Cisco DevNet Associate 200-901 (200-901) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option B is wrong because POST is used to create a new data resource or invoke an operation, not to retrieve existing data. Option C is wrong because PUT is used to replace or update an entire resource, not to read data. Option D is wrong because DELETE is used to remove a resource, which is the opposite of retrieving statistics.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the SSH timeout in ansible.cfg would only mask the symptom; the underlying cause is the slow SSH key exchange negotiation, not a general timeout setting. Option C is wrong because disabling host_key_checking only skips the verification of the remote host's SSH key fingerprint; it does not affect the SSH transport layer timeout or the speed of the cryptographic handshake. Option D is wrong because the ios_command module also uses the same SSH transport and would experience the identical timeout issue; the problem is not specific to the ios_config module.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the Webex API does not use simple page counters; incrementing a page number and appending '?page=2' assumes a fixed page-based pagination scheme that is not supported by the API. Option C is wrong because the Webex API does not return a total count in the response for pagination; even if it did, calculating an offset would be unreliable due to potential data changes between requests. Option D is wrong because the Webex API uses GET requests for pagination, not POST requests, and the 'cursor' parameter is not part of the standard pagination mechanism; the correct mechanism uses the 'Link' header with 'rel="next"'.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Accept header specifies the desired response format, not the request body format; a missing or incorrect Accept header would cause a 406 Not Acceptable error, not a 400. Option B is wrong because a missing or incorrect Content-Type header (e.g., not application/yang-data+json) would also result in a 415 Unsupported Media Type error, not a 400. Option C is wrong because if the API were not enabled, the device would return a 404 Not Found or a connection refusal, not a 400 Bad Request.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because REST over HTTP is typically synchronous and tightly coupled: the client sends a request and waits for a response, creating a direct dependency between services. Option B is wrong because SOAP is a synchronous, tightly coupled protocol that relies on XML messaging over HTTP or other transports, often with strict contract definitions (WSDL) that create strong coupling. Option C is wrong because gRPC, while efficient with HTTP/2 and protobufs, is primarily designed for synchronous request-response communication (though it supports streaming, the default pattern is still coupled and blocking).

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because allowing direct pushes to the main branch bypasses any review or validation, risking the deployment of untested or erroneous configurations. Option C is wrong because a manual approval gate by a manager does not guarantee technical validation of the configuration; it adds a non-technical bottleneck without ensuring code correctness. Option D is wrong because automating deployment of every commit directly to production eliminates all validation gates, making it impossible to catch errors before they impact production devices.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (REST API) is wrong because REST APIs are typically used as northbound APIs for applications to communicate with the SDN controller, not for the controller to program network devices. Option C (East-West API) is wrong because east-west APIs are used for communication between multiple SDN controllers in a distributed control plane, not for device rule installation. Option D (Northbound API) is wrong because northbound APIs allow applications and orchestration tools to interact with the controller, abstracting the underlying network; they do not directly install forwarding rules on devices.

Why this answer

How to eliminate wrong answers

Option B is wrong because an incorrect network ID would result in an HTTP 404 (Not Found) or HTTP 400 (Bad Request) error, not a 200 with an empty array. Option C is wrong because an invalid API key would return an HTTP 401 (Unauthorized) status, not a successful 200 response. Option D is wrong because a malformed request body would typically cause an HTTP 400 (Bad Request) error, as the Meraki API validates the request structure before processing.

Why this answer

How to eliminate wrong answers

Option A is wrong because it uses an 'A' record type, which maps a hostname to an IPv4 address, not a mail exchanger; MX records require the 'MX' type and a priority value. Option C is wrong because a CNAME record creates an alias for a hostname, but MX records cannot point to a CNAME per RFC 2181; they must point directly to an A or AAAA record. Option D is wrong because a TXT record stores text data like SPF policies, not mail server routing information; MX records are specifically for mail exchange.

Why this answer

How to eliminate wrong answers

Option A is wrong because executing a series of CLI commands on network devices in sequence describes a procedural automation approach (e.g., using Ansible or a Python script with Netmiko), not the declarative, API-driven model of Terraform. Option B is wrong because writing imperative scripts that configure network devices via SSH is a traditional, non-declarative method that lacks Terraform's state management and idempotency; Terraform does not use SSH for device configuration. Option C is wrong because the Terraform provider for Catalyst Center does not directly manage routers and switches; it manages resources through Catalyst Center's northbound REST API, which in turn orchestrates device configurations via protocols like NETCONF or CLI.

Why this answer

How to eliminate wrong answers

Option A is wrong because Dynamic NAT translates internal addresses to a pool of public IPs, one-to-one, and does not reuse a single public IP with different ports. Option B is wrong because Static PAT is not a standard term; static NAT with port forwarding is sometimes mislabeled, but the table shows dynamic port assignments, not a fixed mapping. Option C is wrong because Static NAT maps a single internal IP to a single external IP permanently, which would not show multiple internal IPs sharing the same public IP.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the payload were not in JSON format, the API would typically return a 400 Bad Request error, not a 202 Accepted, and the failure would be explicit, not silent. Option B is wrong because an expired API token would cause a 401 Unauthorized error when the request is sent, not a 202 Accepted; the token is validated at request time, not during async processing. Option D is wrong because the endpoint /dna/intent/api/v1/policy-tag is the correct endpoint for creating and updating policy tags in Cisco DNA Center Intent API, as documented in the API reference.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because DELETE is used to remove a resource, not to list networks; using DELETE on this endpoint would attempt to delete all networks in the organization, which is not the intended operation. Option B is wrong because POST is used to create a new resource, such as adding a network to an organization, not to retrieve an existing list. Option C is wrong because PUT is used to update or replace an existing resource, not to retrieve a list; it would attempt to replace the entire collection of networks, which is incorrect.

Why this answer

How to eliminate wrong answers

Option A is wrong because pyATS typically requires more code to set up test infrastructure (e.g., testbed files, test cases) compared to a simple ping script, which can be a single line. Option B is wrong because while pyATS can test multiple devices in parallel, this is not a unique advantage—a simple script using threading or asyncio can also achieve parallel pings; the key advantage is the framework's test management and reusability. Option D is wrong because pyATS does not automatically generate test reports; it provides libraries to create custom reports (e.g., via `pyats.log` or integration with tools like `ATS`), but report generation requires explicit implementation.

Why this answer

How to eliminate wrong answers

Option A is wrong because a centralized load balancer distributes traffic but does not inherently provide dynamic service discovery; it typically requires manual configuration or integration with a registry to know backend endpoints. Option C is wrong because an API gateway handles routing, authentication, and rate limiting for external requests, but it is not designed for internal service-to-service discovery and often relies on a registry or DNS for backend resolution. Option D is wrong because DNS-based service discovery (e.g., using SRV records) can resolve service names to IPs but lacks real-time health checking, TTL-based caching can cause stale entries, and it does not support advanced features like weighted routing or metadata-based filtering that a dedicated registry provides.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because integration testing validates the interaction between components (e.g., network devices and Ansible modules) after deployment, not syntax. Option B is wrong because the deployment stage applies the playbook to production or staging environments, assuming syntax is already correct. Option C is wrong because unit testing validates individual functions or modules in isolation (e.g., Python unit tests for custom modules), not the YAML syntax of Ansible playbooks.

Why this answer

How to eliminate wrong answers

Option B is wrong because Ansible with ios_config is used to automate CLI commands on network devices (e.g., switches, routers), but it cannot directly manage endpoint-to-VN mappings in SD-Access, which are handled by ISE's policy engine. Option C is wrong because Cisco DNA Center REST API is used for fabric provisioning, intent-based automation, and assurance, but it does not provide a direct API for mapping a specific MAC address to a VN; that mapping is enforced by ISE via policy. Option D is wrong because Cisco APIC-EM is a deprecated controller (replaced by DNA Center) and its REST API does not support SD-Access VN assignment for endpoints; it was designed for traditional network automation and APIC-EM is no longer a current product.

Why this answer

How to eliminate wrong answers

Option B is wrong because TCP has higher overhead than UDP due to its connection establishment, acknowledgments, and sequencing mechanisms, not lower overhead. Option C is wrong because UDP is connectionless and low-overhead, but it does not provide reliable, ordered delivery or error checking—it offers no guarantees for delivery or ordering. Option D is wrong because UDP does not provide flow control; flow control is a feature of TCP, implemented via sliding window and advertised window mechanisms.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Configuration Snapshots are point-in-time backups of device configurations used for auditing or comparison, not for active compliance enforcement or remediation. Option B is wrong because NETCONF notifications are asynchronous event messages (e.g., YANG-push or syslog) that alert on state changes but do not enforce or correct configuration compliance. Option C is wrong because CDB rollback reverts the NSO configuration database to a previous transaction, which can undo changes but does not proactively ensure ongoing compliance with corporate standards.

Why this answer

How to eliminate wrong answers

Option A is wrong because wrapping API calls in a single transaction is not a concept supported by RESTful APIs like the Meraki Dashboard API; transactions are a database concept and do not apply to independent HTTP requests. Option B is wrong because increasing the timeout value only prevents premature timeouts but does not reduce the latency of each request; it may even make the script slower if requests hang longer. Option D is wrong because using POST instead of GET does not combine multiple operations into one request; the Meraki API does not support combining a list-networks and list-devices call into a single POST, and POST is semantically incorrect for read-only operations.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because OAuth 2.0 client credentials grant is not supported by Cisco DNA Center; it uses a simpler token-based authentication flow. Option B is wrong because an API key in the request header is not the method used to obtain a token; DNA Center requires username/password authentication to generate a token. Option D is wrong because client certificate authentication is not the standard method for obtaining a token in DNA Center; it relies on HTTP Basic authentication for token generation.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because ValueError is raised when a function receives an argument of the correct type but an inappropriate value (e.g., int('abc')), not for missing dictionary keys. Option C is wrong because IndexError is raised when accessing an index out of range in a sequence like a list or tuple, not for dictionary key access. Option D is wrong because AttributeError is raised when an invalid attribute reference or assignment is made (e.g., my_dict.append), not for missing dictionary keys.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because ENTRYPOINT configures a container to run as an executable, not to execute commands during the build; using ENTRYPOINT for pip install would cause the installation to run every time the container starts, which is inefficient and may fail if the filesystem is read-only. Option B is wrong because CMD provides defaults for an executing container, but it can be overridden; using CMD for pip install would also run the installation at container runtime rather than during the build, leading to unnecessary delays and potential permission issues.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because an NSSA (Not-So-Stubby Area) allows Type 7 LSAs for external routes from within the area and translates them to Type 5 LSAs, which does not block inter-area routes; it is designed for areas that need to import external routes while still blocking some Type 5 LSAs. Option B is wrong because a totally stubby area blocks both Type 5 LSAs and Type 3 LSAs (inter-area routes), leaving only a default route, which would prevent area 1 from seeing any inter-area routes, not just specific ones. Option C is wrong because a virtual-link is used to connect a non-backbone area to area 0 through a transit area when a direct physical connection is missing; it does not filter routes.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `list(response)` would convert the entire dictionary keys into a list, not extract the 'response' field. Option C is wrong because `response[0]` attempts to index the dictionary as if it were a list, which raises a KeyError or TypeError since dictionaries are not sequence types. Option D is wrong because `response.get('response')` would return the value for the 'response' key, but the question specifically asks for the list; while this could work, it is not the correct snippet among the given options because the answer expects the direct indexing approach, and `get()` is a safer alternative but not the one marked correct in the exam context.

Why this answer

How to eliminate wrong answers

Option B (PUT) is wrong because PUT is used to update or replace an existing resource, not to retrieve data; using it for a read operation would violate REST semantics and likely return a 405 Method Not Allowed error. Option C (POST) is wrong because POST is intended for creating new resources or submitting data to be processed, not for idempotent retrieval; it would incorrectly imply a state change on the server. Option D (DELETE) is wrong because DELETE is used to remove a resource, which is the opposite of retrieving a list; it would result in unintended deletion of network devices.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because listing organizations is a read operation requiring GET, not POST; POST is used for creating resources. Option B is wrong because the Meraki API does not support Basic Auth; it requires a dedicated API key header. Option D is wrong because the endpoint includes `/v1/` redundantly (the base URL already contains the version), and the API uses a custom header, not cookie authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because it is identical to the correct answer (B) but not marked as correct in the question; however, in practice, both A and B represent the same endpoint, so the distinction is artificial. Option C is wrong because GET /networks is not a valid Meraki Dashboard API endpoint; the API requires the organization ID in the path to identify the scope. Option D is wrong because GET /organizations/{organizationId}/networks/{networkId} retrieves a single specific network, not a list of all networks.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the 'ansible_network_os' variable is used to specify the network OS type (e.g., ios, nxos) for connection and module selection, not to handle configuration revision mismatches or ensure consistent ACL application. Option C is wrong because the 'backup' option in ios_config creates a backup of the current configuration before making changes, but it does not resolve conflicts caused by different configuration revisions; it only provides a rollback point. Option D is wrong because the 'ignore_errors' directive tells Ansible to continue execution even if a task fails, which would mask the failure of ACL application on some routers rather than fixing the underlying revision mismatch.

Why this answer

Why this answer

Why this answer

Why these pairings

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because comparing the image SHA with a known good hash only verifies integrity (that the image hasn't been tampered with during transit), not authenticity (that the image was signed by a trusted publisher). Option C is wrong because a vulnerability scan checks for known security flaws in the image's packages, but does not validate any cryptographic signature or provenance. Option D is wrong because checking the image size on the registry is a trivial metadata check that provides no security assurance about the image's origin or integrity.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling the local firewall is a blunt, insecure approach that does not address the routing issue; the firewall is unlikely to block outbound HTTP traffic to an internal IP, and the problem is at Layer 3 (routing), not Layer 4 (firewall filtering). Option B is wrong because renewing the DHCP lease would only change the IP address or refresh DNS settings, but the current IP (192.168.1.100) is valid and the DNS server is reachable; the issue is not with IP allocation but with the default gateway. Option C is wrong because restarting the NIC would reset the link-layer connection but would not fix a misconfigured default gateway; the NIC is functioning correctly since the workstation can ping the DNS server on the same subnet.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'none' driver disables all networking for the container, leaving it with only a loopback interface and no external connectivity. Option B is wrong because the 'overlay' driver creates a distributed network across multiple Docker hosts, enabling multi-host communication but not sharing the host's own network stack. Option C is wrong because the 'bridge' driver creates an isolated, private network on the host using NAT and port forwarding, preventing direct access to host interfaces.

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the routing protocol from OSPF to EIGRP is unnecessary and disruptive; OSPF already supports cost manipulation to influence path selection, and the question explicitly requires no topology or hardware changes. Option B is wrong because the 'default-information originate' command injects a default route into OSPF, which does not influence specific host or subnet routing between Server A and Server B; it would only affect traffic destined to networks not in the OSPF database. Option C is wrong because policy-based routing (PBR) can override the routing table, but it adds complexity and administrative overhead; the simpler and more standard approach is to adjust OSPF metrics, which directly influences the SPF calculation and is the intended method for traffic engineering in OSPF.

Why this answer

How to eliminate wrong answers

Option A is wrong because a network firewall blocking the request would typically result in a timeout or connection error (e.g., 0 bytes received), not a 403 Forbidden HTTP response from the server. Option C is wrong because the Meraki Dashboard API uses GET for retrieving data (as per RESTful conventions), and POST is used for creating resources; changing the method would return a 405 Method Not Allowed or 404, not a 403. Option D is wrong because the endpoint URL is verified correct (the organization ID is confirmed, and other endpoints work), and a wrong URL would produce a 404 Not Found, not a 403 Forbidden.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because *kwargs is not valid Python syntax; the correct syntax for variable positional arguments is *args, not *kwargs. Option C is wrong because *args collects extra positional arguments into a tuple, not keyword arguments. Option D is wrong because &kwargs is not a valid Python operator or syntax; Python uses ** for dictionary unpacking and keyword argument collection, not &.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a retry mechanism with exponential backoff and random jitter only handles transient conflicts (e.g., network glitches) but does not prevent the underlying race condition—both instances can still attempt to update the same interface concurrently, leading to repeated 409 errors. Option C is wrong because changing PUT to PATCH does not inherently avoid conflicts; RESTCONF PATCH still requires a consistent base state, and concurrent PATCH requests can still cause 409 Conflict errors if the resource changes between reads and writes. Option D is wrong because using a timestamp to force overwrite ignores the conflict detection mechanism of RESTCONF (which uses ETags or If-Match headers) and can lead to lost updates or data corruption, as the server may still reject the request if the timestamp does not match the expected state.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing secrets in a .env file and adding it to the repository, even with restricted access, still embeds the secrets in version control history and exposes them to anyone with repository access, violating the principle of never storing secrets in code. Option B is wrong because encrypting environment variables with openssl and storing the key elsewhere introduces key management complexity and does not prevent the encrypted value from being exposed in logs or environment dumps; the decryption key must still be securely managed, which is often mishandled. Option D is wrong because requiring manual entry of API keys each time a build runs is impractical for automated CI/CD pipelines, introduces human error, and defeats the purpose of continuous integration and deployment.

Why these pairings

Why this answer

How to eliminate wrong answers

Option B is wrong because a router being unreachable would result in a connection timeout or an HTTP 503 Service Unavailable or 502 Bad Gateway error, not a 409 Conflict. Option C is wrong because a malformed request body would typically trigger an HTTP 400 Bad Request error, indicating the server cannot parse the request. Option D is wrong because incorrect authentication would result in an HTTP 401 Unauthorized or 403 Forbidden response, not a 409 Conflict.