Cisco DevNet Associate 200-901 (200-901) — Questions 901–975

Why this answer

How to eliminate wrong answers

Option B is wrong because 172.32.0.0/12 falls outside the RFC 1918 private range for Class B, which is 172.16.0.0/12 (172.16.0.0 – 172.31.255.255); 172.32.0.0 is a public address range. Option C is wrong because 172.15.0.0/12 is not a private range at all; it is part of the public Class B space and does not overlap with the 172.16.0.0/12 private block. Option D is wrong because 11.0.0.0/8 is a public Class A range (assigned to the US Department of Defense) and is not listed in RFC 1918; the private Class A range is 10.0.0.0/8.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'oc-yang-interfaces' is not a recognized YANG model name; OpenConfig models use the prefix 'openconfig-', not 'oc-yang-'. Option B is wrong because 'ietf-interfaces' is the IETF standard YANG model for interface management (RFC 7223), not an OpenConfig model. Option C is wrong because 'Cisco-IOS-XE-interfaces' is a Cisco proprietary native YANG model specific to IOS XE platforms, not an OpenConfig model.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (DELETE) is wrong because while DELETE is idempotent, it is used to remove a resource, not update it by sending a full representation. Option C (POST) is wrong because POST is not idempotent; it is designed to submit data for processing (e.g., creating a subordinate resource) and repeated requests may create multiple resources. Option D (GET) is wrong because GET is idempotent and safe, but it is used to retrieve a resource, not update it.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a tuple is an immutable ordered sequence that allows duplicates and requires O(n) linear search for membership tests, making it unsuitable for fast lookups. Option C is wrong because a list is an ordered mutable sequence that also allows duplicates and requires O(n) linear search for membership tests, failing both the uniqueness and speed requirements. Option D is wrong because while a dictionary provides O(1) membership tests on its keys, it stores key-value pairs rather than just unique items, making it overkill and semantically incorrect for a simple collection of unique items.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `traceroute` is used to trace the network path to a destination, not to perform DNS resolution; it may trigger a DNS lookup for display but does not directly verify the IP address. Option B is wrong because `show hosts` displays the static hostname-to-address mappings configured locally on the device, not dynamic DNS query results. Option C is wrong because `ping` sends ICMP echo requests to test reachability and may perform a DNS lookup as a side effect, but its primary purpose is not to verify the IP address via DNS.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VLAN 1 is the default native VLAN only if no native VLAN is explicitly configured; here VLAN 99 is set as the native VLAN. Option B is wrong because untagged frames on a trunk port are not dropped; they are assigned to the native VLAN. Option C is wrong because VLAN 10 is not the native VLAN; the native VLAN is explicitly set to VLAN 99.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `git rm --cached` only removes the file from the index (staging area) and the working directory, but the file remains in all previous commits, so it is still accessible in the repository history. Option C is wrong because `git rebase -i` and `git commit --amend` can modify recent commits but cannot efficiently remove a file from deep history without manually editing each commit, and they do not handle large-scale history rewriting for a file that was committed long ago. Option D is wrong because `git revert HEAD` creates a new commit that undoes the changes of the last commit, but it does not remove the sensitive file from earlier commits; the file remains in the commit history and can still be retrieved.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 500 seconds would be an unusually long interval for telemetry updates and the period value in Cisco MDT is always in milliseconds, not seconds. Option C is wrong because a re-establishment-based subscription is a different type (e.g., 'periodic' vs 'on-change' vs 'connection-based'), and the exhibit explicitly shows a periodic subscription with a numeric period value. Option D is wrong because 'on-change' subscriptions do not use a numeric period; they trigger only when the monitored data changes, whereas the exhibit shows a fixed period of 500.

Why this answer

Why this answer

How to eliminate wrong answers

Option A (Docker Pipeline Plugin) is wrong because it only provides Docker commands (like build, push, run) within a pipeline, but it does not integrate with Cisco Container Platform or manage deployments to CCP clusters. Option C (Kubernetes CLI Plugin) is wrong because it wraps kubectl commands for generic Kubernetes clusters, but it lacks the Cisco-specific API calls and authentication mechanisms required for CCP. Option D (SSH Plugin) is wrong because it only enables remote command execution over SSH, which is far too low-level and insecure for orchestrating container deployments to a platform like CCP.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'choice' and 'case' in YANG are used to model a selection among different schema nodes (e.g., different leafs or containers), not to restrict the value of a single leaf to a set of strings. Option B is wrong because 'type string;' would allow any arbitrary string value, providing no restriction to 'full', 'half', or 'auto'. Option C is wrong because 'type leafref' references the value of another leaf in the data tree; it does not define an inline set of allowed values, and the path '/other:duplex-list' would require a separate list node that may not exist or may not contain the desired restriction.

Why this answer

How to eliminate wrong answers

Option A is wrong because skipping the 'save configuration' step would risk losing the running configuration after reload, potentially causing misconfiguration or downtime, and it does not address the primary bottleneck (copy time). Option C is wrong because while a compressed image reduces file size, the copy time is dominated by link speed and protocol overhead; decompression on the switch adds CPU load and time, and the net gain may be minimal or negative. Option D is wrong because reloading all switches simultaneously would cause a complete network outage, violating the requirement for minimal downtime and exceeding the per-switch maintenance window constraint.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Deploy stage applies validated configurations to production or staging environments, not validate syntax; deploying invalid YAML would cause errors. Option C is wrong because the Test stage typically runs functional or integration tests (e.g., using pytest or pyATS) to verify network behavior, not static syntax checks. Option D is wrong because the Build stage compiles or packages code (e.g., converting Python to bytecode or creating Docker images), not validate YAML syntax.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because BPDUs are sent by switches, not servers; a server sending BPDUs with a higher priority would not affect STP convergence, and servers typically do not participate in STP. Option C is wrong because a root bridge flapping due to a configuration mismatch would cause repeated topology changes, but the scenario describes a single link failure followed by intermittent connectivity, not continuous flapping. Option D is wrong because OSPF is a Layer 3 routing protocol and does not affect Layer 2 STP convergence; the issue is within the same VLAN, and OSPF hold-down timers are irrelevant to Rapid PVST+ behavior.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because hardcoding API keys in a Dockerfile embeds secrets in the image layers, making them accessible to anyone who can pull the image and inspect its history. Option C is wrong because storing API keys in source code commits them to version control, exposing them to all repository users and potentially to public repositories. Option D is wrong because while environment variables in build configuration are a step up, they can still leak in build logs or be exposed if the CI/CD system is compromised; the question asks for the best practice, which is to use a dedicated secrets manager or vault (e.g., HashiCorp Vault, AWS Secrets Manager) rather than plain environment variables.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because it uses POST to a '/operations' URI, which is associated with NETCONF-style RPCs, not RESTCONF data resource creation; RESTCONF does not use '/operations' for creating data resources. Option C is wrong because POST on a data resource URL is used to create a child resource (e.g., a new entry in a list) when the parent container is targeted, not to create a specific instance by ID; using POST on '/vlan=100' would attempt to create a child of that specific VLAN, which is incorrect. Option D is wrong because it uses a non-standard '/config' path and omits the YANG module namespace; RESTCONF requires the module name prefix (e.g., 'Cisco-IOS-XE-vlan:') to identify the data model, and the path should be under '/restconf/data'.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because hardcoding the secret in the Python script exposes it to anyone with access to the source code, including version control history, and violates the principle of separating configuration from code. Option B is wrong because storing the secret in a plain text file in the repository makes it readable by anyone who can access the repo, and it can be inadvertently committed and shared, leading to credential exposure. Option C is wrong because encrypting the secret and storing it in the script still requires managing the decryption key within the script or repository, which creates a circular security problem and does not eliminate the risk of exposure through code access.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because dict.setdefault('timeout', 30) does not raise a KeyError; if the key 'timeout' does not exist, it inserts the key with the default value 30 and returns that value. Option C is wrong because dict.get('timeout') returns None (or a user-specified default) if the key is missing, never raising a KeyError. Option D is wrong because dict.pop('timeout', None) removes the key if it exists and returns its value; if the key does not exist, it returns the default value None without raising an error.

Why this answer

How to eliminate wrong answers

Option A is wrong because CSV is a flat, row-oriented format that lacks support for nested structures and is not used for Ansible playbooks or configuration files; it is typically used for tabular data exports. Option C is wrong because HTML is a markup language for web content, not a data serialization format, and has no role in Ansible configuration files. Option D is wrong because XML, while structured and used in older Cisco systems (e.g., NETCONF), is verbose and less human-readable than YAML, making it less preferred for Ansible's declarative playbooks.

Why this answer

How to eliminate wrong answers

Option A is wrong because Jinja2 templates are a tool for generating configuration files from variables, but they do not ensure that the applied configuration matches the desired state; they only help with parameterization and reuse. Option C is wrong because version control tracks changes to configuration files over time but does not enforce that the live environment state matches the code; it is a best practice for auditability, not for state convergence. Option D is wrong because rollback procedures handle failed deployments by reverting to a previous state, but they do not guarantee that the environment state matches the desired configuration defined in code; they are a recovery mechanism, not a preventive or corrective one.

Why these pairings

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the Meraki API does not use Bearer tokens in the Authorization header; it uses a custom header (`X-Cisco-Meraki-API-Key`) instead of the standard `Authorization: Bearer` format. Option B is wrong because the Meraki API does not have a login endpoint or session tokens; authentication is stateless and key-based. Option C is wrong because Basic authentication with username and password is not supported; the API key is a static, pre-generated token that does not involve credentials in the request.

Why this answer

How to eliminate wrong answers

Option A is wrong because a list is mutable but ordered (elements maintain insertion order and are accessed by index). Option B is wrong because a tuple is immutable (cannot be changed after creation) and ordered. Option D is wrong because a set is mutable and unordered, but the question asks for a data type that is both mutable and unordered, and while set fits, dictionary is the correct answer in the context of the provided options; however, note that set is also mutable and unordered, but the exam expects dictionary as the canonical answer for this pairing.

Why this answer

How to eliminate wrong answers

Option B is wrong because the Model is responsible for managing the application's data, business logic, and rules, not for handling user input directly. Option C is wrong because the Router is a component used in web frameworks (e.g., Express.js, Django) to map URLs to controllers, but it is not part of the core MVC pattern and does not handle user input or update the Model. Option D is wrong because the View is responsible for presenting data to the user and rendering the UI, not for processing user input or modifying the Model.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because running as root is a security anti-pattern; the official image intentionally uses a non-root user to follow least-privilege principles. Option B is wrong because the --unsafe-perm flag is only relevant when running npm scripts as root (it prevents dropping privileges), not for fixing permission issues with a non-root user. Option C is wrong because the node:14 image is not inherently buggy regarding permissions; the issue is a deliberate design choice to run as a non-root user, not an outdated bug.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because having 'spark:memberships_write' without 'spark:rooms_write' would still cause a 403 Forbidden (insufficient permissions), not a 401 Unauthorized — the token is valid but lacks the specific scope. Option C is wrong because if the token were not sent in the Authorization header, the API would return a 401 Unauthorized, but this is less likely than a scope issue given the developer is explicitly using an access token; however, the question asks for the 'most likely' cause, and scope misconfiguration is a common pitfall. Option D is wrong because an expired token would also return a 401, but the developer is actively generating and using the token, making expiration less probable than a scope mismatch.

Why this answer

How to eliminate wrong answers

Option A is wrong because GET /dataservice/device/monitor is used for retrieving real-time monitoring data (e.g., CPU, memory) for a specific device, not a list of all devices with site IDs and IP addresses. Option B is wrong because GET /dataservice/device/device is not a valid vManage API endpoint; the correct path for device details is /dataservice/device. Option C is wrong because GET /dataservice/device/overlay returns overlay tunnel statistics (e.g., OMP routes, TLOC information) rather than a flat list of devices with site IDs and IP addresses.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because POST is used to create a new resource, not to retrieve a list; using POST for retrieval violates REST principles and the Meraki API specification. Option C is wrong because /networks is not a valid top-level endpoint; the Meraki API requires the organization ID to scope the request, as networks are always associated with an organization. Option D is wrong because PUT is used to update an existing resource, not to retrieve a list; it would either fail or be interpreted incorrectly by the API.

Why this answer

Why this answer

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because *args collects positional arguments into a tuple, not keyword arguments. Option B is wrong because it defines a single parameter named 'kwargs' that expects a single positional argument, not any number of keyword arguments. Option D is wrong because *kwargs uses the single-asterisk syntax, which collects positional arguments into a tuple, not keyword arguments into a dictionary.

Why this answer

How to eliminate wrong answers

Option A is wrong because a single API call does not guarantee idempotency; for instance, a POST request that creates a resource is not idempotent and can create duplicates. Option C is wrong because failure recovery (e.g., retry logic or rollback) is a separate reliability concern, not a definition of idempotency; idempotency ensures safe retries but does not itself handle recovery. Option D is wrong because running a script on multiple devices simultaneously relates to parallelism or concurrency, not idempotency; idempotency applies per-operation regardless of the number of targets.

Why this answer

How to eliminate wrong answers

Option A is wrong because Neighbor Advertisement (ICMPv6 type 136) is the response message, not the initial query used to discover a MAC address. Option B is wrong because Router Solicitation (ICMPv6 type 133) is used by hosts to discover routers on the link, not to resolve a neighbor's MAC address. Option D is wrong because Address Resolution Protocol (ARP) is an IPv4-only protocol; IPv6 uses Neighbor Discovery Protocol (NDP) with ICMPv6 messages instead of ARP.

Why this answer

How to eliminate wrong answers

Option A is wrong because using HTTP instead of HTTPS would typically result in a redirect (301/302) or a connection error, not a 403 Forbidden; the Meraki API enforces HTTPS at the transport layer, not as an authorization check. Option B is wrong because an incorrect network ID would cause a 404 Not Found (resource not found) or a 400 Bad Request, not a 403 Forbidden; the 403 is an authorization failure, not a resource identification issue. Option D is wrong because omitting the organization ID would result in a 400 Bad Request (missing required parameter) or a 404 if the endpoint expects it in the path, not a 403; the 403 specifically points to authentication/authorization failure, not a missing parameter.

Why this answer

How to eliminate wrong answers

Option B (401 Unauthorized) is wrong because it indicates missing or invalid authentication credentials, not a malformed payload. Option C (403 Forbidden) is wrong because it means the server understood the request but refuses to authorize it, typically due to insufficient permissions, not a syntax error. Option D (422 Unprocessable Entity) is wrong because it is defined in RFC 4918 for WebDAV and indicates the server understands the content type and syntax but cannot process the instructions (e.g., semantic validation failures), not a malformed JSON structure.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because NETCONF is a stateful protocol that relies on SSH or TLS and uses RPC-based operations, not stateless HTTP methods. Option B is wrong because SNMP uses UDP and a manager-agent model with GET/SET/TRAP operations, not HTTP methods, and is not designed for modifying running configurations via RESTful APIs. Option D is wrong because CLI (Command-Line Interface) is a human-interactive interface that does not use HTTP methods and is not a protocol for programmatic, stateless configuration management.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an MTU misconfiguration would cause fragmentation issues or ICMP 'fragmentation needed' messages, not an incomplete ARP entry; ARP operates independently of MTU. Option B is wrong because routing protocol convergence affects the routing table, not the ARP table; an incomplete ARP entry is a Layer 2 issue, not a routing protocol state. Option D is wrong because an ACL blocking traffic would drop packets after a successful ARP resolution, resulting in a complete ARP entry but no forwarded packets; an incomplete ARP entry specifically indicates the ARP request itself failed.

Why this answer

How to eliminate wrong answers

Option A is wrong because PUT is used to update an existing resource, not to trigger a new operation, and /api/v1/version is a read-only endpoint for retrieving version information, not for initiating upgrades. Option B is wrong because DELETE is used to remove a resource, and /api/v1/firmware would typically represent a firmware resource or collection, not an action endpoint; deleting firmware does not trigger an upgrade. Option C is wrong because GET is used to retrieve data, and /api/v1/status is for checking system status or health, not for performing state-changing operations like firmware upgrades.

Why this answer