200-901 Infrastructure and Automation Practice Test 2 — 15 Questions

Question 1

A developer is using Python requests library to interact with a Cisco IOS XE device's REST API. The call returns a 400 Bad Request status. The payload is correctly formatted JSON. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authentication credentials are missing or incorrect in the request header. A 400 Bad Request status from a Cisco IOS XE REST API indicates a client-side error, typically related to malformed syntax or missing required elements. Since the JSON payload is confirmed as correctly formatted, the most likely cause is missing or incorrect authentication credentials in the request header, as the API requires valid credentials (e.g., Basic Auth with username:password encoded in Base64) to process the request. Without proper authentication, the server rejects the request with a 400 status before even evaluating the payload.

Answer

The device's API service is not enabled

Answer

The requested URL path is incorrect

Answer

The JSON payload contains a syntax error

Question 2

A Python script sends the above REST API request to a Cisco Catalyst 9000 switch running IOS XE. The response is a 400 Bad Request. Which field is most likely missing from the JSON payload?

Accepted Answer

interface. The REST API request is targeting the creation of a network interface on a Cisco Catalyst 9000 switch running IOS XE. The 400 Bad Request indicates a missing required field in the JSON payload. According to the Cisco IOS XE REST API documentation for the `/api/v1/interface` endpoint, the `interface` field (which specifies the interface name, e.g., 'GigabitEthernet1/0/1') is mandatory when creating a new interface. Without it, the API cannot determine which interface to configure, resulting in a 400 error.

Answer

vlanId

Answer

description

Answer

name

Question 3

A network engineer attempts to use RESTCONF to retrieve the running configuration of a Cisco IOS XE device. The GET request to '/restconf/data/Cisco-IOS-XE-native:native' returns a 405 Method Not Allowed error. What is the most likely cause?

Accepted Answer

RESTCONF is not enabled or the YANG module is not supported.. A 405 Method Not Allowed error indicates that the HTTP method (GET) is not supported for the requested resource. In RESTCONF, this typically occurs when the RESTCONF service is not enabled on the device or the specific YANG module (Cisco-IOS-XE-native) is not supported or loaded. Without the service or module, the server cannot process the GET request for the running configuration.

Answer

The API key provided is invalid.

Answer

The request body was malformed.

Answer

The device does not support HTTPS.

Question 4

A network automation engineer uses Ansible to manage a group of Cisco IOS XE devices. The playbook fails with 'unreachable' for some devices. Which TWO actions should the engineer take to troubleshoot the connectivity?

Accepted Answer

Use the 'ios_command' module to test connectivity.. The 'ios_command' module can be used to verify basic connectivity by sending a simple command (e.g., 'show version') to the device. If the module returns a response, it confirms that Ansible can reach the device and that the credentials are valid, isolating the issue to the specific task or playbook logic rather than connectivity.

Answer

Increase the timeout value in the playbook.

Answer

Ignore the unreachable devices and proceed.

Answer

Check if SNMP is enabled on the devices.

Question 5

A NETCONF RPC reply indicates a validation failure. Based on the exhibit, what is the most probable reason for the failure?

Accepted Answer

The MTU value provided is outside the allowed range.. The NETCONF RPC reply indicates a validation failure, which typically occurs when the data being configured does not conform to the YANG model's constraints. In this context, the MTU value provided is outside the allowed range defined in the YANG model for the interface, triggering a validation error before any configuration is applied.

Answer

The XML syntax in the edit operation was malformed.

Answer

The XML namespace 'Cisco-IOS-XE-native' is not supported.

Answer

The NETCONF session timed out before the operation completed.

Question 6

A network engineer wants to programmatically enable an interface using the YANG model shown. Which XPath expression correctly targets the 'shutdown' leaf for GigabitEthernet0/1?

Accepted Answer

/interfaces/GigabitEthernet[name='0/1']/shutdown. It uses the correct XPath syntax to target the 'shutdown' leaf under a specific GigabitEthernet interface instance. The path starts from the root, navigates to the 'interfaces' container, selects the 'GigabitEthernet' list entry where the 'name' key equals '0/1', and then accesses the 'shutdown' leaf. This matches the YANG model structure where list entries are filtered using a predicate with the key leaf.

Answer

//shut

Answer

/Cisco-IOS-XE-interface:interfaces/GigabitEthernet[0/1]/shutdown

Answer

/native/interface/GigabitEthernet0/1/shutdown

Question 7

A network automation engineer is writing an Ansible playbook to configure interface descriptions on Cisco IOS-XE devices. The playbook uses the ios_config module. Which attribute should be used to ensure idempotency and only apply changes when the interface does not already have the desired description?

Accepted Answer

lines. The `lines` attribute in the `ios_config` module specifies the exact configuration lines to be applied. Ansible's `ios_config` module inherently checks the current device configuration against the desired state defined in `lines`; if the interface already has the matching description, the module skips the task, ensuring idempotency. This prevents unnecessary configuration changes and maintains network stability.

Answer

src

Answer

parents

Answer

before

Question 8

Refer to the exhibit. Based on the output, which interface is experiencing a Layer 2 issue?

Accepted Answer

Serial0/0/0. The output shows that Serial0/0/0 is in the 'up/down' state (Status is up, Protocol is down), which indicates a Layer 2 issue. Common causes include an encapsulation mismatch, missing keepalive, or a problem with the data link layer. This is distinct from a Layer 1 issue, which would show 'down/down' (Status and Protocol both down).

Answer

Loopback0

Answer

GigabitEthernet1

Answer

GigabitEthernet2

Question 9

Refer to the exhibit. An Ansible playbook is intended to set the description on GigabitEthernet0/1. However, the playbook fails because the device does not have that interface. What is the most likely reason?

Accepted Answer

The specified interface does not exist on the device. The playbook explicitly targets GigabitEthernet0/1 using the `interface` attribute under `lines`, and the error indicates the device does not have that interface. Ansible's ios_config module will fail if the specified interface does not exist on the device, as it cannot apply configuration to a non-existent logical or physical interface.

Answer

The module requires gather_facts to be yes

Answer

The hosts group is incorrect

Answer

The lines attribute is misconfigured

Question 10

A Python script using the ncclient library connects to a Cisco IOS-XE device to retrieve the running configuration. The script raises an exception: 'TimeoutError: Session timed out'. Which is the most likely cause?

Accepted Answer

The SSH port (830) is blocked by a firewall. The ncclient library uses NETCONF over SSH, which by default connects to TCP port 830. A 'TimeoutError: Session timed out' indicates that the TCP connection to the device could not be established within the timeout period. The most likely cause is that a firewall is blocking port 830, preventing the SSH session from being initiated.

Answer

The device does not support NETCONF

Answer

The device's running configuration is too large

Answer

The XML payload is malformed

Question 11

A large enterprise uses Cisco SD-Access with fabric automation. The network administrator wants to automate the process of adding a new user device to a specific virtual network (VN) based on its MAC address. Which API or tool should they use?

Accepted Answer

Cisco ISE REST API. Cisco ISE REST API is the correct choice because ISE is the policy and authentication engine in SD-Access that manages endpoint identity and virtual network (VN) assignments. When a new user device is added, the administrator can use the ISE REST API to programmatically create an endpoint entry with its MAC address and map it to a specific VN, leveraging ISE's policy sets and authorization profiles. This directly automates the VN assignment without requiring changes to fabric underlay or overlay configurations.

Answer

Ansible playbook with ios_config

Answer

Cisco DNA Center REST API

Answer

Cisco APIC-EM REST API

Question 12

When implementing network automation with Cisco devices, which THREE practices help ensure idempotency? (Select THREE)

Accepted Answer

Performing a full configuration replace using RESTCONF PUT instead of PATCH.. A full configuration replace using RESTCONF PUT ensures idempotency by setting the entire configuration to a known state, regardless of the current state. Unlike PATCH, which applies incremental changes that may behave differently depending on the existing configuration, PUT overwrites the entire resource, guaranteeing the same result every time it is executed.

Answer

Writing scripts that only push incremental configurations.

Answer

Relying on manual rollback procedures after automation failures.

Question 13

A network administrator is managing a small office with 10 Cisco 9200 switches. They want to automate the deployment of a standard base configuration (VLANs, STP, management access) to all switches. They have a Linux server with Ansible installed. The administrator writes a playbook that uses the 'ios_config' module to apply configuration blocks. However, when they run the playbook against the first switch, it fails with an authentication error. The administrator can SSH to the switch manually using the same credentials. What is the most likely cause of the failure?

Accepted Answer

The Ansible playbook is missing the 'ansible_connection: network_cli' and 'ansible_network_os: ios' variables.. The most likely cause is that the playbook is missing the required connection and platform variables. When using Ansible's `ios_config` module, you must explicitly set `ansible_connection: network_cli` and `ansible_network_os: ios` in the host variables or playbook. Without these, Ansible defaults to the `smart` connection plugin, which attempts an SSH connection using the `paramiko` library but does not properly negotiate the network CLI session, leading to authentication failures even though manual SSH works.

Answer

The switch's SSH server does not support the key exchange algorithm used by Ansible.

Answer

The playbook is using the wrong username because the variable is not defined.

Answer

The switch is running an incompatible IOS version that does not support the commands in the playbook.

Question 14

A network automation engineer is developing a Python script that uses the NETCONF protocol to retrieve the running configuration from a Cisco IOS XE device. They use the ncclient library. The script works on the test device but fails on a production device with an error: "ncclient.transport.errors.AuthenticationError: Authentication exception". The engineer verifies that the SSH credentials (username and password) are correct and that the production device is reachable via SSH on port 830. What is the most likely issue?

Accepted Answer

The production device requires SSH key-based authentication, but the script uses password.. The error 'AuthenticationException' from ncclient indicates that the NETCONF session over SSH failed during authentication. Since the engineer verified the password is correct and the device is reachable on port 830, the most likely cause is that the production device is configured to require SSH key-based authentication (e.g., using 'ip ssh server algorithm authentication publickey' or similar), while the script is attempting password-based authentication. ncclient defaults to password authentication unless explicitly configured with a key filename.

Answer

The production device uses a different port for NETCONF than the test device.

Answer

The production device has a firewall rule blocking NETCONF capabilities.

Answer

The production device does not have NETCONF enabled; it only supports SSH.

Question 15

A network administrator automates the provisioning of Meraki MX security appliances using the Meraki Dashboard API. The Python script reads a CSV file with site details and creates VLANs, firewall rules, and VPN settings. Recently, the script started throwing an HTTP 429 error. The script is single-threaded and makes fewer than 10 requests per second. Which of the following is the most likely cause of the 429 error?

Accepted Answer

The organization has a lower rate limit than the API key's default.. The HTTP 429 (Too Many Requests) error indicates the client has exceeded the rate limit imposed by the Meraki Dashboard API. Even though the script makes fewer than 10 requests per second, the organization-level rate limit can be lower than the default API key limit. Option D is correct because the organization's rate limit overrides the default, and the script's request rate may still exceed that lower threshold.

Answer

The API key has been revoked.

Answer

The rate limit for the API key is 5 requests per second.

Answer

The Meraki cloud is under maintenance.