200-901 Multiple Select — 30 Questions

Question 1

A network automation engineer is evaluating options for model-driven programmability on Cisco devices. Which THREE are valid YANG model sources or tools? (Choose three.)

Accepted Answer

pyang. pyang is a YANG tool, yangcatalog.org is a repository, and Cisco native models are valid sources. OpenConfig is a standard, but oc-interfaces is a model, not a source/tool.

Answer

NETCONF

Answer

oc-interfaces

Question 2

A developer is troubleshooting a Cisco RESTCONF API call that returns a 409 Conflict error. Which two scenarios could cause this? (Choose two.)

Accepted Answer

The resource's current state conflicts with the requested change (e.g., trying to delete a resource that is in use).. Option B is correct because RESTCONF returns HTTP 409 Conflict when the server cannot complete the request due to a conflict with the resource's current state, such as attempting to delete a resource that is still referenced or in use by another object. Option C is correct because a 409 Conflict is also returned when a client attempts to create a resource that already exists, violating the uniqueness constraint of the target data node. Option A is incorrect because a missing authentication token produces HTTP 401 Unauthorized (or 403 Forbidden), not 409. Option D is incorrect because a nonexistent resource yields HTTP 404 Not Found. Option E is incorrect because invalid data types trigger HTTP 400 Bad Request due to schema or validation failure.

Answer

Authentication token is missing.

Answer

The resource does not exist.

Answer

The request contains invalid data types.

Question 3

Which TWO are valid methods to secure a Docker container?

Accepted Answer

Use read-only filesystem. Option A (Use read-only filesystem) is correct because mounting a container's root filesystem with the --read-only flag prevents processes from writing to the filesystem, which blocks malware persistence, unauthorized file modification, and many privilege-escalation or tampering attacks. Option C (Set resource limits) is correct because constraining CPU, memory, and other resources via flags such as --memory, --cpus, or --pids-limit mitigates denial-of-service and resource-exhaustion attacks, and limits the blast radius if a container is compromised. The remaining options weaken security: exposing all ports (B) unnecessarily enlarges the attack surface, running containers as root (D) violates least privilege and increases the impact of a container breakout, and disabling network isolation (E) removes segmentation that normally restricts lateral movement between containers and hosts.

Answer

Expose all ports

Answer

Run containers as root

Answer

Disable network isolation

Question 4

Which TWO Ansible modules are commonly used for automating Cisco IOS devices?

Accepted Answer

ios_config. The `ios_config` module is correct because it is specifically designed to manage Cisco IOS device configurations by sending configuration commands via SSH or Telnet, using the CLI to apply changes to the running or startup configuration. This module is part of Ansible's `cisco.ios` collection and directly supports the IOS operating system, making it the standard choice for automating configuration tasks on Cisco IOS devices.

Answer

junos_config

Answer

nxos_command

Answer

eos_config

Question 5

Which TWO actions are best practices for managing secrets in a CI/CD pipeline?

Accepted Answer

Store secrets as environment variables from a .env file not committed to version control. Option B is correct because loading secrets as environment variables from a .env file that is excluded from version control (e.g., via .gitignore) keeps credentials out of the repository history and injects them only at runtime, reducing exposure. Option E is correct because a dedicated secrets manager like HashiCorp Vault centralizes storage, enforces access policies, supports dynamic/short-lived credentials, and provides auditing and encryption, which are core best practices for CI/CD secret handling. Option A is wrong because long-lived static passwords increase the blast radius if leaked and violate rotation and least-privilege principles. Option C is wrong because hardcoding secrets in source code exposes them to anyone with repository access and persists them in build artifacts and history. Option D is wrong because committing secrets to a configuration file in git stores them in plaintext within version control, where they can be cloned, forked, or leaked.

Answer

Use long-lived static passwords for service accounts

Answer

Hardcode secrets directly in application code for ease of access

Answer

Store secrets in a configuration file stored in the git repository

Question 6

Which three of the following are common data formats used with REST APIs on Cisco platforms?

Accepted Answer

JSON. JSON (JavaScript Object Notation) is a lightweight, text-based data interchange format that is natively supported by most programming languages and REST APIs. Cisco platforms, such as Cisco DNA Center and Cisco Meraki, use JSON as the primary data format for API requests and responses because it is easy to parse and has a compact structure. JSON's key-value pair syntax aligns well with RESTful principles, making it the most common choice for modern Cisco REST APIs.

Answer

CSV

Answer

HTML

Question 7

Which THREE of the following are features of HTTP/2?

Accepted Answer

Header compression (HPACK). HTTP/2 introduces HPACK header compression (option A), which reduces overhead by compressing header fields using a static table, a dynamic table, and Huffman encoding, making it a defining feature of the protocol. It also uses binary framing (option D), splitting communication into binary-encoded frames (HEADERS, DATA, SETTINGS, etc.) instead of HTTP/1.1's textual format, which enables more efficient parsing and processing. Multiplexed streams (option E) allow many concurrent request/response exchanges over a single TCP connection, eliminating HTTP/1.1's head-of-line blocking at the application layer. Option B is incorrect because HTTP/2 headers are binary-encoded, not plain text, and option C is incorrect because persistent connections already existed in HTTP/1.1 and are not a new or distinguishing feature of HTTP/2.

Answer

Plain text headers

Answer

Persistent connections

Question 8

Which three statements about Webex API webhooks are true? (Choose three.)

Accepted Answer

Webhooks deliver event data via HTTP POST to a specified URL.. Option A is correct because Webex webhooks push event notifications as an HTTP POST request containing a JSON payload to the target URL you register. Option C is correct because when creating a webhook you specify the resource (e.g., messages, meetings, memberships) and the event (e.g., created, updated, deleted), so it only fires for those matching events. Option D is correct because webhooks are registered programmatically by sending an authenticated POST request to the Webex REST endpoint https://webexapis.com/v1/webhooks with fields such as name, targetUrl, resource, and event. Option B is not required: webhook creation uses an OAuth 2.0 access token (often from an integration or bot), not specifically the client credentials grant, and webhook delivery itself is secured via a secret/signature rather than that grant. Option E is incorrect because Webex webhooks are push-based HTTP callbacks, not long polling.

Answer

Webhooks require OAuth 2.0 client credentials grant for security.

Answer

Webhooks use long polling to receive events.

Question 9

Which THREE of the following are characteristics of IPv6? (Select exactly three.)

Accepted Answer

IPv6 does not have a built-in NAT requirement.. IPv6 was designed without a built-in requirement for Network Address Translation (NAT) because its vast 128-bit address space allows every device to have a globally unique public IP address. Unlike IPv4, which relies on NAT to conserve limited address space, IPv6 restores end-to-end connectivity by default, eliminating the need for address translation at the network edge.

Answer

IPv6 addresses are 32 bits in length.

Answer

IPv6 uses ARP to resolve MAC addresses.

Question 10

A Python script is interacting with a REST API that returns JSON. The script needs to handle potential errors gracefully. Which TWO practices should be implemented? (Choose two.)

Accepted Answer

Use response.raise_for_status() to raise exceptions for HTTP errors.. Option A is correct because response.raise_for_status() from the requests library inspects the HTTP status code and raises an HTTPError for 4xx and 5xx responses, letting the script handle failures via try/except instead of silently processing bad data. Option C is correct because explicitly checking response.status_code (e.g., comparing against 200 or using 200 <= status_code < 300) lets the script branch on success or failure and decide whether to parse JSON or handle the error, which is essential for graceful error handling. Option B is not appropriate because a single undifferentiated try/except hides the specific cause of failures and prevents tailored handling of HTTP errors, JSON decode errors, or connection issues. Option D is wrong because assuming requests always succeed ignores network failures, timeouts, and 4xx/5xx responses, which defeats graceful error handling. Option E is wrong because calling json.loads() unconditionally can raise JSONDecodeError on non-JSON bodies (e.g., HTML error pages), so parsing should occur only after confirming a successful, JSON content-type response.

Answer

Use a single try/except block to catch all exceptions without differentiation.

Answer

Assume the request always succeeds; errors are rare.

Answer

Always parse the response body with json.loads() regardless of content type.

Question 11

Which THREE options are valid methods to expose a Kubernetes service to external traffic?

Accepted Answer

NodePort. NodePort (B) is correct because it allocates a static port in the 30000-32767 range on every node's IP, allowing external clients to reach the service via :. Ingress (D) is correct because it provides HTTP/HTTPS routing from outside the cluster to internal services through an ingress controller acting as a reverse proxy. LoadBalancer (E) is correct because it provisions an external load balancer (e.g., via a cloud provider) with a public IP that forwards traffic to the service's NodePort. ExternalName (A) is not a valid exposure method for external traffic; it merely creates a CNAME DNS alias to an external hostname without proxying traffic. ClusterIP (C) is incorrect because it only exposes the service on an internal cluster IP reachable solely from within the cluster.

Answer

ExternalName

Answer

ClusterIP

Question 12

Which TWO HTTP status codes indicate client errors?

Accepted Answer

404 Not Found. Option B, 404 Not Found, is correct because it is a 4xx-class status code signaling that the client requested a resource the server cannot locate, which is by definition a client-side error. Option C, 400 Bad Request, is also correct because it is a 4xx status returned when the server cannot process the request due to malformed syntax, invalid framing, or deceptive routing sent by the client. The unmarked options do not belong: 500 Internal Server Error (A) is a 5xx server error indicating the server failed unexpectedly, while 200 OK (D) and 201 Created (E) are 2xx success codes confirming the request was received, understood, and processed (with 201 specifically indicating a new resource was created).

Answer

500 Internal Server Error

Answer

200 OK

Answer

201 Created

Question 13

Which two statements are true about Cisco DevNet Sandboxes?

Accepted Answer

DevNet Sandboxes include reserved labs for fixed time periods and always-on labs.. DevNet Sandboxes offer two primary reservation models: reserved labs, which provide exclusive access to a sandbox for a fixed time period (e.g., 4 hours), and always-on labs, which are perpetually available but shared among users. This flexibility allows developers to choose between dedicated, time-limited environments for intensive testing and persistent, always-available environments for ongoing development and learning.

Answer

DevNet Sandboxes are only available with a paid subscription.

Answer

DevNet Sandboxes only support Cisco Catalyst switches.

Answer

DevNet Sandboxes do not support third-party devices.

Question 14

A company is implementing a secure CI/CD pipeline. Which THREE practices are essential for securing the pipeline?

Accepted Answer

Sign and verify all build artifacts.. Option A is correct because signing build artifacts (e.g., with Sigstore/cosign or GPG) and verifying those signatures before deployment ensures integrity and provenance, preventing tampered or unauthorized artifacts from reaching production. Option D is correct because implementing role-based access control (RBAC) on the CI/CD system enforces least privilege, restricting who can modify pipelines, trigger builds, or access secrets and deployment targets. Option E is correct because integrating SAST tools into the build stage catches code-level vulnerabilities (e.g., injection flaws, insecure deserialization) early, before artifacts are promoted through the pipeline. Option B is incorrect because pulling container images from any public registry exposes the pipeline to untrusted or malicious images; images should come from vetted, trusted registries with scanning and signature verification. Option C is incorrect because storing secrets such as API keys and passwords in version control exposes them to anyone with repository access and to history leaks; secrets should be kept in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) and injected at runtime.

Answer

Allow all container images to be pulled from any public registry.

Answer

Store secrets (API keys, passwords) in version control.

Question 15

A network developer is using Cisco NSO to manage multi-vendor devices. Which three are valid approaches to handle device-specific differences? (Choose three.)

Accepted Answer

Write custom Python code in the service model. Cisco NSO allows developers to write custom Python code within the service model to handle device-specific logic, such as translating abstract service parameters into vendor-specific CLI or NETCONF commands. This approach provides flexibility to accommodate non-standard configurations that cannot be expressed purely through YANG models or NEDs.

Answer

Use SNMP MIBs for all configurations

Answer

Configure each device manually through CLI

Question 16

A developer is building a Cisco Webex bot that needs to automatically respond to messages. Which THREE resources/endpoints are essential for this functionality? (Choose three.)

Accepted Answer

Rooms API. Essential endpoints are Messages (to send/receive), Webhooks (to get notified of events), and Rooms (to interact with rooms). People is useful but not essential for bot functionality.

Answer

People API

Answer

Licenses API

Question 17

Which TWO of the following are examples of application layer protocols?

Accepted Answer

HTTP. HTTP (Hypertext Transfer Protocol) operates at the application layer (Layer 7) of the OSI model, enabling web browsers and servers to exchange hypertext documents. It defines how requests and responses are formatted and transmitted, relying on lower-layer protocols like TCP for reliable delivery.

Answer

IP

Answer

TCP

Answer

ARP

Question 18

A developer is designing a Cisco Catalyst Center integration that uses the intent API. Which THREE of the following are available via the intent API? (Select three.)

Accepted Answer

Site hierarchy. Option A (Site hierarchy) is correct because the Cisco Catalyst Center intent API exposes site management endpoints (e.g., /dna/intent/api/v1/site) that let you create, read, and manage the site hierarchy used for policy and device assignment. Option C (Issues and health scores) is correct because the intent API provides endpoints such as /dna/intent/api/v1/issues and /dna/intent/api/v1/health that return detected issues and overall network/device health scores. Option D (List of network devices) is correct because the intent API includes device inventory endpoints (e.g., /dna/intent/api/v1/network-device) that return the list of managed network devices. Option B is not part of the intent API's exposed capabilities, as configuration file retrieval is handled through other mechanisms such as the configuration archive or CLI-based tools rather than intent API endpoints. Option E is also not available via the intent API, since real-time interface statistics are obtained through streaming telemetry, SNMP, or the platform's monitoring/assurance data paths rather than the intent API.

Answer

Network device configuration files

Answer

Real-time interface statistics

Question 19

Which TWO of the following features are provided by Cisco DNA Center but NOT by Cisco Prime Infrastructure? (Choose two.)

Accepted Answer

Machine learning-based assurance analytics. Machine learning-based assurance analytics is a feature exclusive to Cisco DNA Center, which uses advanced telemetry and ML algorithms to proactively detect anomalies, predict network issues, and provide closed-loop assurance. Cisco Prime Infrastructure relies on traditional polling and threshold-based monitoring, lacking the predictive and adaptive analytics capabilities that DNA Center's Assurance engine offers.

Answer

Configuration compliance auditing

Answer

Software image management

Answer

Network Hierarchy and Site Management

Question 20

Which TWO are components of a REST API request? (Choose two.)

Accepted Answer

URI. A REST API request is defined by the combination of a URI (Uniform Resource Identifier) and an HTTP method. The URI identifies the specific resource (e.g., /api/users/123) on the server, while the HTTP method (GET, POST, PUT, DELETE, etc.) specifies the desired action to be performed on that resource. Together, they form the fundamental components that the client sends to the server to initiate a request.

Answer

Status code

Answer

Payload

Answer

Query string