200-901 Infrastructure and Automation Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are valid methods to handle API rate limiting in a Python automation script? (Select exactly 3.)

Accepted Answer

Parse the Retry-After header from the response. The Retry-After header is a standard HTTP mechanism (defined in RFC 7231) that explicitly tells the client how long to wait before making the next request. Parsing this header allows your Python script to respect the server's rate limit dynamically, rather than using a fixed or arbitrary delay. This is a common pattern when interacting with REST APIs that enforce rate limiting.

Answer

Sleep for a fixed amount of time between requests

Answer

Ignore the limit and send requests faster

Question 2

Refer to the exhibit. An automation script expects the interface IP address to be configured via DHCP. Based on the output, what is the current configuration source for the IP address?

Accepted Answer

Manual configuration (NVRAM). The output shows 'IP address is 192.168.1.1, subnet mask is 255.255.255.0' with no DHCP or BOOTP flags, and the configuration is stored in NVRAM (startup-config). This indicates the IP was manually configured (typed by an administrator) and saved, not obtained via DHCP. Option C is correct because the source is manual configuration from NVRAM.

Answer

DHCP

Answer

BOOTP

Answer

PPP negotiation

Question 3

Refer to the exhibit. A Python script uses the YANG model to configure the interface. After applying this JSON payload via a PATCH request, what is the expected operational state of the interface?

Accepted Answer

Administratively down. The PATCH request applies the provided JSON payload, which sets the interface's 'enabled' leaf to 'false' (or equivalent YANG leaf for administrative state). In YANG models for interfaces (e.g., RFC 8343 or Cisco native models), setting 'enabled' to false places the interface in an administratively down state. The PATCH operation is valid for modifying interface configuration, and the payload explicitly changes the administrative state to down, overriding any previous configuration.

Answer

Error because PATCH is not allowed on interfaces

Answer

No change, remains as previously configured

Answer

Administratively up and protocol up

Question 4

Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?

Accepted Answer

Wrong SSH username or password. The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.

Answer

The device is unreachable

Answer

The playbook syntax is incorrect

Answer

The device is not running IOS

Question 5

You are a network automation engineer at a large enterprise. The network consists of 200 Cisco Catalyst switches distributed across five data centers. Each switch runs IOS-XE and supports NETCONF. Your team uses a centralized Ansible control node to manage configurations. Recently, the security team mandated that all management access must use SSH keys instead of passwords. You updated the Ansible inventory to use SSH keys and tested on a few switches successfully. However, when you run the playbook against all switches, about 30 switches fail with the error: 'Authentication failed.' You verify that the SSH public key is correctly deployed on those switches via the console. What is the most likely cause of the failure?

Accepted Answer

The private key file on the Ansible control node has permissions 644, which SSH rejects. SSH strictly requires private key files to have permissions no more permissive than 600 (owner read/write) or 640 (owner read/write, group read) on Unix-like systems. A permission of 644 allows group and others to read the key, which SSH interprets as insecure and refuses to use, causing 'Authentication failed' even though the public key is correctly deployed on the switches.

Answer

The public key on the switches is not in the correct format

Answer

The Ansible become method is misconfigured

Answer

The switches are not reachable over the network

Question 6

You are automating the deployment of a new software image on a fleet of Cisco Nexus switches using Ansible. The switches are in a production environment and must have minimal downtime. You have a maintenance window of 30 minutes per switch. Your playbook performs the following steps: 1) Copy the image to the switch via SCP, 2) Set the boot variable to the new image, 3) Save the configuration, 4) Reload the switch. During a dry run on a test switch, you notice that the reload step takes 8 minutes, but the copy step takes 15 minutes due to slow link speed. For the production rollout, you need to reduce the overall time per switch. Which approach should you take?

Accepted Answer

Use a local file server with HTTP for image transfer to improve speed. The bottleneck is the SCP copy time (15 minutes), which exceeds the 30-minute maintenance window when combined with the reload (8 minutes). Using HTTP for image transfer leverages a more efficient protocol with better throughput and lower overhead than SCP, which uses SSH encryption and can be slower on low-bandwidth links. This directly reduces the copy time, bringing the total per-switch time under the maintenance window limit.

Answer

Skip the save configuration step to save time

Answer

Use a compressed image to reduce copy time

Answer

Reload all switches simultaneously in the same maintenance window

Question 7

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

Accepted Answer

Use an idempotent Ansible module that checks for existing VLANs before creating them.. Ansible's idempotent modules, such as `ios_vlan` for Cisco IOS devices, are designed to check the current state of the device before making changes. If the VLAN already exists, the module will report 'ok' and not attempt to create it again, preventing the error and ensuring the playbook completes successfully. This aligns with Ansible's best practice of writing idempotent playbooks that produce the same result regardless of how many times they are run.

Answer

Modify the playbook to skip switches where the VLAN already exists.

Answer

Remove the VLAN from all switches before creating it again.

Answer

Add ignore_errors: yes to the VLAN creation task.

Question 8

Which TWO statements accurately describe characteristics of infrastructure as code (IaC) in network automation?

Accepted Answer

IaC tools use declarative or imperative models to define the desired state of network infrastructure.. Infrastructure as Code (IaC) tools like Ansible, Terraform, and Cisco NSO allow network engineers to define the desired state of infrastructure using either declarative (what the end state should be) or imperative (step-by-step instructions) models. This abstraction enables consistent, repeatable deployments and reduces configuration drift across the network.

Answer

IaC eliminates the need for manual review of configuration changes before deployment.

Answer

IaC requires that all network devices be replaced with software-based equivalents.

Answer

IaC is only applicable to virtual network functions, not physical devices.

Question 9

Refer to the exhibit. A network engineer applies this JSON-based QoS policy to a Cisco device using NETCONF/YANG. Which statement best describes the expected behavior for traffic from 10.0.0.0/24 with DSCP EF?

Accepted Answer

Traffic from 10.0.0.0/24 with DSCP EF is re-marked to AF41 and limited to 100 Mbps; excess is dropped.. The JSON-based QoS policy uses a class map matching traffic from source 10.0.0.0/24 with DSCP EF, then applies a police action that re-marks exceeding traffic to AF41 and drops it when the rate exceeds 100 Mbps. This is a standard two-rate policer behavior in Cisco IOS QoS, where conforming traffic is transmitted unchanged and exceeding traffic is re-marked and dropped.

Answer

Traffic with DSCP EF from any source is re-marked to AF41 and dropped if exceeding 100 Mbps.

Answer

The policy is invalid because DSCP values cannot be changed in a QoS policy.

Answer

Traffic from 10.0.0.0/24 is re-marked to DSCP EF, then policed at 100 Mbps.

Question 10

A DevOps team manages a hybrid cloud environment with on-premises Cisco Nexus switches and AWS VPCs using Terraform. They have a configuration management tool that pushes VLAN and interface configurations to the Nexus switches. Recently, they noticed that after a Terraform run that updates the AWS VPC subnets, some on-premises switches lose connectivity to the cloud. The team suspects a mismatch between the VLAN configurations on the Nexus switches and the AWS VPC subnets. They have a centralized source of truth stored in a Git repository containing YAML files for network definitions. Which action should the team take first to resolve the issue and prevent future occurrences?

Accepted Answer

Compare the Git repository's YAML definitions with the actual switch configurations and AWS VPC subnets, then correct any discrepancies.. The team's centralized source of truth in Git (YAML files) should be the authoritative reference for network definitions. By comparing these definitions against both the actual Nexus switch configurations and AWS VPC subnets, the team can identify and correct any drift or mismatch. This aligns with Infrastructure as Code (IaC) best practices, ensuring that all environments are synchronized from a single, version-controlled source before making any changes.

Answer

Restore the Nexus switch configurations from the most recent backup.

Answer

Modify the Terraform scripts to automatically update Nexus switches when AWS VPC subnets change.

Answer

Manually reconfigure the VLANs on the Nexus switches to match the AWS VPC subnets.

Question 11

Drag and drop the steps to configure OSPF on a Cisco router into the correct order.

Accepted Answer

1. Enable OSPF routing process (router ospf [process-id]). 2. Configure Router ID (router-id [id]). 3. Advertise networks (network [network] [wildcard] area [area]).. OSPF configuration requires enabling the OSPF process, setting a router ID, and advertising networks in specific areas.

Answer

1. Configure Router ID (router-id [id]). 2. Enable OSPF routing process (router ospf [process-id]). 3. Advertise networks (network [network] [wildcard] area [area]).

Answer

1. Enable OSPF routing process (router ospf [process-id]). 2. Advertise networks (network [network] [wildcard] area [area]). 3. Configure Router ID (router-id [id]).

Answer

1. Advertise networks (network [network] [wildcard] area [area]). 2. Enable OSPF routing process (router ospf [process-id]). 3. Configure Router ID (router-id [id]).

Question 12

Match each JSON data type to its example.

Accepted Answer

String: "hello". JSON supports basic data types: string (e.g., "hello"), number (e.g., 42), boolean (true/false), null, array, and object. Common confusions include misidentifying boolean values as strings or strings as numbers.

Answer

String: true

Answer

Number: "hello"

Question 13

A developer wants to automate the configuration of multiple Cisco IOS-XE devices using Ansible. Which protocol should be used to ensure secure and idempotent configuration updates?

Accepted Answer

SSH. SSH (Secure Shell) is the correct protocol because it provides encrypted, authenticated remote access to Cisco IOS-XE devices, which is essential for secure automation. Ansible uses SSH to connect to network devices and execute configuration commands idempotently by comparing the desired state (defined in playbooks) against the current device state, ensuring only necessary changes are applied without duplication or disruption.

Answer

Telnet

Answer

SNMP

Answer

HTTP

Question 14

A team is using Python scripts with netmiko to back up configurations from a large number of network devices. What is the primary advantage of using netmiko over direct paramiko for this task?

Accepted Answer

Netmiko simplifies the handling of device-specific prompts and command output. Netmiko is built on top of Paramiko but adds a higher-level abstraction layer that automatically handles device-specific prompt detection, command output parsing, and SSH session management. This simplifies the backup process across heterogeneous devices by eliminating the need to manually write code for each device's unique prompt patterns and command responses.

Answer

Netmiko supports only Cisco devices

Answer

Netmiko uses REST API instead of SSH

Answer

Netmiko is faster than paramiko

Question 15

An automation engineer wants to programmatically retrieve the interface configuration of a Cisco Nexus switch using NX-API. Which API call method is most appropriate?

Accepted Answer

GET. The NX-API on Cisco Nexus switches uses HTTP methods that map to CRUD operations. To retrieve (read) interface configuration without modifying any state, the GET method is the correct and most appropriate choice, as it corresponds to the 'show' commands in the CLI. POST, PUT, and DELETE are intended for creating, updating, or deleting resources, not for read-only queries.

Answer

POST

Answer

DELETE

Answer

PUT