Cisco DevNet Associate 200-901 (200-901) — Questions 151–225

HTTP/2 introduces binary framing with streams, letting many concurrent requests and responses share one TCP connection. HTTP/1.1 requires separate connections or serialised pipelining, so head-of-line blocking delays later requests. Multiplexing removes that per-connection queueing, which is the primary performance gain.

The candidate datastore capability allows a device to support a candidate configuration that can be edited and then committed to the running datastore. This matches the workflow described, where changes are made to a candidate and only applied after a commit. Without this capability, the device would not support the candidate datastore, and the <edit-config> targeting candidate would fail.

PATCH applies a partial modification, sending only the fields being changed rather than a full replacement representation. PUT would overwrite the entire resource, so PATCH is the method that satisfies the requirement to update part of an existing resource.

Webhooks push notifications by sending an HTTP POST containing event payload data to the subscriber's configured target URL. This satisfies the stem's requirement for a true statement about Webex webhook delivery, distinguishing push-based event delivery from polling the API.

HTTP/2 compresses request and response header fields with HPACK, which uses static and dynamic tables plus Huffman coding. HTTP/1.1 sends headers as uncompressed plaintext on every request, so repetitive headers waste bandwidth that HPACK eliminates.

To add a member to a Webex space, you send a POST request to /v1/memberships with a JSON body containing 'roomId', 'personEmail', and optionally 'isModerator'. This creates a new membership. The API returns the membership details. This is the correct method and endpoint for adding a member.

LoadBalancer provisions an external load balancer (typically via the cloud provider) that assigns a stable, externally reachable IP address. This IP remains consistent even if pods are rescheduled or nodes are replaced. It automatically routes traffic to the appropriate NodePort and ClusterIP, fulfilling the requirement for stable external access to the application.

GraphQL queries declare precisely the fields required, so the server returns only those fields, eliminating the over-fetching inherent in REST's fixed resource representations. This satisfies the microservice's need to minimise payload size when calling the GraphQL API.

409 Conflict indicates a conflict with the current state.

A TCP segment with the SYN flag set and the ACK flag not set is the first step of the three-way handshake, used to initiate a connection. The destination port 443 indicates the host is attempting to connect to an HTTPS service. This is the standard behavior for a client opening a TCP connection to a web server.

The signature `def fetch_devices(*endpoints, **options)` satisfies both stem constraints: `*endpoints` collects positional API endpoint arguments into a tuple, while `**options` gathers keyword arguments such as `timeout` into a dictionary. This is the only syntax Python permits for combining arbitrary positional and keyword parameters in one definition.

This snippet reads the API key from the environment variable 'API_KEY' using os.environ, then passes it in the headers dictionary to requests.get. This avoids hardcoding the key and follows security best practices. It correctly sets the custom header 'X-API-Key' as required by the API.

The reply originates from the local gateway 192.168.1.1, meaning the packet reached the default router but no route existed onward to 8.8.8.8. This confirms a routing failure beyond the local subnet, matching the stem's destination-unreachable output.

A Kubernetes Secret stores sensitive data separately from the image and manifest, and it can be injected into a container as an environment variable using envFrom or valueFrom. This keeps the password out of the container image and out of the Deployment YAML. It is the standard mechanism for supplying runtime secrets in Kubernetes.

ncclient is the standard Python library for NETCONF sessions and supports SSH transport. PyYAML parses the inventory file without hardcoding device data. Reading credentials from environment variables keeps secrets out of source code, which satisfies the reusability and security requirements described in the scenario.

Meraki's Dashboard API returns a Retry-After header on 429 responses that indicates how many seconds the client must wait. Honoring this header prevents further throttling and aligns with Meraki's documented rate-limit behavior. Simply pausing for a fixed interval without reading the header may retry too soon or waste time.

The southbound API connects the SDN controller to underlying switches, letting it push flow rules and forwarding instructions directly to the data plane. This satisfies the stem's requirement for controller-to-device communication, whereas northbound interfaces serve applications and management layers instead.

Meraki's REST API paginates large collections, returning a Link header containing the URL of the next page of results, often with rel="next". The engineer follows that URL to retrieve subsequent networks until no Link header remains, indicating the final page.

Meraki's REST API expects the key in a custom request header named X-Cisco-Meraki-API-Key, not as a query parameter or body field. This satisfies the stem's requirement to authenticate the organisation-listing call, since Meraki validates that header on every request before returning the organisations list.

NX-API's JSON-RPC interface accepts commands at the /ins endpoint via HTTP POST, with the CLI commands supplied in the JSON body. GET is unsuitable because it cannot carry the command payload, and /cli returns plain text rather than JSON.

The ios_banner module is specifically designed to manage banners on Cisco IOS devices. It allows you to configure the login, motd, exec, and other banners with idempotent behavior. This module is part of the cisco.ios collection and is the vendor-supported way to ensure a banner is present. Using it simplifies the playbook and ensures proper handling of device interactions.

UDP's eight-byte header, versus TCP's minimum twenty bytes, cuts per-packet overhead, satisfying the stem's comparison of protocol characteristics. Omitting handshakes, acknowledgements and congestion control further reduces processing and bandwidth cost, which suits latency-sensitive traffic that tolerates loss.

The Authorization Code Grant is ideal for applications that need to act on behalf of users without storing their credentials. The user authenticates directly with Webex, and the application receives an authorization code, which it exchanges for an access token. This flow is secure because the application never sees the user's password, and tokens can be scoped and revoked. It is the recommended flow for web and mobile apps requiring user context.

The code parses the JSON file into a Python dictionary, then indexes the `interfaces` list to retrieve its first element and reads that dictionary's `name` key. Given the supplied file content, this resolves to the string `GigabitEthernet0/1`, which `print` outputs without quotes.

Collection variables persist across every request in the collection, so a token captured from the login response remains accessible to all subsequent requests. This satisfies the requirement to reuse the token collection-wide rather than per-request.

Storing the token in a .env file that is excluded via .gitignore keeps it out of the repository while still making it available to the script at runtime through python-dotenv. This separates configuration from code and prevents accidental exposure in commits. It is a standard local development pattern that preserves authentication functionality without hardcoding secrets.

Cisco DNA Center returns an authentication token in the response body when you POST to /dna/system/api/v1/auth/token with Basic Auth credentials. That token must then be supplied in the X-Auth-Token HTTP header on every subsequent API call. This is the documented and required header for token-based authentication with DNA Center, making it the correct choice for the script.

The Authorization header is the standard HTTP header used to carry credentials for authenticating a client with a server. When using an API key, it is common to include it in the Authorization header, often with a scheme like Bearer or Basic. This header is designed specifically for authentication and is the correct choice for passing an API key.

Reconciling the Git YAML source of truth against live Nexus and AWS VPC state exposes the VLAN/subnet mismatch causing connectivity loss. This satisfies the requirement to identify the drift first before applying any corrective automation.

Environment variables populated from a CI/CD secret store keep the key out of the repository and inject it only at runtime. The application reads the value without hardcoding it, and the pipeline masks the value in logs. This is the standard pattern for separating configuration and secrets from code in automated builds.

Ansible is agentless by design: it connects to managed nodes over SSH, pushes modules and playbooks from the control node, and requires no long-running agent on the target. For Cisco IOS XE it uses modules such as ios_config to apply banner and other configuration. This matches every constraint in the scenario, including the YAML playbook format.

GET requests retrieve data without modifying server state, matching the read-only intent of listing network devices. The path `/dna/intent/api/v1/network-device` is Cisco DNA Center's Intent API endpoint for device inventory, satisfying the requirement to fetch the device collection. POST, PUT or DELETE would alter resources or target the wrong operation.

The Meraki Dashboard API authenticates every call with a dedicated request header rather than a query string or bearer token. Supplying the key as X-Cisco-Meraki-API-Key satisfies the stem's requirement for the correct method when issuing GET https://api.meraki.com/api/v1/organizations, keeping credentials out of the URL and logs.

GET retrieves a resource representation from the server without modifying it, satisfying the retrieval half of the requirement. It is safe and idempotent, returning the current state of the target resource identified by the request URI.

The Cisco Meraki Dashboard API uses a custom header named X-Cisco-Meraki-API-Key to authenticate requests. The API key generated in the Meraki Dashboard must be included in this header for all API calls. Without it, the server returns a 401 Unauthorized error. This header is specific to Meraki and is the correct way to authenticate.

A /27 mask leaves five host bits, yielding 32 addresses minus network and broadcast, so exactly 30 usable hosts. It is the smallest subnet satisfying the stated requirement without waste, whereas /28 would provide only 14 usable addresses.

Signing images produces cryptographic proof of who built and published them. Enforcing verification at admission time, for example with a policy engine or cosign-backed admission controller, ensures only images with valid signatures from trusted publishers can run. This satisfies the requirement that only trusted images are deployed, even if an attacker compromises the registry.

Intersight REST API calls authenticate using an API key ID paired with a secret key, signing each request with HMAC-SHA256. The signature is placed in the Authorization header, so no session token or basic credentials are used.

RESTCONF uses HTTP GET to read data, and the data resource is addressed under /restconf/data/ followed by the module name and a colon, then the container path. This URL matches the standard RESTCONF structure for retrieving the interfaces container from the ietf-interfaces YANG module, so it returns the requested configuration data.

A YANG leaf of type uint32 holds exactly one unsigned 32-bit integer, so 'bandwidth' represents a single scalar value rather than a list or container. The stem's constraint is the leaf keyword, which always models one atomic instance, here the interface's bandwidth expressed in kilobits per second.

Idempotent modules such as ios_vlan query existing VLAN configuration before applying changes, so a pre-existing VLAN ID produces no error and no duplicate. This satisfies the requirement that the playbook complete successfully across switches with differing current state.

git checkout -b <branch> creates the new branch at the current HEAD and immediately switches the working tree to it, combining creation and checkout. This single-step behaviour matches the stem's requirement, unlike git branch alone, which only creates.

The client credentials grant exchanges the application's own client ID and secret directly for an access token, with no resource owner or browser redirect involved. This matches server-to-server backend calls where no user context exists, unlike authorisation code or implicit grants.

The GET /dna/intent/api/v1/network-device endpoint targets Cisco DNA Center's Intent API, returning the full inventory of managed network devices. Its HTTP GET method and network-device resource path satisfy the requirement to retrieve, not modify, device listings.

HTTP 429 is the standard 'Too Many Requests' status code, returned when a client exceeds the server's permitted request rate within a given window. It directly signals rate limiting, satisfying the stem's scenario of an automation script being throttled by the network device.

A /26 mask yields 64 addresses, giving 62 usable hosts, which satisfies the 50-host requirement with minimal waste. Smaller masks like /25 waste over 70 addresses; larger masks like /27 provide only 30 usable hosts, falling short.

HTTP 204 No Content confirms the server processed the PUT successfully but returns no body, matching the stem's update scenario. It differs from 200, which carries a response body, and from 404, which signals the resource was not found.

With the destination off-subnet, the host must forward the frame to 10.0.0.1, but its ARP cache holds no MAC mapping for that gateway. ARP resolves the gateway's link-layer address, so the host broadcasts a request for 10.0.0.1 before it can encapsulate and transmit the packet.

NETCONF runs over a secure, connection-oriented SSH session on port 830, giving encrypted transport and authenticated access to network devices. This satisfies the characteristic of using SSH as its transport protocol, distinguishing it from SNMP or RESTCONF over HTTPS.

VLANs (Virtual LANs) logically segment a switch into multiple broadcast domains. Each VLAN is a separate broadcast domain. To allow communication between VLANs, a Layer 3 device (like a router or a Layer 3 switch) is required. The scenario asks for segmentation into broadcast domains, which VLANs provide.

Cisco DNA Center's authentication endpoint returns a token that clients must present in the X-Auth-Token request header on subsequent API calls. This avoids re-sending credentials and lets the controller validate the session quickly. The header name is case-insensitive per HTTP, but the exact spelling matters for clarity and for tools that generate requests from documentation examples.

The sequence of SYN, SYN-ACK, and ACK is the standard TCP three-way handshake used to establish a connection. The first host sends a SYN to initiate, the second host responds with SYN-ACK to acknowledge and synchronize, and the first host completes with an ACK. This ensures both sides are ready to communicate and agree on initial sequence numbers. The capture clearly shows this exact exchange.

The Accept request header tells the server which media types the client can handle, so setting Accept: application/json requests a JSON response. This satisfies the stem's requirement to specify JSON as the desired response format.

Building a Docker container packages the Python application with its dependencies into an immutable image, satisfying the pipeline's need for consistent, reproducible artefacts across environments. This step typically follows unit testing and precedes registry push and deployment, ensuring the Cisco device management code runs identically regardless of the underlying host configuration.

Snyk scans third-party dependencies for known vulnerabilities, matching packages against a vulnerability database, which directly satisfies the pipeline's dependency-checking requirement. It integrates into CI/CD workflows and supports Python manifests such as requirements.txt and Pipfile, complementing the unit tests rather than replacing them.

The cli Python module is bundled inside the IOS XE guest shell, exposing functions such as cli.execute and cli.configurep to run CLI commands programmatically. It satisfies the constraint of interacting with the router's CLI from within the guest shell itself.

Assigning a device to a site is another key operation in Site Management. This is done via endpoints such as POST /dna/intent/api/v1/site/{siteId}/device. It associates a network device with a specific site, enabling site-based monitoring and policy enforcement. This operation is fundamental for site-based management.

Feature branches isolate new work from the mainline, so unfinished or experimental changes never destabilise shared code. This satisfies the stem's collaborative best-practice requirement by enabling independent development and clean pull requests before merging into the shared branch.

endingBefore retrieves items before a given ID, effectively moving backward.

A 404 on the Webex Teams messages endpoint occurs when the bot lacks membership in the target room, since the API scopes room access to authenticated participants. The stem's constraint is that some rooms succeed while others fail, which rules out token or syntax faults and points to per-room authorisation.

Enabling IP routing on a Layer 3 switch allows it to route packets between VLANs. Each VLAN interface (SVI) acts as a default gateway for hosts in that VLAN, and the switch uses its routing table to forward traffic between subnets. This is the standard method for inter-VLAN routing on modern switches.

json.loads parses the string into a dictionary, then ['scores'] retrieves the list and [1] indexes its second element, which is 85. Python lists are zero-indexed, so index 1 satisfies the stem's requirement of extracting the second score rather than the first.

The Authorization header carries credentials for HTTP authentication, and the Bearer scheme conveys an OAuth 2.0 access token, so 'Authorization: Bearer <token>' transmits the bearer token. This satisfies the token-based authentication requirement, since servers read that header to validate client authorisation.

Switches forward frames using MAC addresses contained in Ethernet headers, which reside at Layer 2, the Data Link layer. This satisfies the scenario's forwarding basis, distinguishing switches from Layer 3 routers that forward on IP addresses.

The second handshake step has the server responding to the client's initial SYN with its own sequence number while acknowledging the client's, so both SYN and ACK flags are set. This synchronises sequence numbers in both directions.

HTTP Basic Authentication over HTTPS supplies credentials in the request header, which RESTCONF accepts for programmatic access, satisfying the stem's chatbot requirement. HTTPS encrypts the base64-encoded credentials in transit, preventing interception, and the method needs no browser-based interactive login flow.

HTTP Basic Authentication transmits credentials as base64-encoded `username:password` in the `Authorization` header. Encoding `admin:secret` yields `YWRtaW46c2VjcmV0`, satisfying the stem's requirement to send those exact credentials. The `Basic` scheme prefix must precede the encoded value, which this header does correctly.

In ncclient, the get_config method retrieves configuration data from a specified datastore. Using source='running' fetches the running configuration. This is the correct method for retrieving configuration via NETCONF. The method returns a response object containing the configuration in XML format, which can then be parsed.

Using a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) centralizes secret storage with encryption, access controls, and audit logging. Injecting secrets at runtime avoids embedding them in code or configuration files, reducing exposure. This is a best practice for secure secret management in CI/CD pipelines.

Patching requests.get with unittest.mock replaces the real network call with a controlled return value, so the test exercises the function's parsing and error handling without contacting the Meraki Dashboard API. This makes the test fast, deterministic, and safe to run in CI. It is the standard Python approach for isolating external HTTP dependencies in unit tests.

In dial-in telemetry the collector opens the gRPC session to the device and subscribes; in dial-out the device initiates the connection to the collector and pushes data. This direction of session initiation is the defining difference between the two modes.

The Rooms API lets the bot enumerate and inspect Webex spaces, supplying the roomId that every message response must target. Without it, the bot cannot determine which conversation to post into, so it satisfies the requirement to respond automatically to messages received across multiple rooms.

The candidate capability allows a client to edit a candidate datastore and then commit those changes to the running datastore. Because the script edits the candidate and commits, the device must advertise this capability. Without it, the client cannot use <edit-config> with a candidate target or issue <commit>, so this is the required capability for the described workflow.

Cisco DNA Center requires token-based authentication: credentials are Base64-encoded and POSTed to /dna/system/api/v1/auth/token, which returns a time-limited token. Subsequent REST calls must include this token in the X-Auth-Token header, satisfying the stem's requirement to retrieve the device list securely without resending credentials per request.

Cisco Meraki's cloud-managed dashboard exposes a REST API authenticated with an API key in the request header and enforces a documented rate limit of 5 requests per second per organisation, matching all three stated constraints.