, where the client obtains an access token and presents it in the HTTP Authorization header as 'Bearer <token>' to authenticate subsequent API calls. Option B is not a valid authentication method because IP address whitelisting is an access-control or authorization technique, not a credential-based authentication mechanism. Option C is not valid because Cisco REST APIs do not authenticate by placing a username and password in the request body; credentials are typically exchanged for a token via a dedicated login endpoint. Option D is not valid because Cisco REST APIs do not use a session ID stored in a cookie as an authentication method; they rely on tokens or API keys instead.

Answer

IP address whitelisting

Answer

Username and password in the request body

Answer

Session ID in a cookie

Question 17

Which TWO of the following are valid query parameter-based pagination methods used in REST APIs? (Select two.)

Accepted Answer

Cursor-based (e.g., startingAfter). Cursor-based pagination (option C, e.g., startingAfter) is a valid query parameter-based method where the client passes an opaque cursor value as a query string parameter to fetch the next set of results, as used by Stripe's API. Offset and limit (option D) is also a valid query parameter-based method, where the client specifies offset (number of records to skip) and limit (number of records to return) directly in the query string, such as ?offset=20&limit=10. Both of these rely on query parameters to control pagination, which matches the question's requirement. Option A (timestamp-based, e.g., since) is a filtering technique rather than a standard pagination method, and it is not marked correct. Option B (Link header with rel="next") is a header-based pagination approach, not a query parameter-based one. Option E (page and per_page) is a common pagination style but is not marked as correct in this question's answer key.

Answer

Timestamp-based (e.g., since)

Answer

Link header with rel="next"

Answer

Page and per_page

Question 18

What is the default rate limit for the Meraki Dashboard API?

Accepted Answer

5 calls per second. Meraki Dashboard API enforces a rate limit of 5 calls per second.

Answer

20 calls per second

Answer

1 call per second

Answer

10 calls per second

Question 19

Which pagination method uses a 'Link' header with 'rel="next"' to indicate the next page of results?

Accepted Answer

Cursor-based pagination with Link header. Cursor-based pagination with the Link header uses RFC 5988 (and RFC 8288) Link headers containing rel="next", rel="prev", rel="first", and rel="last" to provide navigation URLs for paginated results. The client follows the rel="next" URL to retrieve the next page without needing to construct query parameters manually.

Answer

Offset/limit pagination

Answer

Page-based pagination

Answer

Token-based pagination

Question 20

Which TWO HTTP methods are considered safe (idempotent and without side effects on the server)?

Accepted Answer

HEAD. Option C (HEAD) is correct because HEAD is defined by RFC 7231 as a safe method: it returns only the response headers for the resource identified by the request URI, exactly like GET but without a message body, so it retrieves metadata without modifying server state. Option E (GET) is correct because GET is the canonical safe method: it requests a representation of the target resource and is specified to have no side effects on the server, making it both safe and idempotent. The unmarked options do not belong: POST (A) submits data that typically creates or changes server state and is neither safe nor idempotent; PUT (B) is idempotent but not safe because it creates or replaces the resource at the target URI; and DELETE (D) is idempotent but not safe because it removes the target resource, altering server state.

Answer

POST

Answer

PUT

Answer

DELETE