200-901 Infrastructure and Automation Practice Test 7 — 15 Questions

Question 1

An engineer is writing a Python script using the Cisco DevNet sandbox to configure OSPF on a CSR1000v via RESTCONF. What authentication method is typically used for RESTCONF requests?

Accepted Answer

Basic authentication over HTTPS. RESTCONF typically uses Basic authentication over HTTPS (RFC 7235) because it is a lightweight, stateless mechanism that sends a base64-encoded username:password pair in the Authorization header. In the Cisco DevNet sandbox CSR1000v environment, this is the standard method for authenticating RESTCONF requests, as the sandbox provides a username and password for access.

Answer

No authentication

Answer

OAuth2

Answer

API token only

Question 2

A company uses Ansible to automate network configuration. They have an Ansible control node that must reach all network devices. Which transport protocol does Ansible use by default to connect to Cisco IOS devices?

Accepted Answer

SSH. Ansible uses SSH as its default transport protocol to connect to Cisco IOS devices because SSH provides encrypted, secure remote access and is the standard for network device management in modern environments. Ansible's native architecture relies on SSH for agentless communication, executing modules and playbooks over this secure channel without requiring additional software on the target devices.

Answer

HTTP

Answer

Telnet

Answer

SNMP

Question 3

A large enterprise uses Cisco SD-Access with fabric automation. The network administrator wants to automate the process of adding a new user device to a specific virtual network (VN) based on its MAC address. Which API or tool should they use?

Accepted Answer

Cisco ISE REST API. Cisco ISE REST API is the correct choice because ISE is the policy and authentication engine in SD-Access that manages endpoint identity and virtual network (VN) assignments. When a new user device is added, the administrator can use the ISE REST API to programmatically create an endpoint entry with its MAC address and map it to a specific VN, leveraging ISE's policy sets and authorization profiles. This directly automates the VN assignment without requiring changes to fabric underlay or overlay configurations.

Answer

Ansible playbook with ios_config

Answer

Cisco DNA Center REST API

Answer

Cisco APIC-EM REST API

Question 4

An engineer is troubleshooting a NETCONF session that fails to establish with a Cisco IOS XE device. The SSH connection succeeds, but NETCONF capabilities are not exchanged. What is the most likely cause?

Accepted Answer

The device's NETCONF server is not enabled.. Option D is correct because NETCONF uses a client-server model where the server (the Cisco IOS XE device) must have the NETCONF server explicitly enabled. If the SSH transport succeeds but capabilities are not exchanged, it indicates the NETCONF subsystem is not active on the device. The `netconf-yang` feature must be enabled via `netconf-yang` in global configuration mode to start the NETCONF server and allow capability exchange.

Answer

The device requires authentication via SSH keys but password was used.

Answer

The firewall is blocking port 830.

Answer

The device is running an older IOS version that does not support NETCONF.

Question 5

A DevOps team uses a CI/CD pipeline to deploy network configurations. They want to ensure that only authorized network engineers can trigger changes to production devices. Which integration is most appropriate?

Accepted Answer

Implement Role-Based Access Control (RBAC) on the CI/CD tool. Option B is correct because Role-Based Access Control (RBAC) on the CI/CD tool directly restricts which users or groups can trigger pipeline jobs that modify production network devices. This ensures that only authorized network engineers have the permissions to execute changes, aligning with the principle of least privilege in deployment pipelines.

Answer

Encrypt the Ansible vault password

Answer

Use a separate staging environment

Answer

Use a pre-commit hook in Git to validate YAML syntax

Question 6

An engineer is automating the configuration of SNMP on Cisco routers using Ansible. Which two modules are commonly used for this purpose? (Select TWO)

Accepted Answer

cisco.ios.ios_config. The cisco.ios.ios_config module is correct because it allows you to push raw CLI configuration lines to Cisco IOS devices, including SNMP-related commands like 'snmp-server community' or 'snmp-server host'. The cisco.ios.ios_snmp_server module is correct because it is a dedicated Ansible module that provides structured, idempotent management of SNMP server settings (e.g., communities, hosts, traps) without requiring raw CLI lines.

Answer

cisco.ios.ios_interface

Answer

cisco.ios.ios_command

Answer

cisco.ios.ios_banner

Question 7

A network automation solution uses YANG data models to describe network configurations. Which THREE statements about YANG are true? (Select THREE)

Accepted Answer

YANG can be used in conjunction with NETCONF and RESTCONF.. YANG is a data modeling language that defines the structure and constraints of configuration and state data, and it is designed to be used with NETCONF (RFC 6241) and RESTCONF (RFC 8040) as the transport protocols. This makes option A correct because YANG models are encoded in XML or JSON and exchanged via these protocols.

Answer

YANG models are always written in XML syntax.

Answer

YANG is a replacement for SNMP.

Question 8

When implementing network automation with Cisco devices, which THREE practices help ensure idempotency? (Select THREE)

Accepted Answer

Performing a full configuration replace using RESTCONF PUT instead of PATCH.. Option C is correct because a full configuration replace using RESTCONF PUT ensures idempotency by setting the entire configuration to a known state, regardless of the current state. Unlike PATCH, which applies incremental changes that may behave differently depending on the existing configuration, PUT overwrites the entire resource, guaranteeing the same result every time it is executed.

Answer

Writing scripts that only push incremental configurations.

Answer

Relying on manual rollback procedures after automation failures.

Question 9

A network administrator is managing a small office with 10 Cisco 9200 switches. They want to automate the deployment of a standard base configuration (VLANs, STP, management access) to all switches. They have a Linux server with Ansible installed. The administrator writes a playbook that uses the 'ios_config' module to apply configuration blocks. However, when they run the playbook against the first switch, it fails with an authentication error. The administrator can SSH to the switch manually using the same credentials. What is the most likely cause of the failure?

Accepted Answer

The Ansible playbook is missing the 'ansible_connection: network_cli' and 'ansible_network_os: ios' variables.. For Ansible to connect to network devices, the connection type must be set to 'network_cli' and the network OS must be specified. Without these, Ansible may attempt to use the default SSH connection method (paramiko) which does not handle network device prompts correctly, leading to authentication errors.

Answer

The switch's SSH server does not support the key exchange algorithm used by Ansible.

Answer

The playbook is using the wrong username because the variable is not defined.

Answer

The switch is running an incompatible IOS version that does not support the commands in the playbook.

Question 10

A large enterprise uses Cisco DNA Center to manage their campus network. They have deployed fabric technology for SD-Access. The network team wants to use the DNA Center REST API to automate the addition of new wireless users to a specific virtual network (VN) based on their location (building). They have identified the API endpoint for creating a user device in the fabric. However, when they send a POST request with the appropriate JSON body, they receive a 400 Bad Request error. The JSON payload includes the mandatory fields for hostname, MAC address, and VN name. What is the most likely cause of the error?

Accepted Answer

The virtual network name provided does not exist in the fabric.. The 400 Bad Request error indicates that the server cannot process the request due to a client-side issue, such as invalid data in the payload. Since the mandatory fields (hostname, MAC address, VN name) are provided, the most likely cause is that the virtual network (VN) name does not match any existing VN in the fabric. DNA Center validates the VN name against its fabric configuration; if the VN is not defined, the API rejects the request with a 400 error.

Answer

The API call requires an authentication token that is missing or expired.

Answer

The MAC address format is incorrect (e.g., lowercase vs uppercase).

Answer

The user making the API call does not have sufficient privileges.

Question 11

A network automation engineer is developing a Python script that uses the NETCONF protocol to retrieve the running configuration from a Cisco IOS XE device. They use the ncclient library. The script works on the test device but fails on a production device with an error: "ncclient.transport.errors.AuthenticationError: Authentication exception". The engineer verifies that the SSH credentials (username and password) are correct and that the production device is reachable via SSH on port 830. What is the most likely issue?

Accepted Answer

The production device requires SSH key-based authentication, but the script uses password.. The error 'AuthenticationException' from ncclient indicates that the NETCONF session over SSH failed during authentication. Since the engineer verified the password is correct and the device is reachable on port 830, the most likely cause is that the production device is configured to require SSH key-based authentication (e.g., using 'ip ssh server algorithm authentication publickey' or similar), while the script is attempting password-based authentication. ncclient defaults to password authentication unless explicitly configured with a key filename.

Answer

The production device uses a different port for NETCONF than the test device.

Answer

The production device has a firewall rule blocking NETCONF capabilities.

Answer

The production device does not have NETCONF enabled; it only supports SSH.

Question 12

An engineer needs to automate the deployment of VLAN configurations on a fleet of Cisco Catalyst 9000 switches running IOS-XE. The team uses Ansible Tower for automation. Which Ansible module should be used to push VLAN configuration idempotently?

Accepted Answer

ios_vlan. The ios_vlan module is purpose-built for idempotent VLAN management on Cisco IOS-XE devices. It ensures that a VLAN with the specified VLAN ID, name, and state (active/suspend) is present or absent without affecting other VLANs, making it the correct choice for automating VLAN deployment idempotently.

Answer

ios_command

Answer

ios_config

Answer

ios_interface

Question 13

Which TWO of the following are true about NETCONF capabilities as defined in RFC 6241?

Accepted Answer

The operation supports 'merge', 'replace', 'create', 'delete', and 'remove' operations.. Option A is correct because RFC 6241 defines the operation with the 'merge', 'replace', 'create', 'delete', and 'remove' operations. These allow granular modification of configuration data, with 'merge' being the default behavior if no operation attribute is specified.

Answer

The <edit-config> operation replaces the entire configuration by default.

Answer

The :rollback-on-error capability is mandatory.

Answer

The <running> configuration datastore is optional.

Question 14

Based on the exhibit, what is the frequency of the telemetry subscription?

Accepted Answer

Every 500 milliseconds. The exhibit shows a telemetry subscription with a 'period' of 500, which in Cisco model-driven telemetry (MDT) is expressed in milliseconds. Therefore, the frequency is every 500 milliseconds, making option B correct.

Answer

Every 500 seconds

Answer

When the management connection is re-established

Answer

On-change only

Question 15

A large enterprise uses Cisco DNA Center to manage over 500 network devices across multiple sites. The network operations team wants to automate the validation of device compliance with a baseline configuration. They have a Python script that uses the Cisco DNA Center REST API to retrieve the device configuration and compare it against a golden configuration stored in a local file. Recently, the script started failing with a 401 HTTP response code when trying to authenticate. The team confirmed the username and password are correct and that the DNA Center server is reachable. The script uses the /api/system/v1/auth/token endpoint to obtain a token. Which of the following is the most likely cause of the 401 error?

Accepted Answer

The authentication token has expired and the script is not refreshing it.. The 401 HTTP response code indicates an authentication failure. Since the username and password are confirmed correct and the server is reachable, the most likely cause is that the script obtained a token earlier but is now using an expired token without refreshing it. Cisco DNA Center tokens have a configurable timeout (default 1 hour), and the script must re-authenticate or refresh the token before it expires.

Answer

The API endpoint requires a different HTTP method (e.g., POST vs GET).

Answer

The script is using an incorrect API version path (e.g., /v2 instead of /v1).

Answer

CORS (Cross-Origin Resource Sharing) is blocking the request.