200-901 Timed Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A developer is building a Docker image for a Node.js application. The Dockerfile contains:
```
FROM node:14
WORKDIR /usr/src/app
COPY package*.json ./
RUN npm install
COPY . .
CMD ["node", "app.js"]
```
When building, the error shown occurs. What is the most likely cause?

Accepted Answer

The application is running as a non-root user (e.g., node) that lacks write permission to the working directory.. The error occurs because the official Node.js Docker image (node:14) runs as a non-root user named 'node' by default. The WORKDIR /usr/src/app is owned by root, so the 'node' user lacks write permission to that directory. When npm install tries to create node_modules or write package-lock.json, it fails with a permission error. Option D correctly identifies this user-permission mismatch.

Answer

The Dockerfile should use the root user for running npm install.

Answer

The npm install command should be run with the --unsafe-perm flag.

Answer

The base image node:14 is outdated and contains a bug.

Question 2

A network engineer is configuring EtherChannel between two switches. The switches are connected via four links. The engineer wants to load balance traffic based on source and destination IP addresses. Which configuration command should be used on Cisco IOS?

Accepted Answer

port-channel load-balance src-dst-ip. The command 'port-channel load-balance src-dst-ip' configures EtherChannel to use both the source and destination IP addresses in the hash algorithm, which is exactly what the engineer needs for load balancing based on source and destination IP addresses. This ensures traffic distribution across the four links by computing a hash on the combination of source and destination IPs, providing a balanced distribution for IP traffic.

Answer

port-channel load-balance src-ip

Answer

port-channel load-balance dst-ip

Answer

port-channel load-balance src-dst-mac

Question 3

A developer is using the Meraki Dashboard API to retrieve a list of clients for a network. The API returns a 429 error. What should the developer do to handle this correctly?

Accepted Answer

Wait for the number of seconds specified in the Retry-After header before retrying.. A 429 HTTP status code indicates 'Too Many Requests,' meaning the client has exceeded the rate limit imposed by the Meraki Dashboard API. The correct handling is to respect the Retry-After header, which specifies the number of seconds the client must wait before retrying the request, as per RFC 7231 Section 7.1.3. This ensures compliance with API rate limits and prevents further throttling or temporary blocking.

Answer

Ignore the error and continue, as 429 is a temporary issue.

Answer

Switch to a different base URL to bypass the limit.

Answer

Increase the request rate by using multiple API keys in parallel.

Question 4

A developer is working with the Cisco SD-WAN vManage API to monitor overlay tunnels. They need to retrieve a list of all devices with their site IDs and IP addresses. Which API endpoint is most appropriate?

Accepted Answer

GET /dataservice/device. The GET /dataservice/device endpoint returns a list of all devices managed by the Cisco SD-WAN vManage, including their site IDs and IP addresses. This is the correct endpoint for retrieving device inventory details, as it provides the necessary fields like 'deviceId', 'system-ip', and 'site-id' in the response.

Answer

GET /dataservice/device/monitor

Answer

GET /dataservice/device/device

Answer

GET /dataservice/device/overlay

Question 5

An engineer is exploring YANG models for network interfaces. They need a vendor-neutral model that can be used across multiple device types. Which YANG model should they use?

Accepted Answer

OpenConfig interfaces. OpenConfig models are vendor-neutral, while Cisco native models are vendor-specific.

Answer

ietf-interfaces

Answer

Cisco-NX-OS-device

Answer

Cisco-IOS-XE-native

Question 6

A developer notices that after a new deployment, the application is not receiving traffic. The Service selector does not match the pod labels. Which kubectl command can be used to inspect the Service's selector?

Accepted Answer

kubectl describe service my-service. The `kubectl describe service my-service` command displays detailed information about the Service, including its selector field, which defines the label key-value pairs used to match pods. This allows the developer to directly compare the selector against the pod labels to identify the mismatch. It is the most straightforward way to inspect the selector without needing to parse raw YAML or execute commands inside the service.

Answer

kubectl exec service/my-service -- cat /etc/hosts

Answer

kubectl get service my-service -o yaml

Answer

kubectl logs service/my-service

Question 7

A developer needs to send a message to a specific room in Webex using the API. What is the correct endpoint and required body parameter for the room destination?

Accepted Answer

POST /v1/messages with roomId parameter. To send a message to a Webex room, use POST /v1/messages with the roomId parameter to specify the target room.

Answer

POST /v1/messages with toPersonEmail parameter

Answer

POST /v1/memberships with roomId

Answer

POST /v1/rooms with message text

Question 8

A Kubernetes cluster runs a microservice that needs to read configuration values from a ConfigMap and sensitive database credentials from a Secret. The pod manifest references both resources. How should the Secret be mounted to avoid exposing sensitive data in logs or environment variables?

Accepted Answer

Using a volume mount with a secret volume. Mounting a Secret as a volume stores the data in the tmpfs (RAM-backed filesystem) of the pod, which is not written to disk and is not exposed via environment variables that could be logged or printed by the application. This approach prevents accidental leakage of sensitive data through log outputs or environment variable dumps, as the application must explicitly read the file from the mount point.

Answer

Hardcoding the credentials in the ConfigMap

Answer

Using a sidecar container to fetch secrets via API

Answer

Using envFrom with secretRef

Question 9

In a network automation workflow, a developer needs to ensure idempotency. What does idempotency mean in this context?

Accepted Answer

Running the script once produces the same result as running it multiple times. Idempotency in network automation means that executing an operation multiple times results in the same network state as executing it once. For example, using a REST API PUT request to set a VLAN configuration will leave the device in the same state whether the request is sent once or repeatedly, because PUT is inherently idempotent. This prevents unintended side effects like duplicate VLANs or interface misconfigurations when a script is retried due to network failures or timeouts.

Answer

The script uses a single API call

Answer

The script can recover from failures

Answer

The script can run on multiple devices simultaneously

Question 10

A network engineer configures an HTTP/2 server. Which feature of HTTP/2 reduces overhead by compressing headers using HPACK?

Accepted Answer

HPACK. HPACK is the header compression mechanism specified for HTTP/2 (RFC 7541). It reduces overhead by encoding HTTP headers into a compact binary format using static and dynamic tables, eliminating redundant header data across requests. This directly addresses the question's focus on reducing overhead through header compression.

Answer

Server push

Answer

Binary framing layer

Answer

Multiplexed streams

Question 11

An IPv6-enabled host is trying to discover the MAC address of another host on the same link. The host knows the destination IPv6 address but does not have a corresponding entry in the neighbor cache. Which protocol and message type does the host use?

Accepted Answer

Neighbor Solicitation (ICMPv6 type 135). When an IPv6 host needs to resolve a known destination IPv6 address to its MAC address on the same link, it sends a Neighbor Solicitation (NS) message, which is ICMPv6 type 135. This message is multicast to the solicited-node multicast address of the target, and the host with that IPv6 address responds with a Neighbor Advertisement (ICMPv6 type 136) containing its MAC address. This process replaces ARP in IPv4 and is defined in RFC 4861.

Answer

Neighbor Advertisement (ICMPv6 type 136)

Answer

Router Solicitation (ICMPv6 type 133)

Answer

Address Resolution Protocol (ARP)

Question 12

A security team is developing an application that collects network alerts from Cisco Firepower Management Center (FMC) API. The API requires OAuth2 authorization code grant flow. After obtaining an authorization code, what must the application do to get an access token?

Accepted Answer

Exchange the authorization code for an access token by calling the token endpoint with the code and client credentials.. In the OAuth2 authorization code grant flow, the authorization code is an intermediate credential that must be exchanged for an access token. The application must call the token endpoint, presenting the authorization code along with its client credentials (client ID and client secret) to receive the access token. This exchange is required by RFC 6749 and is a fundamental security measure to ensure the client is authorized to obtain the token.

Answer

Resend the authorization request with the code included in the redirect URI.

Answer

Decode the authorization code using base64 to extract the access token.

Answer

Use the authorization code directly in subsequent API requests as a bearer token.

Question 13

A large enterprise uses Cisco SD-Access with fabric automation. The network administrator wants to automate the process of adding a new user device to a specific virtual network (VN) based on its MAC address. Which API or tool should they use?

Accepted Answer

Cisco ISE REST API. Cisco ISE REST API is the correct choice because ISE is the policy and authentication engine in SD-Access that manages endpoint identity and virtual network (VN) assignments. When a new user device is added, the administrator can use the ISE REST API to programmatically create an endpoint entry with its MAC address and map it to a specific VN, leveraging ISE's policy sets and authorization profiles. This directly automates the VN assignment without requiring changes to fabric underlay or overlay configurations.

Answer

Ansible playbook with ios_config

Answer

Cisco DNA Center REST API

Answer

Cisco APIC-EM REST API

Question 14

When implementing network automation with Cisco devices, which THREE practices help ensure idempotency? (Select THREE)

Accepted Answer

Performing a full configuration replace using RESTCONF PUT instead of PATCH.. A full configuration replace using RESTCONF PUT ensures idempotency by setting the entire configuration to a known state, regardless of the current state. Unlike PATCH, which applies incremental changes that may behave differently depending on the existing configuration, PUT overwrites the entire resource, guaranteeing the same result every time it is executed.

Answer

Writing scripts that only push incremental configurations.

Answer

Relying on manual rollback procedures after automation failures.

Question 15

An organization wants to automate the deployment of wireless configurations across multiple Meraki networks using the Meraki Dashboard API. What authentication method should the developer use in the API requests?

Accepted Answer

Include an API key in the X-Cisco-Meraki-API-Key header. The Meraki Dashboard API uses a simple API key for authentication, not OAuth2 or JWT. The key must be included in the `X-Cisco-Meraki-API-Key` header of every request. This is the only supported method for authenticating with the Meraki API, as documented by Cisco Meraki.

Answer

Provide username and password in the Authorization header with Basic auth

Answer

Use OAuth2 client credentials grant and pass a bearer token

Answer

Generate a JSON Web Token (JWT) signed with a shared secret

Question 16

In Cisco DNA Center, which API endpoint is used to retrieve the site hierarchy?

Accepted Answer

GET /dna/intent/api/v1/site. The site hierarchy can be retrieved via GET /dna/intent/api/v1/site.

Answer

POST /dna/intent/api/v1/site

Answer

GET /dna/intent/api/v1/network-device

Answer

GET /dna/intent/api/v1/topology

Question 17

An engineer is troubleshooting packet loss between two hosts on different subnets. The traceroute shows that packets reach the first hop router but then stop. The router's ARP table shows an incomplete entry for the next-hop IP address. What is the most likely cause?

Accepted Answer

The next-hop device is powered off or has a Layer 1 issue.. An incomplete ARP entry for the next-hop IP address indicates that the router sent an ARP request but received no reply. This typically means the next-hop device is unreachable at Layer 2, often because it is powered off, has a failed interface, or there is a cabling issue. Since traceroute shows packets reaching the first hop but not beyond, the Layer 2 failure at the next hop is the most direct cause.

Answer

The MTU is misconfigured on the outgoing interface.

Answer

The routing protocol has not converged yet.

Answer

An ACL is blocking traffic on the outgoing interface.

Question 18

An HTTP/2 connection uses multiple concurrent streams over a single TCP connection. Which feature of HTTP/2 enables this?

Accepted Answer

Multiplexing. Multiplexing is the HTTP/2 feature that allows multiple concurrent streams to share a single TCP connection. This eliminates head-of-line blocking at the application layer by enabling the interleaving of frames from different streams, so a slow response on one stream does not block others.

Answer

Binary framing layer

Answer

Server push

Answer

Header compression (HPACK)

Question 19

A Cisco Catalyst Center API uses OAuth 2.0 with the client credentials grant for server-to-server communication. Which token endpoint parameter should the client include to identify itself?

Accepted Answer

grant_type=client_credentials. In client credentials, the client sends client_id and client_secret (often as Basic auth or form parameters) to authenticate.

Answer

scope=admin

Answer

response_type=token

Answer

grant_type=authorization_code

Question 20

An EEM applet is triggered when a specific syslog message pattern appears. Which action should be used to send a custom syslog message?

Accepted Answer

action 1.0 syslog msg "Custom event occurred". EEM applets use 'action syslog msg ' to generate a syslog message.

Answer

action 1.0 cli command "show logging"

Answer

action 1.0 info type routername

Answer

action 1.0 set 1.0 _syslog_msg "Custom event"