200-901 Network Fundamentals Practice Question
A developer is writing a Python script that will call a REST API. The API documentation states that the service listens on TCP port 443 and requires an encrypted channel. The developer wants to confirm from the command line that the remote host is reachable on that specific port before writing any code. Which command best accomplishes this?
⚠ Common exam trap
The trap here is treating a successful ping as proof that a service is reachable, when ICMP success only shows the host responds to echo requests, not that TCP port 443 is accepting connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nc -vz api.example.com 443
Testing a specific TCP port requires a tool that performs a TCP handshake against that port. Netcat's verbose zero-I/O scan does exactly that, confirming the API's listener is reachable before the developer invests time in code. Ping, traceroute, and nslookup validate different layers and cannot prove the service port is open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nslookup api.example.com
Why it's wrong here
Nslookup queries DNS to resolve the hostname to an IP address, which only confirms name resolution. It provides no information about whether the host is up or whether TCP port 443 is open. A name can resolve perfectly to a server whose service is down or firewalled.
- ✓
nc -vz api.example.com 443
Why this is correct
Netcat with the verbose and zero-I/O scan flags opens a TCP connection to the specified host and port, reporting whether the three-way handshake succeeds. This directly answers the question of whether the API's listening port is reachable from the client, which is exactly the precondition the Python script depends on.
- ✗
traceroute api.example.com
Why it's wrong here
Traceroute maps the router hops along the path to a destination using incrementing TTL values, but it does not verify that a particular TCP port is accepting connections. The path could be fully intact while the target port is filtered, so traceroute output would not confirm the API endpoint is usable.
- ✗
ping api.example.com
Why it's wrong here
ICMP echo requests test basic IP reachability but say nothing about whether TCP port 443 is open. Many networks block or rate-limit ICMP, so a successful ping does not prove the API is listening, and a failed ping does not prove the port is closed. It cannot validate the specific service the developer needs.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.