Cisco DevNet Associate 200-901 (200-901) — Questions 226–300

A CNAME record maps one DNS name to another canonical name, so querying example.com returns www.example.com's records. This satisfies the stem's requirement for an alias rather than a duplicate A record, letting both hostnames resolve to the same web server without maintaining separate IP entries.

git commit --amend rewrites the most recent commit, replacing it with a new commit object that has a different hash, thereby altering commit history. This differs from commands such as git commit, which only append new commits.

Content-Type specifies the media type of the request body, such as application/json, so the server knows how to parse the POST payload. Accept instead describes the desired response format, so Content-Type satisfies the requirement to declare the body's format.

SSL/TLS operates between HTTP and TCP, encrypting the request and response payloads and authenticating the server via its certificate. Plain HTTP provides neither confidentiality nor identity verification, so layering TLS satisfies the encryption and authentication requirement.

In dial-out telemetry, the network device acts as the client and initiates the TCP connection to the collector, which listens as the server. This satisfies the dial-out model, reversing the dial-in approach where the collector connects to the device.

Cisco IOS XE exposes comprehensive REST APIs through its RESTCONF and NETCONF interfaces, enabling programmatic configuration and monitoring via YANG models. This satisfies the stem's requirement for a platform offering REST APIs for both network configuration and monitoring tasks.

`docker build` reads a Dockerfile and constructs an image layer by layer, satisfying the stem's requirement to build an image from a Dockerfile. It parses instructions such as FROM, RUN and COPY, committing each layer, then tags the resulting image locally so containers can be created from it.

Publishing with 8080:5000 means the host listens on 8080 and forwards to port 5000 inside the container. The application is reachable only through 8080 on the host; host port 5000 is never bound by Docker, so a connection attempt there is refused. To reach the app on host port 5000 the mapping would need to be 5000:5000.

A 404 Not Found indicates that the server cannot find the requested resource. Even with valid IDs, if the endpoint path is wrong (e.g., misspelled 'vlans' or wrong API version) or the specific port does not exist, the server returns 404. The developer should double-check the URL structure and ensure the port identifier is valid for that switch.

SW1's trunk permits only VLAN 10, so VLAN 20 frames arriving from SW2 are dropped before reaching SW1's VLAN 20 devices. SW2's allowed list is irrelevant; the missing VLAN 20 on SW1's trunk is the actual cause of the connectivity failure.

The serial keyword controls how many hosts Ansible executes per play iteration. Setting serial: 1 runs the play against one switch at a time, completing each before starting the next, which prevents simultaneous VLAN changes from disrupting the network.

LoadBalancer provisions an external load balancer through the cloud provider, assigning a stable public IP that routes to the pods on your chosen port. This satisfies the stem's requirement for external traffic on a specific port, unlike ClusterIP (internal only) or NodePort (no stable external IP).

The `*args` parameter collects the positional arguments 1, 2 and 3 into a tuple, which `sum()` totals to 6. The `**kwargs` parameter collects `offset=10` into a dictionary, and `kwargs.get('offset', 0)` retrieves 10. Adding 6 and 10 returns 16.

201 Created is returned when a POST request results in a new resource being created on the server, typically accompanied by a Location header identifying its URI. Other 2xx codes, such as 200 OK, indicate success without confirming resource creation.

TCP is reliable and connection-oriented, suitable for reliable data transfer.

`kubectl describe pod my-pod` surfaces the pod's status conditions, container states and recent events, exposing scheduling failures, image pull errors or crash loops that stop it starting. This directly satisfies the troubleshooting constraint by revealing why the pod cannot launch, without requiring logs from a container that never ran.

This is correct because git stash saves the current working directory and index state, reverting the working directory to match the HEAD commit. It allows the developer to switch branches without committing unfinished work. Later, git stash pop or git stash apply can restore the changes. This command is specifically designed for temporarily shelving changes.

A VLAN interface (SVI) remains in a down state until the VLAN is active, which requires at least one physical port to be up and assigned to that VLAN, or the VLAN to be manually activated. Without an active port in VLAN 10, the SVI cannot come up. The engineer must assign an access port to VLAN 10 and ensure it is connected and up.

A for loop iterates directly over the hostnames list, binding each element to the loop variable in turn, which is the idiomatic structure for processing every item in a sequence. It satisfies the requirement to process each hostname without manual index management.

The Meraki Dashboard API authenticates each request by placing the API key in the X-Cisco-Meraki-API-Key request header. This satisfies the stem's requirement, since the key is passed as a custom HTTP header rather than a query string or bearer token.

The Webex messages endpoint accepts toPersonEmail to address a recipient directly by their email address. This satisfies the stem's requirement to send a message to a specific person identified by email, rather than by person ID or room ID.

10.0.0.0/8 falls within the RFC 1918 private address space, alongside 172.16.0.0/12 and 192.168.0.0/16. These ranges are non-routable on the public internet, satisfying the stem's requirement for a private IPv4 range. The /8 prefix covers 10.0.0.0 through 10.255.255.255.

DNA Center issues a token after authentication, and subsequent calls must present it as a Bearer credential in the Authorization header. This OAuth-style scheme lets the controller validate the caller's identity per request, satisfying the stem's requirement for the header included after successful token retrieval.

In REST, GET is defined as a safe and idempotent method. Safe means it does not alter server state, and idempotent means multiple identical requests have the same effect as a single one. This is why GET is used for retrieving data without side effects, and clients can cache or retry GET requests without concern for unintended changes.

emptyDir volumes are created when a pod is assigned to a node and exist for that pod's lifetime, shared by all containers within it. Because both containers mount the same emptyDir, they read and write the same filesystem, satisfying the requirement for intra-pod file sharing.

Ansible provides a native Cisco ACI module that interacts directly with the APIC REST API, letting the administrator declaratively push VLAN configuration across the fabric. It satisfies the automation requirement without bespoke scripting, unlike manual CLI or generic tools lacking ACI-aware modules.

REST treats everything as a resource, so URIs should name those resources with nouns (for example, /orders/42) rather than verbs or actions. The HTTP method then conveys the operation, keeping the interface uniform and predictable.

The GET method against /dna/intent/api/v1/network-device queries Cisco DNA Center's Intent API inventory collection, returning the full device list as JSON. This satisfies the stem's requirement to retrieve, rather than modify, network devices, since GET is the read-only HTTP verb mapped to that resource.

MAC addressing and frame delivery occur at the Data Link layer, which encapsulates packets into frames and uses hardware addresses to forward them between nodes on the same segment. Layer 2 therefore satisfies the stem's requirement for intra-segment delivery, unlike Layer 3's logical IP routing.

NETCONF uses SSH as its default transport, running over TCP port 830 to provide an encrypted, authenticated channel for configuration and state retrieval. TLS is optional rather than default, so SSH satisfies the stem's requirement.

Parameterised queries send SQL code and user-supplied values separately, so input is bound as data rather than parsed as executable SQL. This structurally prevents injection, unlike escaping or validation, which can be bypassed by crafted payloads.

Resource-based URLs expose each entity as a distinct addressable endpoint, so clients manipulate state through standard HTTP verbs rather than bespoke method names. This satisfies REST's uniform-interface constraint, letting the API scale statelessly and cache predictably across distributed callers.

The Authorization header with the Bearer scheme is the standard way to transmit a token for OAuth 2.0 and many REST APIs. It clearly indicates the token type and is widely supported. Using this header ensures the API can validate the token and grant access to the requested resource.

Chaining commands with && in a single RUN creates one layer and allows cleanup of temporary files in that same layer, reducing image size. Each RUN creates a new layer, so separate commands leave intermediate files. This is a best practice for minimizing layers and cache efficiency.

git rebase main replays the commits from the current feature branch on top of the latest main, resulting in a linear history without a merge commit. This is the standard way to incorporate upstream changes while keeping a clean, linear commit sequence. It rewrites the feature branch commits, which is acceptable for local branches that have not been shared.

Least privilege limits what an attacker can do with a stolen credential, even inside its validity window. If the identity can only push to one registry namespace or update one service, compromise does not yield broad access to other repositories or cloud resources, which is the core of reducing blast radius in this scenario.

`<edit-config>` is a standard NETCONF operation, defined in RFC 6241, that loads configuration data into a target datastore such as running or candidate. It satisfies the stem's requirement for valid NETCONF operations, unlike RESTCONF-specific verbs or SNMP primitives, making it one of the three correct choices.

Standard best practice to handle rate limiting.

192.168.1.128 falls within the 192.168.1.0/24 subnet range, satisfying the network constraint. Unlike the network address (192.168.1.0) or broadcast address (192.168.1.255), it is assignable to a host device. The /24 mask leaves 254 usable host addresses, and .128 sits comfortably inside that pool.

When the TCP handshake completes but the TLS handshake never begins, an inline device such as a firewall, proxy, or intrusion prevention system may be accepting the TCP connection on behalf of the server and then dropping or resetting it before TLS negotiation. This behavior is typical of a device performing TCP proxy or deep packet inspection without proper TLS passthrough.

Catalyst Center’s intent API is reached over HTTPS at a host-specific endpoint, so the base URL must combine the appliance’s hostname with its port, satisfying the stem’s requirement for a true statement about API structure. Requests target that address directly, making hostname and port integral rather than optional.

PATCH applies a partial modification to an existing resource, sending only the changed fields. It satisfies the constraint of updating a device's configuration partially, whereas PUT would replace the entire representation and require the full payload.

Basic Authentication encodes the administrator's credentials and posts them to /dna/system/api/v1/auth/token, which returns a time-limited token. Cisco DNA Center requires this token exchange before any other API call, satisfying the stem's constraint that a token must be obtained first.

Credentials embedded in source code can leak through version control, logs, or shared repositories. Reading them from environment variables or a secrets manager keeps them out of the codebase and supports rotation. This is a foundational secure coding practice for API automation.

The PUT replaces the target resource with the supplied payload, so the interface's existing IP address is overwritten by whatever the JSON body specifies. If the payload omits the address or matches the current 10.10.10.1/24 value, the configuration is effectively unchanged and the request returns a success status.

Environment variables are a common and secure way to inject secrets into applications at runtime. They are not stored in the codebase and can be managed by the operating system or container orchestration. This approach keeps credentials out of source control and allows different environments to use different values.

This is the URL capability for NETCONF.

Running tests before the push gate ensures only validated artefacts reach the registry. Building first produces the image under test; executing unit tests against it then permits the push stage to publish solely on success, preventing untested images from being distributed.

json.loads() deserialises a JSON-formatted string into a Python dictionary, satisfying the stem's requirement to parse an incoming REST API string. Its counterpart json.load() reads from a file object instead, so it would not work on the raw string the developer receives.

The response pinpoints a malformed JSON token at position 42, so the request body itself is invalid. A JSON validator parses the payload and reports the exact syntax fault, letting the developer correct it before resending the vManage call.

This implementation checks the input with isinstance against list and raises TypeError when the check fails, then builds the required dictionary with a comprehension. It satisfies both stated requirements: type validation that raises TypeError and a mapping of each interface name to its character length.

GET /v1/people/me returns the authenticated user's own profile, identified by the access token, so no user ID is needed. Other people endpoints require an explicit personId, making them unsuitable for retrieving the current user's information.

The `GET /dna/intent/api/v1/network-device` endpoint retrieves all network devices from Cisco DNA Center, satisfying the stem’s requirement to “retrieve a list” by using the HTTP GET method, which is idempotent and safe for read-only operations. This contrasts with POST, which would create a new resource, and DELETE, which would remove devices. The path’s `/network-device` resource collection directly maps to the requested data set.

201 Created confirms a new resource now exists at the URI returned in the Location header, satisfying the stem's requirement for successful creation. Unlike 200 OK, which merely reports general success, 201 explicitly signals that the POST persisted a new entity — the precise semantic REST expects after resource creation.

The Meraki Dashboard API returns HTTP 429 when a client exceeds the allowed call rate. A well-behaved client should inspect this status, read the Retry-After header when present, and pause before retrying. Handling 429 explicitly prevents the application from hammering the API and being throttled further.

unittest.mock is part of the Python standard library and provides a flexible framework for mocking objects and functions in unit tests. It allows patching requests.get with a mock object that returns a predefined response, eliminating network calls. The patch decorator or context manager can temporarily replace the function during the test. This is the standard approach for mocking in Python.

Parameterised queries send SQL code and user-supplied values to the database as separate constructs, so input is bound as data rather than parsed as executable SQL. This neutralises injection payloads by removing the mechanism attackers rely on, directly satisfying the requirement to prevent SQL injection within the application code.

A /26 mask leaves six host bits, giving 62 usable addresses, which satisfies the minimum of 50 hosts per subnet. A /27 would provide only 30 usable addresses, so 255.255.255.192 is the smallest mask that meets the requirement.

The Meraki Dashboard API authenticates requests with a custom header named X-Cisco-Meraki-API-Key whose value is the API key generated in the dashboard. Setting this header on every call is the documented method, and it works alongside the required Content-Type and Accept headers for JSON payloads.

This command executes netstat inside the running container and lists all TCP/UDP listening ports. Since the application may not be listening on the port declared in EXPOSE, checking the actual listening socket is the most direct way to identify a mismatch. It provides the ground truth needed to correct the port mapping or application configuration.

Offset pagination advances by the page size, so the next page begins after the 50 items already retrieved. Keeping limit=50 and setting offset=50 returns items 50-99, satisfying the stem's requirement to fetch the subsequent page without overlap or gaps.

When services are attached to the same user-defined bridge network in Docker Compose, Docker's embedded DNS server automatically resolves service names to their container IPs. This allows the web service to connect to 'db' by hostname without manual linking or IP management. It is the recommended and simplest approach for service discovery in Compose.

The none network mode attaches no network interface beyond loopback, so the container cannot reach other containers or external hosts. This delivers the strongest isolation, satisfying the requirement of connecting to no network at all.

Port 80 is the default port for HTTP (Hypertext Transfer Protocol) used for unencrypted web traffic. Web servers listen on port 80 for standard HTTP requests. Opening this port on the firewall allows clients to access web content over HTTP, matching the requirement.

Running merge with the feature branch checked out integrates the commits from main into the current branch and leaves the feature branch history intact. Conflicts are surfaced in the working tree for the developer to resolve and commit, and the pull request then reflects the merged state. This is the standard way to incorporate upstream changes before review.

HTTP 429 signals rate limiting, and the Retry-After header specifies how long to wait before retrying. Honouring that value respects the server's throttling window, satisfying the stem's requirement to handle the error appropriately rather than retrying immediately or abandoning the request.

CI/CD systems can securely inject tokens as environment variables without storing them in code.

The client credentials grant is intended for machine-to-machine communication where the client authenticates with its own client ID and secret, with no end user involved. The server script can POST its credentials to the token endpoint and receive an access token directly. This matches the unattended execution requirement and the authorization server's supported grant exactly.

The asterisk before the parameter name collects all positional arguments into a tuple named interfaces. This allows the function to accept any number of interface names, including zero, and directly returns them as a tuple when referenced. This matches the scenario's requirement for arbitrary positional arguments.

Webhooks push event data to your HTTPS endpoint the moment a message is created, satisfying the real-time notification requirement without polling. Subscribing to the 'messages' resource delivers the posted message payload directly, whereas periodic GET requests to the messages API would introduce latency and unnecessary API calls.

The southbound API connects the SDN controller downward to the physical and virtual network devices, carrying forwarding instructions such as OpenFlow flow-table entries. This directly satisfies the stem's separation of control and data planes, since the controller programmes devices through this interface.

Action cli command runs a command.

A connection timeout on port 22 means no TCP response arrived, indicating the router's IP is unreachable from the control node. SSH credential or key errors would surface as authentication failures, not timeouts, so reachability is the actual fault.