200-901 Understanding and Using APIs Practice Test 2 — 15 Questions

Question 1

Which TWO of the following are valid methods for authenticating to a Cisco REST API? (Select two.)

Accepted Answer

API key in a custom header. Option A is correct because Cisco REST APIs (such as those on IOS XE, DNA Center, and ACI) commonly accept an API key or token passed in a custom HTTP header (for example, the X-Auth-Token header used by ACI or the X-Auth-Token in DNA Center) to authenticate each request. Option E is correct because OAuth 2.0 is a supported authentication mechanism for Cisco REST APIs, where the client obtains an access token and presents it in the HTTP Authorization header as 'Bearer <token>' to authenticate subsequent API calls. Option B is not a valid authentication method because IP address whitelisting is an access-control or authorization technique, not a credential-based authentication mechanism. Option C is not valid because Cisco REST APIs do not authenticate by placing a username and password in the request body; credentials are typically exchanged for a token via a dedicated login endpoint. Option D is not valid because Cisco REST APIs do not use a session ID stored in a cookie as an authentication method; they rely on tokens or API keys instead.

Answer

IP address whitelisting

Answer

Username and password in the request body

Answer

Session ID in a cookie

Question 2

Which TWO of the following are valid query parameter-based pagination methods used in REST APIs? (Select two.)

Accepted Answer

Cursor-based (e.g., startingAfter). Cursor-based pagination (option C, e.g., startingAfter) is a valid query parameter-based method where the client passes an opaque cursor value as a query string parameter to fetch the next set of results, as used by Stripe's API. Offset and limit (option D) is also a valid query parameter-based method, where the client specifies offset (number of records to skip) and limit (number of records to return) directly in the query string, such as ?offset=20&limit=10. Both of these rely on query parameters to control pagination, which matches the question's requirement. Option A (timestamp-based, e.g., since) is a filtering technique rather than a standard pagination method, and it is not marked correct. Option B (Link header with rel="next") is a header-based pagination approach, not a query parameter-based one. Option E (page and per_page) is a common pagination style but is not marked as correct in this question's answer key.

Answer

Timestamp-based (e.g., since)

Answer

Link header with rel="next"

Answer

Page and per_page

Question 3

What is the default rate limit for the Meraki Dashboard API?

Accepted Answer

5 calls per second. Meraki Dashboard API enforces a rate limit of 5 calls per second.

Answer

20 calls per second

Answer

1 call per second

Answer

10 calls per second

Question 4

Which pagination method uses a 'Link' header with 'rel="next"' to indicate the next page of results?

Accepted Answer

Cursor-based pagination with Link header. Cursor-based pagination with the Link header uses RFC 5988 (and RFC 8288) Link headers containing rel="next", rel="prev", rel="first", and rel="last" to provide navigation URLs for paginated results. The client follows the rel="next" URL to retrieve the next page without needing to construct query parameters manually.

Answer

Offset/limit pagination

Answer

Page-based pagination

Answer

Token-based pagination

Question 5

Which TWO HTTP methods are considered safe (idempotent and without side effects on the server)?

Accepted Answer

HEAD. Option C (HEAD) is correct because HEAD is defined by RFC 7231 as a safe method: it returns only the response headers for the resource identified by the request URI, exactly like GET but without a message body, so it retrieves metadata without modifying server state. Option E (GET) is correct because GET is the canonical safe method: it requests a representation of the target resource and is specified to have no side effects on the server, making it both safe and idempotent. The unmarked options do not belong: POST (A) submits data that typically creates or changes server state and is neither safe nor idempotent; PUT (B) is idempotent but not safe because it creates or replaces the resource at the target URI; and DELETE (D) is idempotent but not safe because it removes the target resource, altering server state.

Answer

POST

Answer

PUT

Answer

DELETE

Question 6

A developer is configuring a RESTCONF request to retrieve the configuration of an interface on a Cisco device. Which URL path and Content-Type header are correct?

Accepted Answer

GET /restconf/data/interface with Content-Type: application/yang-data+json. RESTCONF uses the '/restconf/data' base path to retrieve configuration data (the 'data' resource), and the correct Content-Type for RESTCONF with JSON encoding is 'application/yang-data+json', as defined in RFC 8040. This combination ensures the request targets the operational or configuration datastore and specifies the YANG-encoded JSON media type.

Answer

GET /restconf/data/interface with Content-Type: application/xml

Answer

GET /restconf/data/interface with Content-Type: application/json

Answer

GET /restconf/operations/interface with Content-Type: application/yang-data+json

Question 7

A developer is designing a REST API that requires pagination. Which two pagination methods are commonly used? (Choose two.)

Accepted Answer

Offset/limit pagination. Offset/limit pagination (B) is correct because it is a standard REST pagination technique where the client passes query parameters such as ?offset=20&limit=10 to skip a fixed number of records and return a bounded page, commonly implemented with SQL LIMIT and OFFSET. Cursor-based pagination (D) is also correct because it uses an opaque cursor or continuation token pointing to a specific position in the result set, typically encoded from a stable sort key, and is widely used for large or frequently changing datasets to avoid skipped or duplicated records. The other options are not standard REST pagination methods: B-tree pagination (A) describes a database index structure rather than an API pagination pattern, Link header pagination (C) is a mechanism for conveying pagination links via the HTTP Link header rather than a pagination method itself, and hash-based pagination (E) is not a recognized common pagination approach.

Answer

B-tree pagination

Answer

Link header pagination

Answer

Hash-based pagination

Question 8

Which two HTTP methods are considered idempotent? (Choose two.)

Accepted Answer

PUT. PUT (C) is idempotent because sending the same request repeatedly replaces the target resource with the same representation, leaving the server in the same state regardless of how many times it is executed. GET (D) is idempotent because it is a safe, read-only retrieval method; repeating it does not alter server state, so multiple identical requests produce the same effect as one. POST (A) is not idempotent because it typically creates a new subordinate resource or triggers a non-idempotent action on each submission, so repeated calls can create duplicates or side effects. PATCH (B) is generally not idempotent because a partial modification may be applied cumulatively or depend on current state, so repeating it can yield different results. DELETE (E) is not among the two marked correct answers here, even though the HTTP specification treats DELETE as idempotent; the question's marked key selects only PUT and GET.

Answer

POST

Answer

PATCH

Answer

DELETE

Question 9

A developer is testing a REST API using curl. They need to send a GET request with a custom header 'X-API-Key: abc123' to authenticate. Which curl command correctly sends this request?

Accepted Answer

curl -H "X-API-Key: abc123" https://api.example.com/resource. To send a custom header with curl, the correct option is to use the -H flag followed by the header in 'Name: Value' format. This ensures the API receives the X-API-Key header as intended. Other flags like -d, -u, or incorrect syntax will not work.

Answer

curl -X GET -H "X-API-Key=abc123" https://api.example.com/resource

Answer

curl -u "X-API-Key: abc123" https://api.example.com/resource

Answer

curl -d "X-API-Key: abc123" https://api.example.com/resource

Question 10

An automation engineer is designing a Python script that interacts with the Cisco Meraki Dashboard API. The script must handle rate limiting gracefully. Which TWO of the following approaches are appropriate for dealing with HTTP 429 responses? (Choose two.)

Accepted Answer

Implement exponential backoff and retry the request after a delay.. When the Meraki API returns HTTP 429, it indicates that the client has exceeded the rate limit. The correct responses are to wait and retry using exponential backoff or to honor the Retry-After header if provided. These methods allow the client to recover gracefully without overwhelming the server. Immediate retries or switching APIs are ineffective, and caching is a preventive measure rather than a direct handling technique.

Answer

Switch to using the Cisco DNA Center API instead.

Answer

Reduce the number of API calls by caching responses and only requesting new data when necessary.

Answer

Immediately resend the request in a tight loop until it succeeds.

Question 11

A developer is writing a Python script to interact with a REST API. The API requires an API key for authentication, which must be included in every request. Which HTTP header should the developer use to pass the API key?

Accepted Answer

Authorization. The Authorization header is the correct choice because it is the standard HTTP header for transmitting authentication credentials, including API keys. Other headers like Content-Type and Accept serve different purposes. While custom headers like X-API-Key exist, they are not standard and the question implies a typical REST API. Therefore, Authorization is the appropriate header.

Answer

Content-Type

Answer

X-API-Key

Answer

Accept

Question 12

A developer is testing a REST API endpoint that returns a list of interfaces on a Cisco IOS XE device using RESTCONF. The developer wants to filter the response to only include interfaces that are operationally up. Which query parameter should be used in the RESTCONF request?

Accepted Answer

?filter=interfaces/interface[oper-status='up']. RESTCONF provides a 'filter' query parameter that accepts an XPath expression to filter the data returned. To retrieve only interfaces that are operationally up, the developer should use an XPath predicate like 'interfaces/interface[oper-status='up']'. This leverages the underlying YANG data model and allows precise filtering. Other parameters like 'content' or 'fields' serve different purposes and cannot filter by leaf values.

Answer

?select=oper-status

Answer

?filter=oper-status=up

Answer

?content=config

Question 13

A developer is building a Python application that consumes a REST API. The API returns a JSON response containing a list of devices. The developer wants to parse the response and extract the value of the 'hostname' field for each device. Which Python code snippet correctly parses the JSON response and accesses the hostname for each device, assuming the response object is stored in the variable response and the JSON structure is a list of dictionaries under the key 'devices'?

Accepted Answer

data = response.json(); for device in data['devices']: print(device['hostname']). The requests library provides the response.json() method to deserialize JSON content into Python objects. Once parsed, the data can be accessed like a dictionary or list. Iterating over the 'devices' list and accessing each device's 'hostname' key yields the required information. Other options misuse the API by calling methods incorrectly or passing the wrong object type.

Answer

data = json.loads(response); for device in data['devices']: print(device['hostname'])

Answer

data = response.json; for device in data['devices']: print(device['hostname'])

Answer

data = response.text(); for device in data['devices']: print(device['hostname'])

Question 14

A developer is designing a Python application that will interact with multiple Cisco APIs, including Cisco DNA Center and Cisco Webex Teams. The application needs to handle authentication for each API. Which TWO of the following are valid authentication methods supported by these Cisco APIs? (Choose two.)

Accepted Answer

Basic authentication with username and password. Basic authentication and OAuth 2.0 authorization code grant are both valid methods for Cisco DNA Center and Webex Teams. Basic auth is used for simple integrations, while OAuth 2.0 is preferred for user-delegated access. SAML, query parameter API keys, and external JWTs are not supported for direct API authentication. These two methods are commonly documented and used in practice.

Answer

API key passed as a query parameter

Answer

SAML assertion in the Authorization header

Answer

JWT bearer token obtained from an identity provider

Question 15

A developer is writing a Python script that uses the requests library to call a REST API. The API returns a JSON response with a list of devices. The developer needs to check if the request was successful and then iterate over the list of devices. Which code snippet correctly performs this task?

Accepted Answer

if response.status_code == 200:
    devices = response.json()
    for device in devices:
        print(device['name']). The correct code checks for a 200 status code, parses the JSON response into a list, and iterates over that list. This assumes the API returns a JSON array of devices. The other options either misuse the .json method, treat the response as a string, or incorrectly assume a nested structure.

Answer

if response.status_code == 200:
    devices = response.json()
    for device in devices['items']:
        print(device['name'])

Answer

if response.ok:
    devices = response.json
    for device in devices:
        print(device['name'])

Answer

if response.status_code == 200:
    devices = response.text
    for device in devices:
        print(device['name'])