200-901 Hard Questions — 25 Difficult Questions

Question 1

An engineer is using EEM on an IOS XE device. They want to trigger an applet when a specific syslog message appears. Which event trigger type should they use?

Accepted Answer

event syslog pattern. The 'event syslog pattern' trigger in EEM (Embedded Event Manager) is specifically designed to fire an applet when a syslog message matching a regex pattern is logged. It watches the device's syslog stream and activates the applet when the pattern matches. This is the canonical trigger for reacting to specific log events on IOS XE.

Answer

event interface

Answer

event cli match

Answer

event timer

Question 2

A network engineer is configuring EtherChannel between two switches. The switches are connected via four links. The engineer wants to load balance traffic based on source and destination IP addresses. Which configuration command should be used on Cisco IOS?

Accepted Answer

port-channel load-balance src-dst-ip. The command 'port-channel load-balance src-dst-ip' configures EtherChannel to use both the source and destination IP addresses in the hash algorithm, which is exactly what the engineer needs for load balancing based on source and destination IP addresses. This ensures traffic distribution across the four links by computing a hash on the combination of source and destination IPs, providing a balanced distribution for IP traffic.

Answer

port-channel load-balance src-ip

Answer

port-channel load-balance dst-ip

Answer

port-channel load-balance src-dst-mac

Question 3

A network automation engineer is evaluating options for model-driven programmability on Cisco devices. Which THREE are valid YANG model sources or tools? (Choose three.)

Accepted Answer

pyang. pyang is a YANG tool, yangcatalog.org is a repository, and Cisco native models are valid sources. OpenConfig is a standard, but oc-interfaces is a model, not a source/tool.

Answer

NETCONF

Answer

oc-interfaces

Question 4

An engineer is exploring YANG models for network interfaces. They need a vendor-neutral model that can be used across multiple device types. Which YANG model should they use?

Accepted Answer

OpenConfig interfaces. OpenConfig interfaces is a vendor-neutral YANG model developed by the OpenConfig working group, which aims to provide standardized data models that work across multiple vendors and device types. Unlike vendor-specific models, OpenConfig models are designed to be implemented consistently on different platforms, enabling multi-vendor automation and management. Therefore, for a vendor-neutral model usable across multiple device types, OpenConfig interfaces is the correct choice.

Answer

ietf-interfaces

Answer

Cisco-NX-OS-device

Answer

Cisco-IOS-XE-native

Question 5

A network administrator is deploying a custom container application on a Cisco Catalyst 9300 switch running IOS XE 16.12. The application is packaged as a .tar file and installed using 'app-hosting install app myapp flash:myapp.tar'. The administrator configures the app-hosting context as follows:

app-hosting app myapp
 app-default-gateway 192.168.1.1
 app-vnic gateway0 guest-interface 0
  guest-ipaddress 192.168.1.10 netmask 255.255.255.0
 app-resource profile custom
  cpu 1000
  memory 2048
  storage 5000

The administrator also creates a virtual port group 'vg0' and assigns it to the management interface. The application fails to start with the error: 'Application failed to start: guest interface not ready'. The administrator verifies that the .tar file is valid, the resources are sufficient, and the gateway is reachable. What is the most likely cause of the failure?

Accepted Answer

The guest-interface is not bound to the virtual port group.. The error 'guest interface not ready' indicates that the virtual network interface defined in the app-hosting configuration is not properly linked to a virtual port group on the switch. In IOS XE, the 'app-vnic gateway0 guest-interface 0' command must be associated with a virtual port group (e.g., 'vpg vg0') using the 'guest-interface 0' binding under the virtual port group configuration. Without this binding, the guest interface remains uninitialized, preventing the container from starting.

Answer

The application requires a DHCP server, but the configuration uses a static IP address.

Answer

The .tar file is corrupt despite appearing valid.

Answer

The CPU allocation of 1000 units is insufficient for the application.

Question 6

A network engineer configures an HTTP/2 server. Which feature of HTTP/2 reduces overhead by compressing headers using HPACK?

Accepted Answer

HPACK. HPACK is the header compression mechanism specified for HTTP/2 (RFC 7541). It reduces overhead by encoding HTTP headers into a compact binary format using static and dynamic tables, eliminating redundant header data across requests. This directly addresses the question's focus on reducing overhead through header compression.

Answer

Server push

Answer

Binary framing layer

Answer

Multiplexed streams

Question 7

An IPv6-enabled host is trying to discover the MAC address of another host on the same link. The host knows the destination IPv6 address but does not have a corresponding entry in the neighbor cache. Which protocol and message type does the host use?

Accepted Answer

Neighbor Solicitation (ICMPv6 type 135). When an IPv6 host needs to resolve a known destination IPv6 address to its MAC address on the same link, it sends a Neighbor Solicitation (NS) message, which is ICMPv6 type 135. This message is multicast to the solicited-node multicast address of the target, and the host with that IPv6 address responds with a Neighbor Advertisement (ICMPv6 type 136) containing its MAC address. This process replaces ARP in IPv4 and is defined in RFC 4861.

Answer

Neighbor Advertisement (ICMPv6 type 136)

Answer

Router Solicitation (ICMPv6 type 133)

Answer

Address Resolution Protocol (ARP)

Question 8

A large enterprise is migrating to a DevOps model and needs to automate the provisioning of network devices. The team has chosen Ansible for configuration management and is using a Git repository for version control. The network includes Cisco IOS routers, Catalyst switches running IOS-XE, and ASA firewalls. The team has written Ansible playbooks for each device type. The goal is to have a CI/CD pipeline that automatically deploys configuration changes to the production network after the changes are merged into the main branch. However, during a recent deployment, a misconfiguration was pushed to a core router, causing a 10-minute outage. The root cause was that the playbook that was executed was not the correct one for that device model. The team wants to implement a mechanism to prevent similar incidents. Which approach should the team adopt?

Accepted Answer

Implement a CI/CD pipeline that runs playbooks against a staging environment with similar devices, and only deploy to production after successful validation. A staging environment with similar devices allows the team to validate playbooks against representative hardware before production deployment. This catches model-specific incompatibilities (e.g., a playbook written for IOS-XE being applied to a classic IOS router) without risking production outages. The CI/CD pipeline can run the same playbooks in staging, verify the resulting device state, and only promote changes to production after successful validation.

Answer

Require all changes to be approved by a change advisory board before merging

Answer

Require two-person peer review for all playbook changes

Answer

Use a pre-commit hook that checks the playbook syntax and device compatibility

Question 9

A developer is using NETCONF to retrieve the running configuration of a network device. Which operation should be used?

Accepted Answer

. The operation retrieves configuration from a datastore (e.g., running).

Answer

<get>

Answer

<copy-config>

Answer

<edit-config>

Question 10

A CI/CD pipeline for network automation includes a stage that runs Ansible playbooks against a staging environment. The pipeline is triggered by Git commits. After a commit, the pipeline fails because the Ansible inventory file is missing. What is the most likely reason?

Accepted Answer

The inventory file is listed in .gitignore. The most likely reason the Ansible inventory file is missing is that it is listed in .gitignore, which prevents it from being tracked by Git and thus not present in the repository when the pipeline clones it. Since the pipeline is triggered by Git commits, it only has access to files that are committed and pushed. If the inventory file is ignored, it will not be available for the Ansible playbook execution, causing the pipeline to fail.

Answer

The pipeline script has a typo in the inventory path

Answer

The Ansible version in the pipeline is incompatible

Answer

The staging environment is not reachable

Question 11

Which THREE of the following are features of HTTP/2?

Accepted Answer

Header compression (HPACK). HTTP/2 introduces HPACK header compression (option A), which reduces overhead by compressing header fields using a static table, a dynamic table, and Huffman encoding, making it a defining feature of the protocol. It also uses binary framing (option D), splitting communication into binary-encoded frames (HEADERS, DATA, SETTINGS, etc.) instead of HTTP/1.1's textual format, which enables more efficient parsing and processing. Multiplexed streams (option E) allow many concurrent request/response exchanges over a single TCP connection, eliminating HTTP/1.1's head-of-line blocking at the application layer. Option B is incorrect because HTTP/2 headers are binary-encoded, not plain text, and option C is incorrect because persistent connections already existed in HTTP/1.1 and are not a new or distinguishing feature of HTTP/2.

Answer

Plain text headers

Answer

Persistent connections

Question 12

Which three statements about Webex API webhooks are true? (Choose three.)

Accepted Answer

Webhooks deliver event data via HTTP POST to a specified URL.. Option A is correct because Webex webhooks push event notifications as an HTTP POST request containing a JSON payload to the target URL you register. Option C is correct because when creating a webhook you specify the resource (e.g., messages, meetings, memberships) and the event (e.g., created, updated, deleted), so it only fires for those matching events. Option D is correct because webhooks are registered programmatically by sending an authenticated POST request to the Webex REST endpoint https://webexapis.com/v1/webhooks with fields such as name, targetUrl, resource, and event. Option B is not required: webhook creation uses an OAuth 2.0 access token (often from an integration or bot), not specifically the client credentials grant, and webhook delivery itself is secured via a secret/signature rather than that grant. Option E is incorrect because Webex webhooks are push-based HTTP callbacks, not long polling.

Answer

Webhooks require OAuth 2.0 client credentials grant for security.

Answer

Webhooks use long polling to receive events.

Question 13

Which THREE of the following are characteristics of IPv6? (Select exactly three.)

Accepted Answer

IPv6 does not have a built-in NAT requirement.. IPv6 was designed without a built-in requirement for Network Address Translation (NAT) because its vast 128-bit address space allows every device to have a globally unique public IP address. Unlike IPv4, which relies on NAT to conserve limited address space, IPv6 restores end-to-end connectivity by default, eliminating the need for address translation at the network edge.

Answer

IPv6 addresses are 32 bits in length.

Answer

IPv6 uses ARP to resolve MAC addresses.

Question 14

A large enterprise uses Cisco DNA Center to manage over 500 network devices across multiple sites. The network operations team wants to automate the validation of device compliance with a baseline configuration. They have a Python script that uses the Cisco DNA Center REST API to retrieve the device configuration and compare it against a golden configuration stored in a local file. Recently, the script started failing with a 401 HTTP response code when trying to authenticate. The team confirmed the username and password are correct and that the DNA Center server is reachable. The script uses the /api/system/v1/auth/token endpoint to obtain a token. Which of the following is the most likely cause of the 401 error?

Accepted Answer

The authentication token has expired and the script is not refreshing it.. The 401 HTTP response code indicates an authentication failure. Since the username and password are confirmed correct and the server is reachable, the most likely cause is that the script obtained a token earlier but is now using an expired token without refreshing it. Cisco DNA Center tokens have a configurable timeout (default 1 hour), and the script must re-authenticate or refresh the token before it expires.

Answer

The API endpoint requires a different HTTP method (e.g., POST vs GET).

Answer

The script is using an incorrect API version path (e.g., /v2 instead of /v1).

Answer

CORS (Cross-Origin Resource Sharing) is blocking the request.

Question 15

Refer to the exhibit. A Python script uses the YANG model to configure the interface. After applying this JSON payload via a PATCH request, what is the expected operational state of the interface?

Accepted Answer

Administratively down. The PATCH request applies the provided JSON payload, which sets the interface's 'enabled' leaf to 'false' (or equivalent YANG leaf for administrative state). In YANG models for interfaces (e.g., RFC 8343 or Cisco native models), setting 'enabled' to false places the interface in an administratively down state. The PATCH operation is valid for modifying interface configuration, and the payload explicitly changes the administrative state to down, overriding any previous configuration.

Answer

Error because PATCH is not allowed on interfaces

Answer

No change, remains as previously configured

Answer

Administratively up and protocol up

Question 16

A developer is building a Webex Teams bot that monitors network alerts from Cisco DNA Assurance. The bot must authenticate to the Webex API. Which authentication method should be used?

Accepted Answer

OAuth2 client credentials grant with bot token. Webex Teams bots require OAuth2 client credentials grant to obtain a bot token, which is a long-lived, scoped token that authenticates the bot without user interaction. This method is designed for server-to-server communication, matching the bot's need to post messages and listen for events via the Webex API. Basic authentication, session cookies, and API keys are not supported or appropriate for bot authentication in Webex.

Answer

Basic authentication with username/password

Answer

Session ID cookie

Answer

API key in query string

Question 17

A Python script using the Cisco Meraki API v1 is failing with a 429 status code. What is the recommended course of action?

Accepted Answer

Implement retry logic with exponential backoff and respect Retry-After header. A 429 status code indicates rate limiting, meaning the client has exceeded the allowed number of requests per time window. The correct response is to implement retry logic with exponential backoff and respect the Retry-After header, which tells the client how long to wait before retrying. This is a standard best practice for REST APIs, including Cisco Meraki's API v1, to handle rate limits gracefully without overwhelming the server.

Answer

Change the API endpoint to a different region

Answer

Check the API token

Answer

Increase the rate limit on the dashboard

Question 18

A developer is working with the Cisco SD-WAN vManage API to monitor overlay tunnels. They need to retrieve a list of all devices with their site IDs and IP addresses. Which API endpoint is most appropriate?

Accepted Answer

GET /dataservice/device. The GET /dataservice/device endpoint returns a list of all devices managed by the Cisco SD-WAN vManage, including their site IDs and IP addresses. This is the correct endpoint for retrieving device inventory details, as it provides the necessary fields like 'deviceId', 'system-ip', and 'site-id' in the response.

Answer

GET /dataservice/device/monitor

Answer

GET /dataservice/device/device

Answer

GET /dataservice/device/overlay

Question 19

Using the Cisco DNA Center API, an engineer wants to create a new site with building and floor information. Which HTTP method and endpoint should be used?

Accepted Answer

POST /dna/intent/api/v1/site. The POST HTTP method is used to create a new resource on the server, and the Cisco DNA Center API endpoint `/dna/intent/api/v1/site` is designed to accept a POST request with a JSON payload containing site, building, and floor details. This follows RESTful conventions where POST is the standard method for resource creation, and the API documentation specifies this exact endpoint for adding a new site hierarchy.

Answer

PUT /dna/intent/api/v1/site

Answer

GET /dna/intent/api/v1/site

Answer

POST /dna/intent/api/v1/site/create

Question 20

A network engineer wants to stream telemetry data from a Cisco router using gRPC. Which gRPC service model is typically used for the router to push data to a collector?

Accepted Answer

Dial-out model. Dial-out streaming (also called telemetry push) is where the device initiates the connection and sends data to the collector. Dial-in is where the collector pulls data from the device.

Answer

RESTCONF events

Answer

NETCONF subscription

Answer

Dial-in model