Courseiva

Cisco DevNet Associate 200-901 (200-901) — Questions 151–225

989 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 14

Page 4
151
MCQhard

In gNMI, what is the difference between dial-in and dial-out streaming?

A.Dial-in is for configuration, dial-out for telemetry
B.Dial-in: device initiates the connection; dial-out: client initiates
C.Dial-in: client initiates subscription and receives data; dial-out: device pushes data to a configured receiver
D.Dial-in uses gRPC, dial-out uses HTTP
AnswerC

Correct description.

Why this answer

In gNMI, dial-in streaming refers to the client initiating a subscription request to the device, which then streams telemetry data back over the same gRPC session. Dial-out streaming, on the other hand, is a server-initiated model where the device (gNMI target) pushes telemetry data to a pre-configured receiver (collector) without waiting for a client request. Option C correctly captures this distinction: dial-in has the client subscribe and receive data, while dial-out has the device push data to a configured receiver.

Exam trap

Cisco often tests the direction of connection initiation (client vs. device) as the key differentiator, and the trap here is confusing which side initiates the connection in dial-in versus dial-out, leading candidates to reverse the roles as in Option B.

How to eliminate wrong answers

Option A is wrong because both dial-in and dial-out are used for telemetry streaming, not configuration; gNMI uses separate RPCs (Set/Get) for configuration. Option B is wrong because it reverses the roles: in dial-in, the client initiates the connection and subscription, while in dial-out, the device initiates the connection to the receiver. Option D is wrong because both dial-in and dial-out use gRPC as the transport protocol; HTTP is not used for gNMI streaming.

Full explanation →
152
Multi-Selecthard

An organization is planning to implement HTTPS for their web services. Which three statements accurately describe the HTTPS protocol? (Choose three.)

Select 3 answers
A.HTTPS uses UDP as the transport protocol.
B.HTTPS uses TLS to encrypt HTTP traffic.
C.HTTPS is stateless after the initial handshake.
D.HTTPS uses a certificate to verify the server's identity.
E.HTTPS negotiates a symmetric session key for encryption.
AnswersB, D, E

HTTPS is HTTP over TLS, providing encryption.

Why this answer

HTTPS uses TLS for encryption, involves certificate verification, and negotiates a symmetric session key. It does not use UDP typically (TCP is used) and it is not stateless after the handshake.

Full explanation →
153
MCQhard

Refer to the exhibit. A router has the routing table shown. A packet arrives at GigabitEthernet0/0 with destination IP 8.8.8.8. What will the router do?

A.Look up the destination in the ARP cache and then forward.
B.Send an ICMP unreachable message back to the source.
C.Forward the packet out GigabitEthernet0/1 to the default gateway.
D.Drop the packet because there is no route to 8.8.8.8.
E.Forward the packet out GigabitEthernet0/0 via 10.0.0.1.
AnswerE

The default route is used, and the next hop is 10.0.0.1 out Gi0/0.

Why this answer

The routing table shows a default route (0.0.0.0/0) pointing to next-hop 10.0.0.1 via GigabitEthernet0/0. Since destination 8.8.8.8 does not match any more specific prefix, the router uses this default route and forwards the packet out GigabitEthernet0/0 to 10.0.0.1. Option E correctly describes this behavior.

Exam trap

The trap here is that candidates often assume a public IP like 8.8.8.8 must be routed via a specific interface or that a missing explicit route means the packet is dropped, but the presence of a default route (0.0.0.0/0) means the router will forward the packet to the configured next-hop.

How to eliminate wrong answers

Option A is wrong because the router first performs a longest-prefix-match routing lookup; ARP is used only after a route is selected and the next-hop IP needs a Layer 2 address, not as the initial forwarding decision. Option B is wrong because the router has a default route, so it does not generate an ICMP unreachable; ICMP unreachable is sent only when no route exists. Option C is wrong because the default route points out GigabitEthernet0/0, not GigabitEthernet0/1, and the next-hop is 10.0.0.1, not a default gateway on a different interface.

Option D is wrong because the default route provides a path to 8.8.8.8, so the packet is not dropped due to a missing route.

Full explanation →
154
MCQmedium

In the context of REST API design, which HTTP status code should be returned when a client sends a request that exceeds the API rate limit?

A.503 Service Unavailable
B.400 Bad Request
C.429 Too Many Requests
D.401 Unauthorized
AnswerC

This status code explicitly indicates the client has sent too many requests in a given time.

Why this answer

(429 Too Many Requests) is correct because RFC 6585 defines this status code specifically for cases where a client has sent too many requests in a given time frame, exceeding the API's rate limit. REST APIs use this response to enforce throttling and inform the client to back off, often including a Retry-After header to indicate when to retry.

Exam trap

Cisco often tests the distinction between server-side errors (5xx) and client-side rate-limit errors (429), where candidates mistakenly choose 503 Service Unavailable because they confuse server overload with client rate limiting.

How to eliminate wrong answers

Option A is wrong because 503 Service Unavailable indicates the server is temporarily unable to handle the request due to overload or maintenance, not specifically due to client rate limiting. Option B is wrong because 400 Bad Request indicates a malformed request syntax or invalid parameters, not a rate-limit violation. Option D is wrong because 401 Unauthorized indicates missing or invalid authentication credentials, not exceeding a rate limit.

Full explanation →
155
MCQmedium

A developer is writing a Python script to interact with a Cisco device using NETCONF. Which library is most appropriate?

A.netmiko
B.requests
C.paramiko
D.ncclient
AnswerD

ncclient is a Python library that provides an API for NETCONF operations on network devices.

Why this answer

The most appropriate library for NETCONF operations in Python is ncclient (option D). ncclient is a Python library that provides a client for NETCONF, allowing interaction with network devices via NETCONF protocol. Option A (netmiko) is used for SSH/Telnet connections to network devices but does not natively support NETCONF. Option B (requests) is for HTTP requests, not NETCONF.

Option C (paramiko) is a pure Python SSH implementation, which is not suitable for NETCONF. Therefore, ncclient is the correct choice.

Full explanation →
156
MCQhard

A company uses Cisco NSO to manage multiple network devices. They want to ensure that before deploying a configuration change, all devices are in sync with NSO's CDB. Which approach is the best practice?

A.Configure NSO to automatically sync devices when changes are detected
B.Run 'devices sync-from' on all devices before each deployment
C.Schedule a periodic sync every hour
D.Use the 'check-sync' action and only deploy if all devices are in sync
AnswerA

NSO can automatically sync devices via 'sync-from' triggered by device changes or periodic checks.

Why this answer

NSO's automatic sync capability (via the 'devices sync' or 'sync-from' action triggered by device changes) ensures that the Configuration Database (CDB) remains the authoritative source of truth without manual intervention. This best practice eliminates the risk of deploying a change to devices that are out of sync, which could cause configuration drift or operational failures. NSO's NETCONF-based synchronization allows it to detect and reconcile differences between CDB and device running configurations automatically.

Exam trap

Cisco often tests the misconception that 'check-sync' is sufficient for safe deployments, but the trap is that it only verifies state without automatically resolving drift, which still requires a separate sync action to ensure CDB accuracy before deployment.

How to eliminate wrong answers

Option B is wrong because running 'devices sync-from' on all devices before each deployment is inefficient and disruptive, as it forces a full configuration pull from every device even if only a subset is out of sync, and it does not leverage NSO's ability to detect changes incrementally. Option C is wrong because scheduling a periodic sync every hour introduces a window of vulnerability where devices could become out of sync between sync intervals, and it does not guarantee that devices are in sync at the exact moment of deployment. Option D is wrong because using the 'check-sync' action only reports the sync status without automatically correcting out-of-sync devices; if a device is out of sync, the deployment would be blocked or proceed with stale data, requiring manual intervention to sync first, which defeats the purpose of an automated best practice.

Full explanation →
157
MCQeasy

What is the primary benefit of using HTTP/2 over HTTP/1.1?

A.It is connectionless
B.It uses plain text for headers
C.It eliminates the need for TLS
D.It supports multiplexing
AnswerD

Multiplexing reduces latency by enabling concurrent streams.

Why this answer

HTTP/2 introduces multiplexed streams, allowing multiple requests/responses in parallel over a single connection.

Full explanation →
158
MCQeasy

Which HTTP method is used to partially update an existing resource in a RESTful API?

A.UPDATE
B.POST
C.PATCH
D.PUT
AnswerC

PATCH performs a partial update.

Why this answer

PATCH is used for partial updates; PUT replaces the entire resource.

Full explanation →
159
Multi-Selecthard

Which three statements about Webex API webhooks are true? (Choose three.)

Select 3 answers
A.Webhooks deliver event data via HTTP POST to a specified URL.
B.Webhooks require OAuth 2.0 client credentials grant for security.
C.Webhooks can be filtered to trigger only on specific resources and events.
D.Webhooks are created by sending a POST request to the /webhooks endpoint.
E.Webhooks use long polling to receive events.
AnswersA, C, D

Webhooks send POST requests.

Why this answer

Webhooks are registered via POST, deliver payload via HTTP POST, and can be filtered by resource/event. They are not secured by OAuth exclusively and do not use long polling.

Full explanation →
160
Multi-Selecthard

Which THREE of the following are true about HTTP/2 compared to HTTP/1.1? (Select three.)

Select 3 answers
A.Text-based protocol
B.Requires TLS/SSL encryption
C.Header compression using HPACK
D.Server push capability
E.Multiplexing multiple streams over a single connection
AnswersC, D, E

Correct. HPACK reduces header overhead.

Why this answer

HTTP/2 is binary, multiplexes streams, and uses HPACK for header compression.

Full explanation →
161
Multi-Selectmedium

Which THREE of the following are typically included in a Cisco DevNet sandbox environment? (Choose three.)

Select 3 answers
A.Ability to run production application traffic
B.Access to production customer data for realistic testing
C.Pre-configured Cisco devices (routers, switches, or firewalls)
D.A sample network topology with an IP plan
E.REST API endpoints for programmatic interaction
AnswersC, D, E

Sandboxes typically include virtual or physical Cisco devices for testing.

Why this answer

Cisco DevNet sandboxes provide pre-configured Cisco devices (routers, switches, firewalls) to allow developers to test automation scripts and network configurations without needing physical hardware. These sandboxes are isolated environments that mirror production-like setups, enabling safe experimentation with device APIs and CLI commands.

Exam trap

Cisco often tests the distinction between sandbox environments and production systems, and the trap here is that candidates mistakenly assume sandboxes include real customer data or can handle production traffic, when in fact they are strictly for development and testing with simulated resources.

Full explanation →
162
Multi-Selectmedium

Which TWO of the following are valid reasons to use a trunk link between two switches? (Select exactly two.)

Select 2 answers
A.To connect a switch to a router using a single link for one VLAN.
B.To increase bandwidth between switches by combining multiple links.
C.To reduce latency by using 802.1Q encapsulation.
D.To interconnect switches in a multi-VLAN environment.
E.To allow traffic from multiple VLANs to traverse a single link.
AnswersD, E

Trunks are standard for switch-to-switch connections carrying multiple VLANs.

Why this answer

Trunk links are specifically designed to interconnect switches in a multi-VLAN environment, allowing the switches to exchange frames tagged with VLAN information using the 802.1Q protocol. Without a trunk, each VLAN would require a separate physical link between switches, which is inefficient and does not scale.

Exam trap

Cisco often tests the distinction between trunking (VLAN tagging) and link aggregation (EtherChannel), so candidates mistakenly select 'increase bandwidth' as a trunk benefit when it is actually a feature of EtherChannel.

Full explanation →
163
Multi-Selecthard

A Python developer is working on a microservices project where one service needs to communicate with another service that exposes a GraphQL API. Which THREE statements about GraphQL compared to REST are accurate? (Choose three.)

Select 3 answers
A.GraphQL allows clients to request exactly the fields they need.
B.GraphQL is a database query language.
C.GraphQL has a strongly typed schema that defines the API.
D.GraphQL typically uses multiple endpoints for different resources.
E.GraphQL uses HTTP POST for queries and mutations.
AnswersA, C, E

Reduces over-fetching and under-fetching.

Why this answer

GraphQL allows querying specific data, uses a single endpoint, and provides a schema.

Full explanation →
164
MCQhard

An engineer needs to troubleshoot a RESTCONF request that returns a 409 Conflict error when trying to modify a YANG data node. What is the most likely cause?

A.The data node is read-only
B.Authentication failure
C.The resource was modified by another client during the operation
D.The YANG model version mismatch
AnswerC

409 Conflict indicates a conflict with the current state.

Why this answer

A 409 Conflict error in RESTCONF specifically indicates a resource state conflict, typically caused by a YANG data store version mismatch detected via the 'if-match' header or ETag validation. When another client modifies the same resource between the time a client retrieves it and attempts to update it, the server rejects the request to prevent lost updates, enforcing optimistic locking as defined in RFC 8040.

Exam trap

Cisco often tests the distinction between HTTP status codes in RESTCONF, and the trap here is that candidates confuse a 409 Conflict with a generic 'modification failure' and incorrectly attribute it to permissions (401) or model issues (400/404), rather than recognizing it as a concurrency control mechanism.

How to eliminate wrong answers

Option A is wrong because a read-only data node would return a 405 Method Not Allowed or a 403 Forbidden, not a 409 Conflict, as RESTCONF explicitly rejects write operations on read-only nodes. Option B is wrong because authentication failure results in a 401 Unauthorized error, not a 409 Conflict, which is a resource state issue unrelated to credentials. Option D is wrong because a YANG model version mismatch would typically cause a 400 Bad Request or a 404 Not Found if the data node is unrecognized, not a 409 Conflict, which is specific to concurrent modification conflicts.

Full explanation →
165
MCQhard

A Python script using the ncclient library connects to a Cisco IOS-XE device to retrieve the running configuration. The script raises an exception: 'TimeoutError: Session timed out'. Which is the most likely cause?

A.The device does not support NETCONF
B.The SSH port (830) is blocked by a firewall
C.The device's running configuration is too large
D.The XML payload is malformed
AnswerB

If port 830 is blocked, the connection cannot be established, leading to a timeout.

Why this answer

The ncclient library uses NETCONF over SSH, which by default connects to TCP port 830. A 'TimeoutError: Session timed out' indicates that the TCP connection to the device could not be established within the timeout period. The most likely cause is that a firewall is blocking port 830, preventing the SSH session from being initiated.

Exam trap

Cisco often tests the distinction between connection-level errors (like timeouts) and protocol-level errors (like capability mismatches or malformed payloads), so candidates must identify that a timeout points to a network connectivity issue rather than a configuration or data format problem.

How to eliminate wrong answers

Option A is wrong because if the device did not support NETCONF, the error would typically be a capability exchange failure or an 'Unsupported protocol' error, not a timeout during session establishment. Option C is wrong because a large running configuration might cause a slow retrieval or memory issues, but it would not prevent the initial TCP connection and SSH session from being established; the timeout occurs before any configuration data is exchanged. Option D is wrong because a malformed XML payload would cause an RPC error or parsing exception after the session is established, not a timeout during the connection phase.

Full explanation →
166
MCQmedium

A Python function is designed to fetch device data from multiple sources. It uses *args to accept variable number of API endpoints and **kwargs for optional parameters like timeout. Which function definition correctly implements this?

A.def fetch_devices(**endpoints, *options):
B.def fetch_devices(endpoints, **options):
C.def fetch_devices(*endpoints, **options):
D.def fetch_devices(*endpoints, options):
AnswerC

Correct syntax: * for variable positional args, ** for keyword args.

Why this answer

It uses *endpoints to accept a variable number of positional arguments (the API endpoint strings) and **options to accept any number of keyword arguments (like timeout=30). This matches the requirement for a function that can handle multiple sources with optional parameters, following Python's standard *args/**kwargs pattern.

Exam trap

Cisco often tests the distinction between *args (variable positional arguments) and **kwargs (variable keyword arguments), and the trap here is that candidates confuse the syntax or order, thinking **endpoints can appear before *options or that a simple parameter name like options can accept keyword arguments without the double asterisk.

How to eliminate wrong answers

Option A is wrong because it places **endpoints before *options, which is syntactically invalid in Python — keyword-only arguments must follow positional ones, and **kwargs must be the last parameter. Option B is wrong because it defines endpoints as a single positional parameter, not allowing a variable number of API endpoints; it would require the caller to pass a list or tuple explicitly. Option D is wrong because it uses *endpoints correctly but defines options as a regular positional parameter, not as **kwargs, so optional parameters like timeout cannot be passed as keyword arguments.

Full explanation →
167
MCQeasy

A network technician runs the command 'ping 8.8.8.8' from a workstation and receives 'Reply from 192.168.1.1: Destination host unreachable.' What does this indicate?

A.There is a routing issue beyond the local network.
B.DNS resolution is failing.
C.The default gateway is misconfigured.
D.The workstation has no internet connectivity.
E.The remote server is down.
AnswerA

The gateway cannot reach the destination, indicating a routing problem.

Why this answer

The 'Reply from 192.168.1.1: Destination host unreachable' message indicates that the local router (192.168.1.1) received the ICMP echo request for 8.8.8.8 but could not find a route to that destination in its routing table. This means the router has a valid path back to the workstation (so the default gateway is reachable), but it lacks a route to the remote network, pointing to a routing issue beyond the local subnet.

Exam trap

Cisco often tests the distinction between 'Destination host unreachable' (routing issue at a router) and 'Request timed out' (no response received), leading candidates to incorrectly assume the default gateway is misconfigured or that there is no connectivity at all.

How to eliminate wrong answers

Option B is wrong because DNS resolution is not involved in a ping to an IP address; the command uses a raw IP address, so no DNS query occurs. Option C is wrong because if the default gateway were misconfigured, the workstation would not receive any reply (or would get 'Request timed out'), as the ICMP echo request would never leave the local network. Option D is wrong because the workstation does have internet connectivity to its local router (192.168.1.1), as evidenced by the reply; the issue is beyond the local network.

Option E is wrong because the remote server (8.8.8.8) is not necessarily down; the router cannot even attempt to reach it due to missing routing information.

Full explanation →
168
MCQeasy

Which of the following is a private IPv4 address range as defined by RFC 1918?

A.192.168.0.0/16
B.169.254.0.0/16
C.11.0.0.0/8
D.172.32.0.0/12
AnswerA

This is a private range for internal networks.

Why this answer

RFC 1918 reserves the 192.168.0.0/16 block (192.168.0.0 – 192.168.255.255) as a private IPv4 address range, meaning these addresses are not routable on the public internet and are intended for use within private networks.

Exam trap

Cisco often tests the exact prefix boundaries of RFC 1918, and the trap here is confusing the 172.16.0.0/12 range (which includes 172.16.0.0 – 172.31.255.255) with the similar-looking 172.32.0.0/12, which is a public block.

How to eliminate wrong answers

Option B is wrong because 169.254.0.0/16 is the Automatic Private IP Addressing (APIPA) range, used by DHCP clients when they fail to obtain a lease; it is not a private range per RFC 1918. Option C is wrong because 11.0.0.0/8 is a public IPv4 address range (assigned to the US Department of Defense) and is not reserved for private use. Option D is wrong because 172.32.0.0/12 falls outside the RFC 1918 private block 172.16.0.0/12 (which covers 172.16.0.0 – 172.31.255.255); 172.32.0.0/12 is a public range.

Full explanation →
169
MCQmedium

A team is deploying a microservice that must scale independently. The service uses environment variables for configuration. Which Kubernetes resource should be used to store non-sensitive configuration data separate from the container image?

A.Secret
B.Service
C.ConfigMap
D.Deployment
AnswerC

ConfigMap stores non-sensitive key-value pairs for configuration.

Why this answer

ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data (like environment variables) separately from the container image. This allows the microservice to scale independently because configuration changes can be applied without rebuilding or redeploying the image, enabling stateless, horizontally scalable pods.

Exam trap

Cisco often tests the distinction between ConfigMap and Secret, trapping candidates who confuse 'configuration data' with 'sensitive data' or who think a Deployment itself stores configuration.

How to eliminate wrong answers

Option A is wrong because Secret is designed for sensitive data (e.g., passwords, tokens) and stores values base64-encoded, not for general non-sensitive configuration. Option B is wrong because Service is a network abstraction that exposes a set of pods as a stable endpoint, not a storage mechanism for configuration data. Option D is wrong because Deployment manages the desired state of replica sets and rolling updates, but it does not store configuration data; it references ConfigMaps or Secrets for that purpose.

Full explanation →
170
MCQmedium

In Software-Defined Networking (SDN), which interface is used for communication between the controller and the network devices (e.g., switches) to forward traffic?

A.Northbound API
B.Control plane
C.Southbound API
D.East-West API
AnswerC

Southbound API communicates with devices.

Why this answer

The southbound API (e.g., OpenFlow, NETCONF) is used to communicate between the SDN controller and the data plane devices.

Full explanation →
171
MCQmedium

A Meraki dashboard API request to list networks returns a paginated response. The engineer notices a Link header in the response. What does this header typically contain?

A.The rate limit remaining
B.The total number of resources
C.A URL to the next page of results
D.An error message
AnswerC

Correct. The Link header includes rel='next' for the next page.

Why this answer

Meraki uses Link headers for pagination, providing URLs for the next and previous pages.

Full explanation →
172
MCQeasy

A script is using the Cisco Meraki API to fetch a list of organizations. The script needs to authenticate with an API key. Where should the API key be included in the request?

A.In the HTTP Authorization header using Bearer scheme.
B.In the request body as a JSON field.
C.In the request URL as a query parameter.
D.In the request header as 'X-Cisco-Meraki-API-Key'.
AnswerD

Meraki API uses the custom header 'X-Cisco-Meraki-API-Key' for API key authentication.

Why this answer

The Cisco Meraki API requires the API key to be sent in a custom HTTP header named 'X-Cisco-Meraki-API-Key'. This is a vendor-specific authentication mechanism, not a standard Bearer token. Including the key in this header ensures the request is authenticated without exposing the key in the URL or body.

Exam trap

Cisco often tests the fact that many APIs use standard Bearer tokens, but the Meraki API specifically uses a custom header, so candidates mistakenly choose the Authorization header option without reading the vendor-specific documentation.

How to eliminate wrong answers

Option A is wrong because the Meraki API does not use the standard HTTP Authorization header with the Bearer scheme; it uses a custom header. Option B is wrong because API keys should never be sent in the request body as a JSON field, as this would require parsing the body for authentication and violates RESTful stateless design. Option C is wrong because including the API key as a query parameter in the URL exposes it in logs, browser history, and network traffic, which is a security risk and not supported by the Meraki API.

Full explanation →
173
MCQhard

A developer is using NX-API on a Cisco Nexus switch to execute CLI commands via JSON. Which endpoint and method should be used?

A.GET /restconf/data/Cisco-NX-OS-device:cli
B.POST /api/cli with XML body
C.GET /ins?cmd=show version
D.POST /ins with JSON body
AnswerD

Correct. NX-API endpoint is /ins and uses POST.

Why this answer

NX-API uses POST /ins with JSON payload containing CLI commands.

Full explanation →
174
Multi-Selectmedium

Which TWO of the following are characteristics of UDP compared to TCP? (Select two.)

Select 2 answers
A.Ordered data delivery
B.Reliable delivery with retransmission
C.Connection-oriented communication
D.Lower overhead
E.No flow control or congestion control
AnswersD, E

Correct. UDP has minimal header and no handshake.

Why this answer

UDP is connectionless and has lower overhead, but is unreliable.

Full explanation →
175
MCQmedium

Refer to the exhibit. A security audit requires that the container cannot run as root. Which part of the pod spec ensures this?

A.The configMap volume
B.The image tag "latest"
C.allowPrivilegeEscalation: false
D.runAsUser: 1000
AnswerD

Sets the container to run as a non-root user.

Why this answer

Setting `runAsUser: 1000` in the pod's security context explicitly instructs the container runtime to launch the container's main process with a user ID of 1000, which is a non-root user. This directly satisfies the security audit requirement that the container cannot run as root (UID 0). The `runAsUser` field overrides the default behavior where containers run as root unless a non-root user is specified in the container image or security context.

Exam trap

Cisco often tests the distinction between security context fields: candidates confuse `allowPrivilegeEscalation` (which prevents gaining additional privileges after startup) with `runAsUser` (which sets the initial user), leading them to incorrectly select option C when the requirement is to avoid running as root entirely.

How to eliminate wrong answers

Option A is wrong because a ConfigMap volume is used to inject configuration data (key-value pairs) into a container's filesystem or environment variables; it has no effect on the user identity under which the container process runs. Option B is wrong because the image tag 'latest' simply refers to the most recent version of a container image and does not influence the runtime user ID; it is a common anti-pattern for reproducibility but irrelevant to root vs. non-root execution. Option C is wrong because `allowPrivilegeEscalation: false` controls whether a process can gain more privileges than its parent (e.g., via setuid binaries), but it does not prevent the container from starting as root; a container can still run as root with privilege escalation disabled, which would violate the audit requirement.

Full explanation →
176
MCQmedium

Given the following Python code snippet: with open('config.json', 'r') as f: data = json.load(f) print(data['interfaces'][0]['name']) What is the expected output if config.json contains {"interfaces": [{"name": "GigabitEthernet0/1"}]}?

A.GigabitEthernet0/1
B.None
C.interfaces
D.Error: list indices must be integers
AnswerA

Correctly accesses the first interface's name.

Why this answer

json.load() reads the file and returns a dict; then accessing the nested structure yields 'GigabitEthernet0/1'.

Full explanation →
177
MCQmedium

A developer needs to create a Postman collection that uses a variable for the base URL and a token variable for authentication. The token is obtained from a login request and must be reused across requests. Where should the token variable be defined to persist across all requests in the collection?

A.As a data variable from a CSV file
B.As a global variable
C.As a collection variable
D.As a local variable in the login request
AnswerC

Collection variables are scoped to the collection and persist.

Why this answer

Collection variables in Postman are scoped to the entire collection, meaning they persist across all requests within that collection. By storing the token as a collection variable after the login request, it can be reused in subsequent requests without re-authentication. This is the recommended approach for sharing authentication tokens across requests in a Postman collection.

Exam trap

Cisco often tests the distinction between variable scopes in Postman, and the trap here is that candidates confuse global variables (which are too broad) with collection variables (which are correctly scoped), or mistakenly think local variables persist beyond the request in which they are defined.

How to eliminate wrong answers

Option A is wrong because data variables from a CSV file are used for data-driven testing and are only available during the execution of a single request iteration, not persisted across all requests. Option B is wrong because global variables are shared across all collections and workspaces, which is too broad and can lead to unintended overwrites or conflicts; collection variables provide the correct scope for a single collection. Option D is wrong because local variables are scoped to a single request or script execution and are not accessible outside that request, so the token would be lost after the login request completes.

Full explanation →
178
MCQeasy

A DevOps team manages a hybrid cloud environment with on-premises Cisco Nexus switches and AWS VPCs using Terraform. They have a configuration management tool that pushes VLAN and interface configurations to the Nexus switches. Recently, they noticed that after a Terraform run that updates the AWS VPC subnets, some on-premises switches lose connectivity to the cloud. The team suspects a mismatch between the VLAN configurations on the Nexus switches and the AWS VPC subnets. They have a centralized source of truth stored in a Git repository containing YAML files for network definitions. Which action should the team take first to resolve the issue and prevent future occurrences?

A.Restore the Nexus switch configurations from the most recent backup.
B.Modify the Terraform scripts to automatically update Nexus switches when AWS VPC subnets change.
C.Compare the Git repository's YAML definitions with the actual switch configurations and AWS VPC subnets, then correct any discrepancies.
D.Manually reconfigure the VLANs on the Nexus switches to match the AWS VPC subnets.
AnswerC

The source of truth should be verified first.

Why this answer

The team's centralized source of truth in Git (YAML files) should be the authoritative reference for network definitions. By comparing these definitions against both the actual Nexus switch configurations and AWS VPC subnets, the team can identify and correct any drift or mismatch. This aligns with Infrastructure as Code (IaC) best practices, ensuring that all environments are synchronized from a single, version-controlled source before making any changes.

Exam trap

The trap here is that candidates may assume the immediate fix is to restore or manually reconfigure the switches (options A or D), rather than first validating the source of truth (Git) to identify the root cause of the mismatch, which is a core DevOps principle of treating infrastructure as code.

How to eliminate wrong answers

Option A is wrong because restoring from a backup does not address the root cause of the mismatch; it may reintroduce outdated configurations that do not match the current AWS VPC subnets, and it ignores the centralized Git repository as the source of truth. Option B is wrong because modifying Terraform scripts to automatically update Nexus switches would bypass the configuration management tool and the Git-based source of truth, potentially causing further inconsistencies and breaking the separation of concerns between cloud provisioning and on-premises network management. Option D is wrong because manually reconfiguring VLANs on the Nexus switches is error-prone, not scalable, and does not leverage the Git repository as the single source of truth, making it impossible to prevent future occurrences through automation and version control.

Full explanation →
179
Multi-Selecteasy

A developer is using Cisco Webex Teams REST API. Which two authentication methods are supported for bot accounts? (Choose two.)

Select 2 answers
A.OAuth2 with client credentials
B.Bearer Token
C.JWT
D.Basic Auth
E.API Key
AnswersA, B

OAuth2 client credentials grant is supported for server-to-server.

Why this answer

OAuth2 with client credentials is the standard authentication flow for server-to-server communication, allowing a bot to authenticate without user interaction. Option B is correct because a Bearer Token, typically obtained via OAuth2, is used in the Authorization header of API requests to authenticate bot accounts in Cisco Webex Teams.

Exam trap

Cisco often tests the distinction between authentication methods supported for bots versus user accounts, and the trap here is that candidates may confuse JWT (used for guest access) or API Key (common in other APIs) with the OAuth2 token-based methods actually required for bot accounts.

Full explanation →
180
MCQhard

A Python script using the Cisco ACI Toolkit (aciToolkit) fails with 'LoginError: unable to login to APIC'. The APIC is reachable via HTTPS. What is the most likely cause?

A.The APIC has reached its maximum session limit.
B.The script uses HTTP instead of HTTPS.
C.The script uses an incorrect APIC domain (e.g., 'apic' instead of the FQDN).
D.The APIC is running an unsupported firmware version.
AnswerC

The aciToolkit's login() requires the correct APIC domain; an incorrect domain prevents proper authentication.

Why this answer

The Cisco ACI Toolkit (aciToolkit) requires the APIC domain to be specified as a fully qualified domain name (FQDN) or IP address that matches the APIC's certificate. Using a short name like 'apic' instead of the FQDN (e.g., 'apic.example.com') causes a TLS certificate hostname mismatch, leading to a login failure even though the APIC is reachable. The 'LoginError: unable to login to APIC' error typically indicates an authentication or connectivity issue, and in this scenario, the certificate validation fails because the toolkit verifies the server's hostname against the certificate's Subject Alternative Name (SAN).

Exam trap

Cisco often tests the nuance that a reachable APIC via HTTPS does not guarantee successful login if the hostname in the script does not match the APIC's TLS certificate, leading candidates to overlook certificate validation as the root cause.

How to eliminate wrong answers

Option A is wrong because the APIC session limit would produce a different error (e.g., 'maximum sessions reached' or 'login denied'), not a generic 'unable to login' message, and the APIC is reachable via HTTPS. Option B is wrong because the error message explicitly states the APIC is reachable via HTTPS, and if the script used HTTP, it would likely fail with a connection timeout or HTTP error, not a login error. Option D is wrong because an unsupported firmware version would typically cause API incompatibility errors (e.g., 'unsupported version' or 'method not found'), not a login failure, and the APIC is reachable.

Full explanation →
181
MCQeasy

A developer wants to retrieve a list of network devices from Cisco DNA Center. Which HTTP method and URL structure should be used?

A.POST /dna/intent/api/v1/network-device
B.GET /dna/intent/api/v1/network-device
C.DELETE /dna/intent/api/v1/network-device
D.PUT /dna/intent/api/v1/network-device
AnswerB

This is the correct method and path.

Why this answer

The DNA Center intent API uses GET with the path /dna/intent/api/v1/network-device to retrieve devices.

Full explanation →
182
MCQmedium

A developer is using the Meraki Dashboard API to list the organizations accessible by the API key. They send a GET request to https://api.meraki.com/api/v1/organizations. What is the correct way to pass the API key?

A.In the Authorization header as Bearer token
B.In the URL as a query parameter: ?apiKey=...
C.In the request body as JSON
D.In the X-Cisco-Meraki-API-Key header
AnswerD

This is the correct header for Meraki API authentication.

Why this answer

Meraki Dashboard API uses the X-Cisco-Meraki-API-Key header for authentication.

Full explanation →
183
Multi-Selectmedium

Which TWO of the following are commonly used HTTP methods for a RESTful API to retrieve and update a resource? (Select TWO)

Select 2 answers
A.GET
B.POST
C.PUT
D.DELETE
E.HEAD
AnswersA, C

GET retrieves the current state of a resource.

Why this answer

GET is correct because it is the HTTP method defined by RFC 7231 for retrieving a representation of a resource. In a RESTful API, a GET request to a resource URI fetches the current state of that resource without side effects, making it idempotent and safe. PUT is correct because it is the HTTP method used to update or replace a resource at a given URI; it is idempotent, meaning multiple identical PUT requests produce the same result as a single request.

Exam trap

Cisco often tests the misconception that POST can be used for both creation and update, but in a strictly RESTful API, PUT is the standard method for updating a resource, while POST is reserved for creation or non-idempotent operations.

Full explanation →
184
MCQmedium

A network engineer is designing a subnet that needs to support 30 usable hosts. Which subnet mask should be used?

A.255.255.255.240 (/28)
B.255.255.255.0 (/24)
C.255.255.255.224 (/27)
D.255.255.255.192 (/26)
AnswerC

Correct. /27 provides 32 addresses, 30 usable.

Why this answer

(255.255.255.224, /27) provides 5 host bits, yielding 2^5 = 32 total addresses per subnet. Subtracting the network and broadcast addresses leaves exactly 30 usable hosts, meeting the requirement precisely.

Exam trap

Cisco often tests the formula 2^n - 2 for usable hosts, and the trap here is that candidates may forget to subtract the network and broadcast addresses, or they may confuse the number of host bits with the subnet mask value (e.g., thinking /28 supports 16 usable hosts instead of 14).

How to eliminate wrong answers

Option A is wrong because 255.255.255.240 (/28) provides only 4 host bits, giving 2^4 - 2 = 14 usable hosts, which is insufficient for 30 hosts. Option B is wrong because 255.255.255.0 (/24) provides 8 host bits, yielding 2^8 - 2 = 254 usable hosts, which is far more than needed and wastes address space. Option D is wrong because 255.255.255.192 (/26) provides 6 host bits, giving 2^6 - 2 = 62 usable hosts, which exceeds the requirement but is not the most efficient choice for exactly 30 hosts.

Full explanation →
185
Multi-Selectmedium

A developer is building an integration with Cisco Webex and needs to retrieve information about the authenticated user. Which TWO APIs can be used? (Choose two.)

Select 2 answers
A.GET /v1/rooms
B.GET /v1/memberships
C.GET /v1/people/me
D.GET /v1/people
E.POST /v1/people
AnswersC, D

Returns the authenticated user's details.

Why this answer

GET /v1/people/me returns the current user. GET /v1/people with an email also returns user info. POST /v1/people is not valid.

Full explanation →
186
MCQhard

In a Kubernetes cluster, you need to store non-sensitive configuration data (e.g., database hostname) that can be consumed by pods as environment variables. Which resource should you use?

A.ConfigMap
B.PersistentVolume
C.Secret
AnswerA

ConfigMap is the correct resource for non-sensitive configuration data.

Why this answer

A ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data like a database hostname. It is designed to decouple configuration artifacts from image content, allowing pods to consume this data as environment variables or mounted files without hardcoding values into container images.

Exam trap

Cisco often tests the distinction between ConfigMaps and Secrets, where the trap is that candidates confuse 'non-sensitive' with 'sensitive' and incorrectly choose Secrets for all configuration data, or they pick PersistentVolume because they think any data storage requires persistent volumes.

How to eliminate wrong answers

Option B (PersistentVolume) is wrong because PersistentVolumes are used for persistent storage of data (e.g., files, databases) across pod restarts, not for storing small configuration key-value pairs as environment variables. Option C (Secret) is wrong because Secrets are intended for sensitive data (e.g., passwords, tokens, SSH keys) and are base64-encoded; using a Secret for non-sensitive data like a hostname is unnecessary and violates the principle of least privilege.

Full explanation →
187
MCQhard

In a microservices architecture, a REST API must support idempotent updates. Which HTTP method and design practice should be used?

A.PUT with the full resource representation
B.POST with a unique transaction ID
C.DELETE with a resource version
D.PATCH with a conditional header
AnswerA

PUT is idempotent by definition; replacing the entire resource ensures the same result regardless of request count.

Why this answer

PUT is inherently idempotent per HTTP/1.1 RFC 7231, meaning repeated identical requests produce the same server state. In microservices, using PUT with the full resource representation ensures that any number of identical PUT requests result in the same resource state, which is critical for safe retries in distributed systems. This aligns with RESTful design principles where PUT replaces the entire resource at the given URI.

Exam trap

Cisco often tests the distinction between PUT (idempotent, full replacement) and PATCH (non-idempotent, partial update), tempting candidates to choose PATCH with conditional headers because it seems safer, but the question explicitly requires idempotent updates, which only PUT guarantees natively.

How to eliminate wrong answers

Option B is wrong because POST is not idempotent by definition; while a unique transaction ID can be used to achieve idempotency at the application layer, the question asks for the HTTP method and design practice that 'must support idempotent updates' — POST without additional mechanisms is non-idempotent and introduces complexity. Option C is wrong because DELETE is idempotent but is used for deletion, not updates; a resource version is irrelevant for idempotent updates as DELETE removes the resource entirely. Option D is wrong because PATCH is not inherently idempotent; while conditional headers (e.g., If-Match) can prevent conflicts, they do not guarantee idempotency — repeated PATCH requests with the same payload can cause different outcomes if the resource state changes between requests.

Full explanation →
188
MCQeasy

A developer uses Cisco Intersight API to manage UCS servers. Which authentication method is required for Intersight API calls?

A.API key with HMAC signature
B.OAuth2 token from Webex
C.Session cookie
D.Basic authentication with username/password
AnswerA

Correct method.

Why this answer

Cisco Intersight API requires API key authentication with HMAC (Hash-Based Message Authentication Code) signing for all REST API calls. The developer generates an API key pair (private and public) in the Intersight GUI, then uses the private key to create an HMAC-SHA256 signature over the request headers and payload. This signature is included in the Authorization header, ensuring request integrity and non-repudiation without transmitting the secret key over the network.

Exam trap

Cisco often tests the distinction between web UI authentication (session cookies) and API authentication (HMAC keys), and candidates mistakenly choose session cookies because they are familiar from the Intersight web interface, forgetting that API calls require a different, stateless mechanism.

How to eliminate wrong answers

Option B is wrong because OAuth2 tokens from Webex are used for Cisco Webex API authentication, not for Intersight; Intersight does not support OAuth2 token exchange from Webex. Option C is wrong because session cookies are used for browser-based web UI sessions, not for programmatic API calls; Intersight API calls are stateless and require per-request authentication via HMAC signatures. Option D is wrong because basic authentication with username/password is not supported for Intersight API calls; it would expose credentials in plaintext and violates Intersight's security model, which mandates key-based HMAC signing.

Full explanation →
189
Multi-Selectmedium

A developer is building an integration with Cisco Meraki and needs to handle rate limiting. Which two responses indicate rate limiting and how should they be handled? (Choose two.)

Select 2 answers
A.X-RateLimit-Remaining header
B.Retry-After header with wait time in seconds
C.HTTP status code 429
D.Link header with rel="next"
E.HTTP status code 503
AnswersB, C

Retry-After tells how long to wait.

Why this answer

The Retry-After header explicitly tells the client how long to wait before retrying a request, which is the standard way to handle rate limiting. Option C is correct because HTTP status code 429 (Too Many Requests) is the definitive signal from the server that the client has exceeded the allowed rate limit. Together, these two responses allow a developer to identify and respond to rate limiting by pausing requests for the specified duration.

Exam trap

Cisco often tests the distinction between proactive headers (like X-RateLimit-Remaining) and reactive responses (like 429 and Retry-After), so candidates mistakenly choose the header that warns about limits rather than the actual rate-limiting response.

Full explanation →
190
Multi-Selecteasy

Which TWO of the following are commonly used protocols for network automation?

Select 2 answers
A.RESTCONF
B.NETCONF
C.HTTP
D.SNMP
E.SSH
AnswersA, B

RESTCONF is a RESTful protocol for network automation using YANG models.

Why this answer

NETCONF and RESTCONF are standardized protocols used for network automation based on YANG models. SNMP is primarily for monitoring, HTTP is a transport protocol, and SSH is used for CLI access but not as an automation protocol.

Full explanation →
191
MCQeasy

A YANG module defines a leaf named 'bandwidth' of type 'uint32'. What does this represent in the context of a network device?

A.A set of unique bandwidth values
B.A single integer value representing bandwidth in kilobits per second
C.A grouping of related bandwidth parameters
D.An ordered list of bandwidth values
AnswerB

A leaf holds one value; uint32 is appropriate for bandwidth.

Why this answer

In YANG, a 'leaf' node defines a single, scalar value of a specific data type. When the leaf is named 'bandwidth' with type 'uint32', it represents a single integer value, typically interpreted as kilobits per second (kbps) in the context of network device configuration (e.g., interface bandwidth). This aligns with the standard YANG data modeling approach where a leaf cannot hold multiple values or complex structures.

Exam trap

Cisco often tests the distinction between a 'leaf' (single value) and a 'leaf-list' (multiple values), so the trap here is that candidates may confuse a leaf with a list or container, especially when the leaf name 'bandwidth' might imply multiple possible values.

How to eliminate wrong answers

Option A is wrong because a 'leaf' in YANG cannot represent a set of unique values; sets are modeled using 'leaf-list' or 'list' nodes, not a single leaf. Option C is wrong because a grouping of related parameters is defined using a 'container' or 'grouping' statement in YANG, not a leaf. Option D is wrong because an ordered list of values is modeled with a 'leaf-list' (which can have ordered-by user or system), not a single leaf of type uint32.

Full explanation →
192
MCQeasy

Which YANG model is commonly used as an open standard for interface configuration and is supported by many vendors?

A.ietf-interfaces
B.cisco-routing
C.openconfig-interfaces
D.Cisco-IOS-XE-native
AnswerC

Correct. OpenConfig interfaces model is a vendor-neutral standard.

Why this answer

OpenConfig models are vendor-neutral standard models. oc-interfaces is the OpenConfig interface model.

Full explanation →
193
MCQmedium

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

A.Modify the playbook to skip switches where the VLAN already exists.
B.Remove the VLAN from all switches before creating it again.
C.Use an idempotent Ansible module that checks for existing VLANs before creating them.
D.Add ignore_errors: yes to the VLAN creation task.
AnswerC

Idempotent modules handle existing configurations gracefully.

Why this answer

Ansible's idempotent modules, such as `ios_vlan` for Cisco IOS devices, are designed to check the current state of the device before making changes. If the VLAN already exists, the module will report 'ok' and not attempt to create it again, preventing the error and ensuring the playbook completes successfully. This aligns with Ansible's best practice of writing idempotent playbooks that produce the same result regardless of how many times they are run.

Exam trap

Cisco often tests the concept of idempotency in automation tools like Ansible, and the trap here is that candidates may think 'ignore_errors' is a valid workaround for configuration conflicts, when in fact it only hides failures without ensuring the desired state is achieved.

How to eliminate wrong answers

Option A is wrong because skipping switches where the VLAN already exists would require manual or dynamic inventory logic that is not built into a simple playbook; it would also defeat the purpose of automation by not ensuring consistent VLAN configuration across all switches. Option B is wrong because removing the VLAN from all switches before recreating it would cause unnecessary network disruption and downtime, violating the principle of minimal change in network automation. Option D is wrong because adding `ignore_errors: yes` would mask the error but not resolve the underlying issue; the VLAN creation task would still fail on the switch where the VLAN exists, and the playbook would continue without correcting the configuration, potentially leading to an inconsistent state.

Full explanation →
194
MCQmedium

In version control with Git, which command creates a new branch and switches to it in one step?

A.git checkout -b <branch>
B.git checkout <branch>
C.git branch <branch>
D.git switch <branch>
AnswerA

Creates and switches.

Why this answer

git checkout -b <branch> creates and switches. git branch <branch> creates but does not switch. git switch -c is also valid but not listed.

Full explanation →
195
MCQhard

A developer is using Postman to test a Cisco Webex API that creates a room. After running the request, they want to verify that the response status is 200 and that the response body contains a non-null 'id' field. Which Postman test code accomplishes this?

A.pm.test('Status code is 200', () => { pm.response.to.have.status(200); }); pm.test('ID exists', () => { pm.expect(pm.response.json().id).to.not.be.null; });
B.pm.response.to.have.status(200); if(pm.response.json().id) { console.log('exists'); }
C.pm.expect(pm.response.code).to.equal(200); pm.expect(pm.response.json().id).to.not.be.null;
D.pm.test('Status code is 200', () => { pm.response.to.have.status(200); }); pm.test('ID exists', () => { pm.expect(pm.response.json().id).to.be.null; });
AnswerA

Correct syntax for both checks.

Why this answer

pm.response.to.have.status checks the status; pm.expect and pm.response.json() access the body.

Full explanation →
196
MCQmedium

Which OAuth 2.0 grant type is most appropriate for a server-to-server integration where no user interaction is required, such as a backend service calling Cisco API?

A.Authorization code grant
B.Password grant
C.Device code grant
D.Client credentials grant
AnswerD

Allows a client to act on its own behalf without user involvement.

Why this answer

Client credentials grant is designed for server-to-server scenarios without user consent. Authorization code requires user interaction. Device code is for devices with limited UI.

Full explanation →
197
MCQeasy

A developer wants to retrieve a list of all network devices from Cisco DNA Center. Which API endpoint should they use?

A.GET /dna/intent/api/v1/topology/l2/{vlanID}
B.GET /dna/intent/api/v1/network-device
C.POST /dna/system/api/v1/auth/token
D.GET /dna/intent/api/v1/issues
AnswerB

This endpoint returns the list of network devices.

Why this answer

The correct endpoint is GET /dna/intent/api/v1/network-device as per Cisco DNA Center API documentation.

Full explanation →
198
MCQmedium

During an automation script run, a network device returns HTTP 429. What does this indicate?

A.Internal server error
B.Rate limiting
C.Authentication failure
D.Resource not found
AnswerB

429 means rate limit exceeded.

Why this answer

HTTP 429 (Too Many Requests) indicates the client has sent too many requests in a given amount of time, triggering rate limiting on the server. In network automation, devices like routers or switches enforce rate limits to prevent resource exhaustion, often based on RFC 6585. This is common when automation scripts exceed API call thresholds, requiring retry logic with exponential backoff.

Exam trap

Cisco often tests HTTP 429 to distinguish it from HTTP 503 (Service Unavailable), which is a server overload but not specifically a client rate limit, and candidates may confuse the two due to both involving temporary unavailability.

How to eliminate wrong answers

Option A is wrong because HTTP 500 (Internal Server Error) indicates a server-side failure, not a client-side request limit. Option C is wrong because authentication failures return HTTP 401 (Unauthorized) or 403 (Forbidden), not 429. Option D is wrong because resource not found returns HTTP 404, which is unrelated to request throttling.

Full explanation →
199
Multi-Selectmedium

Which TWO statements about Dockerfile best practices are correct? (Choose two.)

Select 2 answers
A.Use the ADD instruction instead of COPY to copy local files into the image.
B.Combine multiple RUN commands into a single RUN statement to reduce image layers.
C.Use a .dockerignore file to exclude unnecessary files from the build context.
D.Use the EXPOSE instruction to secure the container by limiting exposed ports.
E.Prefer official base images from trusted registries.
AnswersC, E

.dockerignore reduces build context size and improves security by excluding sensitive files.

Why this answer

A .dockerignore file prevents unnecessary files (e.g., node_modules, .git, logs) from being sent to the Docker daemon as part of the build context. This reduces build time, minimizes the risk of including sensitive data, and ensures a cleaner, more efficient image build.

Exam trap

Cisco often tests the misconception that EXPOSE actually secures or opens ports, when in reality it is only documentation and has no effect on container network security.

Full explanation →
200
MCQmedium

A network administrator is configuring subnetting for a new branch office that requires 50 usable host addresses per subnet. The available network is 192.168.10.0/24. What subnet mask should be used to meet the requirement with minimal waste?

A.255.255.255.128 (/25)
B.255.255.255.224 (/27)
C.255.255.255.192 (/26)
D.255.255.255.240 (/28)
AnswerC

/26 provides 62 usable hosts, suitable for 50 hosts.

Why this answer

A /26 mask provides 62 usable hosts (2^(32-26)-2=62), which is the smallest subnet that supports 50 hosts.

Full explanation →
201
MCQmedium

A Python script sends a PUT request to update a resource. The API returns a response with status code 204. What does this indicate?

A.The request was malformed.
B.The update was successful and no content is returned.
C.The resource was not found.
D.The update failed due to a server error.
AnswerB

204 No Content indicates success with no body.

Why this answer

204 No Content means the request succeeded, but there is no response body (common for PUT or DELETE).

Full explanation →
202
MCQhard

An application sends a packet with destination IP 10.0.0.10. The sending host's routing table has a default gateway of 10.0.0.1. The host's ARP cache is empty. What is the next step after the host determines the packet should go to the default gateway?

A.Sends an ARP request for 10.0.0.1
B.Sends the packet to the DNS server
C.Sends the packet directly to 10.0.0.10
D.Sends an ARP request for 10.0.0.10
AnswerA

The host needs the MAC of the gateway to encapsulate the packet.

Why this answer

When the host determines that the destination IP (10.0.0.10) is not on the same subnet and must be sent to the default gateway (10.0.0.1), it needs the gateway's MAC address to encapsulate the packet in a Layer 2 frame. Since the ARP cache is empty, the host must send an ARP request for the IP address of the default gateway (10.0.0.1) to obtain its MAC address before the packet can be forwarded.

Exam trap

Cisco often tests the misconception that ARP is always used for the final destination IP, but the trap here is that when routing through a gateway, ARP is only performed for the next-hop router's IP, not the remote destination.

How to eliminate wrong answers

Option B is wrong because DNS resolution is used to resolve hostnames to IP addresses, not to determine the next-hop MAC address; the destination IP is already known. Option C is wrong because the host cannot send the packet directly to 10.0.0.10 if it is on a different subnet; the packet must be sent to the default gateway for routing. Option D is wrong because the host does not need the MAC address of the final destination (10.0.0.10) when routing through a gateway; it only needs the MAC address of the next-hop router (10.0.0.1).

Full explanation →
203
MCQeasy

Which Cisco product provides end-to-end application visibility and performance monitoring across hybrid cloud environments?

A.Cisco Intersight
B.Cisco DNA Center
C.Cisco AppDynamics
D.Cisco SecureX
AnswerA

Cisco Intersight provides unified infrastructure management with end-to-end application visibility and performance monitoring across hybrid cloud environments. It is the correct answer.

Why this answer

Cisco Intersight is the correct answer because it provides unified infrastructure management with end-to-end application visibility and performance monitoring across hybrid cloud environments. It integrates telemetry from compute, storage, and network resources, enabling real-time insights into application behavior regardless of whether workloads run on-premises or in public clouds.

Exam trap

Cisco often tests the distinction between application performance monitoring (AppDynamics) and unified infrastructure management with application visibility (Intersight), leading candidates to confuse a specialized APM tool with a broader hybrid cloud management platform.

How to eliminate wrong answers

Option B is wrong because Cisco DNA Center focuses on intent-based networking for campus and branch networks, not on application performance monitoring across hybrid clouds. Option C is wrong because Cisco AppDynamics is an application performance monitoring (APM) tool that provides deep application-level visibility, but it does not offer end-to-end infrastructure visibility across hybrid cloud environments as a unified management platform. Option D is wrong because Cisco SecureX is a cloud-native security platform that integrates security products and automates threat response, not application performance monitoring.

Full explanation →
204
Multi-Selecthard

Which THREE of the following are characteristics of NETCONF? (Select THREE)

Select 3 answers
A.Uses SSH as the transport protocol
B.Uses HTTP as the transport protocol
C.Supports JSON encoding for data
D.Encodes operations as XML RPCs
E.Supports operations like <edit-config> and <get-config>
AnswersA, D, E

NETCONF typically runs over SSH (RFC 6242).

Why this answer

NETCONF uses SSH for transport, XML-encoded RPCs, and operations like edit-config/get-config. It does not use HTTP or JSON, and it is not stateless.

Full explanation →
205
MCQeasy

A developer is making a GET request to a REST API and needs to specify that the response should be in JSON format. Which HTTP header should be set?

A.Content-Type
B.User-Agent
C.Authorization
D.Accept
AnswerD

Accept specifies the desired response format.

Why this answer

The Accept header is used by the client to tell the server which media types (e.g., application/json) it can understand and prefers for the response. In a GET request, the client does not send a body, so Content-Type is irrelevant for specifying the response format. Setting Accept: application/json ensures the server returns JSON if it supports that format.

Exam trap

Cisco often tests the distinction between Content-Type (for request body) and Accept (for response body), leading candidates to mistakenly choose Content-Type because they confuse 'sending' data with 'receiving' data.

How to eliminate wrong answers

Option A is wrong because Content-Type indicates the media type of the request body, not the desired response format; for a GET request with no body, Content-Type has no effect on the response. Option B is wrong because User-Agent identifies the client software (e.g., browser or tool) and has no role in content negotiation. Option C is wrong because Authorization carries credentials (e.g., Bearer token) for access control, not a preference for response format.

Full explanation →
206
Multi-Selectmedium

Which THREE of the following are common steps in a CI/CD pipeline for a Python application that manages Cisco devices?

Select 3 answers
A.Build a Docker container
B.Manually review code before merge
C.Perform static code analysis (linting)
D.Run unit tests on each commit
E.Deploy to production on every commit
AnswersA, C, D

Containerization is common for packaging the application.

Why this answer

Containerizing the Python application with Docker ensures consistent runtime environments across development, testing, and production. This is especially important for managing Cisco devices, as dependencies like Netmiko or NAPALM must be reliably available. Docker also simplifies integration with orchestration tools like Kubernetes for scaling network automation tasks.

Exam trap

Cisco often tests the distinction between version control practices (like manual code review) and actual CI/CD pipeline stages (automated build, test, deploy), leading candidates to incorrectly select manual review as a pipeline step.

Full explanation →
207
MCQmedium

A CI/CD pipeline for a Python project should run unit tests and check for known vulnerabilities in dependencies. Which tool can be integrated into the pipeline to perform dependency scanning?

A.Docker
B.Kubernetes
C.Jenkins
D.Snyk
AnswerD

Snyk scans dependencies for vulnerabilities.

Why this answer

Snyk is a popular dependency scanning tool that integrates with CI/CD pipelines. pip audit and npm audit are similar but for specific ecosystems. Snyk supports multiple languages.

Full explanation →
208
MCQmedium

A network administrator uses the Cisco IOS XE CLI to configure a router. They want to use a Python script to automate this configuration via the guest shell. Which library should they use to interact with the CLI from within the guest shell?

A.cli
B.requests
C.ncclient
D.paramiko
AnswerA

The cli library allows Python to execute IOS XE commands.

Why this answer

The `cli` library is a built-in Python module available within the Cisco Guest Shell that allows scripts to execute IOS XE CLI commands directly on the host device. This library provides functions like `cli.execute()` and `cli.configure()` to send commands and retrieve output, making it the correct choice for automating configuration via the Guest Shell without external dependencies.

Exam trap

Cisco often tests the distinction between on-box automation (using the `cli` library) and off-box automation (using libraries like paramiko, ncclient, or requests), and the trap here is that candidates may assume any SSH library (paramiko) works for local Guest Shell interaction, not realizing the `cli` library is purpose-built for direct host communication.

How to eliminate wrong answers

Option B (requests) is wrong because it is an HTTP client library used for REST API calls, not for interacting with the native IOS XE CLI within the Guest Shell. Option C (ncclient) is wrong because it is a Python library for NETCONF, which uses XML-based YANG models over SSH, not the direct CLI interface. Option D (paramiko) is wrong because it is an SSH implementation for remote connections, but within the Guest Shell, the script runs locally on the device and does not need to SSH back into itself; the `cli` library provides direct, privileged access without additional authentication.

Full explanation →
209
Multi-Selecthard

Which THREE of the following are best practices when using Git for a collaborative project? (Choose three.)

Select 3 answers
A.Use feature branches for new work.
B.Rebase or merge regularly to incorporate upstream changes.
C.Commit directly to the main branch.
D.Write descriptive commit messages.
E.Avoid pulling from remote to prevent conflicts.
AnswersA, B, D

Isolate work.

Why this answer

A is correct because feature branches isolate new work from the stable main branch, enabling parallel development without disrupting the shared codebase. This practice aligns with Git's branching model and supports code review and continuous integration workflows.

Exam trap

Cisco often tests the misconception that committing directly to main is acceptable for small changes, but the exam emphasizes that all changes should go through feature branches to maintain a clean, reviewable history.

Full explanation →
210
MCQeasy

Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?

A.The device is unreachable
B.The playbook syntax is incorrect
C.The device is not running IOS
D.Wrong SSH username or password
AnswerD

Authentication failure points to credentials.

Why this answer

The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.

Exam trap

Cisco often tests the distinction between connectivity errors (unreachable) and authentication errors (wrong credentials), where candidates mistakenly attribute a failed SSH authentication to a network reachability issue.

How to eliminate wrong answers

Option A is wrong because if the device were unreachable, Ansible would return a 'Host unreachable' or 'Connection timed out' error, not an authentication failure. Option B is wrong because a playbook syntax error would be caught during YAML parsing before any connection attempt, resulting in a 'Syntax Error' message. Option C is wrong because if the device were not running IOS, Ansible would still attempt SSH authentication; the error would be about unsupported connection methods or missing required modules, not authentication failure.

Full explanation →
211
Multi-Selectmedium

A developer is working with the Meraki Dashboard API to manage SSIDs. Which TWO statements about pagination are correct? (Choose two.)

Select 2 answers
A.Pagination is handled automatically by the client library; no action required
B.The 'page' query parameter is used to specify page number
C.The 'endingBefore' parameter is used to go to the previous page
D.The 'startingAfter' parameter can be used to fetch the next page of results
E.The Link header contains a 'last' URL for the final page
AnswersC, D

endingBefore retrieves items before a given ID, effectively moving backward.

Why this answer

Meraki uses the Link header with 'prev' and 'next' URLs for pagination. Additionally, the startingAfter and endingBefore query parameters allow manual pagination.

Full explanation →
212
Multi-Selecteasy

Which THREE of the following are layers in the OSI model? (Select exactly three.)

Select 3 answers
A.Internet
B.Network Access
C.Transport
D.Presentation
E.Data Link
AnswersC, D, E

Layer 4 of the OSI model.

Why this answer

The Transport layer (Layer 4) of the OSI model is correct because it provides end-to-end communication, error recovery, and flow control between hosts. Protocols such as TCP and UDP operate at this layer, ensuring reliable or connectionless data delivery as required by applications.

Exam trap

Cisco often tests the distinction between the OSI and TCP/IP models, and the trap here is that candidates confuse the TCP/IP layers (Internet, Network Access) with OSI layers, leading them to select those incorrect options instead of the correct OSI layers like Data Link.

Full explanation →
213
MCQhard

A developer is writing a Python script using the Cisco Webex Teams API to send a message to a specific room. The script works for some rooms but fails for others with a 404 error. What is the most likely reason?

A.The API rate limit has been exceeded for those rooms.
B.The access token is invalid for those rooms.
C.The bot does not have permission to send messages in those rooms.
D.The bot is not a member of those rooms.
AnswerD

Non-membership results in 404 when trying to send to a room.

Why this answer

The 404 error indicates that the resource (the room) was not found by the API. In the Cisco Webex Teams API, a bot can only interact with rooms it has been added to as a member. If the bot is not a member of a room, the API cannot locate the room from the bot's perspective, resulting in a 404 error.

This is the most common cause of intermittent 404 errors when the script works for some rooms but not others.

Exam trap

Cisco often tests the distinction between HTTP status codes (404 vs 403 vs 401) and their specific meanings in the context of API authorization and resource existence, leading candidates to confuse permission issues (403) with membership/visibility issues (404).

How to eliminate wrong answers

Option A is wrong because exceeding the API rate limit would return a 429 (Too Many Requests) error, not a 404. Option B is wrong because an invalid access token would cause a 401 (Unauthorized) error for all API calls, not just for specific rooms. Option C is wrong because permission issues (e.g., not having the 'send messages' scope) would typically result in a 403 (Forbidden) error, not a 404; the bot must be a member of the room to even be considered for permission checks.

Full explanation →
214
MCQmedium

Given the JSON string: '{"name": "Alice", "scores": [90, 85, 92]}', which Python code correctly extracts the second score (85)?

A.json.loads(json_str)['scores'][1]
B.json.dumps(json_str)['scores'][1]
C.json_str['scores'][1]
D.json.loads(json_str)['scores'][2]
AnswerA

Correct.

Why this answer

json.loads converts to dict, then access scores list index 1.

Full explanation →
215
MCQeasy

An application exposes a REST API. To ensure that only authorized clients can access the API, the developer implements token-based authentication. Which HTTP header is typically used to transmit the bearer token?

A.Cookie
B.X-API-Key
C.Authorization: Basic
D.Authorization: Bearer
AnswerD

This is the standard header for bearer tokens.

Why this answer

The Authorization header with the Bearer scheme (RFC 6750) is the standard method for transmitting bearer tokens in HTTP requests. When a client authenticates and receives a token, it includes the token in the Authorization header as 'Bearer <token>', allowing the server to validate the token and authorize the request without requiring session state.

Exam trap

Cisco often tests the distinction between Authorization: Basic and Authorization: Bearer, where candidates confuse the two because both use the Authorization header, but Basic transmits credentials while Bearer transmits a token.

How to eliminate wrong answers

Option A is wrong because the Cookie header is used for session-based authentication (e.g., JSESSIONID) and is not the standard for bearer token transmission; cookies are vulnerable to CSRF and require additional security measures. Option B is wrong because X-API-Key is a custom header typically used for API key authentication, not for bearer tokens; it lacks the standardized Bearer scheme defined in RFC 6750. Option C is wrong because Authorization: Basic uses Base64-encoded credentials (username:password) for HTTP Basic Authentication, not a token; it transmits credentials directly rather than a bearer token.

Full explanation →
216
MCQeasy

At which layer of the OSI model do switches operate when forwarding frames based on MAC addresses?

A.Layer 1 (Physical)
B.Layer 3 (Network)
C.Layer 2 (Data Link)
D.Layer 4 (Transport)
AnswerC

Switches use MAC addresses to forward frames at Layer 2.

Why this answer

Switches operate at Layer 2 (Data Link layer) because they use MAC addresses to forward frames.

Full explanation →
217
MCQeasy

A developer creates a Dockerfile for a Python web application. Which instruction should be used to define the working directory inside the container for subsequent commands?

A.ENV
B.RUN
C.COPY
D.WORKDIR
AnswerD

WORKDIR sets the working directory for all subsequent Dockerfile instructions.

Why this answer

The WORKDIR instruction in a Dockerfile sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Dockerfile. For a Python web application, using WORKDIR /app ensures that subsequent commands like COPY and RUN operate inside the /app directory, keeping the container filesystem organized and avoiding path errors.

Exam trap

Cisco often tests the distinction between WORKDIR and RUN cd, where candidates mistakenly think RUN cd sets a persistent working directory, but in Docker each RUN command runs in a new shell with the working directory reset unless WORKDIR is used.

How to eliminate wrong answers

Option A is wrong because ENV sets environment variables, not the working directory. Option B is wrong because RUN executes commands in a new layer on top of the current image but does not persist a working directory for subsequent instructions. Option C is wrong because COPY copies files from the host into the container at a specified path, but it does not define or change the working directory for later commands.

Full explanation →
218
Multi-Selecteasy

Which TWO of the following are common methods for authenticating to Cisco REST APIs? (Choose two.)

Select 2 answers
A.API Key
B.Certificate-based Authentication
C.NTLM Authentication
D.OAuth 2.0
E.Basic Authentication
AnswersA, D

API keys are a common authentication method for Cisco APIs such as Meraki and DNA Center.

Why this answer

API Key authentication (Option A) is a common method for Cisco REST APIs, such as those on Cisco DNA Center and Meraki, where a pre-generated key is included in the HTTP header (e.g., 'X-Cisco-Meraki-API-Key') to identify the client. OAuth 2.0 (Option D) is widely used in Cisco platforms like Webex Teams and Cisco DNA Center for delegated access, issuing a bearer token after an authorization flow. Both methods are officially supported and documented for Cisco REST API authentication.

Exam trap

Cisco often tests the distinction between 'common' and 'possible' authentication methods, leading candidates to select Basic Authentication (Option E) because it is widely known, even though Cisco REST APIs explicitly recommend against it in favor of API keys or OAuth 2.0.

Full explanation →
219
MCQmedium

Which TCP flag is set in the second step of the three-way handshake?

A.ACK
B.SYN and ACK
C.SYN
D.FIN
AnswerB

The server responds with SYN-ACK.

Why this answer

The TCP three-way handshake begins with the client sending a SYN segment to initiate a connection. In the second step, the server responds with a SYN-ACK segment, which both acknowledges the client's SYN (using the ACK flag) and synchronizes its own sequence number (using the SYN flag). This combined flag is essential for establishing a reliable, bidirectional connection.

Exam trap

Cisco often tests the misconception that the second step uses only an ACK flag, confusing it with the third step where the client sends an ACK to complete the handshake.

How to eliminate wrong answers

Option A is wrong because the ACK flag alone is used in later stages of the handshake (e.g., the third step) or in subsequent data transfers, not in the second step where both synchronization and acknowledgment are required. Option C is wrong because a pure SYN flag is only sent in the first step by the client to initiate the connection; the server must also acknowledge that SYN, so a standalone SYN in the second step would leave the client's initial sequence number unacknowledged. Option D is wrong because the FIN flag is used to gracefully terminate a connection, not to establish one; it appears in the four-way teardown process.

Full explanation →
220
MCQmedium

A developer is building a chatbot that retrieves interface status from a Cisco Catalyst 9000 switch using RESTCONF. Which authentication method is most appropriate for programmatic access?

A.HTTP Basic Authentication over HTTPS.
B.API key passed in the HTTP header.
C.OAuth 2.0 with client credentials grant.
D.Client certificate authentication.
AnswerA

RESTCONF on Cisco devices supports basic auth over HTTPS.

Why this answer

RESTCONF on Cisco Catalyst 9000 switches supports HTTP Basic Authentication over HTTPS as a straightforward, standards-based method for programmatic access. Basic authentication sends the username and password in the HTTP Authorization header, and when combined with HTTPS, the credentials are encrypted in transit, providing adequate security for device management without requiring additional infrastructure like an OAuth provider or certificate authority.

Exam trap

Cisco often tests the misconception that RESTCONF requires OAuth or API keys because it is a RESTful API, but in reality, IOS XE devices rely on traditional AAA and HTTP Basic Auth over HTTPS for programmatic access.

How to eliminate wrong answers

Option B is wrong because RESTCONF does not natively support API key authentication; API keys are typically used with REST APIs that have a dedicated key management system, not with NETCONF/RESTCONF on Cisco IOS XE. Option C is wrong because OAuth 2.0 with client credentials grant is not a standard authentication mechanism for RESTCONF on Catalyst 9000 switches; these devices use local or AAA-based authentication, not token-based OAuth flows. Option D is wrong while client certificate authentication is supported for HTTPS, it is not the most appropriate for simple programmatic access because it requires a PKI infrastructure and certificate management, adding complexity that is unnecessary for basic interface status retrieval.

Full explanation →
221
MCQeasy

A developer is working with a REST API that uses HTTP Basic Authentication. The developer needs to send a request with the username 'admin' and password 'secret'. Which HTTP header should be set?

A.Authorization: Basic admin:secret
B.Authorization: YWRtaW46c2VjcmV0
C.Authorization: Basic YWRtaW46c2VjcmV0
D.Authorization: Bearer YWRtaW46c2VjcmV0
AnswerC

Correct: This is the standard format for Basic Auth.

Why this answer

HTTP Basic Authentication requires the credentials to be formatted as 'username:password', then Base64-encoded, and sent in the Authorization header with the 'Basic' scheme. Option C correctly includes the 'Basic' scheme followed by the Base64-encoded string 'YWRtaW46c2VjcmV0' (which decodes to 'admin:secret').

Exam trap

Cisco often tests whether candidates know that the credentials must be Base64-encoded and prefixed with the 'Basic' scheme, not sent in plaintext or with the wrong scheme like 'Bearer'.

How to eliminate wrong answers

Option A is wrong because it sends the credentials in plaintext 'admin:secret' without Base64 encoding and omits the required 'Basic' scheme prefix. Option B is wrong because it sends the Base64-encoded string 'YWRtaW46c2VjcmV0' but lacks the 'Basic' scheme identifier, making the header invalid per RFC 7617. Option D is wrong because it uses the 'Bearer' scheme, which is used for OAuth 2.0 token authentication, not HTTP Basic Authentication.

Full explanation →
222
Multi-Selecteasy

Which TWO conditions are valid triggers for a webhook notification in Cisco Meraki?

Select 2 answers
A.Client data usage exceeds configured threshold
B.A client joins a wireless network
C.Firmware upgrade completes
D.Network administrator logs in
E.A new SSID is added
AnswersA, B

Meraki webhooks support 'Data usage alert' events.

Why this answer

(Client data usage exceeds configured threshold) is a valid trigger because Meraki can send webhook notifications when data usage thresholds are exceeded. Option B (A client joins a wireless network) is also a valid trigger, corresponding to the 'Client join' event. Option C (Firmware upgrade completes) is not a standard webhook trigger.

Option D (Network administrator logs in) is not a standard trigger. Option E (A new SSID is added) is not a standard trigger.

Full explanation →
223
MCQmedium

A developer is using gRPC/gNMI for model-driven telemetry from a Cisco device. Which of the following best describes the difference between dial-in and dial-out streaming?

A.Dial-in uses gNMI; dial-out uses NETCONF.
B.Dial-in uses TCP; dial-out uses UDP.
C.Dial-in is initiated by the network device; dial-out is initiated by the collector.
D.Dial-in is initiated by the collector; dial-out is initiated by the device.
AnswerD

Correct: dial-in subscription from collector; dial-out is device pushing.

Why this answer

In gNMI, dial-in is when the collector initiates the subscription to the device; dial-out is when the device pushes data to the collector.

Full explanation →
224
Multi-Selecthard

A developer is building a Cisco Webex bot that needs to automatically respond to messages. Which THREE resources/endpoints are essential for this functionality? (Choose three.)

Select 3 answers
A.Rooms API
B.People API
C.Licenses API
D.Webhooks API
E.Messages API
AnswersA, D, E

Required to create or list rooms where bot participates.

Why this answer

Essential endpoints are Messages (to send/receive), Webhooks (to get notified of events), and Rooms (to interact with rooms). People is useful but not essential for bot functionality.

Full explanation →
225
MCQmedium

Refer to the exhibit. A Python script using RESTCONF sends a GET request to retrieve the interface configuration. The response is shown. What is the VLAN assigned to GigabitEthernet1/0/1?

A.10
B.1
C.100
D.20
AnswerA

The JSON clearly shows 'vlan': 10.

Why this answer

(VLAN 10) because the RESTCONF GET response shows the native VLAN for GigabitEthernet1/0/1 is set to 10. In Cisco IOS-XE, the native VLAN is the VLAN assigned to an interface when it is in access mode, and the response explicitly includes the 'native-vlan' field with a value of 10 under the 'Cisco-IOS-XE-native:interface' hierarchy.

Exam trap

Cisco often tests whether candidates can distinguish between the 'native-vlan' field (which represents the access VLAN for an access port) and the default VLAN 1, leading many to incorrectly select VLAN 1 when the response clearly shows a different value.

How to eliminate wrong answers

Option B (VLAN 1) is wrong because VLAN 1 is the default VLAN on Cisco switches, but the RESTCONF response explicitly shows the native VLAN is 10, not 1. Option C (VLAN 100) is wrong because VLAN 100 is not referenced anywhere in the response; it might be a distractor for a trunk port scenario, but this interface is configured as an access port. Option D (VLAN 20) is wrong because VLAN 20 is not present in the response; the only VLAN value shown is 10 under the native-vlan field.

Full explanation →
Page 2

Page 3 of 14

Page 4

All pages

1234567891011121314

Practice 200-901 by domain

Target a specific domain to shore up weak areas.

Application Deployment and SecuritySoftware Development and DesignUnderstanding and Using APIsCisco Platforms and DevelopmentNetwork FundamentalsInfrastructure and Automation
See all domains with question counts →