200-901 Infrastructure and Automation Practice Question
A DevOps team manages network infrastructure using Infrastructure as Code (IaC). They store configuration files in a Git repository and use CI/CD to deploy changes. What is the best practice to ensure that only validated configurations are applied to production devices?
⚠ Common exam trap
Test-takers frequently confuse a manual approval gate (Option C) with a technical validation step, but Cisco tests the understanding that peer code review (via pull requests) is the best practice for ensuring configuration correctness in IaC, not managerial sign-off.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require a pull request with at least one approval before merging to the main branch
Requiring a pull request with at least one approval before merging to the main branch enforces peer review and validation of configuration changes. This ensures that only code that has been reviewed for correctness, syntax, and adherence to standards is merged, preventing erroneous or malicious configurations from reaching production via the CI/CD pipeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require a pull request with at least one approval before merging to the main branch
Why this is correct
Branch protection requiring an approving pull request gates merges, so unvalidated configuration never reaches the main branch that CI/CD deploys from. This enforces peer review before production devices receive changes, satisfying the constraint that only validated configurations are applied.
- ✗
Allow any team member to push directly to the main branch after testing locally
Why it's wrong here
Pushing directly to main after local testing bypasses peer review and pipeline validation, so untested or conflicting changes merge unchecked. Local testing cannot reproduce production conditions. The correct practice routes changes through pull requests with automated validation and review before they reach the main branch.
- ✗
Use a manual approval gate in the CI/CD pipeline that requires manager sign-off
Why it's wrong here
A manual manager sign-off verifies that a human approved the change, but it does not validate the configuration itself; an unvalidated or malformed config can still pass. Automated pipeline validation, such as linting and policy checks against the IaC files, is what actually confirms correctness before deployment.
- ✗
Automate the deployment of every commit directly to production
Why it's wrong here
Deploying every commit straight to production removes the validation stage entirely, so unverified or broken configurations reach live devices. The pipeline must run automated validation and tests on the IaC before promotion; direct commit-to-production deployment is the practice this question is asking you to avoid.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.