200-901 Infrastructure and Automation Practice Test 9 — 15 Questions

Question 1

A company uses Ansible to automate configuration of its Cisco IOS XE routers. The network team recently upgraded the routers' software from IOS 15.x to IOS XE 17.x. Since the upgrade, the Ansible playbook fails intermittently with the message: 'Failed to connect to the host via ssh: timed out'. However, the team can SSH manually to the routers from the Ansible control node without issues. The playbook uses the 'cisco.ios.ios_config' module with default SSH options. The routers have been configured with SSH version 2 and local authentication. The Ansible control node runs Red Hat Enterprise Linux 8. Which action should the network engineer take to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the SSH timeout in the Ansible configuration file (ansible.cfg) to 60 seconds.. The intermittent SSH timeout after upgrading to IOS XE 17.x is likely due to slower key exchange algorithms (e.g., diffie-hellman-group-exchange-sha256) that increase connection setup time. Increasing the SSH timeout in ansible.cfg (e.g., setting timeout=60) gives the SSH handshake enough time to complete, avoiding the timeout. Forcing SSHv1 is not recommended as it is deprecated and may not be supported. Host key checking (option C) does not affect timeout, and using a different module (option D) does not solve the underlying connectivity issue.

Answer

Configure the routers to use SSH version 1 only.

Answer

Set the 'host_key_checking' option to False in ansible.cfg.

Answer

Use the 'ios_command' module instead of 'ios_config' to perform the tasks.

Question 2

A developer is building a Python tool that must retrieve the list of interfaces from a Cisco IOS XE device using the RESTCONF API. The device is reachable at https://10.1.1.1 and supports the ietf-interfaces YANG model. The developer wants to send the request and parse the JSON response. Which Python code snippet correctly performs this operation?

Accepted Answer

import requests
response = requests.get('https://10.1.1.1/restconf/data/ietf-interfaces:interfaces', headers={'Accept': 'application/yang-data+json'}, auth=('admin', 'password'))
interfaces = response.json(). RESTCONF uses HTTP methods to manipulate YANG-modeled data. To retrieve data, a GET request is sent to the resource URL, with the Accept header set to application/yang-data+json to request JSON-encoded data. Basic authentication is commonly used. The correct snippet follows these conventions, while the others misuse HTTP methods or headers.

Answer

import requests
response = requests.post('https://10.1.1.1/restconf/data/ietf-interfaces:interfaces', headers={'Content-Type': 'application/yang-data+json'}, auth=('admin', 'password'))
interfaces = response.json()

Answer

import requests
response = requests.get('https://10.1.1.1/restconf/data/ietf-interfaces:interfaces', headers={'Accept': 'application/json'}, auth=('admin', 'password'))
interfaces = response.json()

Answer

import requests
response = requests.get('https://10.1.1.1/restconf/data/ietf-interfaces:interfaces', headers={'Content-Type': 'application/yang-data+json'}, auth=('admin', 'password'))
interfaces = response.json()

Question 3

A network automation engineer needs to ensure that a Python script can securely store and retrieve API credentials for Cisco DNA Center without hardcoding them in the script. Which method is the most appropriate?

Accepted Answer

Use environment variables to hold the credentials and access them via os.environ in the script.. Using environment variables keeps credentials out of source code and allows them to be managed securely by the deployment environment. This is a widely accepted practice for handling secrets in automation scripts. It avoids the risks of hardcoding or storing secrets in version control, and it supports different credentials per environment.

Answer

Embed the credentials directly in the Python script as constants.

Answer

Store the credentials in a YAML file that is committed to the same Git repository as the script.

Answer

Store the credentials in a plain text file on the local filesystem and read them at runtime.

Question 4

A developer is writing a Python script that uses the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script must filter the configuration to return only the interface configuration. Which filter type should be used in the <get-config> RPC to achieve this?

Accepted Answer

subtree filter. NETCONF supports two standard filter types: subtree and xpath. The subtree filter is the most widely implemented and allows selective retrieval of configuration data by specifying an XML fragment. For retrieving only interface configuration, a subtree filter containing the <interfaces> node is the correct approach.

Answer

xpath filter

Answer

attribute filter

Answer

key filter

Question 5

A developer must build a Python script that reads a list of devices from a YAML inventory file and then pushes configuration to each device using NETCONF over SSH. The script must be reusable and must not hardcode credentials. Which approach best satisfies these requirements?

Accepted Answer

Use the ncclient library, load the inventory with PyYAML, and retrieve credentials from environment variables.. The scenario requires a NETCONF client, a YAML parser, and externalized credentials. ncclient provides the NETCONF over SSH capability, PyYAML reads the inventory, and environment variables keep secrets out of the code. Together these choices meet both the protocol and the reusability requirements without embedding sensitive data.

Answer

Use paramiko to open an interactive SSH shell and type configuration commands into the CLI prompt.

Answer

Use the requests library to POST XML configuration directly to the device management IP on port 830.

Answer

Use the ncclient library and hardcode the device list and credentials inside the script for simplicity.

Question 6

An automation engineer is writing a Python script that uses the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The device requires SSH and uses the default NETCONF port. Which code snippet correctly establishes a NETCONF session and retrieves the configuration?

Accepted Answer

from ncclient import manager
with manager.connect(host='10.1.1.1', port=830, username='admin', password='pass', hostkey_verify=False) as m:
    config = m.get_config(source='running'). NETCONF over SSH uses port 830 by default. The ncclient library provides manager.connect to establish a session and get_config to retrieve configuration data. The source parameter specifies the datastore, such as 'running'. Using the correct port and method ensures successful communication with the device.

Answer

from ncclient import manager
with manager.connect(host='10.1.1.1', port=22, username='admin', password='pass', hostkey_verify=False) as m:
    config = m.get_config(source='running')

Answer

from ncclient import manager
with manager.connect(host='10.1.1.1', port=830, username='admin', password='pass', hostkey_verify=False) as m:
    config = m.get(source='running')

Answer

from ncclient import manager
with manager.connect(host='10.1.1.1', port=22, username='admin', password='pass', hostkey_verify=False) as m:
    config = m.get(source='running')

Question 7

A developer is building a Python script to configure a Cisco IOS XE device using NETCONF. The script must send an <edit-config> RPC that places the target datastore in candidate mode, changes the description of GigabitEthernet0/0, and commits the change. Which NETCONF capability must the device advertise for the script to use the candidate datastore?

Accepted Answer

urn:ietf:params:netconf:capability:candidate:1.0. The candidate capability is required because the script edits a candidate datastore and then commits the change to running. NETCONF capabilities are advertised in the server's message; a client must check for the candidate capability before using with a candidate target and . Rollback-on-error, validate, and writable-running serve different purposes and do not enable the candidate datastore workflow.

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:validate:1.0

Question 8

A developer is writing a Python script that uses the Cisco DNA Center Intent API to retrieve a list of all network devices. The script must handle pagination to ensure all devices are returned. Which TWO parameters are used to control pagination in the Cisco DNA Center API? (Choose two.)

Accepted Answer

limit. Cisco DNA Center uses offset and limit query parameters to implement pagination. The offset indicates the starting record, and limit sets the page size. By looping with increasing offset values, the script can retrieve all devices. Other parameter names like page, size, or start are not used by this API.

Answer

start

Answer

size

Answer

page

Question 9

A network automation engineer needs to retrieve the running configuration of a Cisco IOS XE device using NETCONF. Which ncclient method should be used to fetch the configuration without modifying the device?

Accepted Answer

get_config. Reading the running configuration over NETCONF requires a read operation against the running datastore. The ncclient get_config method is designed for exactly this purpose, accepting a source datastore and optional subtree or XPath filter. The other methods either modify state, apply staged changes, or send unvalidated raw RPCs.

Answer

edit_config

Answer

dispatch

Answer

commit

Question 10

A developer is writing a Python script that uses the Meraki Dashboard API to page through a very large organization's list of network devices. The developer wants to iterate through all pages of results without manually constructing page URLs. Which approach should be used?

Accepted Answer

Send a single GET request and read the HTTP Link response header to follow the next page URL until no Link header is returned.. Meraki paginates large collections and advertises the subsequent page through the HTTP Link response header with rel="next". A client that inspects headers and follows that URL iterates the entire collection robustly, which is the documented pattern for traversing large result sets. Approaches that assume a single oversized page, misuse POST, or repurpose rate-limit headers all fail to advance through the data.

Answer

Send a POST request to the devices endpoint with a body containing a startingIndex field that the API uses to return the next slice.

Answer

Send a single GET request with the query parameter perPage set to the organization's total device count so all devices return in one response.

Answer

Rely on the X-RateLimit-Remaining response header; when it reaches zero, the API automatically returns the next page of devices.

Question 11

A developer is writing a Python script that must authenticate to the Cisco DNA Center REST API and create a new site. The script stores the controller hostname, username, and password in environment variables. Which approach correctly obtains the authentication token required for subsequent API calls?

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with HTTP Basic authentication using the username and password, then read the 'Token' field from the JSON response.. Cisco DNA Center authenticates API clients by exchanging HTTP Basic credentials for a time-limited token. The client posts to /dna/system/api/v1/auth/token, and the controller returns a JSON object whose 'Token' field is then used in the X-Auth-Token header. This is the only supported pattern among the choices, so the script must follow it to create sites successfully.

Answer

Send a POST request to /api/v1/token with the username and password in a JSON body, then read the 'access_token' field from the JSON response.

Answer

Send a POST request to /dna/system/api/v1/auth/token with the username and password in a JSON body, then read the 'Token' field from the JSON response.

Answer

Send a GET request to /dna/system/api/v1/auth/token with the username and password as query parameters, then read the 'Token' field from the JSON response.

Question 12

A network automation engineer is writing a Python script that uses the Meraki Dashboard API to update the VLAN configuration on a switch. The engineer needs to send a PUT request to the endpoint /devices/{serial}/switch/ports/{portId}. Which HTTP header must be included to authenticate the request?

Accepted Answer

X-Cisco-Meraki-API-Key: <API key>. The Meraki Dashboard API requires the API key to be sent in the X-Cisco-Meraki-API-Key request header. This is a custom header defined by Meraki, and it must be present on every API call. Other authentication schemes such as Bearer tokens, X-Auth-Token, or Basic authentication are not supported for Meraki API keys, so requests using them will be rejected with an authentication error.

Answer

Authorization: Basic <base64(API key:)>

Answer

X-Auth-Token: <API key>

Answer

Authorization: Bearer <API key>

Question 13

A developer writes a Python script that uses ncclient to configure a loopback interface on a Cisco IOS XE router. The script calls edit_config against the candidate datastore and then exits without calling commit. The next day, the interface is missing from the running configuration. What is the most likely cause?

Accepted Answer

The candidate datastore was discarded because the session ended without a commit operation.. NETCONF separates candidate configuration from running configuration. Writing to the candidate datastore stages changes but does not activate them. Only a commit RPC copies the candidate contents to running. When the session ends without commit, the candidate is discarded, which explains the missing interface.

Answer

The running configuration was overwritten by a scheduled job that removed all loopback interfaces.

Answer

The edit_config operation requires a confirmed-commit timer to persist changes to the running datastore.

Answer

The device rejected the edit_config because loopback interfaces require a separate YANG module.

Question 14

A network automation team wants to run a Python script that uses the ncclient library to retrieve configuration from a Cisco IOS XE device over NETCONF. The device is reachable on TCP port 830. Which transport and port combination must the script use?

Accepted Answer

SSH transport on TCP port 830. NETCONF on Cisco IOS XE is exposed as an SSH subsystem on TCP port 830. The ncclient library negotiates the SSH transport and then exchanges XML capabilities and RPCs. Using SSH on the NETCONF port is the documented combination, so the script must target TCP 830 rather than the standard CLI port or a TLS-based alternative.

Answer

HTTP transport on TCP port 80

Answer

SSH transport on TCP port 22

Answer

TLS transport on TCP port 6513

Question 15

A developer is writing a Python script to interact with a Cisco IOS XE device using the NETCONF protocol. The script must retrieve the running configuration and then modify it. Which two actions must the script perform to establish a NETCONF session and retrieve the running configuration? (Choose two.)

Accepted Answer

Open an SSH session to the device on port 830 and exchange messages.. To establish a NETCONF session, the client opens an SSH connection to port 830 and exchanges messages with the server. Once the session is established, the client can send RPCs. To retrieve the running configuration, the client sends a RPC with . The other options either use the wrong RPC, the wrong transport, or an operation that does not read configuration into the session.

Answer

Send a RPC with a filter of to retrieve the running configuration.

Answer

Authenticate using the NETCONF username and password over HTTPS on port 443.

Answer

Use the <copy-config> RPC to copy the running datastore to a local file.