200-901 Understanding and Using APIs — Timed 20 Questions

Question 1

What HTTP method should be used to update only the description field of a network device resource via a REST API?

Accepted Answer

PATCH. PATCH is used for partial updates, whereas PUT replaces the entire resource. GET retrieves, POST creates, DELETE removes.

Answer

DELETE

Answer

PUT

Answer

POST

Question 2

A developer is building a script to retrieve a list of network devices from Cisco DNA Center. The API response includes a 'nextToken' field in the body to indicate more results. What pagination method is being used?

Accepted Answer

Cursor-based pagination. Cursor-based pagination uses a token (e.g., nextToken) to point to the next set of results, unlike offset/limit which uses page numbers.

Answer

Page-based pagination

Answer

Offset/Limit pagination

Answer

Link header pagination

Question 3

Which HTTP header is used to specify the format of the request body (e.g., application/json) when sending a POST request to a REST API?

Accepted Answer

Content-Type. Content-Type indicates the media type of the request body. Accept indicates the desired response format. Authorization carries credentials.

Answer

Accept

Answer

Authorization

Answer

X-Requested-With

Question 4

A developer is using the Meraki Dashboard API and receives a 429 Too Many Requests error. The API documentation states a rate limit of 5 calls per second. What is the best practice to handle this?

Accepted Answer

Implement exponential backoff and honor the Retry-After header.. Implementing exponential backoff with retry-after headers is the recommended approach for rate-limited APIs. Ignoring or simply retrying immediately may worsen the situation.

Answer

Ignore the error and retry immediately.

Answer

Use a different API key to bypass the limit.

Answer

Increase the number of concurrent requests to exhaust the rate limit quickly.

Question 5

Which OAuth 2.0 grant type is most appropriate for a server-to-server integration where no user interaction is required, such as a backend service calling Cisco API?

Accepted Answer

Client credentials grant. Client credentials grant is designed for server-to-server scenarios without user consent. Authorization code requires user interaction. Device code is for devices with limited UI.

Answer

Authorization code grant

Answer

Password grant

Answer

Device code grant

Question 6

A developer wants to use Postman to test a REST API that requires a Bearer token. Where should the token be placed in the request?

Accepted Answer

In the Authorization header. The Bearer token is placed in the Authorization header using the format 'Bearer <token>'. The request body is used for data, not authentication.

Answer

As a query parameter

Answer

In a custom header like X-Auth-Token

Answer

In the request body

Question 7

What is the correct URL path for retrieving the configuration of a network interface using RESTCONF on a Cisco device?

Accepted Answer

/restconf/data/ietf-interfaces:interfaces. RESTCONF uses /restconf/data/ followed by the YANG module path. The standard path for interfaces is /restconf/data/ietf-interfaces:interfaces.

Answer

/restconf/data/interfaces

Answer

/api/restconf/data/interfaces

Answer

/restconf/operations/get-config

Question 8

A network engineer wants to stream telemetry data from a Cisco router using gRPC. Which gRPC service model is typically used for the router to push data to a collector?

Accepted Answer

Dial-out model. Dial-out streaming (also called telemetry push) is where the device initiates the connection and sends data to the collector. Dial-in is where the collector pulls data from the device.

Answer

RESTCONF events

Answer

NETCONF subscription

Answer

Dial-in model

Question 9

Which NETCONF operation is used to retrieve the entire configuration datastore from a network device?

Accepted Answer

. retrieves configuration datastore. retrieves state and config data. modifies configuration. confirms a candidate configuration.

Answer

<edit-config>

Answer

<get>

Answer

Question 10

What is the purpose of the 'Authorization' header in a REST API request?

Accepted Answer

To authenticate the client. The Authorization header carries credentials (e.g., Bearer token, Basic auth) to authenticate the client. Content-Type specifies body format. Accept specifies response format.

Answer

To enable caching of the response

Answer

To specify the desired response format

Answer

To specify the format of the request body

Question 11

A developer is using the Webex API to create a webhook that triggers when a new message is posted in a room. What information is typically included in the webhook payload sent by Webex to the callback URL?

Accepted Answer

The resource type, event type, and relevant IDs (e.g., message ID, room ID). Webhook payloads contain event details such as resource, event type, and relevant data like message ID and room ID. The full message content is not included; the application must fetch it via API.

Answer

The full message content and all room members

Answer

The OAuth token for the bot

Answer

The complete list of webhooks configured on the account

Question 12

In Cisco DNA Center's intent API, which endpoint would you use to retrieve the list of all network devices?

Accepted Answer

GET /dna/intent/api/v1/network-device. The correct endpoint is GET /dna/intent/api/v1/network-device. Other options are incorrect or refer to other areas like topology or site hierarchy.

Answer

GET /dna/intent/api/v1/topology

Answer

GET /dna/intent/api/v1/site

Answer

GET /dna/intent/api/v1/issues

Question 13

A developer needs to use Postman to test an API that uses Basic authentication. How should the credentials be configured in Postman?

Accepted Answer

Use the Authorization tab, select Basic Auth, and enter username and password. Postman's Authorization tab provides a Basic Auth type that automatically encodes credentials. The raw base64-encoded string is the underlying mechanism but is handled by Postman. Basic auth does not use bearer tokens.

Answer

Send the credentials in the request body as JSON

Answer

Set the Authorization header to 'Bearer base64(username:password)'

Answer

Add a query parameter 'auth' with base64-encoded credentials

Question 14

Which authentication flow is most appropriate for a native mobile app that needs to access the Webex API on behalf of a user?

Accepted Answer

Authorization code grant. The authorization code grant is designed for apps that can securely store a client secret, but for native apps, PKCE (Proof Key for Code Exchange) is recommended. However, among standard grants, authorization code is the correct choice for user delegation.

Answer

Client credentials grant

Answer

Resource owner password grant

Answer

Implicit grant

Question 15

What is the correct Content-Type header value for a RESTCONF request using JSON encoding?

Accepted Answer

application/yang-data+json. RESTCONF uses application/yang-data+json for JSON and application/yang-data+xml for XML. application/json is not specific to YANG data.

Answer

application/json

Answer

text/json

Answer

application/xml

Question 16

Which TWO of the following are valid OAuth 2.0 grant types? (Select TWO)

Accepted Answer

Client credentials. Authorization code and client credentials are standard grant types. Basic is not OAuth 2.0. API key is a different authentication method. Implicit is deprecated.

Answer

API key

Answer

Basic authentication

Answer

Implicit grant

Question 17

Which THREE of the following are characteristics of NETCONF? (Select THREE)

Accepted Answer

Uses SSH as the transport protocol. NETCONF uses SSH for transport, XML-encoded RPCs, and operations like edit-config/get-config. It does not use HTTP or JSON, and it is not stateless.

Answer

Uses HTTP as the transport protocol

Answer

Supports JSON encoding for data

Question 18

Which TWO of the following are commonly used when implementing pagination in REST APIs? (Select TWO)

Accepted Answer

Cursor-based token in response. Offset/limit (or page/limit) and cursor-based pagination are common. Rate limiting is separate. OAuth is authentication. Webhooks are for events.

Answer

Rate limiting headers

Answer

OAuth 2.0 token

Answer

Webhook callback URL

Question 19

Which TWO of the following are HTTP methods used for creating or updating resources in REST APIs? (Select TWO)

Accepted Answer

PUT. POST is used to create, PUT to fully replace, and PATCH to partially update. GET retrieves, DELETE removes.

Answer

DELETE

Answer

GET

Question 20

An application needs to retrieve a list of network devices from Cisco DNA Center. Which HTTP method should be used against the /dna/intent/api/v1/network-device endpoint?

Accepted Answer

GET. GET is used to retrieve resources in REST APIs.

Answer

PUT

Answer

DELETE

Answer

POST