200-901 Understanding and Using APIs Practice Test 9 — 15 Questions

Question 1

A network engineer is using the Cisco Meraki Dashboard API to retrieve a list of organizations. The API returns a JSON array. Which HTTP method should be used to fetch this list?

Accepted Answer

GET. The GET method is designed for retrieving data from a specified resource. In the context of the Meraki Dashboard API, listing organizations is a read-only operation, so GET is the correct choice. GET requests should not have side effects, ensuring that repeated calls do not alter the state of the server. This aligns with REST principles and the Meraki API documentation, which specifies GET for all retrieval endpoints.

Answer

POST

Answer

PUT

Answer

DELETE

Question 2

A network engineer is using the Cisco DNA Center API to retrieve a list of all sites. The API response is a JSON object with a 'response' array containing site objects. The engineer wants to extract the name of each site. Which Python code snippet correctly parses the JSON response and prints each site name?

Accepted Answer

for site in response.json()['response']:
    print(site['name']). The Cisco DNA Center API returns site data within a top-level 'response' array. To print each site name, the code must parse the JSON, access the 'response' list, iterate over each site dictionary, and print the 'name' value. The correct snippet does exactly that, while the others either misidentify the key or attempt to iterate over the wrong structure.

Answer

for site in response.json():
    print(site['name'])

Answer

print(response.json()['name'])

Answer

for site in response.json()['sites']:
    print(site['name'])

Question 3

A developer is testing a REST API endpoint using curl. The API requires an API key to be sent in the HTTP header 'X-API-Key'. Which curl command correctly includes the API key?

Accepted Answer

curl -H "X-API-Key: abc123" https://api.example.com/resource. The -H flag in curl is used to add custom headers to an HTTP request. Since the API requires the API key in the 'X-API-Key' header, using -H with the appropriate header string is the correct approach. This ensures the key is transmitted as an HTTP header, which the API will validate.

Answer

curl -G "X-API-Key=abc123" https://api.example.com/resource

Answer

curl -u "X-API-Key:abc123" https://api.example.com/resource

Answer

curl -d "X-API-Key=abc123" https://api.example.com/resource

Question 4

A network engineer is writing a Python script to interact with a Cisco Catalyst Center (formerly DNA Center) REST API. They need to authenticate and obtain a token that will be used in subsequent API calls. Which HTTP header should be included in the authentication request to specify the expected response format?

Accepted Answer

Accept: application/json. To request a JSON response from the Catalyst Center authentication endpoint, the client must include the Accept header with application/json. This header informs the server of the desired response format. Other headers serve different purposes: Content-Type describes the request body, Authorization provides credentials, and X-Auth-Token is used after authentication.

Answer

Authorization: Basic <credentials>

Answer

Content-Type: application/xml

Answer

X-Auth-Token: <token>

Question 5

A developer is designing a Python application that consumes several Cisco REST APIs. To make the code maintainable and secure, the developer wants to implement reusable API request handling. Which two practices should be applied? (Choose two.)

Accepted Answer

Store API credentials in environment variables or a secrets manager rather than hard-coding them in source files.. Secure and maintainable API clients externalize secrets and centralize shared request logic. Storing credentials in environment variables or a secrets manager prevents accidental exposure, while a reusable client module ensures consistent authentication, headers, and error handling. Hard-coding keys, disabling TLS verification, or duplicating logic all undermine security or maintainability and should be avoided.

Answer

Disable TLS certificate verification to avoid errors when calling multiple APIs.

Answer

Write a separate copy of the authentication and request logic for each API endpoint to keep functions independent.

Answer

Hard-code the API key in each script so every team member can run it without configuration.

Question 6

A developer is integrating with the Cisco Meraki Dashboard API. They need to update the name of an existing network. Which HTTP method should they use to modify only the name attribute without affecting other attributes?

Accepted Answer

PATCH. PATCH is the correct HTTP method for partial updates. It allows sending only the changed attribute, such as the network name, without affecting other fields. PUT replaces the entire resource, POST creates, and GET retrieves. In Cisco Meraki API, PATCH is used to update specific attributes of a network.

Answer

GET

Answer

PUT

Answer

POST

Question 7

A developer is building a Python script that calls the Cisco Webex Teams API to list all memberships in a room. The API returns a maximum of 100 items per page and includes a 'Link' header in the response. The developer needs to retrieve all memberships across multiple pages. What is the correct approach to handle pagination using the Link header?

Accepted Answer

Parse the Link header for the 'rel="next"' URL and make a GET request to that URL to retrieve the next page of results, repeating until no 'next' link is present.. The correct approach is to parse the Link header for the 'rel="next"' URL and follow it. This is how the Webex Teams API implements pagination, using RFC 5988 Link headers. The other options suggest methods not supported by this API, such as page numbers, max parameter for all items, or body tokens. Following the next link ensures all pages are retrieved correctly.

Answer

Use the 'max' query parameter to request all memberships in a single response, avoiding pagination.

Answer

Extract the 'nextPageToken' from the JSON response body and include it as a query parameter in the next request.

Answer

Increment the 'page' query parameter by 1 in each subsequent request until an empty response is returned.

Question 8

A developer is testing a custom REST API that returns a JSON error object with an HTTP 400 status when an invalid query parameter is sent. They want to confirm that the API is behaving correctly according to REST conventions. Which HTTP status code class indicates that the client's request contains an error that the client can potentially fix?

Accepted Answer

4xx. HTTP status codes are grouped into classes, and the 4xx class is reserved for client errors. An HTTP 400 Bad Request is a 4xx code, so it signals that the client sent something invalid, such as a malformed query parameter. Recognizing this class helps developers distinguish between problems they can fix in their request and problems that originate on the server.

Answer

5xx

Answer

2xx

Answer

3xx

Question 9

A developer is writing a Python script that calls the Cisco Webex API. The script must handle the case where the API returns a 429 Too Many Requests response. Which HTTP response header should the script inspect to determine how long to wait before retrying the request?

Accepted Answer

Retry-After. When a REST API throttles a client with 429 Too Many Requests, the standard way to communicate the required backoff is the Retry-After response header, which contains either a number of seconds or an HTTP date. Cisco Webex returns this header, so a well-behaved client reads it and delays the next attempt accordingly, rather than retrying immediately and remaining throttled.

Answer

X-RateLimit-Limit

Answer

Cache-Control

Answer

Link

Question 10

A developer is building a Python application that integrates with Cisco DNA Center. The application needs to authenticate and then retrieve a list of network devices. The developer decides to use the DNA Center Intent API. Which two steps are required to successfully authenticate and make an API call? (Choose two.)

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with Basic Auth credentials to obtain a token.. To authenticate with the DNA Center Intent API, the developer must first obtain a token by sending a POST request with Basic Auth credentials to the token endpoint. Then, that token must be included in the 'X-Auth-Token' header for all subsequent API calls. This two-step process ensures secure authentication and authorization. The other options describe incorrect or insecure methods that are not supported by DNA Center.

Answer

Generate a JWT token using the DNA Center certificate and sign each request with it.

Answer

Use OAuth 2.0 with the client credentials grant to obtain an access token from the /token endpoint.

Answer

Pass the username and password as query parameters in each API request.

Question 11

A developer is building a Python script that calls the Cisco Webex API to retrieve a list of rooms. The API returns a maximum of 100 items per page and includes a 'Link' response header with a rel="next" URL. The script must automatically fetch all pages until no 'next' link remains. Which approach should the developer implement?

Accepted Answer

Parse the Link header, extract the URL with rel="next", and issue a GET request to that URL in a loop until the header is absent.. The Webex API provides pagination through Link headers containing a rel="next" URL. Following that URL in a loop ensures all pages are retrieved. Other methods like page numbers, large max values, or offset parameters are not supported by this API and would fail to return the complete dataset.

Answer

Set the 'max' query parameter to 1000 and make a single GET request to retrieve all rooms at once.

Answer

Use the 'offset' query parameter, increasing it by 100 on each request until the response body is empty.

Answer

Increment a 'page' query parameter starting at 0 and continue until an empty JSON array is returned.

Question 12

A developer is using the Cisco Meraki Dashboard API to update the configuration of a wireless SSID. The API requires a PUT request to /networks/{networkId}/wireless/ssids/{number}. Which HTTP header is mandatory to include the API key for authentication?

Accepted Answer

X-Cisco-Meraki-API-Key. The Meraki Dashboard API requires the API key to be sent in the X-Cisco-Meraki-API-Key header. This custom header is the only accepted method for authentication. Other headers like Authorization or X-Auth-Token are used by different Cisco APIs and will not work with Meraki. Content-Type is for the request body, not authentication.

Answer

Content-Type: application/json

Answer

X-Auth-Token

Answer

Authorization: Bearer <token>

Question 13

A developer is designing a Python application that will consume multiple REST APIs from different Cisco platforms. The application must handle common API behaviors such as authentication, rate limiting, and error responses. Which TWO of the following are best practices for making the application robust and maintainable? (Choose two.)

Accepted Answer

Implement exponential backoff when retrying requests after receiving 5xx errors.. Implementing exponential backoff for retries and using a shared HTTP session are both best practices that enhance robustness and maintainability. Exponential backoff handles transient errors gracefully, while a session improves performance and simplifies authentication management. Together, they help build a resilient application that can handle common API behaviors effectively.

Answer

Ignore HTTP status codes and parse the response body for error messages.

Answer

Hard-code API keys and tokens directly in the source code for simplicity.

Answer

Always use synchronous requests to simplify code and avoid concurrency issues.

Question 14

A developer is integrating with Cisco DNA Center. After a successful POST to create a new site, the API returns HTTP 202 Accepted with a task ID in the response body. The developer needs to confirm when the site creation completes. What should the developer do next?

Accepted Answer

Poll the task endpoint using the returned task ID until the task status indicates success or failure.. Cisco DNA Center uses asynchronous task processing for many write operations. A 202 Accepted response includes a task ID, and the client must poll the task endpoint until the status reflects completion. Treating 202 as success, resending the POST, or immediately reading the resource can produce duplicates or false assumptions about the resource state.

Answer

Immediately issue a GET to the site endpoint and assume the site exists if any response is returned.

Answer

Resend the original POST request with the same payload until a 201 Created is returned.

Answer

Treat the 202 response as final success and proceed without further verification.

Question 15

A developer is building a Python application that consumes the Cisco Webex Teams API. The application needs to handle rate limiting gracefully. Which TWO of the following are appropriate strategies when the API returns a 429 Too Many Requests status code? (Choose two.)

Accepted Answer

Implement exponential backoff, doubling the wait time after each consecutive 429 response.. When encountering a 429 Too Many Requests, the client should respect the Retry-After header if present, or implement exponential backoff to gradually increase wait times. These strategies prevent further rate limit violations and allow successful retries. Immediate retries, ignoring the error, or switching endpoints do not address the root cause and can lead to continued failures.

Answer

Ignore the 429 error and continue sending requests as fast as possible.

Answer

Immediately retry the request without any delay.

Answer

Switch to a different API endpoint that is not rate limited.