200-901 Understanding and Using APIs Practice Test 11 — 15 Questions

Question 1

A developer is building a Python application that uses the Cisco Webex API to send messages. The application must authenticate on behalf of a user without storing the user's password. Which OAuth 2.0 grant type should be used to obtain an access token?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization Code Grant. To authenticate on behalf of a user without handling their password, the Authorization Code Grant is the correct OAuth 2.0 flow. It redirects the user to the authorization server, where they authenticate directly. The application receives an authorization code, which it exchanges for an access token. This method is secure, supports refresh tokens, and is widely recommended for server-side applications like the Python app described.

Answer

Resource Owner Password Credentials Grant

Answer

Client Credentials Grant

Answer

Implicit Grant

Question 2

A developer is integrating a Python application with the Cisco Webex API. The application must act on behalf of users to create messages in Webex spaces. The developer wants to avoid storing user credentials. Which OAuth 2.0 flow is most appropriate for this scenario?

Accepted Answer

Authorization Code Grant. The Authorization Code Grant is the most secure and appropriate OAuth 2.0 flow for applications that need to act on behalf of users without handling their credentials. It involves redirecting the user to Webex for authentication, receiving an authorization code, and exchanging it for an access token. This flow supports refresh tokens and fine-grained scopes, making it ideal for integrations that create messages on behalf of users.

Answer

Implicit Grant

Answer

Resource Owner Password Credentials Grant

Answer

Client Credentials Grant

Question 3

A developer is designing a REST API client that must handle rate limiting from a Cisco Webex API. The API returns HTTP 429 Too Many Requests with a 'Retry-After' header. Which two strategies should the developer implement to handle rate limiting gracefully? (Choose two.)

Accepted Answer

Implement exponential backoff, increasing the delay between retries after each 429 response.. To handle rate limiting gracefully, the client should respect the 'Retry-After' header and implement exponential backoff. These strategies reduce request frequency and align with server expectations. Immediate retries, switching endpoints, or indefinite caching do not properly address rate limiting and can worsen the situation.

Answer

Cache all responses indefinitely to avoid making repeated requests.

Answer

Switch to a different API endpoint that is not rate-limited.

Answer

Immediately retry the request without delay to ensure the data is retrieved as quickly as possible.

Question 4

A developer is building a Python script that calls the Cisco Webex API. The API returns JSON with a top-level key "items" containing a list of records, and a "link" object with a "next" URL when more records exist. The developer needs to iterate through all pages until every record is retrieved. Which approach correctly handles this pagination style?

Accepted Answer

Parse the top-level "items" array, then check the "link" object for a "next" URL and request that URL until no "next" key is present.. The Webex API paginates by returning an "items" array plus a "link" object whose "next" field holds the URL of the following page. A correct client parses each page, then follows the "next" URL until that field disappears, indicating the last page. This link-driven approach avoids guessing page sizes or totals and adapts if the server changes page boundaries.

Answer

Read the "X-Total-Count" response header and loop exactly that many times using an offset parameter.

Answer

Request the same endpoint repeatedly and deduplicate results until the returned item count stabilizes.

Answer

Increment a "page" query parameter starting at 1 and stop when the response body is empty.

Question 5

A developer's script calls a REST API and receives HTTP 429 Too Many Requests. The response includes a Retry-After header with a value of 30. What should the script do to behave correctly?

Accepted Answer

Wait at least 30 seconds, then retry the request.. A 429 response signals that the client has exceeded a rate limit, and the accompanying Retry-After header states how long to wait before retrying. Pausing for that interval respects the server's throttling policy and avoids worsening the condition. Immediate retries, method changes, or permanently aborting all fail to follow the server's explicit guidance.

Answer

Immediately resend the identical request in a tight loop until it succeeds.

Answer

Change the HTTP method from GET to POST and resend.

Answer

Treat the response as a permanent failure and stop all further API calls.

Question 6

A developer is building a Python script that calls the Cisco Webex API to create a new room. The API returns a JSON payload containing the room ID. The developer needs to extract the room ID from the response and use it in a subsequent API call to add a member to that room. Which Python code snippet correctly parses the JSON response and extracts the room ID, assuming the response object is stored in a variable named `response` and the JSON key is `id`?

Accepted Answer

room_id = response.json()['id']. The correct approach is to use the .json() method provided by the requests library to parse the JSON response into a Python dictionary, then access the 'id' key. This yields the room ID needed for subsequent API calls. The other options incorrectly assume that the response object can be indexed directly or that .json is a property.

Answer

room_id = response.text['id']

Answer

room_id = response.json['id']

Answer

room_id = response.content['id']

Question 7

A developer is building a script that authenticates to the Cisco DNA Center API. The documentation states that the authentication endpoint returns a token that must be included in subsequent API calls. Which authentication scheme does Cisco DNA Center expect for those subsequent calls?

Accepted Answer

An Authorization header with the Bearer scheme followed by the token. Cisco DNA Center authenticates clients through a dedicated endpoint that returns a token, and that token is then presented in the Authorization header using the Bearer scheme. This keeps credentials off subsequent requests and allows the token to expire on a schedule. Basic auth, custom token headers, and session cookies do not match the documented mechanism and would not authenticate successfully.

Answer

A custom X-Auth-Token header containing the token returned by the authentication endpoint

Answer

A Cookie header containing the session identifier issued at login

Answer

HTTP Basic authentication using the username and password on every request

Question 8

A developer is testing a REST API that returns a JSON response with a 'Location' header when a new resource is created. The developer wants to capture the URL of the newly created resource from the response. Which HTTP status code and header should the developer look for?

Accepted Answer

HTTP 201 Created and the Location header. When a REST API creates a resource, it should return HTTP 201 Created along with a Location header that specifies the URI of the new resource. This allows the client to know where the resource can be accessed. Other status codes like 200, 204, or 302 do not serve this purpose. The developer should check for 201 and extract the Location header value.

Answer

HTTP 204 No Content and the ETag header

Answer

HTTP 200 OK and the Content-Location header

Answer

HTTP 302 Found and the Location header

Question 9

A developer is writing an integration that calls a REST API which returns a large collection of items across many pages. The API documentation states that the response includes a 'next' link when more results are available. Which approach correctly retrieves the complete collection?

Accepted Answer

Follow the 'next' link in each response and request it repeatedly until no 'next' link is present.. When an API advertises a 'next' link, the intended traversal is to request that link and repeat until the response no longer includes one. This respects server-controlled cursors and guarantees every page is visited. Assuming a single response is complete, replaying the identical request, or extending timeouts all fail because none of them advances through the paginated result set.

Answer

Request the collection once and assume all items are returned in a single response.

Answer

Increase the request timeout so the server returns all pages in one response.

Answer

Send the same request repeatedly and merge the responses until the total item count stops growing.

Question 10

A developer is testing a REST API with curl and wants the response to include only the HTTP status code and response headers, discarding the body. Which curl option accomplishes this?

Accepted Answer

curl -I https://api.example.com/devices. The -I option issues a HEAD request, which asks the server for the same headers it would send for a GET but without the body. This is ideal for checking status codes, content types, and rate-limit headers cheaply. It is a safe, idempotent inspection method that avoids transferring large payloads during API testing.

Answer

curl -o headers.txt https://api.example.com/devices

Answer

curl -d @payload.json https://api.example.com/devices

Answer

curl -X POST https://api.example.com/devices

Question 11

A network engineer is using curl to test a REST API endpoint on a Cisco IOS XE device that supports RESTCONF. The engineer wants to retrieve the configuration of the GigabitEthernet1 interface. Which curl command correctly sends a GET request to the RESTCONF API with the appropriate headers to retrieve the interface configuration in JSON format?

Accepted Answer

curl -X GET -H 'Accept: application/yang-data+json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'. To retrieve data via RESTCONF, a GET request must be sent with the Accept header set to 'application/yang-data+json' to request JSON-formatted YANG data. The URL must correctly reference the data node using the module name and interface name. The other options use incorrect headers or HTTP methods.

Answer

curl -X POST -H 'Accept: application/yang-data+json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'

Answer

curl -X GET -H 'Accept: application/json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'

Answer

curl -X GET -H 'Content-Type: application/yang-data+json' 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'

Question 12

A developer calls a REST API with GET /api/v1/devices?limit=50 and receives the first page of results plus a body field named nextPageToken. The API documentation states that results are cursor-paginated. How should the script request the next page?

Accepted Answer

Call GET /api/v1/devices?limit=50&nextPageToken=<value>.. Cursor pagination relies on an opaque token that marks the position of the last retrieved record. The client echoes that token in the next request, and the server returns the subsequent slice. Loop until the token is missing. Offset, page-number, and oversized-limit approaches do not follow the API's documented contract and can skip or repeat data.

Answer

Call GET /api/v1/devices?limit=50&page=2.

Answer

Call GET /api/v1/devices?limit=100 to fetch everything at once.

Answer

Call GET /api/v1/devices?limit=50&offset=50.

Question 13

A developer is integrating with a REST API that returns JSON error responses. The team needs to handle failures robustly in code. Which TWO practices are appropriate when processing API responses? (Choose two.)

Accepted Answer

Check the HTTP status code before attempting to parse the response body.. Robust API clients branch on the HTTP status code first, then guard JSON parsing by checking the content type and body presence. This ordering prevents schema mismatches when error payloads differ from success payloads and avoids parser exceptions on empty or non-JSON responses. These two practices together form a reliable foundation for error handling in any REST integration.

Answer

Retry every failed request immediately in a tight loop until it succeeds.

Answer

Ignore the status code and rely solely on whether the body parses as valid JSON.

Answer

Assume any response containing the word "error" in the body indicates a failure and raise an exception.

Question 14

A developer is integrating a Python application with the Cisco DNA Center API. The application must handle rate limiting gracefully. The API returns HTTP 429 Too Many Requests with a 'Retry-After' header indicating the number of seconds to wait before retrying. Which approach best implements exponential backoff with jitter to respect the rate limit and avoid overwhelming the server?

Accepted Answer

Upon receiving 429, wait for the number of seconds specified in Retry-After, then retry the request. If it fails again, double the wait time and add a random jitter between 0 and 1 second.. The best practice for handling 429 responses is to honor the Retry-After header and then apply exponential backoff with jitter for subsequent retries. This respects the server's guidance while preventing synchronized retries from multiple clients. The other options either ignore the header, use fixed waits, or give up permanently, all of which are suboptimal.

Answer

Upon receiving 429, wait for a fixed 60 seconds before retrying, regardless of the Retry-After header. Repeat this fixed wait for each retry.

Answer

Upon receiving 429, log the error and abort the request permanently, as rate limiting indicates a fatal error.

Answer

Upon receiving 429, immediately retry the request in a tight loop until it succeeds, ignoring the Retry-After header.

Question 15

A developer's integration must call a Cisco Webex API on behalf of users across many customer organizations. Each organization administers its own users and consents independently, and the integration must refresh access without user interaction after initial consent. Which OAuth 2.0 grant type should the integration use?

Accepted Answer

Authorization code grant. Delegated access across many organizations requires each user to authenticate and consent at Cisco Webex, which the authorization code grant accomplishes. Exchanging the returned code yields both an access token and a refresh token, so the integration can renew access silently afterward. The other grants either lack refresh capability, require unsafe password handling, or represent the app rather than the user.

Answer

Implicit grant

Answer

Resource owner password credentials grant

Answer

Client credentials grant