200-901 Software Development and Design — 15 Questions

Question 1

A developer is designing a REST API that will be used by multiple client applications. The API must support versioning to ensure backward compatibility. Which approach should the developer use to implement API versioning?

Accepted Answer

Embed the version in the URI, e.g., /v1/resource. Embedding the version in the URI (e.g., /v1/resource) is the most common and straightforward approach for REST API versioning. It makes the version explicit in the URL, allowing clients to directly target a specific version without requiring special header handling or query parameter parsing. This method is widely adopted in industry APIs (e.g., GitHub, Twilio) and ensures backward compatibility by keeping older endpoints accessible under their original URI path.

Answer

Use different HTTP methods for different versions

Answer

Pass the version as a query parameter, e.g., ?version=1

Answer

Use a custom HTTP header to specify the version

Question 2

A development team is implementing a microservices architecture. They need to ensure that services can discover each other dynamically without hardcoding IP addresses. Which technology should they use?

Accepted Answer

A service registry like Consul. A service registry like Consul provides a centralized directory where microservices register their network locations (IP and port) and health status. Other services query the registry to discover available instances dynamically, eliminating the need for hardcoded addresses. Consul supports health checks, multi-datacenter replication, and integrates with tools like Envoy for service mesh functionality.

Answer

A centralized load balancer

Answer

An API gateway

Answer

DNS-based service discovery

Question 3

A developer is writing a Python script that uses the Cisco Meraki API to retrieve a list of networks for an organization. The API returns a JSON array. The developer wants to filter networks where the 'tags' field contains 'production'. Which code snippet correctly filters the results?

Accepted Answer

filtered = [net for net in networks if 'production' in net['tags']]. Option A is correct because the Meraki API returns the 'tags' field as a list of strings (e.g., ['production', 'critical']). The Python `in` operator directly checks membership in a list, so `'production' in net['tags']` efficiently filters networks where the exact string 'production' appears as an element in the list.

Answer

filtered = [net for net in networks if 'production' in str(net['tags'])]

Answer

filtered = [net for net in networks if 'production' in net['tags'].split(',')]

Answer

filtered = [net for net in networks if any('production' in t for t in net['tags'])]

Question 4

A developer is writing a Python script that uses the Cisco Catalyst Center (formerly DNA Center) API to get the list of sites. The API returns a response with a 'response' key containing a list of sites. The developer wants to access the 'response' field from the JSON response. Which code snippet correctly extracts the list?

Accepted Answer

sites = response['response']. Option B is correct because the Cisco Catalyst Center API returns a JSON response where the list of sites is nested under the 'response' key. Using dictionary-style indexing with `response['response']` directly retrieves that list, which is the standard way to access a known key in a Python dictionary parsed from JSON.

Answer

sites = list(response)

Answer

sites = response[0]

Answer

sites = response.get('response')

Question 5

A network automation engineer is using Ansible to manage Cisco IOS devices. The playbook includes a task that executes a 'show version' command and registers the output. The engineer then wants to parse the output to extract the IOS version. Which approach should be used?

Accepted Answer

Use the 'cisco.ios.ios_facts' module to get structured facts. The 'cisco.ios.ios_facts' module retrieves structured data from Cisco IOS devices, including the IOS version as a key-value pair in the Ansible facts dictionary. This eliminates the need for manual parsing, as the module uses the device's CLI or NETCONF to gather structured output, making it the most efficient and reliable approach for extracting specific device attributes.

Answer

Use the 'cisco.ios.ios_command' module and parse the output with regex

Answer

Use the 'cisco.ios.ios_command' module and the 'parse' option

Answer

Use the 'cisco.ios.ios_config' module to retrieve the version

Question 6

A developer is using the Cisco Webex API to create a room and add members. The API requires an access token with the appropriate scopes. The developer receives a 401 Unauthorized error when trying to create a room. What is the most likely cause?

Accepted Answer

The access token only has the 'spark:rooms_read' scope. The 401 Unauthorized error indicates that the request lacks valid authentication credentials. Since the developer is using an access token but still getting a 401, the most likely cause is that the token does not have the required scopes to perform the operation. The 'spark:rooms_read' scope only allows reading room details, not creating them, so the API rejects the request with a 401 because the token is valid but insufficiently scoped.

Answer

The access token has the 'spark:memberships_write' scope but not 'spark:rooms_write'

Answer

The access token is not being sent in the Authorization header

Answer

The access token has expired

Question 7

A developer is working with a REST API that uses HTTP Basic Authentication. The developer needs to send a request with the username 'admin' and password 'secret'. Which HTTP header should be set?

Accepted Answer

Authorization: Basic YWRtaW46c2VjcmV0. HTTP Basic Authentication requires the credentials to be formatted as 'username:password', then Base64-encoded, and sent in the Authorization header with the 'Basic' scheme. Option C correctly includes the 'Basic' scheme followed by the Base64-encoded string 'YWRtaW46c2VjcmV0' (which decodes to 'admin:secret').

Answer

Authorization: Basic admin:secret

Answer

Authorization: YWRtaW46c2VjcmV0

Answer

Authorization: Bearer YWRtaW46c2VjcmV0

Question 8

A developer is using Git for source control. They have made changes to a file and want to temporarily save the changes without committing, then work on a different branch. Which Git command should they use?

Accepted Answer

git stash. Option D is correct because `git stash` temporarily saves uncommitted changes (both staged and unstaged) to a stack, reverting the working directory to the last commit. This allows the developer to switch branches without losing work, then later reapply the changes with `git stash pop` or `git stash apply`.

Answer

git checkout other-branch

Answer

git commit -m 'temp'

Answer

git reset --hard

Question 9

Which TWO statements about REST API design best practices are true? (Choose two.)

Accepted Answer

Use nouns for resource endpoints, e.g., /devices instead of /getDevices. Option D is correct because RESTful APIs use nouns to represent resources (e.g., /devices) rather than verbs (e.g., /getDevices). This aligns with the uniform interface constraint of REST, where the HTTP method (GET, POST, etc.) defines the action, and the URI identifies the resource. Using nouns keeps the API intuitive, consistent, and scalable.

Answer

Avoid API versioning to keep the API simple

Answer

Include the HTTP method in the URI path, e.g., /getDevices

Answer

Always use file-based transfer for large payloads

Question 10

Which THREE of the following are common design patterns for microservices? (Choose three.)

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern (B) is a common microservices design pattern that prevents cascading failures by monitoring for failures and opening a circuit to stop requests to a failing service, allowing it to recover. It is widely implemented in frameworks like Netflix Hystrix or Resilience4j, where states (closed, open, half-open) control request flow and timeout thresholds.

Answer

Chain of Responsibility

Answer

Singleton

Question 11

Which HTTP method is considered both safe and idempotent?

Accepted Answer

GET. GET is both safe and idempotent according to HTTP semantics (RFC 7231). Safe means it must not cause side effects on the server, and idempotent means multiple identical requests produce the same result as a single request. GET is designed solely for retrieval of a resource, so it satisfies both properties.

Answer

POST

Answer

PUT

Answer

PATCH

Answer

DELETE

Question 12

A large enterprise is migrating to a DevOps model and needs to automate the provisioning of network devices. The team has chosen Ansible for configuration management and is using a Git repository for version control. The network includes Cisco IOS routers, Catalyst switches running IOS-XE, and ASA firewalls. The team has written Ansible playbooks for each device type. The goal is to have a CI/CD pipeline that automatically deploys configuration changes to the production network after the changes are merged into the main branch. However, during a recent deployment, a misconfiguration was pushed to a core router, causing a 10-minute outage. The root cause was that the playbook that was executed was not the correct one for that device model. The team wants to implement a mechanism to prevent similar incidents. Which approach should the team adopt?

Accepted Answer

Implement a CI/CD pipeline that runs playbooks against a staging environment with similar devices, and only deploy to production after successful validation. Option A is correct because a staging environment with similar devices allows the team to validate playbooks against representative hardware before production deployment. This catches model-specific incompatibilities (e.g., a playbook written for IOS-XE being applied to a classic IOS router) without risking production outages. The CI/CD pipeline can run the same playbooks in staging, verify the resulting device state, and only promote changes to production after successful validation.

Answer

Require all changes to be approved by a change advisory board before merging

Answer

Require two-person peer review for all playbook changes

Answer

Use a pre-commit hook that checks the playbook syntax and device compatibility

Question 13

A network engineer is developing a Python script to automate the collection of interface statistics from multiple Cisco Catalyst switches using NETCONF. The engineer uses the 'ncclient' library to connect to each switch. The script works for most switches, but for one switch, the connection consistently fails with an authentication error. The engineer has verified that the username and password are correct and that the switch has NETCONF enabled. The engineer suspects the issue might be related to SSH host key checking. The engineer wants to modify the script to bypass host key checking for this specific switch. Which approach should the engineer use?

Accepted Answer

Set the 'hostkey_verify' parameter to False in the connect method. Option A is correct because the 'ncclient' library's connect method accepts a 'hostkey_verify' parameter. Setting it to False disables SSH host key checking, which bypasses the verification of the switch's host key against the known_hosts file. This resolves authentication errors caused by host key mismatches, such as when the switch's host key has changed or is not present in the known_hosts file.

Answer

Disable SSH key-based authentication by setting 'look_for_keys=False'

Answer

Use the 'allow_agent' parameter set to False

Answer

Set the 'known_hosts' parameter to an empty file in the connect method

Question 14

A company uses a CI/CD pipeline to deploy network configurations. The pipeline includes a stage that runs automated tests against a simulated network environment. Which testing strategy does this represent?

Accepted Answer

Integration testing. Option C is correct because running automated tests against a simulated network environment validates how multiple network components (e.g., routers, switches, firewalls) interact as a whole. This is integration testing, which focuses on detecting interface and communication failures between integrated units, not on individual components or end-to-end system behavior. In a CI/CD pipeline for network configurations, this stage ensures that the combined changes work together before deployment to production.

Answer

Regression testing

Answer

Unit testing

Answer

Smoke testing

Question 15

Which TWO statements about REST API design best practices are correct?

Accepted Answer

Resources should be represented using nouns in the URI. Option C is correct because REST API best practices dictate that URIs should represent resources (nouns), not actions. For example, '/users' or '/orders' clearly identifies the resource being manipulated, while verbs like '/getUsers' or '/createOrder' are discouraged as they conflate the resource with the operation.

Answer

API versioning should be implemented using query parameters only

Answer

HTTP PUT method should be used for partial updates to a resource

Answer

Responses should return only HTTP status codes without a body