Knowledge + Practice

Cisco DevNet Associate 200-901 (200-901) — Questions 76–150

989 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 2 of 14

76

Multi-Selectmedium

Which TWO statements about REST API design best practices are true? (Choose two.)

Select 2 answers

A.Avoid API versioning to keep the API simple

B.Include the HTTP method in the URI path, e.g., /getDevices

C.Always use file-based transfer for large payloads

D.Use nouns for resource endpoints, e.g., /devices instead of /getDevices

E.Use HTTP methods appropriately: GET for retrieval, POST for creation, etc.

AnswersD, E

Correct: Nouns represent resources.

Why this answer

RESTful APIs use nouns to represent resources (e.g., /devices) rather than verbs (e.g., /getDevices). This aligns with the uniform interface constraint of REST, where the HTTP method (GET, POST, etc.) defines the action, and the URI identifies the resource. Using nouns keeps the API intuitive, consistent, and scalable.

Exam trap

Cisco often tests the misconception that verbs in URIs (like /getDevices) are acceptable, when in fact REST mandates nouns for resources and HTTP methods for actions, and that avoiding versioning is a shortcut that breaks backward compatibility.

Full explanation →

77

Multi-Selectmedium

A developer is integrating with Cisco Webex Teams. Which two resources can trigger a webhook?

Select 2 answers

A.resource: 'memberships', event: 'deleted'

B.resource: 'rooms', event: 'created'

C.resource: 'people', event: 'created'

D.resource: 'messages', event: 'created'

E.resource: 'teams', event: 'updated'

AnswersB, D

Correct. Room creation can trigger a webhook.

Why this answer

The Cisco Webex Teams API supports webhooks for the 'rooms' resource with the 'created' event, which triggers when a new room (space) is created. This is a documented and valid webhook combination that allows developers to react to room creation events in real-time.

Exam trap

Cisco often tests the exact list of valid resource-event pairs, and the trap here is that candidates assume all resources support all CRUD-like events (create, read, update, delete), but in reality each resource has a limited set of supported events, and 'people' has no webhook support at all.

Full explanation →

78

Multi-Selectmedium

An application is secured using OAuth 2.0 for Cisco Webex API access. Which three components are involved in the authorization code grant flow? (Choose three.)

Select 3 answers

A.Client Secret

B.Client ID

C.Authorization Code

D.Refresh Token

E.API Key

AnswersA, B, C

Client Secret authenticates the application.

Why this answer

The authorization code grant flow in OAuth 2.0 requires the client to present its Client ID and Client Secret to authenticate itself to the authorization server. The flow begins by requesting an authorization code, which is then exchanged for an access token. The three components explicitly involved in this exchange are the Client Secret (A), Client ID (B), and Authorization Code (C).

Exam trap

Cisco often tests the distinction between the components used in the initial authorization code grant flow versus those used in subsequent token refresh, causing candidates to incorrectly include the Refresh Token as a required component of the initial flow.

Full explanation →

79

MCQmedium

An engineer is designing a CI/CD pipeline for a Python application. The pipeline should automatically run unit tests, build a Docker image, push it to a private registry, and deploy to a Kubernetes cluster. Which sequence of stages is correct?

A.Build -> Test -> Push -> Deploy

B.Test -> Push -> Deploy

C.Test -> Deploy -> Build -> Push

D.Test -> Build -> Push -> Deploy

AnswerD

Tests run first; if they pass, the image is built, pushed to registry, then deployed.

Why this answer

A CI/CD pipeline for a Python application must first run unit tests to validate code quality, then build the Docker image from the tested code, push the image to a private registry, and finally deploy to Kubernetes. This sequence ensures that only tested and built artifacts are deployed, preventing deployment of broken or untested code.

Exam trap

Cisco often tests the logical order of CI/CD stages, and the trap here is that candidates may think building before testing is acceptable, but the pipeline must validate code before creating artifacts to avoid deploying untested code.

How to eliminate wrong answers

Option A is wrong because it places Build before Test, which would build a Docker image from untested code, risking deployment of a broken image. Option B is wrong because it omits the Build stage entirely, meaning no Docker image is created before pushing to the registry, which is impossible. Option C is wrong because it attempts to Deploy before Build and Push, which would fail since no image exists in the registry to deploy to Kubernetes.

Full explanation →

80

Multi-Selectmedium

Which THREE of the following are common tools used in a CI/CD pipeline for network automation? (Choose three.)

Select 3 answers

A.Jenkins

B.Git

C.Ansible

D.VMware vSphere

E.Docker

AnswersA, B, C

Jenkins is a popular CI/CD automation server.

Why this answer

Jenkins is a widely used automation server that orchestrates CI/CD pipelines, including those for network automation, by triggering jobs such as configuration validation or deployment upon code commits. Its plugin ecosystem integrates with network tools like Ansible and Git, making it a core component for automating network changes.

Exam trap

Cisco often tests the distinction between tools that are part of the CI/CD pipeline (like Jenkins, Git, Ansible) versus infrastructure or containerization tools (like VMware vSphere and Docker) that support but do not define the pipeline itself.

Full explanation →

81

Multi-Selectmedium

Which TWO HTTP methods are considered safe (idempotent and without side effects on the server)?

Select 2 answers

A.POST

B.PUT

C.HEAD

D.DELETE

E.GET

AnswersC, E

HEAD is identical to GET but returns only headers; safe.

Why this answer

(HEAD) is correct because the HEAD method is defined as idempotent and safe per RFC 7231: it retrieves the same headers as a GET request but without a response body, causing no side effects on the server. Option E (GET) is also correct because GET is explicitly defined as a safe method that only retrieves data and does not modify server state, making it idempotent.

Exam trap

Cisco often tests the distinction between idempotent and safe, trapping candidates who assume that idempotent methods (like PUT and DELETE) are also safe, when in fact safety requires no side effects on the server, which PUT and DELETE clearly violate.

Full explanation →

82

Multi-Selectmedium

Which TWO statements are true about VXLAN? (Choose two.)

Select 2 answers

A.VXLAN requires MPLS in the underlay

B.VXLAN encapsulates Ethernet frames in UDP packets

C.VXLAN uses IP-in-IP encapsulation

D.VXLAN operates at Layer 2 only

E.VXLAN supports up to 16 million logical networks

AnswersB, E

VXLAN uses UDP encapsulation.

Why this answer

VXLAN (Virtual Extensible LAN) encapsulates the original Layer 2 Ethernet frame inside a UDP packet (typically UDP destination port 4789). This allows the Layer 2 frame to be transported over a Layer 3 IP network, enabling network virtualization and overlay networking without requiring changes to the physical underlay.

Exam trap

Cisco often tests the misconception that VXLAN is a pure Layer 2 technology, but the trap here is that VXLAN encapsulates Layer 2 frames into Layer 3 UDP packets, making it a Layer 2 overlay over a Layer 3 underlay.

Full explanation →

83

Multi-Selecteasy

Which TWO Ansible modules are commonly used for automating Cisco IOS devices?

Select 2 answers

A.junos_config

B.nxos_command

C.ios_config

D.ios_command

E.eos_config

AnswersC, D

Manages Cisco IOS configuration.

Why this answer

The `ios_config` module is correct because it is specifically designed to manage Cisco IOS device configurations by sending configuration commands via SSH or Telnet, using the CLI to apply changes to the running or startup configuration. This module is part of Ansible's `cisco.ios` collection and directly supports the IOS operating system, making it the standard choice for automating configuration tasks on Cisco IOS devices.

Exam trap

Cisco often tests the candidate's ability to distinguish between device-specific Ansible modules (e.g., `ios_config` vs. `nxos_command`) rather than generic command modules, so the trap here is assuming that any 'command' module works across all Cisco platforms, when in fact each OS family (IOS, NX-OS, IOS-XR) has its own dedicated modules in the Ansible collections.

Full explanation →

84

Multi-Selectmedium

Which TWO of the following are commonly used when implementing pagination in REST APIs? (Select TWO)

Select 2 answers

A.Cursor-based token in response

B.Rate limiting headers

C.OAuth 2.0 token

D.Offset and limit query parameters

E.Webhook callback URL

AnswersA, D

Uses a token to point to the next page.

Why this answer

Offset/limit (or page/limit) and cursor-based pagination are common. Rate limiting is separate. OAuth is authentication.

Webhooks are for events.

Full explanation →

85

MCQhard

An engineer wants to trigger an EEM applet when a specific syslog message appears. Which event detector should be used?

A.event timer cron

B.event interface

C.event cli pattern

D.event syslog pattern

AnswerD

Syslog event detector triggers on syslog messages.

Why this answer

EEM's syslog event detector triggers on syslog messages matching a pattern.

Full explanation →

86

Multi-Selecthard

Which TWO of the following are valid ways to handle errors in a Python program that uses the Cisco Meraki API?

Select 2 answers

A.Checking the response body for an 'errors' key and handling accordingly

B.Checking the HTTP status code and raising an exception for 4xx and 5xx

C.Assuming the API always returns 200 and logging success

D.Retrying the request indefinitely until success

E.Using a try-except block around the API call and catching generic Exception

AnswersA, B

Many APIs, including Meraki, provide error details in the response body.

Why this answer

The Cisco Meraki API commonly returns a JSON response body containing an 'errors' key when a request fails, even when the HTTP status code is not a traditional 4xx or 5xx. Checking this key allows the developer to extract specific error messages from the API, enabling precise handling of issues like invalid parameters or permission errors. This approach aligns with Meraki's documented error response format, where the 'errors' field provides an array of human-readable strings detailing what went wrong.

Exam trap

Cisco often tests the distinction between handling errors via HTTP status codes versus parsing the response body for API-specific error fields, and the trap here is that candidates may think catching a generic Exception is sufficient, but the exam expects specific, layered error handling that respects both the HTTP protocol and the API's documented response format.

Full explanation →

87

MCQhard

A developer is integrating with Cisco SD-WAN vManage using REST APIs. After successfully submitting credentials, the API returns a 401 Unauthorized error for subsequent requests. What is the most likely missing step?

A.The request URL must include an API key parameter.

B.The API call must use the HTTPS protocol.

C.The password must be sent in base64 encoding.

D.The session token (X-XSRF-TOKEN) must be obtained and included in subsequent requests.

AnswerD

This is required after initial authentication.

Why this answer

Cisco SD-WAN vManage uses a two-step authentication process: first, credentials are submitted to obtain a session token (X-XSRF-TOKEN) and a JSESSIONID cookie. If subsequent API requests do not include the X-XSRF-TOKEN in the HTTP header, vManage rejects them with a 401 Unauthorized error, as the token is required for CSRF protection and session validation.

Exam trap

Cisco often tests the distinction between session cookies and CSRF tokens, trapping candidates who assume that a successful login alone (cookie) is enough for all subsequent API calls.

How to eliminate wrong answers

Option A is wrong because vManage does not require an API key parameter in the URL; it relies on session-based tokens (X-XSRF-TOKEN) and cookies for authentication. Option B is wrong while HTTPS is strongly recommended for security, its absence would typically cause a connection failure or redirect, not a 401 Unauthorized error after successful credential submission. Option C is wrong because vManage expects credentials in JSON format (plain text or hashed), not base64 encoding; base64 is used for HTTP Basic Authentication, which is not the default for vManage REST APIs.

Full explanation →

88

Multi-Selecthard

A network engineer is using Cisco DNA Center to automate network changes. Which THREE operations are part of the 'Change your network' API category? (Choose three.)

Select 3 answers

A.Create and assign a site to a device

B.Run a command on a device via Command Runner

C.Initiate a Plug and Play (PnP) device provisioning

D.Deploy a configuration template to devices

E.Retrieve the list of network devices

AnswersA, C, D

Site creation is part of changing the network topology.

Why this answer

The 'Change your network' API category in Cisco DNA Center includes operations that actively modify the network state. Creating and assigning a site to a device is a configuration change that associates a physical location with a device, which directly alters the network's logical topology and is part of the site management workflow under this API category.

Exam trap

Cisco often tests the distinction between read-only (query/inventory) and write (change) API operations, and the trap here is that candidates mistakenly classify 'Run a command on a device' as a change because it interacts with a device, but it is a transient troubleshooting action, not a persistent configuration change.

Full explanation →

89

MCQmedium

Refer to the exhibit. A developer needs to authenticate to this router via NETCONF using the devuser credentials. Why might authentication fail?

A.NETCONF requires AAA authentication

B.The devuser has privilege level 1, which is not enough for NETCONF access

C.The password is encrypted with type 5

D.The username does not have SSH access

AnswerB

Privilege level 1 is too low for NETCONF.

Why this answer

NETCONF access requires a minimum privilege level of 15 on Cisco IOS/IOS-XE devices. The devuser has privilege level 1, which restricts the user to basic monitoring commands and prevents NETCONF operations. Even with correct SSH and authentication, the privilege level mismatch causes the NETCONF session to be rejected.

Exam trap

Cisco often tests the misconception that any valid SSH user can use NETCONF, but the trap is that NETCONF requires privilege level 15 regardless of SSH access or authentication method.

How to eliminate wrong answers

Option A is wrong because NETCONF does not require AAA authentication; it can use local authentication (as shown in the exhibit with username/password). Option C is wrong because type 5 encryption (MD5-based) is a valid and supported password encryption for local users; it does not cause authentication failure. Option D is wrong because the exhibit shows the devuser is configured with SSH access (the 'ssh' keyword is present in the username command), so SSH access is explicitly granted.

Full explanation →

90

MCQhard

A large enterprise uses Cisco DNA Center to manage its campus network. The network team has automated wireless SSID provisioning using the Intent API. Recently, a new SSID was created but it does not appear on the wireless LAN controllers. The Python script that calls the API returns a 200 OK response, but the SSID is not deployed. The script uses the POST /dna/intent/api/v1/ssid endpoint with a JSON body containing the SSID name and security settings. A day later, the SSID is still missing. The engineer checks the DNA Center GUI and sees the SSID in the 'Design' section but with a 'Provisioning Failed' status. Which step should the engineer take next to resolve the issue?

A.Re-run the same API call and ignore the 200 response

B.Use the 'Provision' API endpoint to deploy the SSID to the targeted sites

C.Delete the SSID and recreate it with a different name

D.Wait for the next scheduled provisioning cycle

AnswerB

A separate provision step is required to push the SSID to controllers.

Why this answer

The 200 OK response from the POST /dna/intent/api/v1/ssid endpoint only confirms that the API request was accepted and the SSID configuration was created in the DNA Center design database. It does not automatically trigger deployment to the wireless LAN controllers. The 'Provisioning Failed' status in the GUI indicates that the SSID was designed but not successfully deployed to the targeted sites.

To complete the deployment, the engineer must use the Intent API's 'Provision' endpoint (e.g., POST /dna/intent/api/v1/provision) to push the SSID configuration to the specific sites or devices, which is the missing step.

Exam trap

Cisco often tests the distinction between design and provisioning phases in the Intent API, and the trap here is that candidates assume a 200 OK response means the configuration is fully deployed, when in reality it only confirms the design was accepted.

How to eliminate wrong answers

Option A is wrong because re-running the same API call will only recreate the design object and return another 200 OK, but it will not trigger deployment; the provisioning step is separate and required. Option C is wrong because deleting and recreating the SSID with a different name does not address the root cause—the design object already exists, and the failure is in the provisioning workflow, not the SSID name. Option D is wrong because DNA Center does not have a scheduled provisioning cycle; provisioning is an explicit action that must be initiated via the API or GUI, and waiting will not resolve the issue.

Full explanation →

91

MCQhard

A developer is implementing a Cisco Intersight API solution to manage multiple UCS domains. They receive an HTTP 403 Forbidden response when trying to create an organization. What is the most likely issue?

A.The request body is malformed

B.The user account does not have sufficient privileges

C.The API key is invalid

D.The organization already exists

AnswerB

403 means the server understands the request but refuses to authorize it.

Why this answer

An HTTP 403 Forbidden response indicates that the server understood the request but is refusing to authorize it. In the context of Cisco Intersight, this typically means the API key or user account associated with the request lacks the required privileges to perform the action, such as creating an organization. Only accounts with administrative or appropriate role-based access control (RBAC) permissions can create organizations.

Exam trap

Cisco often tests the distinction between HTTP 401 (authentication failure) and 403 (authorization failure) to trap candidates who confuse invalid credentials with insufficient privileges.

How to eliminate wrong answers

Option A is wrong because a malformed request body would typically result in a 400 Bad Request error, not a 403 Forbidden. Option C is wrong because an invalid API key would result in a 401 Unauthorized error, indicating authentication failure rather than authorization failure. Option D is wrong because attempting to create an organization that already exists would result in a 409 Conflict error, not a 403 Forbidden.

Full explanation →

92

MCQhard

A developer is using the Meraki Dashboard API to retrieve a list of clients for a network. After a successful request, the response includes a Link header with rel="next" pointing to the next page. What does this indicate about the API's pagination?

A.The API uses page-based pagination with page and perPage parameters.

B.The API uses offset-based pagination and the next page can be retrieved by incrementing an offset parameter.

C.The API uses Link header pagination and the next page can be retrieved by following the URL in the Link header.

D.The API uses cursor-based pagination with startingAfter/endingBefore parameters.

AnswerC

The Link header with rel="next" provides the URL for the next page.

Why this answer

Meraki API uses Link headers for pagination, and a rel="next" link indicates there are additional pages to fetch.

Full explanation →

93

MCQmedium

Which Git command is used to switch to an existing branch named 'feature-x' and update the working directory?

A.git merge feature-x

B.git branch feature-x

C.git switch -c feature-x

D.git checkout feature-x

AnswerD

Switches to the specified branch and updates the working directory.

Why this answer

`git checkout feature-x` is the traditional Git command that switches the HEAD reference to the existing branch 'feature-x' and updates the working directory to match that branch's commit history. This command performs both the branch switch and the working tree update in one operation, which is the core requirement of the question.

Exam trap

Cisco often tests the distinction between `git checkout` for switching to an existing branch versus `git checkout -b` (or `git switch -c`) for creating and switching to a new branch, and candidates frequently confuse the `-c` flag as a switch-only option rather than a creation flag.

How to eliminate wrong answers

Option A is wrong because `git merge feature-x` integrates changes from 'feature-x' into the current branch, rather than switching to 'feature-x'. Option B is wrong because `git branch feature-x` creates a new branch named 'feature-x' from the current HEAD, but does not switch to it or update the working directory. Option C is wrong because `git switch -c feature-x` creates and switches to a new branch named 'feature-x', but the question specifies switching to an existing branch, and the `-c` flag is for creation, not for an existing branch.

Full explanation →

94

Multi-Selectmedium

A network engineer is designing a wireless network for an office that requires high throughput and minimal interference. Which two channels should be used for the 2.4 GHz band to avoid overlap? (Choose two.)

Select 2 answers

A.Channel 11

B.Channel 9

C.Channel 6

D.Channel 3

E.Channel 1

AnswersC, E

Channel 6 is non-overlapping with channels 1 and 11.

Why this answer

In the 2.4 GHz band, channels 1, 6, and 11 are the only non-overlapping channels when using 20 MHz channel spacing, as each channel occupies 22 MHz of bandwidth and these three are spaced 25 MHz apart. Channels 1 and 6 are correct because they do not overlap, minimizing co-channel interference and maximizing throughput.

Exam trap

Cisco often tests the misconception that any three channels (e.g., 1, 4, 8) are non-overlapping, but the correct non-overlapping set is strictly 1, 6, and 11 due to the 22 MHz channel width and 5 MHz spacing.

Full explanation →

95

MCQhard

A CI/CD pipeline uses GitHub Actions. The workflow should trigger only when a pull request is opened against the 'main' branch. Which 'on' trigger configuration is correct?

A.on: pull_request: branches: [main]

B.on: [pull_request, push]

C.on: push: branches: [main]

D.on: pull_request_target: branches: [main]

AnswerA

This triggers when a pull request targets the main branch.

Why this answer

The correct syntax uses pull_request with branches filter.

Full explanation →

96

Multi-Selecthard

Which two statements about the Cisco DevNet Sandbox are true?

Select 2 answers

A.Sandboxes cannot be used for learning APIs

B.Sandboxes require a paid subscription for basic access

C.Sandboxes can be reserved for a fixed time period

D.Sandboxes provide always-on access to a limited set of devices

E.Sandboxes only support Cisco IOS XE devices

AnswersC, D

Many sandboxes require reservation.

Why this answer

Cisco DevNet Sandboxes allow users to reserve a sandbox for a fixed time period, typically ranging from 2 to 4 hours, providing exclusive access to a pre-configured lab environment. This reservation model ensures that users have dedicated resources without contention, which is essential for testing APIs, automation scripts, or network configurations. The fixed-time reservation is a core feature of the DevNet Sandbox service, distinguishing it from always-on sandboxes.

Exam trap

Cisco often tests the distinction between 'always-on' sandboxes (which provide persistent but limited access) and 'reserved' sandboxes (which offer full, time-limited access), and candidates may incorrectly assume all sandboxes require payment or only support a single OS.

Full explanation →

97

MCQhard

A developer is using the Meraki Dashboard API and receives a 429 Too Many Requests error. The API documentation states a rate limit of 5 calls per second. What is the best practice to handle this?

A.Ignore the error and retry immediately.

B.Use a different API key to bypass the limit.

C.Increase the number of concurrent requests to exhaust the rate limit quickly.

D.Implement exponential backoff and honor the Retry-After header.

AnswerD

Exponential backoff with retry headers is the standard rate-limiting handling technique.

Why this answer

Implementing exponential backoff with retry-after headers is the recommended approach for rate-limited APIs. Ignoring or simply retrying immediately may worsen the situation.

Full explanation →

98

Multi-Selecthard

A DevOps engineer is automating network configuration using REST APIs. The engineer needs to choose between NETCONF and OpenFlow as southbound protocols. Which TWO statements are correct?

Select 2 answers

A.OpenFlow allows the controller to install flow entries in switches

B.NETCONF provides real-time packet forwarding control

C.Both protocols are used exclusively for northbound APIs

D.OpenFlow is primarily used for configuration management

E.NETCONF uses YANG data models and XML encoding

AnswersA, E

OpenFlow enables dynamic flow table modification.

Why this answer

NETCONF uses XML and is used for configuration management, while OpenFlow pushes flow entries to switches.

Full explanation →

99

MCQeasy

A Python script using the Cisco Meraki API must update the SSID settings for a network. Which HTTP method should be used to modify an existing SSID?

A.PUT

B.POST

C.DELETE

D.GET

AnswerA

PUT updates an existing resource.

Why this answer

To modify an existing SSID in the Cisco Meraki API, the HTTP PUT method is used because it performs an idempotent update of the resource at the specified URI. The Meraki API follows RESTful conventions where PUT replaces the entire representation of the SSID object, making it the correct choice for updating an existing SSID's settings (e.g., name, encryption, or splash page).

Exam trap

Cisco often tests the distinction between PUT and POST in REST APIs, and the trap here is that candidates mistakenly think POST can be used for updates because they confuse it with 'update' in general CRUD terminology, but POST is specifically for creation in RESTful design.

How to eliminate wrong answers

Option B (POST) is wrong because POST is used to create a new resource (e.g., add a new SSID to a network), not to update an existing one; using POST on an existing SSID would typically result in a 409 Conflict or create a duplicate. Option C (DELETE) is wrong because DELETE is used to remove an SSID entirely, not to modify its settings; calling DELETE on an SSID would remove it from the network. Option D (GET) is wrong because GET is a read-only method used to retrieve the current configuration of an SSID, not to change it.

Full explanation →

100

MCQmedium

In a Kubernetes deployment, the container image pull policy is set to "Always". This causes performance issues during rollouts because the image registry is slow. What is the best practice to reduce pull time while maintaining security?

A.Set pullPolicy to "IfNotPresent" for stable releases and use image tags like v1.2.3.

B.Use the ":latest" tag to ensure always fresh images.

C.Set pullPolicy to "Never" and pre-pull images on nodes.

D.Disable image verification to speed up pulls.

AnswerA

Optimizes pulls and uses versioned tags for consistency.

Why this answer

Setting `pullPolicy` to `IfNotPresent` for stable releases (using immutable tags like `v1.2.3`) avoids unnecessary image pulls from a slow registry when the image already exists on the node. This reduces rollout time while maintaining security by ensuring that only explicitly versioned, verified images are used, preventing accidental use of stale or untagged images.

Exam trap

Cisco often tests the misconception that `:latest` is a safe, always-fresh choice, but the trap here is that `:latest` combined with `Always` causes unnecessary pulls and version ambiguity, whereas immutable tags with `IfNotPresent` balance performance and security.

How to eliminate wrong answers

Option B is wrong because using the `:latest` tag with `pullPolicy: Always` (the default for `:latest`) forces a pull every time, which exacerbates the performance issue and introduces unpredictability, as `:latest` is mutable and can change without notice. Option C is wrong because setting `pullPolicy` to `Never` prevents the kubelet from pulling the image at all, which can cause Pod failures if the image is not already present on the node, and pre-pulling images manually is not scalable or secure for dynamic rollouts. Option D is wrong because disabling image verification (e.g., skipping signature validation or using `imagePullPolicy: Always` without digest-based references) weakens security by allowing potentially tampered images to run, and it does not address the root cause of slow pulls.

Full explanation →

101

MCQhard

A Python script using ncclient to configure a Cisco IOS XE device fails with an error that the capability 'urn:ietf:params:xml:ns:netconf:base:1.0' is missing. What is the most likely cause?

A.The device does not have NETCONF enabled

B.The username or password is incorrect

C.The edit-config operation should be on candidate instead of running

D.The host key verification is disabled incorrectly

AnswerA

If NETCONF is not enabled on the device, it will not advertise the required capabilities.

Why this answer

The error indicates that the NETCONF base capability (urn:ietf:params:xml:ns:netconf:base:1.0) is not advertised by the device. This capability is mandatory for any NETCONF server; its absence means the device is not running a NETCONF server or NETCONF is not enabled. On Cisco IOS XE, NETCONF must be explicitly enabled via the 'netconf-yang' feature, and the error occurs when the ncclient client attempts to establish a session but the device does not respond with the required capability.

Exam trap

Cisco often tests the distinction between authentication/SSH errors and NETCONF capability negotiation errors, trapping candidates who confuse a missing capability with a credential or transport issue.

How to eliminate wrong answers

Option B is wrong because incorrect username or password would result in an authentication failure (e.g., 'Authentication error' or 'SSHException'), not a missing capability error. Option C is wrong because the error is about the base capability not being present during session establishment, not about the target datastore (candidate vs. running) used in an edit-config operation. Option D is wrong because host key verification issues would cause an SSH connection failure (e.g., 'Host key not found' or 'SSHException'), not a missing NETCONF capability error.

Full explanation →

102

MCQeasy

A network engineer wants to automate the configuration of multiple Cisco IOS devices using Ansible. What is the minimum requirement on the control node to execute Ansible playbooks against these devices?

A.Ansible Tower license for automated network configuration

B.A PostgreSQL database to store inventory and credentials

C.A dedicated management server with Ansible Tower installed

D.A Linux or macOS control node with Python installed

AnswerD

Ansible requires Python on the control node; network devices only need SSH access.

Why this answer

Ansible uses a push-based architecture where the control node must be a Linux or macOS system with Python installed to execute playbooks. Python is required because Ansible itself is written in Python and relies on it for modules, SSH connections, and Jinja2 templating. No additional database, license, or dedicated management server is needed for basic network automation against Cisco IOS devices.

Exam trap

Cisco often tests the misconception that Ansible requires a dedicated server or commercial product like Ansible Tower, when in fact the minimum requirement is simply a Linux/macOS host with Python and the Ansible package installed.

How to eliminate wrong answers

Option A is wrong because Ansible Tower (now Red Hat Ansible Automation Platform) is a commercial web UI and API layer that adds RBAC, scheduling, and auditing, but it is not a minimum requirement; the open-source Ansible Engine can run playbooks directly from any control node. Option B is wrong because a PostgreSQL database is only required if you use Ansible Tower's inventory and credential storage; the default flat-file inventory and SSH keys or vault-encrypted credentials work without any database. Option C is wrong because a dedicated management server with Ansible Tower installed is an enterprise deployment pattern, not a minimum requirement; a standard Linux or macOS workstation with Ansible installed via pip or package manager suffices.

Full explanation →

103

Multi-Selecthard

A network automation engineer uses Ansible to manage a group of Cisco IOS XE devices. The playbook fails with 'unreachable' for some devices. Which TWO actions should the engineer take to troubleshoot the connectivity?

Select 2 answers

A.Increase the timeout value in the playbook.

B.Ignore the unreachable devices and proceed.

C.Use the 'ios_command' module to test connectivity.

D.Check if SNMP is enabled on the devices.

E.Verify the device IP address and credentials in the inventory.

AnswersC, E

Helps verify device accessibility.

Why this answer

The 'ios_command' module can be used to verify basic connectivity by sending a simple command (e.g., 'show version') to the device. If the module returns a response, it confirms that Ansible can reach the device and that the credentials are valid, isolating the issue to the specific task or playbook logic rather than connectivity.

Exam trap

Cisco often tests the misconception that SNMP is required for Ansible management, but the trap here is that candidates confuse SNMP-based monitoring with SSH-based automation, leading them to select Option D instead of focusing on the actual connectivity layer.

Full explanation →

104

MCQhard

Refer to the exhibit. This JSON response was received from the Cisco DNA Center API. A developer wants to extract the software version of the first device. Which Python expression correctly retrieves '16.12.5' from the variable `data`?

A.data[0]['softwareVersion']

B.data['response'][0]['version']

C.data['response']['softwareVersion']

D.data['response'][0]['softwareVersion']

AnswerD

Correctly navigates the JSON hierarchy.

Why this answer

The JSON response from Cisco DNA Center's API is structured with a 'response' key containing an array of device objects. To access the software version of the first device, you must first index into the array with [0] to get the first device object, then use the key 'softwareVersion' to retrieve the value '16.12.5'. The variable `data` holds the entire JSON object, so `data['response'][0]['softwareVersion']` correctly navigates this nested structure.

Exam trap

The trap here is that candidates often forget the 'response' wrapper and treat the JSON as a flat list, or confuse the key name 'version' with 'softwareVersion', which Cisco deliberately uses to test attention to exact field names in the API schema.

How to eliminate wrong answers

Option A is wrong because it assumes `data` is a list (using `data[0]`), but the JSON response is a dictionary with a 'response' key, not a top-level array. Option B is wrong because it uses the key 'version' instead of 'softwareVersion', which does not exist in the device object; the correct key is 'softwareVersion'. Option C is wrong because it omits the array index [0], attempting to access 'softwareVersion' directly on the 'response' list, which would cause a TypeError since lists are not subscriptable by string keys.

Full explanation →

105

MCQmedium

Which HTTP status code indicates that a POST request successfully created a new resource?

A.204 No Content

B.301 Moved Permanently

C.201 Created

D.200 OK

AnswerC

Correct: 201 Created indicates successful resource creation.

Why this answer

HTTP 201 Created is the standard response for a successful POST that creates a resource.

Full explanation →

106

MCQeasy

A developer is integrating a monitoring application with Cisco Meraki API to retrieve network health data. The application needs to ensure it doesn't exceed the API rate limit of 5 requests per second. What is the best practice for handling this limitation?

A.Increase the rate limit by contacting Cisco support.

B.Use a single API key for all requests to reduce overhead.

C.Implement exponential backoff and retry after receiving a 429 status code.

D.Send all requests in a loop without delay to complete quickly.

AnswerC

Exponential backoff is the standard technique to handle rate limits, gradually increasing wait time between retries.

Why this answer

The Cisco Meraki API returns HTTP 429 (Too Many Requests) when the rate limit of 5 requests per second is exceeded. Implementing exponential backoff—where the application waits progressively longer intervals between retries—is the standard best practice for handling rate limits gracefully, as it reduces server load and increases the chance of successful retries without overwhelming the API.

Exam trap

Cisco often tests the misconception that rate limits can be bypassed by technical tricks like using a single API key or sending requests faster, when the correct approach is to respect the 429 response with exponential backoff.

How to eliminate wrong answers

Option A is wrong because the rate limit is a fixed server-side policy enforced by Cisco Meraki; contacting support will not increase it, and the developer must work within the documented limits. Option B is wrong because using a single API key does not affect the rate limit—rate limiting is applied per API key or per organization, and a single key cannot reduce overhead or bypass the 5 requests per second cap. Option D is wrong because sending all requests in a loop without delay will immediately trigger 429 responses, causing all requests to fail and potentially leading to temporary IP blocking or account throttling.

Full explanation →

107

MCQmedium

An application needs to authenticate to Cisco DNA Center. Which authentication method is used?

A.API key in X-Cisco-DNA-Center-API-Key header

B.OAuth2 with client credentials grant

C.Bearer token in Authorization header with no prior step

D.Basic Auth over HTTPS to obtain a token

AnswerD

Correct. Basic Auth is used to get a token for subsequent API calls.

Why this answer

DNA Center uses Basic Auth to obtain a token via POST /dna/system/api/v1/auth/token.

Full explanation →

108

MCQmedium

Which DNS record type is used to map a domain name to an IPv6 address?

A.CNAME

B.MX

C.A

D.AAAA

AnswerD

Correct. AAAA maps to IPv6.

Why this answer

The AAAA record is used for IPv6 address mapping.

Full explanation →

109

MCQhard

A DevOps team is developing a CI/CD pipeline for a microservices application that uses Cisco NSO (Network Services Orchestrator) for network configuration. The application code is stored in a Git repository. The pipeline must automatically trigger a test suite when a pull request is merged to the main branch, but only if the tests pass, then deploy to a staging environment. The team is using Jenkins. A junior engineer suggests using a single Jenkinsfile with a declarative pipeline that includes all stages. However, a senior engineer notes that the pipeline should be designed for reusability and maintainability, especially as the number of microservices grows. Which approach best meets these requirements?

A.Use shared libraries to define common stages like testing and deployment, and reference them in each microservice's Jenkinsfile.

B.Create separate Jenkinsfiles for each microservice and call them from a main pipeline using the "build" step.

C.Use a single scripted pipeline that uses "parallel" for microservices and "stage" for testing and deployment.

D.Use a single declarative pipeline with all stages defined in the Jenkinsfile and use "when" conditions to control execution.

AnswerA

Shared libraries in Jenkins allow common pipeline logic (e.g., testing, deployment) to be defined once and reused across multiple microservices. This promotes reusability and maintainability, as changes propagate automatically, reducing duplication.

Why this answer

Shared libraries in Jenkins allow common pipeline logic (e.g., testing and deployment stages) to be defined once and reused across multiple microservices. This promotes reusability and maintainability, as changes to the shared library automatically propagate to all Jenkinsfiles, reducing duplication and simplifying updates as the number of microservices grows.

Exam trap

The trap here is that candidates often choose a monolithic pipeline (Option D) because it seems simpler, but Cisco tests the understanding that reusability and maintainability in a microservices architecture require decoupling pipeline logic via shared libraries, not centralizing it.

How to eliminate wrong answers

Option B is wrong because creating separate Jenkinsfiles for each microservice and calling them from a main pipeline using the 'build' step still leads to duplication of pipeline logic across microservices, which undermines maintainability and reusability. Option C is wrong because using a single scripted pipeline with 'parallel' for microservices tightly couples all microservices into one pipeline, making it difficult to manage individual service updates and reducing reusability. Option D is wrong because using a single declarative pipeline with all stages defined in the Jenkinsfile and 'when' conditions results in a monolithic pipeline that is hard to maintain as microservices proliferate, violating the principles of reusability and modularity.

Full explanation →

110

Drag & Dropmedium

Drag and drop the steps to configure OSPF on a Cisco router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

OSPF configuration requires enabling the OSPF process, setting a router ID, and advertising networks in specific areas.

Full explanation →

111

Multi-Selecthard

When implementing network automation with Cisco devices, which THREE practices help ensure idempotency? (Select THREE)

Select 3 answers

A.Writing scripts that only push incremental configurations.

B.Relying on manual rollback procedures after automation failures.

C.Performing a full configuration replace using RESTCONF PUT instead of PATCH.

D.Using Ansible modules that check the current state before making changes.

E.Using declarative automation tools like Puppet that enforce desired state.

AnswersC, D, E

PUT replaces the whole resource, making it idempotent; PATCH is not necessarily idempotent.

Why this answer

A full configuration replace using RESTCONF PUT ensures idempotency by setting the entire configuration to a known state, regardless of the current state. Unlike PATCH, which applies incremental changes that may behave differently depending on the existing configuration, PUT overwrites the entire resource, guaranteeing the same result every time it is executed.

Exam trap

Cisco often tests the misconception that incremental changes (like PATCH or partial configs) are idempotent, but the trap here is that only full-state replacement or state-checking tools guarantee the same result on every execution, regardless of the starting configuration.

Full explanation →

112

Multi-Selectmedium

Which TWO of the following are southbound protocols in SDN?

Select 2 answers

A.OSPF

B.NETCONF

C.SNMP

D.OpenFlow

E.REST

AnswersB, D

NETCONF is a southbound configuration protocol.

Why this answer

OpenFlow and NETCONF are southbound protocols used between controller and network devices.

Full explanation →

113

MCQeasy

An engineer needs to automate the backup of configuration files from multiple Cisco IOS devices to a central server. Which protocol is most appropriate for pushing configurations from the devices to the server?

A.TFTP

B.FTP

C.HTTP

D.SCP

AnswerD

SCP uses SSH encryption, providing secure file transfer.

Why this answer

SCP (Secure Copy Protocol) is the most appropriate choice because it provides encrypted, authenticated file transfers over SSH, ensuring the confidentiality and integrity of Cisco IOS configuration backups. It is natively supported on Cisco IOS devices and allows secure push operations to a central server without requiring additional software.

Exam trap

Cisco often tests the distinction between secure and insecure file transfer protocols in automation contexts, and the trap here is that candidates may choose TFTP due to its simplicity and common use in lab environments, overlooking the security requirements for production backups.

How to eliminate wrong answers

Option A is wrong because TFTP lacks any security mechanisms (no encryption or authentication) and is typically used for local network transfers like booting or initial configs, not for secure backups to a central server. Option B is wrong because FTP transmits credentials and data in cleartext and requires complex firewall configurations, making it insecure and less suitable for automated, secure backups. Option C is wrong because HTTP is not designed for file transfers in this context; it is stateless and insecure without HTTPS, and Cisco IOS devices do not natively support HTTP-based config push operations to a server.

Full explanation →

114

MCQeasy

What is the output of the following code? my_list = [1, 2, 3] for i in range(len(my_list)): my_list[i] += 1 print(my_list)

A.[2, 3, 4]

B.[1, 2, 3, 1]

C.[1, 2, 3]

D.Error

AnswerA

Correct, each element incremented by 1.

Why this answer

The code modifies each element by adding 1. So [1,2,3] becomes [2,3,4].

Full explanation →

115

MCQeasy

The exhibit shows a JSON response from a Cisco NX-OS API query for interface status. What is the operational state of interface Ethernet1/1?

A.unknown

B.down

C.admin-down

D.up

AnswerB

The 'oper-state' field is 'down'.

Why this answer

The JSON response shows the interface Ethernet1/1 with an 'operState' value of 'down'. In Cisco NX-OS, the 'operState' field directly reflects the operational status of the interface, which is determined by Layer 1 and Layer 2 conditions such as cable connectivity, signal detection, and protocol state. Since the value is 'down', the interface is not passing traffic, making option B correct.

Exam trap

Cisco often tests the distinction between administrative state (adminState) and operational state (operState), where candidates mistakenly assume that an interface with adminState 'up' must also be operationally 'up', but the operational state depends on physical and protocol conditions.

How to eliminate wrong answers

Option A is wrong because 'unknown' would indicate that the operational state could not be determined, but the JSON explicitly provides 'down' as the operState, not 'unknown'. Option C is wrong because 'admin-down' refers to the administrative state (adminState), not the operational state; the JSON shows 'adminState' as 'up', meaning the interface is administratively enabled. Option D is wrong because 'up' would require the operState to be 'up', but it is explicitly 'down' in the response.

Full explanation →

116

MCQmedium

A Docker container running a web application needs to be accessible on the host's port 8080. The application inside the container listens on port 80. Which docker run command achieves this?

A.docker run -d --expose 80 -p 8080 myapp

B.docker run -d -p 80:8080 myapp

C.docker run -d -P 8080:80 myapp

D.docker run -d -p 8080:80 myapp

AnswerD

This maps host port 8080 to container port 80, as required.

Why this answer

The -p flag maps host ports to container ports. The correct syntax is -p <host-port>:<container-port>.

Full explanation →

117

MCQmedium

Which of the following is a best practice for version controlling large binary files (e.g., network device firmware images) in a Git repository?

A.Avoid storing binary files; use a separate artifact repository and reference the version in metadata

B.Use Git submodules to reference external storage

C.Compress them and commit as usual

D.Store them directly in the repository with LFS (Large File Storage)

AnswerA

This keeps the Git repository lean and uses appropriate tools for binary storage.

Why this answer

Git is designed for text-based source code with frequent diffs, not large binary files. Storing firmware images directly bloats the repository, slows clones and fetches, and defeats Git's delta compression. Best practice is to use a dedicated artifact repository (e.g., Nexus, Artifactory, or an S3 bucket) and store only a metadata reference (e.g., URL + checksum) in Git, keeping the repository lean and the binary lifecycle managed separately.

Exam trap

Cisco often tests the misconception that Git LFS is the universal solution for large files, but the 200-901 exam expects you to recognize that for immutable, externally-managed artifacts like firmware images, a separate artifact repository with metadata references is the recommended best practice over LFS.

How to eliminate wrong answers

Option B is wrong because Git submodules are designed to link to other Git repositories, not to external binary storage; they still store Git objects locally and do not solve the problem of large binary bloat. Option C is wrong because compressing binary files before committing does not reduce the repository size impact—Git will still store the compressed blob in its object database, and any change to the binary requires storing a new full copy, leading to rapid repository growth. Option D is wrong because while Git LFS (Large File Storage) replaces large files with text pointers and stores the actual content on a remote server, it is not a best practice for network device firmware images in the context of the 200-901 exam; the exam emphasizes using a separate artifact repository for immutable artifacts, and LFS still introduces overhead and is not designed for versioning firmware that should be managed outside the source code repository.

Full explanation →

118

MCQmedium

A network engineer is designing a data center network with leaf-spine topology. The requirement is to minimize latency and maximize bandwidth for east-west traffic. Which type of links should be used between leaf and spine switches?

A.Multiple links with VSS

B.Single link with LACP

C.Multiple parallel links with ECMP routing

D.Single link with STP

AnswerC

ECMP allows all links to be active, increasing bandwidth and reducing latency.

Why this answer

In a leaf-spine topology, east-west traffic (server-to-server) must traverse the spine switches. Using multiple parallel links with Equal-Cost Multi-Path (ECMP) routing allows all links to be active simultaneously, maximizing bandwidth and minimizing latency by load-balancing traffic across all available paths. ECMP leverages Layer 3 routing (e.g., OSPF or BGP) to forward packets over multiple equal-cost paths, which is ideal for the non-blocking, high-throughput design of leaf-spine architectures.

Exam trap

Cisco often tests the misconception that link aggregation (LACP or VSS) is the best way to increase bandwidth in a leaf-spine design, but the trap is that these are Layer 2 solutions that do not provide the active-active multipath routing (ECMP) required for optimal east-west traffic in a Layer 3 leaf-spine topology.

How to eliminate wrong answers

Option A is wrong because VSS (Virtual Switching System) is a Cisco proprietary technology that bundles multiple physical switches into a single logical switch using a control plane, which introduces complexity and does not scale well in a leaf-spine design; it also relies on a single control plane that can become a bottleneck for east-west traffic. Option B is wrong because a single link with LACP (Link Aggregation Control Protocol) provides link redundancy and increased bandwidth only within a single aggregated link, but it does not provide the multiple parallel active paths needed for full bisectional bandwidth in a leaf-spine topology; LACP is a Layer 2 solution that does not leverage ECMP routing. Option D is wrong because a single link with STP (Spanning Tree Protocol) blocks redundant paths to prevent loops, resulting in only one active link at a time, which severely limits bandwidth and increases latency for east-west traffic; STP is designed for traditional tree topologies, not for the active-active multipath requirement of leaf-spine.

Full explanation →

119

MCQhard

An engineer is configuring Cisco IOS XE for RESTCONF programmability. Which configuration is necessary to enable the RESTCONF API?

A.ip scp server enable

B.ip http server and ip http secure-server

C.feature nxapi

D.netconf-yang and restconf

AnswerD

Correct. Both netconf-yang and restconf are typically enabled to support model-driven programmability via RESTCONF.

Why this answer

RESTCONF requires the 'restconf' service to be enabled globally. Additionally, 'netconf-yang' is often enabled together, but 'restconf' is the key for RESTCONF.

Full explanation →

120

MCQmedium

A network administrator is configuring SNMPv3 on a router for secure monitoring. Which combination of parameters is required to ensure authentication and encryption?

A.SNMPv3 with authPriv

B.SNMPv3 with noAuthNoPriv

C.SNMPv3 with authNoPriv

D.SNMPv2c with a complex community string

AnswerA

Provides authentication and encryption.

Why this answer

SNMPv3 with authPriv is the correct combination because it enables both authentication (via HMAC-MD5 or HMAC-SHA) and encryption (via DES or AES) to ensure secure monitoring. The authPriv security level provides message integrity, origin authentication, and data confidentiality, meeting the requirement for both authentication and encryption.

Exam trap

Cisco often tests the distinction between authNoPriv and authPriv, where candidates mistakenly think authentication alone is sufficient for 'secure monitoring' and overlook the encryption requirement.

How to eliminate wrong answers

Option B (noAuthNoPriv) is wrong because it provides no authentication or encryption, offering only a username for identification with no security. Option C (authNoPriv) is wrong because it enables authentication but no encryption, leaving the SNMP payload in cleartext and vulnerable to eavesdropping. Option D (SNMPv2c with a complex community string) is wrong because SNMPv2c uses community strings for authentication only, which are transmitted in plaintext and provide no encryption, failing the encryption requirement.

Full explanation →

121

MCQeasy

A network engineer wants to retrieve a list of all network devices from Cisco DNA Center using REST API. Which URL and HTTP method should be used?

A.POST /dna/intent/api/v1/network-device

B.GET /dna/system/api/v1/auth/token

C.GET /dna/intent/api/v1/topology/l2/{vlanID}

D.GET /dna/intent/api/v1/network-device

AnswerD

Correct. This is the intended API for listing network devices.

Why this answer

Cisco DNA Center provides the GET /dna/intent/api/v1/network-device endpoint to list all network devices.

Full explanation →

122

MCQhard

In the context of microservices for network automation, which pattern ensures that each service has a separate database to avoid tight coupling?

A.Circuit breaker

B.Database per service

C.API gateway

D.Shared database

AnswerB

This pattern gives each microservice its own database, promoting loose coupling.

Why this answer

The Database per service pattern ensures each microservice owns its private database, preventing tight coupling by eliminating shared schema dependencies. This aligns with the bounded context principle in domain-driven design, where each service manages its own data model independently, enabling autonomous deployments and scaling.

Exam trap

Cisco often tests the Database per service pattern by contrasting it with the Shared Database anti-pattern, where candidates mistakenly think sharing a database simplifies development, but the exam emphasizes that it creates tight coupling and violates microservices design principles.

How to eliminate wrong answers

Option A is wrong because the Circuit Breaker pattern handles fault tolerance by preventing cascading failures when a service is unresponsive, not database isolation. Option C is wrong because the API Gateway pattern provides a single entry point for routing, authentication, and rate limiting, but does not dictate database ownership per service. Option D is wrong because a Shared Database pattern creates tight coupling by forcing multiple services to access the same schema, violating microservices independence and leading to coordination overhead.

Full explanation →

123

MCQeasy

A DevOps engineer is using the Cisco Meraki API to retrieve a list of networks. Which HTTP method should be used?

A.PUT

B.POST

C.DELETE

D.GET

AnswerD

GET is designed to retrieve resources.

Why this answer

The GET method is the correct HTTP verb for retrieving a list of networks from the Cisco Meraki API because it is a read-only operation that fetches existing resources without modifying server state. The Meraki API follows RESTful conventions where GET requests are used to query collections or individual resources, and the endpoint for listing networks is typically a GET to /organizations/{organizationId}/networks.

Exam trap

Cisco often tests whether candidates confuse POST with GET for read operations, especially when the API documentation uses POST for non-standard actions like generating reports or running queries, leading candidates to incorrectly assume POST is acceptable for retrieving lists.

How to eliminate wrong answers

Option A (PUT) is wrong because PUT is used to update or replace an existing resource, not to retrieve data; using PUT for a read operation would violate REST semantics and could cause unintended side effects. Option B (POST) is wrong because POST is used to create a new resource or submit data for processing, not to fetch a list; the Meraki API uses POST for actions like creating networks or generating API keys. Option C (DELETE) is wrong because DELETE is used to remove a resource, which is the opposite of retrieving a list; sending a DELETE to a collection endpoint would attempt to delete the entire collection.

Full explanation →

124

MCQeasy

What is the primary function of a switch in a network?

A.Forward frames based on MAC addresses

B.Amplify wireless signals

C.Forward packets based on IP addresses

D.Convert data to electrical signals

AnswerA

Correct. Switches use MAC addresses.

Why this answer

Switches operate at Layer 2 and forward frames based on MAC addresses within a LAN.

Full explanation →

125

MCQmedium

A developer is automating network configuration using Cisco DNA Center. They want to deploy a configuration template to multiple devices. Which API category should they use?

A.Change your network

B.Platform

C.Run your network

D.Know your network

AnswerA

Correct. Template deployment, plug and play are part of 'change your network'.

Why this answer

Template deployment falls under 'change your network' API category.

Full explanation →

126

MCQeasy

Which wireless standard is commonly known as Wi-Fi 6 and operates in both 2.4 GHz and 5 GHz bands?

A.802.11g

B.802.11n

C.802.11ac

D.802.11ax

AnswerD

802.11ax (Wi-Fi 6) supports both 2.4 GHz and 5 GHz.

Why this answer

802.11ax, marketed as Wi-Fi 6, is the correct answer because it is the only standard among the options that operates in both the 2.4 GHz and 5 GHz bands and introduces OFDMA, 1024-QAM, and improved MU-MIMO for higher efficiency and throughput. Wi-Fi 6 is backward compatible with previous standards but requires compatible clients to leverage its full capabilities.

Exam trap

Cisco often tests the misconception that 802.11ac (Wi-Fi 5) operates in both bands, but it is strictly 5 GHz only, while 802.11ax is the first to bring high-efficiency features to the 2.4 GHz band as well.

How to eliminate wrong answers

Option A is wrong because 802.11g operates only in the 2.4 GHz band, supports up to 54 Mbps, and is not known as Wi-Fi 6. Option B is wrong because 802.11n (Wi-Fi 4) operates in both 2.4 GHz and 5 GHz bands but uses MIMO and up to 40 MHz channels, not OFDMA or 1024-QAM, and is not Wi-Fi 6. Option C is wrong because 802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band, uses up to 160 MHz channels and MU-MIMO (downlink only), but does not support the 2.4 GHz band and is not Wi-Fi 6.

Full explanation →

127

MCQmedium

A developer wants to deploy a containerized application on a Cisco Container Platform (CCP) cluster. The application requires persistent storage. Which Kubernetes resource should be used to provision storage?

A.Secret

B.Service

C.PersistentVolumeClaim

D.ConfigMap

AnswerC

PersistentVolumeClaim: Correct. It requests persistent storage that can be mounted into a pod and survives restarts.

Why this answer

PersistentVolumeClaim (PVC) is the correct Kubernetes resource for requesting persistent storage. A PVC binds to a PersistentVolume (PV) that provides storage independent of pod lifecycle. ConfigMap is for configuration data, not persistent storage.

Secrets store sensitive data, Services enable network access, and neither provides persistent storage.

Exam trap

Candidates often confuse ConfigMap with PersistentVolumeClaim because both can be mounted into pods. However, ConfigMap is only for configuration data and does not provide persistent storage; PersistentVolumeClaim is the correct resource for requesting storage that survives pod restarts.

How to eliminate wrong answers

Option A is wrong because a Secret is used to store sensitive data like passwords or tokens, not to provision storage. Option B is wrong because a Service is a networking abstraction that exposes a set of Pods as a network service, not a storage resource. Option D (ConfigMap) is incorrect because ConfigMaps store non-sensitive configuration data as key-value pairs or files, not persistent storage volumes.

Full explanation →

128

MCQmedium

When making API calls to Cisco Meraki Dashboard, what header must be included for authentication?

A.Authorization: Basic <base64>

B.Authorization: Bearer <token>

C.X-Cisco-Meraki-API-Key: <key>

D.Api-Key: <key>

AnswerC

This is the correct authentication header for Meraki.

Why this answer

Cisco Meraki Dashboard API uses a custom header for authentication rather than standard HTTP authentication schemes. The header `X-Cisco-Meraki-API-Key` must be included with the API key as its value. This is explicitly documented in the Meraki API reference and is required for all API requests to authenticate the caller.

Exam trap

Cisco often tests the fact that Meraki uses a custom header (`X-Cisco-Meraki-API-Key`) rather than the standard `Authorization` header, leading candidates to mistakenly choose `Authorization: Bearer <token>` or `Authorization: Basic <base64>`.

How to eliminate wrong answers

Option A is wrong because `Authorization: Basic <base64>` uses HTTP Basic Authentication, which is not supported by the Meraki Dashboard API; Meraki requires a custom header, not the standard Authorization header. Option B is wrong because `Authorization: Bearer <token>` uses OAuth 2.0 Bearer token authentication, which is not how Meraki authenticates API calls; Meraki uses a static API key in a custom header. Option D is wrong because `Api-Key: <key>` is a generic header name used by some other APIs (e.g., certain cloud services), but Meraki specifically requires the header name `X-Cisco-Meraki-API-Key`.

Full explanation →

129

Multi-Selecthard

Which TWO statements accurately describe characteristics of infrastructure as code (IaC) in network automation?

Select 2 answers

A.IaC eliminates the need for manual review of configuration changes before deployment.

B.IaC requires that all network devices be replaced with software-based equivalents.

C.IaC is only applicable to virtual network functions, not physical devices.

D.IaC tools use declarative or imperative models to define the desired state of network infrastructure.

E.IaC allows network configurations to be stored in version control and tested before deployment.

AnswersD, E

IaC can be declarative (e.g., Terraform) or imperative (e.g., Ansible).

Why this answer

Infrastructure as Code (IaC) tools like Ansible, Terraform, and Cisco NSO allow network engineers to define the desired state of infrastructure using either declarative (what the end state should be) or imperative (step-by-step instructions) models. This abstraction enables consistent, repeatable deployments and reduces configuration drift across the network.

Exam trap

Cisco often tests the misconception that IaC is only for virtual or cloud environments, when in fact it is designed to manage any programmable network device, including physical hardware, via standard interfaces like NETCONF/RESTCONF.

Full explanation →

130

MCQmedium

A developer wants to run a Docker container in detached mode, mapping host port 8080 to container port 80, and mounting a host directory for persistent data. Which command accomplishes this?

A.docker run -it -p 8080:80 -v /host/data:/container/data myapp

B.docker run -d -p 8080:80 -v /host/data:/container/data myapp

C.docker start -d -p 8080:80 -v /host/data:/container/data myapp

D.docker compose up -d -p 8080:80 -v /host/data:/container/data myapp

AnswerB

This command runs the container detached with port mapping and volume mount.

Why this answer

The -d flag runs detached, -p maps ports, and -v mounts a volume from host to container.

Full explanation →

131

MCQmedium

Which DNS record type is used to verify domain ownership for email security (SPF) and is stored as a text string?

A.TXT record

B.CNAME record

C.A record

D.MX record

AnswerA

TXT records can hold any text, including SPF and DKIM data.

Why this answer

TXT records store arbitrary text, commonly used for SPF, DKIM, and domain verification.

Full explanation →

132

MCQmedium

In a Kubernetes deployment, a developer needs to expose a set of pods internally within the cluster on a stable IP address. The pods are stateless and serve HTTP traffic. Which Service type should be used?

A.LoadBalancer

B.ExternalName

C.NodePort

D.ClusterIP

AnswerD

ClusterIP provides an internal stable IP.

Why this answer

ClusterIP exposes the service on a cluster-internal IP, making it reachable only within the cluster. NodePort and LoadBalancer expose externally. ExternalName maps to an external DNS name.

Full explanation →

133

MCQhard

A network engineer attempts to use RESTCONF to retrieve the running configuration of a Cisco IOS XE device. The GET request to '/restconf/data/Cisco-IOS-XE-native:native' returns a 405 Method Not Allowed error. What is the most likely cause?

A.The API key provided is invalid.

B.The request body was malformed.

C.RESTCONF is not enabled or the YANG module is not supported.

D.The device does not support HTTPS.

AnswerC

RESTCONF must be enabled and the module accessible.

Why this answer

A 405 Method Not Allowed error indicates that the HTTP method (GET) is not supported for the requested resource. In RESTCONF, this typically occurs when the RESTCONF service is not enabled on the device or the specific YANG module (Cisco-IOS-XE-native) is not supported or loaded. Without the service or module, the server cannot process the GET request for the running configuration.

Exam trap

Cisco often tests the distinction between HTTP status codes (405 vs. 401 vs. 400) to see if candidates understand that 405 specifically relates to an unsupported HTTP method or disabled service, not authentication or malformed data.

How to eliminate wrong answers

Option A is wrong because RESTCONF uses HTTP authentication (e.g., basic or token-based), not API keys; an invalid API key would result in a 401 Unauthorized error, not 405. Option B is wrong because a malformed request body would cause a 400 Bad Request error, and GET requests typically have no body. Option D is wrong because if the device did not support HTTPS, the request would fail at the transport layer (e.g., connection refused or TLS error), not return an HTTP 405 status code.

Full explanation →

134

MCQeasy

A network administrator needs to verify that a switch port is configured as an access port and assigned to VLAN 30. Which command should be used on a Cisco IOS switch?

A.show running-config interface GigabitEthernet0/1

B.show interfaces status

C.show mac address-table interface GigabitEthernet0/1

D.show vlan brief

AnswerB

The 'Vlan' column in 'show interfaces status' shows the access VLAN.

Why this answer

The 'show interfaces status' command displays the operational status, VLAN assignment, and duplex/speed settings for all switch ports. When verifying an access port, the output includes the VLAN ID under the 'Vlan' column, confirming the port is assigned to VLAN 30 and operating in access mode (trunk ports show 'trunk' instead). This command directly answers the question without requiring interpretation of running configuration or MAC address tables.

Exam trap

Cisco often tests the distinction between configuration commands (like 'show running-config') and operational verification commands (like 'show interfaces status'), trapping candidates who assume the running config always reflects the current operational state, especially when 'switchport mode access' is omitted or when a port is in a trunking mode.

How to eliminate wrong answers

Option A is wrong because 'show running-config interface GigabitEthernet0/1' displays the current configuration, but it does not show the operational VLAN assignment for an access port unless the 'switchport access vlan' command is explicitly present; it may also show default VLAN 1 if not configured, leading to ambiguity. Option C is wrong because 'show mac address-table interface GigabitEthernet0/1' shows MAC addresses learned on that port, but it does not reveal the VLAN ID assigned to the port itself; it only shows which VLANs have active MAC entries, which is irrelevant for verifying access port VLAN assignment. Option D is wrong because 'show vlan brief' lists all VLANs and their member ports, but it does not indicate whether a specific port is configured as an access port or trunk; a port could be a trunk carrying multiple VLANs, and the output would show it in multiple VLANs, not confirming access mode.

Full explanation →

135

MCQmedium

An engineer is configuring IOS XE for RESTCONF. Which YANG module must be enabled to use RESTCONF?

A.restconf

B.Cisco-IOS-XE-native

C.netconf-yang

D.nxapi

AnswerA

The restconf module must be enabled to use RESTCONF.

Why this answer

RESTCONF is a standardized protocol (RFC 8040) that uses HTTP methods to access data defined in YANG modules. To enable RESTCONF on IOS XE, the 'restconf' module must be explicitly enabled in the configuration, typically via the 'restconf' global command. Without this module, the RESTCONF server will not start, and HTTP requests to the RESTCONF API will fail.

Exam trap

Cisco often tests the distinction between the protocol module (restconf) and the YANG data models (like Cisco-IOS-XE-native), leading candidates to confuse the data model with the enabling module.

How to eliminate wrong answers

Option B (Cisco-IOS-XE-native) is wrong because it is a native YANG data model for IOS XE configuration, not a protocol module that enables RESTCONF. Option C (netconf-yang) is wrong because it enables NETCONF, not RESTCONF; while both use YANG, they are separate protocols with different transports and operations. Option D (nxapi) is wrong because it is a Cisco NX-OS API for programmatic access, not applicable to IOS XE RESTCONF.

Full explanation →

136

MCQmedium

Which header is used to pass an API key in Meraki Dashboard API requests?

A.X-API-Key: <key>

B.Authorization: Bearer <token>

C.Authorization: Basic <base64>

D.X-Cisco-Meraki-API-Key: <key>

AnswerD

This is the correct header.

Why this answer

Meraki API uses the X-Cisco-Meraki-API-Key header for authentication.

Full explanation →

137

MCQmedium

During a security audit, it is found that a microservice exposes its internal IP address in error responses. This could help attackers map the network. What is the BEST remediation?

A.Use a service mesh to encrypt traffic.

B.Log the errors and monitor them.

C.Configure the application to return generic error messages without internal details.

D.Add a firewall to block external access to the service.

AnswerC

Eliminates information leakage at the source.

Why this answer

Exposing internal IP addresses in error responses violates the principle of least information disclosure. The best remediation is to configure the application to return generic error messages (e.g., HTTP 500 with a generic body) that strip out internal details like IP addresses, stack traces, or debug data. This prevents attackers from using error responses to map the internal network topology, a common information-gathering technique.

Exam trap

Cisco often tests the misconception that network-level controls (firewalls, encryption) are sufficient to fix application-layer information disclosure, when in fact the application itself must sanitize its output.

How to eliminate wrong answers

Option A is wrong because a service mesh (e.g., Istio, Linkerd) encrypts traffic between microservices (mTLS) but does not modify the content of error responses returned to clients; the internal IP would still leak in the response body. Option B is wrong because logging errors and monitoring them only helps with detection and post-incident analysis, not prevention; the internal IP is still exposed in the live response to the attacker. Option D is wrong because a firewall blocks external access at the network layer, but if the service is meant to be externally accessible (e.g., a public API), the firewall cannot be applied; even if it could, the internal IP would still be exposed to legitimate external clients who receive the error.

Full explanation →

138

MCQeasy

A network administrator needs to assign IP addresses to devices on a subnet with a /25 prefix. How many usable host addresses are available?

A.254

B.126

C.64

D.128

AnswerB

2^(32-25) - 2 = 128 - 2 = 126.

Why this answer

A /25 subnet has 7 bits for hosts (32-25=7), giving 2^7 = 128 total addresses, minus 2 (network and broadcast) = 126 usable hosts.

Full explanation →

139

MCQhard

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

A.Enable root guard on the trunk ports

B.Configure the bridge priority to 61440

C.Enable BPDU guard on the trunk ports

D.Set the bridge priority to 0

AnswerB

High priority makes it less likely to become root.

Why this answer

Setting the bridge priority to 61440 (which is a valid priority value in increments of 4096) ensures the new switch has a higher numerical priority than the current root bridge, preventing it from becoming the root. In STP/RSTP, the switch with the lowest bridge priority becomes the root bridge; by configuring a high priority, the new switch will not disrupt the existing topology.

Exam trap

The trap here is that candidates often confuse root guard (which protects against becoming a root port) with preventing the switch from becoming the root bridge, or they mistakenly think setting priority to 0 (lowest) would prevent root election, when in fact it forces the switch to become root.

How to eliminate wrong answers

Option A is wrong because root guard is used to prevent a port from becoming a root port (i.e., it blocks BPDUs that would make the local switch the root), but it does not prevent the switch itself from becoming the root bridge; it only protects against superior BPDUs received on that port. Option C is wrong because BPDU guard is used to shut down a port if a BPDU is received (typically on access ports configured with PortFast), not to prevent the switch from becoming the root bridge. Option D is wrong because setting the bridge priority to 0 makes the switch the lowest possible priority, which would force it to become the root bridge, the exact opposite of the desired outcome.

Full explanation →

140

MCQmedium

Which Cisco platform provides an Intent API for network automation, including endpoints for network-device, topology, and site hierarchy?

A.Cisco Catalyst Center

B.Cisco Webex

C.Cisco IOS XE

D.Meraki Dashboard

AnswerA

Catalyst Center (formerly DNA Center) provides the Intent API.

Why this answer

Cisco Catalyst Center (formerly DNA Center) provides an Intent API that abstracts network intent into RESTful endpoints. This API includes specific endpoints for managing network devices, retrieving topology views, and interacting with site hierarchy, enabling declarative network automation without low-level device configuration.

Exam trap

Cisco often tests the distinction between device-level APIs (like IOS XE RESTCONF) and platform-level Intent APIs (like Catalyst Center), causing candidates to confuse direct device management with abstracted network automation.

How to eliminate wrong answers

Option B is wrong because Cisco Webex focuses on collaboration and messaging APIs, not network automation or device management. Option C is wrong because Cisco IOS XE provides model-driven APIs like NETCONF/RESTCONF for device-level configuration, but it does not offer a platform-level Intent API with endpoints for site hierarchy or topology. Option D is wrong because Meraki Dashboard provides a REST API for managing Meraki cloud-managed devices, but it lacks the Intent API abstraction and site hierarchy endpoints specific to Catalyst Center.

Full explanation →

141

MCQeasy

A developer wants to automate the configuration of multiple Cisco IOS-XE devices using Ansible. Which protocol should be used to ensure secure and idempotent configuration updates?

A.Telnet

B.SSH

C.SNMP

D.HTTP

AnswerB

SSH provides secure, encrypted communication and is compatible with Ansible.

Why this answer

SSH (Secure Shell) is the correct protocol because it provides encrypted, authenticated remote access to Cisco IOS-XE devices, which is essential for secure automation. Ansible uses SSH to connect to network devices and execute configuration commands idempotently by comparing the desired state (defined in playbooks) against the current device state, ensuring only necessary changes are applied without duplication or disruption.

Exam trap

Cisco often tests the distinction between protocols used for monitoring (SNMP) versus those used for secure configuration management (SSH), and candidates may mistakenly choose SNMP because they associate it with network management, overlooking that Ansible specifically requires an interactive, secure shell for idempotent configuration pushes.

How to eliminate wrong answers

Option A (Telnet) is wrong because it transmits data in plaintext, including credentials and configuration commands, offering no encryption or security, and is not recommended for any production automation. Option C (SNMP) is wrong because it is primarily used for monitoring and retrieving device metrics (e.g., via MIBs), not for pushing idempotent configuration updates; SNMP Set operations are unreliable and lack the transactional, state-based idempotency that Ansible requires. Option D (HTTP) is wrong because it is unencrypted and insecure for configuration management; while HTTPS could be used with RESTCONF/NETCONF, the question specifies Ansible, which relies on SSH for network device automation, and HTTP alone does not provide the secure, idempotent configuration capabilities needed.

Full explanation →

142

MCQhard

In the context of Cisco Webex APIs, which mechanism allows an application to receive real-time notifications when a message is created in a space?

A.Enabling Server-Sent Events (SSE)

B.Registering a webhook with the resource 'messages' and event 'created'

C.Polling the /messages endpoint every second

D.Using a long-lived HTTP connection

AnswerB

Webhooks provide real-time callbacks.

Why this answer

Webex uses webhooks to send HTTP callbacks for events like message creation.

Full explanation →

143

MCQmedium

A company uses Cisco DNA Center to manage their network. A developer wants to retrieve the overall health score of a specific site using the DNA Center REST API. Which API path should be used?

A./dna/intent/api/v1/network-health

B./dna/intent/api/v1/site-health

C./dna/intent/api/v1/assurance/site

D./dna/intent/api/v1/health-score

AnswerB

Correct endpoint for site health.

Why this answer

The correct API path to retrieve the overall health score of a specific site is /dna/intent/api/v1/site-health. This endpoint is part of the Cisco DNA Center Intent API and returns site-level health metrics, including overall health scores for network devices, clients, and applications at a given site. It is specifically designed to aggregate health data per site, unlike broader network-wide endpoints.

Exam trap

Cisco often tests the distinction between network-wide and site-specific health endpoints, and the trap here is that candidates confuse /dna/intent/api/v1/network-health (which returns overall network health) with the site-specific endpoint, or they invent plausible-sounding but non-existent paths like /health-score or /assurance/site.

How to eliminate wrong answers

Option A is wrong because /dna/intent/api/v1/network-health returns the overall network health score across all sites, not a specific site's health. Option C is wrong because /dna/intent/api/v1/assurance/site is not a valid Cisco DNA Center REST API path; the correct assurance-related endpoint for site health uses /site-health. Option D is wrong because /dna/intent/api/v1/health-score is not a valid endpoint; Cisco DNA Center uses specific resource paths like /site-health or /network-health, not a generic /health-score.

Full explanation →

144

MCQmedium

A company is deploying a new application that requires low-latency communication between servers in the same data center. The network team is designing a leaf-spine architecture. What is the primary advantage of this topology over a traditional three-tier design?

A.Simpler redundancy with fewer layers.

B.Consistent low latency and high bandwidth between any two devices.

C.Easier to deploy with less cabling.

D.Reduced number of required switch ports.

AnswerB

With equal-cost multipathing, latency is consistent and low.

Why this answer

In a leaf-spine architecture, every leaf switch connects to every spine switch, creating a full-mesh topology. This ensures that any server-to-server path traverses exactly one leaf and one spine switch, providing consistent, predictable low latency and high bandwidth regardless of which servers communicate. This is the primary advantage over a traditional three-tier design, where traffic may need to traverse multiple aggregation and core layers, introducing variable latency and potential bottlenecks.

Exam trap

The trap here is that candidates confuse 'fewer layers' with 'simpler redundancy' (Option A), but Cisco tests that leaf-spine actually increases the number of switches and cabling to achieve consistent low latency, not to reduce complexity or hardware count.

How to eliminate wrong answers

Option A is wrong because leaf-spine does not simplify redundancy with fewer layers; it actually adds a spine layer and requires more interconnects to achieve full-mesh redundancy, whereas three-tier designs use fewer total switches but with more complex failover mechanisms. Option C is wrong because leaf-spine typically requires more cabling due to the full-mesh connections between every leaf and every spine, not less. Option D is wrong because leaf-spine often increases the total number of switch ports needed, as each leaf must have an uplink port for every spine switch, leading to higher port counts than a three-tier design.

Full explanation →

145

MCQmedium

A company deploys a microservice using Kubernetes. The service must be accessible externally via a stable IP address and load-balanced across pods. Which Service type should be used?

A.NodePort

B.ClusterIP

C.LoadBalancer

D.ExternalName

AnswerC

LoadBalancer provides an external IP and load balancing.

Why this answer

LoadBalancer exposes the service externally using a cloud provider's load balancer. ClusterIP is internal only, NodePort exposes on each node's IP, ExternalName maps to external DNS.

Full explanation →

146

MCQmedium

An engineer is troubleshooting a Cisco DNA Center API call that returns a 401 error. What is the most likely cause?

A.The authentication token has expired

B.The network device is unreachable

C.The request body is invalid

D.The API endpoint is incorrect

AnswerA

401 indicates missing or invalid authentication credentials.

Why this answer

A 401 Unauthorized error from the Cisco DNA Center API indicates that the request lacks valid authentication credentials. The most common cause is that the authentication token (JWT) obtained via the /dna/system/api/v1/auth/token endpoint has expired. Cisco DNA Center tokens have a default expiry of 60 minutes, after which the API rejects the request with a 401 status.

Exam trap

Cisco often tests the distinction between HTTP status codes (401 vs 400 vs 404 vs 502) to see if candidates understand that each code maps to a specific failure category in REST API interactions.

How to eliminate wrong answers

Option B is wrong because a network device being unreachable would typically result in a 502 Bad Gateway or 504 Gateway Timeout error from the API proxy, not a 401. Option C is wrong because an invalid request body usually produces a 400 Bad Request error, not a 401. Option D is wrong because an incorrect API endpoint typically returns a 404 Not Found error, as the server cannot route the request to a valid resource.

Full explanation →

147

MCQhard

In a microservices architecture, which of the following is a key characteristic compared to a monolithic architecture?

A.Changes require rebuilding the entire application.

B.Services communicate via lightweight protocols such as HTTP/REST.

C.The entire application is deployed as a single unit.

D.All services share the same database.

AnswerB

Microservices typically communicate via HTTP/REST, messaging queues, etc.

Why this answer

Microservices are independently deployable, scalable, and developed by small teams, whereas a monolith is a single deployable unit.

Full explanation →

148

MCQeasy

A developer is automating VLAN configuration on a Cisco switch using REST API. Which HTTP method should be used to create a new VLAN?

A.PUT

B.POST

C.GET

D.PATCH

E.DELETE

AnswerB

POST creates a new resource.

Why this answer

To create a new VLAN resource on a Cisco switch via REST API, the POST method is correct because it is designed to create a subordinate resource under a parent collection. In RESTful APIs, POST is used to send data to the server to create a new entity, such as a VLAN, and the server assigns a unique identifier (e.g., VLAN ID) to the new resource. This aligns with the RESTful principle for resource creation, as specified in RFC 7231.

Exam trap

Cisco often tests the distinction between POST and PUT, where candidates mistakenly choose PUT because they think it can 'create or update' a resource, but in REST APIs for Cisco devices, PUT requires a known resource URI and is not used for server-assigned creation of new VLANs.

How to eliminate wrong answers

Option A (PUT) is wrong because PUT is used to replace or update an existing resource at a specific URI, not to create a new resource with a server-assigned identifier; using PUT for creation would require the client to specify the exact VLAN ID in the URI, which is not the standard approach for creating a new VLAN. Option C (GET) is wrong because GET is a safe, idempotent method used only to retrieve existing resources, not to create or modify them. Option D (PATCH) is wrong because PATCH is used for partial modifications to an existing resource, such as changing the name of an existing VLAN, not for creating a new one.

Option E (DELETE) is wrong because DELETE is used to remove an existing resource, such as deleting a VLAN, and has no role in creation.

Full explanation →

149

MCQhard

A Kubernetes deployment is configured with replicas: 3. During a rolling update, the deployment strategy is set to RollingUpdate with maxSurge: 1 and maxUnavailable: 0. What is the maximum number of pods that will be running during the update?

A.4

B.6

C.5

D.3

AnswerA

Correct. Desired 3 + maxSurge 1 = 4 maximum pods.

Why this answer

With maxSurge=1, one extra pod can be created above the desired 3, and maxUnavailable=0 ensures no pods are taken down before new ones are ready. So the maximum is 4 pods.

Full explanation →

150

Multi-Selecthard

Which THREE of the following are features of HTTP/2?

Select 3 answers

A.Header compression (HPACK)

B.Plain text headers

C.Persistent connections

D.Binary framing

E.Multiplexed streams

AnswersA, D, E

HPACK reduces header overhead.

Why this answer

HTTP/2 is binary, supports multiplexed streams, and uses HPACK for header compression.

Full explanation →

Page 2 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 200-901 by domain

Target a specific domain to shore up weak areas.

Application Deployment and Security Software Development and Design Understanding and Using APIs Cisco Platforms and Development Network Fundamentals Infrastructure and Automation

See all domains with question counts →