Courseiva

Cisco DevNet Associate 200-901 (200-901) — Questions 301–375

989 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 14

Page 6
301
MCQeasy

A developer needs to retrieve a list of all network devices from Cisco DNA Center. Which API endpoint and HTTP method should be used?

A.POST /dna/intent/api/v1/issues
B.POST /dna/system/api/v1/auth/token
C.GET /dna/intent/api/v1/network-device
D.GET /dna/intent/api/v1/topology/l2/{vlanID}
AnswerC

The `GET /dna/intent/api/v1/network-device` endpoint retrieves all network devices from Cisco DNA Center, satisfying the stem’s requirement to “retrieve a list” by using the HTTP GET method, which is idempotent and safe for read-only operations. This contrasts with POST, which would create a new resource, and DELETE, which would remove devices. The path’s `/network-device` resource collection directly maps to the requested data set.

Why this answer

The correct API to get the device list is GET /dna/intent/api/v1/network-device. Authentication is handled separately via POST /dna/system/api/v1/auth/token.

Full explanation →
302
MCQhard

A large enterprise uses Cisco Meraki for their wireless and switching infrastructure. The network team has developed a Python script that uses the Meraki API to automatically update SSID configurations across all networks. The script has been running successfully for months, performing daily updates to SSID settings such as names, passwords, and VLAN assignments. Recently, the script started failing with the following error message: '{"errors":["This operation is not allowed for this network"]}'. The team has verified the following: the API key is still valid and has access to the full organization, the network IDs used in the script are correct and the networks are active, and no changes have been made to the script code. The script uses the PUT endpoint '/networks/{networkId}/wireless/ssids/{number}' to update SSIDs. What is the most likely cause of the failure?

A.The Meraki API rate limit has been exceeded, and the request is being rejected.
B.The network(s) have been moved to a different organization in the Meraki dashboard.
C.The API key has been downgraded to read-only access due to a security compliance audit.
D.The SSID number used in the request does not exist on the target network.
AnswerB

When a network is moved to another organization, the original API key loses access, causing this error.

Why this answer

The error 'This operation is not allowed for this network' indicates that the API key's scope no longer includes the target network. Since the script uses the PUT endpoint to update SSID configurations, the most likely cause is that the network(s) have been moved to a different organization in the Meraki dashboard. The API key is tied to the original organization, and after the move, the key no longer has permission to modify the network, even though the network ID remains valid and the key itself is still active.

Exam trap

Cisco often tests the distinction between different HTTP error codes (e.g., 403 vs. 404 vs. 429) and their corresponding error messages, so the trap here is assuming that a valid network ID and API key guarantee access, without considering organizational ownership changes.

How to eliminate wrong answers

Option A is wrong because exceeding the Meraki API rate limit would return a 429 Too Many Requests error, not a 403 Forbidden with the message 'This operation is not allowed for this network'. Option C is wrong because if the API key had been downgraded to read-only access, the error would typically indicate insufficient permissions (e.g., 'Insufficient privileges') rather than a network-specific disallowance, and the team verified the key still has full organization access. Option D is wrong because if the SSID number did not exist, the API would return a 404 Not Found error, not a 403 Forbidden error about the operation not being allowed.

Full explanation →
303
MCQeasy

When designing a RESTful API for a network automation tool, which status code indicates that a resource has been created successfully?

A.204 No Content
B.200 OK
C.201 Created
D.202 Accepted
AnswerC

Correct. 201 Created is the standard HTTP status code for a successful creation of a resource.

Why this answer

(201 Created). According to HTTP semantics and RESTful API best practices, a successful POST request that creates a new resource should return the 201 Created status code. This indicates that the request has been fulfilled and a new resource has been created, often with a Location header pointing to the resource's URI. 204 No Content (option A) is used for successful requests that have no response body, such as DELETE or when an update returns no content, but not for creation.

Exam trap

Cisco often tests the distinction between 201 Created and 204 No Content. A common trap is to think that 204 No Content is appropriate for creation if the API returns no body, but the standard HTTP semantics require 201 for successful resource creation. 204 should be used for operations like DELETE that do not return a body.

How to eliminate wrong answers

Option B (200 OK) is wrong because it indicates a successful request with a response body, but it is not the standard status code for resource creation; it is typically used for read operations like GET. Option C (201 Created) is wrong because, while it is the standard HTTP status code for resource creation, the question specifies that the resource has been created successfully and the correct answer is 204 No Content, which implies the response intentionally omits a body (e.g., when the API returns no representation). Option D (202 Accepted) is wrong because it indicates the request has been accepted for processing but the processing has not been completed, which is used for asynchronous operations, not for immediate successful creation.

Full explanation →
304
MCQmedium

Refer to the exhibit. During a rolling update, a developer notices that the new pods are not passing the readiness probe and the update stalls. What is the most likely reason?

A.The rolling update strategy is configured incorrectly with maxUnavailable and maxSurge.
B.The readiness probe path /health is not implemented in the new image.
C.The image tag is incorrect.
D.The selector does not match the new pods' labels.
AnswerB

If the endpoint is missing, the probe fails and pods remain not ready.

Why this answer

The rolling update stalls because the new pods fail the readiness probe. The readiness probe is configured to check the /health endpoint, and if that endpoint is not implemented in the new image, the probe never returns a success status. Kubernetes will not route traffic to pods that fail the readiness probe, and the rolling update will not proceed to replace old pods until the new ones are ready.

Exam trap

Cisco often tests the distinction between readiness and liveness probes, and the trap here is that candidates may confuse a readiness probe failure with a liveness probe failure or assume the issue is with the rolling update strategy configuration rather than the application endpoint not being implemented.

How to eliminate wrong answers

Option A is wrong because maxUnavailable and maxSurge control the speed and number of pods updated, but they do not cause a stall due to probe failure; they would only affect how many pods are updated at once. Option C is wrong because an incorrect image tag would cause an ImagePullBackOff or ErrImagePull, not a readiness probe failure; the pod would never reach the running state. Option D is wrong because if the selector did not match the new pods' labels, the new pods would not be part of the ReplicaSet or Service, and the update would not even create them under the same selector; the issue is specifically with the readiness check, not label matching.

Full explanation →
305
MCQmedium

A web application is vulnerable to SQL injection. Which secure coding practice should the developer implement in the code to prevent this?

A.Use parameterised queries for database access.
B.Escape all user input with htmlspecialchars.
C.Use a CAPTCHA on the login form.
AnswerA

Parameterised queries separate SQL logic from data, preventing injection.

Why this answer

Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

Full explanation →
306
MCQhard

A network engineer is subnetting the network 192.168.1.0/24 into subnets that each support at least 50 hosts. What subnet mask should be used?

A.255.255.255.192 (/26)
B.255.255.255.224 (/27)
C.255.255.255.240 (/28)
D.255.255.255.128 (/25)
AnswerA

/26 provides 62 hosts, meeting the requirement.

Why this answer

To support at least 50 hosts, you need 6 host bits (2^6 - 2 = 62 usable addresses). A /26 subnet mask (255.255.255.192) provides exactly 6 host bits, meeting the requirement. The original /24 network is borrowed with 2 subnet bits, yielding 4 subnets of 64 addresses each.

Exam trap

Cisco often tests the distinction between the number of host bits needed versus the number of subnet bits, and the trap here is that candidates may choose /25 because it supports more hosts, overlooking that /26 is the minimum mask that meets the 50-host requirement and is the correct answer per the question's wording.

How to eliminate wrong answers

Option B (255.255.255.224, /27) is wrong because it provides only 5 host bits (2^5 - 2 = 30 usable addresses), which is insufficient for 50 hosts. Option C (255.255.255.240, /28) is wrong because it provides only 4 host bits (2^4 - 2 = 14 usable addresses), far below the requirement. Option D (255.255.255.128, /25) is wrong because although it provides 7 host bits (126 usable addresses), it uses only 1 subnet bit, creating only 2 subnets; the question asks for subnets that each support at least 50 hosts, and while /25 meets the host count, it is not the most efficient choice and the correct answer is the smallest mask that satisfies the host requirement, which is /26.

Full explanation →
307
Multi-Selecthard

Which THREE of the following are best practices for writing Ansible playbooks for network automation? (Select exactly 3.)

Select 3 answers
A.Run all tasks without checking for errors
B.Include a validation task after configuration changes
C.Use variables for device-specific parameters
D.Hardcode device IPs in the playbook
E.Use the 'changed_when' condition to ensure idempotency
AnswersB, C, E

Ensures the change took effect.

Why this answer

After applying configuration changes via modules like `ios_config` or `junos_config`, a validation task (e.g., using `wait_for` or `assert` to verify operational state) ensures the device is reachable and the changes took effect before proceeding. This prevents cascading failures in multi-device playbooks and aligns with network automation best practices for reliability.

Exam trap

Cisco often tests the misconception that ignoring errors (Option A) speeds up automation, but the trap is that network devices require strict error handling to avoid partial configs or unreachable states, making error-checking a mandatory best practice.

Full explanation →
308
MCQhard

An application running in a Kubernetes pod needs to access an external database securely. The database credentials are rotated every 24 hours. Which approach ensures that the pod always uses the current credentials without manual intervention?

A.Embed a token in the application code that refreshes automatically.
B.Use a Secrets Store CSI driver to mount secrets from an external vault as a volume.
C.Store credentials in a Kubernetes Secret and mount as volume; restart pod daily.
D.Use a sidecar container that watches a vault and updates the application config.
AnswerB

Dynamically updates secrets without pod restart.

Why this answer

A Secrets Store CSI driver can dynamically mount secrets from an external vault as a volume, and the application can read the updated secret from the volume without restarting the pod, handling credential rotation seamlessly. Option A is incorrect because embedding a token in code is insecure and not automatically refreshed. Option C is incorrect because restarting the pod daily is disruptive and may cause downtime.

Option D is incorrect because a sidecar container that watches a vault and updates config is less integrated and not a native Kubernetes approach compared to the CSI driver.

Full explanation →
309
MCQmedium

A REST API uses offset and limit parameters for pagination. If the first request returns items 0-49 with limit=50 and offset=0, how should the next request be constructed to get the next page?

A.offset=1, limit=50
B.offset=50, limit=50
C.offset=50, limit=100
D.offset=0, limit=100
AnswerB

Correct: skip first 50 items.

Why this answer

Pagination with offset and limit works by advancing the offset by the limit value to fetch the next set of items. The first request returned items 0-49 (offset=0, limit=50), so the next request should start at offset=50 with the same limit=50 to retrieve items 50-99. This ensures no overlap and no gaps in the data.

Exam trap

The trap here is that candidates mistakenly think offset should be incremented by 1 (like a page number) rather than by the limit value, leading them to choose offset=1 instead of offset=50.

How to eliminate wrong answers

Option A is wrong because offset=1 would skip item 0 and start at item 1, causing a gap and missing item 0 from the second page. Option C is wrong because offset=50 with limit=100 would retrieve items 50-149, which is not the correct next page size (should be 50 items) and could exceed the intended page size. Option D is wrong because offset=0 with limit=100 would retrieve items 0-99, which includes the already-fetched first page and changes the page size, leading to duplicate data.

Full explanation →
310
MCQeasy

Which Docker networking mode provides the most isolation by not connecting the container to any network?

A.overlay
B.bridge
C.none
D.host
AnswerC

Correct. none disables all networking.

Why this answer

The `none` networking mode in Docker creates a container with no network interfaces except the loopback device, providing the highest level of network isolation. This means the container cannot send or receive any external traffic, making it ideal for security-sensitive workloads that require complete network disconnection.

Exam trap

Cisco often tests the misconception that 'none' means no network at all (including loopback), but the container still has a loopback interface; the trap is that candidates confuse 'none' with 'host' or assume bridge provides stronger isolation than it actually does.

How to eliminate wrong answers

Option A is wrong because the overlay network mode creates a distributed network across multiple Docker hosts, enabling container-to-container communication across nodes, which does not provide isolation from external networks. Option B is wrong because the bridge network mode (default) connects containers to a private internal network and provides NAT-based outbound connectivity, allowing external traffic through port mapping. Option D is wrong because the host network mode removes network isolation entirely by sharing the host's network stack, giving the container direct access to all host network interfaces.

Full explanation →
311
MCQhard

A Python script uses a try/except block to handle API errors. If the API returns a 429 status code, which mechanism should the script implement to handle the error appropriately?

A.Switch to a different API endpoint
B.Wait for the time specified in the Retry-After header and then retry
C.Log the error and continue without retrying
D.Immediately retry the same request without delay
AnswerB

Respecting the Retry-After header is the proper way to handle rate limiting.

Why this answer

A 429 status code indicates the client has sent too many requests in a given amount of time (rate limiting). The HTTP specification (RFC 6585) recommends including a Retry-After header in the response, which tells the client how long to wait before retrying. Implementing a wait based on this header and then retrying is the correct and respectful way to handle rate limiting, allowing the script to eventually succeed without overwhelming the server.

Exam trap

Cisco often tests the distinction between handling transient errors (like 429) versus permanent errors (like 404 or 500), and the trap here is that candidates may choose to immediately retry (D) or log and continue (C) without understanding that 429 specifically requires a delay before retry.

How to eliminate wrong answers

Option A is wrong because switching to a different API endpoint does not address the rate limit on the current endpoint; the client is still rate-limited and the new endpoint may also be affected or require separate authentication. Option C is wrong because logging the error and continuing without retrying means the script abandons the operation entirely, which is not appropriate when the error is transient and can be resolved by waiting. Option D is wrong because immediately retrying the same request without delay will almost certainly result in another 429 error, as the rate limit has not yet expired, and may worsen the situation by further exhausting the rate limit window.

Full explanation →
312
Multi-Selecteasy

Which TWO of the following are best practices for securely managing API tokens in a CI/CD pipeline?

Select 2 answers
A.Store tokens as plain text in the source code repository for easy access.
B.Hardcode tokens into the Docker image during build.
C.Use environment variables injected by the CI/CD system (e.g., Jenkins secrets).
D.Encrypt tokens with a static key stored in the repository.
E.Use a secrets management service like HashiCorp Vault to retrieve tokens at runtime.
AnswersC, E

CI/CD systems can securely inject tokens as environment variables without storing them in code.

Why this answer

CI/CD systems like Jenkins provide built-in secret management features (e.g., Jenkins Credentials Binding plugin) that inject API tokens as environment variables at runtime, keeping them out of source code and build artifacts. This approach ensures tokens are never stored in plain text or committed to version control, aligning with the principle of least privilege and secure pipeline design.

Exam trap

Cisco often tests the misconception that encrypting secrets with a key stored in the same repository is secure, but the trap here is that encryption without separate key management is equivalent to obfuscation—attackers with repo access can decrypt the token using the stored key.

Full explanation →
313
MCQmedium

An application needs to receive real-time notifications when a new message is posted in a Webex space. Which Webex API feature should be used?

A.Establish a WebSocket connection to the Webex API
B.Create a webhook that triggers on 'messages' events
C.Use Server-Sent Events (SSE) from the Webex API
D.Poll the messages endpoint every second
AnswerB

Webhooks provide real-time event notifications.

Why this answer

Webex uses webhooks to push real-time event notifications to an external server. By creating a webhook that triggers on 'messages' events, the application receives an HTTP POST request whenever a new message is posted in the specified space, eliminating the need for polling or persistent connections.

Exam trap

Cisco often tests the distinction between push-based (webhooks) and pull-based (polling) mechanisms, and candidates may mistakenly assume WebSocket or SSE are available because they are common real-time technologies, but Webex specifically relies on webhooks for event-driven notifications.

How to eliminate wrong answers

Option A is wrong because Webex does not expose a WebSocket endpoint for real-time messaging events; webhooks are the standard mechanism. Option C is wrong because Webex does not support Server-Sent Events (SSE) for message notifications; SSE is not part of the Webex API. Option D is wrong because polling the messages endpoint every second is inefficient, introduces latency, and violates API rate limits; webhooks provide immediate, push-based notifications without active polling.

Full explanation →
314
MCQhard

In Software-Defined Networking (SDN), the control plane is separated from the data plane. Which of the following best describes the function of the southbound API?

A.Interface between applications and the controller
B.Interface between the controller and network devices
C.Communication between two controllers
D.Interface between the control plane and management plane
AnswerB

Southbound API (e.g., OpenFlow) allows the controller to configure devices.

Why this answer

Southbound API is used by the SDN controller to communicate with network devices (e.g., switches, routers) to enforce forwarding rules.

Full explanation →
315
Multi-Selecthard

Which three actions can an EEM applet perform when triggered? (Choose three.)

Select 3 answers
A.Modify a YANG data model
B.Execute a CLI command
C.Send a syslog message
D.Set a variable
E.Create a new VLAN
AnswersB, C, D

Action cli command runs a command.

Why this answer

EEM (Embedded Event Manager) applets can execute CLI commands when triggered by an event. This allows automation of operational tasks such as configuration changes or troubleshooting commands without manual intervention.

Exam trap

Cisco often tests the distinction between EEM's built-in actions and actions that require a CLI command to achieve, such as creating a VLAN, which is not a direct EEM action but must be done via a CLI command.

Full explanation →
316
MCQeasy

A network engineer runs an Ansible playbook to backup a Cisco router configuration. The playbook fails with the error: 'ssh: connect to host 192.168.1.1 port 22: Connection timed out'. What is the most likely cause?

A.The router's IP address is unreachable from the control node.
B.The playbook uses the incorrect gather_facts setting.
C.The SSH key is not authorized on the router.
D.The router does not have SSH enabled.
AnswerA

A connection timeout typically means the host is not reachable, often due to network issues or incorrect IP.

Why this answer

The error 'Connection timed out' indicates that the control node sent a TCP SYN to 192.168.1.1 on port 22 but never received a SYN-ACK response. This occurs when the destination IP is unreachable due to routing issues, a firewall dropping packets, or the host being offline. Since Ansible uses SSH to connect to network devices, a timeout at the transport layer points directly to network reachability problems, not authentication or service configuration.

Exam trap

Cisco often tests the distinction between 'Connection timed out' (network unreachable) and 'Connection refused' (service not listening) to trap candidates who confuse SSH service availability with network connectivity.

How to eliminate wrong answers

Option B is wrong because the gather_facts setting controls whether Ansible collects system information before running tasks; it does not affect TCP connectivity or SSH transport. Option C is wrong because an unauthorized SSH key would produce a 'Permission denied' error, not a connection timeout. Option D is wrong because if SSH were not enabled on the router, the control node would receive a 'Connection refused' (RST) response, not a timeout.

Full explanation →
317
MCQhard

In the OSI model, which layer is responsible for session management, including establishing, maintaining, and terminating connections between applications?

A.Layer 4 (Transport)
B.Layer 7 (Application)
C.Layer 5 (Session)
D.Layer 6 (Presentation)
AnswerC

Session layer manages dialog control and session establishment.

Why this answer

The Session layer (Layer 5) manages sessions between applications. The Transport layer handles end-to-end communication.

Full explanation →
318
MCQhard

A microservice application uses JWT for authentication. The JWT is signed with RS256. Which practice ensures that the public key used for verification is securely distributed to all services?

A.Include the public key in the JWT header.
B.Embed the public key in each service's source code.
C.Use a public key infrastructure (PKI) and distribute via HTTPS.
D.Store the public key in a Kubernetes ConfigMap and mount it into pods.
AnswerD

Standard method for distributing configuration in Kubernetes.

Why this answer

Kubernetes ConfigMaps allow you to decouple configuration artifacts like public keys from container images, enabling secure, centralized distribution. Mounting the ConfigMap into pods ensures that all microservice instances can access the same public key without embedding it in source code or relying on external PKI for every verification. This approach aligns with cloud-native best practices for managing secrets and configuration in a microservice architecture.

Exam trap

Cisco often tests the misconception that PKI is always required for secure key distribution, but in a microservice environment with a static public key, a simpler configuration management approach (like Kubernetes ConfigMaps) is more practical and aligns with DevOps principles.

How to eliminate wrong answers

Option A is wrong because including the public key in the JWT header (e.g., in the 'jwk' header parameter) would allow an attacker to replace the key and forge tokens, defeating the purpose of signature verification. Option B is wrong because embedding the public key in each service's source code creates a maintenance nightmare, requires redeployment to update the key, and violates the principle of separating configuration from code. Option C is wrong because while PKI and HTTPS distribution are secure, they introduce unnecessary complexity for a static public key; in a microservice environment, the key is typically long-lived and can be distributed more simply via a shared configuration mechanism like ConfigMaps, without the overhead of certificate authorities and revocation checks.

Full explanation →
319
MCQmedium

A developer has created a Webex Teams bot that listens for messages in a specific room and responds with information from an external database. The bot uses the Webex API's 'messages.create' method to post replies. During testing, the bot sometimes fails to respond, but no errors are logged. The developer checks the Webex Developer Portal and sees that the bot's rate limit is set to 10 requests per second. The bot's average load is 5 requests per second, but occasionally spikes to 15 requests per second for a few seconds. The developer wants to ensure the bot functions reliably without exceeding rate limits. Which approach should the developer implement?

A.Implement a request queue that limits outgoing requests to 10 per second and uses exponential backoff on failure.
B.Request a higher rate limit from the Webex API support team.
C.Catch HTTP 429 (Too Many Requests) errors and immediately retry the request.
D.Reduce the bot's overall request rate to 5 per second to stay well within the limit.
AnswerA

This ensures steady request rate and handles errors gracefully.

Why this answer

Implementing a request queue that limits outgoing requests to 10 per second and uses exponential backoff on failure ensures the bot respects the Webex API rate limit of 10 requests per second. The queue smooths out spikes (e.g., 15 req/s) by buffering excess requests, while exponential backoff handles any HTTP 429 responses gracefully by retrying after increasing delays, preventing further rate limit violations. This approach directly addresses the bot's intermittent failure without relying on external support or sacrificing functionality.

Exam trap

Cisco often tests the misconception that simply catching HTTP 429 errors and retrying immediately is sufficient, when in fact exponential backoff is required to avoid compounding the rate limit violation.

How to eliminate wrong answers

Option B is wrong because requesting a higher rate limit from the Webex API support team is not a standard practice for Webex Teams bots; rate limits are fixed per application and cannot be arbitrarily increased, and the developer should first optimize their bot's behavior rather than seeking a limit change. Option C is wrong because catching HTTP 429 errors and immediately retrying the request would likely trigger another 429 response, as the rate limit is still exceeded; proper handling requires a delay (e.g., via exponential backoff) before retrying. Option D is wrong because reducing the bot's overall request rate to 5 per second is an overreaction that unnecessarily limits the bot's throughput and does not address the occasional spikes to 15 req/s, which could still cause failures if not managed with queuing or backoff.

Full explanation →
320
MCQeasy

A developer needs to securely store API keys for use in a CI/CD pipeline. Which best practice should be followed?

A.Share the keys via email to the team.
B.Hardcode the keys in the source code.
C.Use built-in pipeline secrets or environment variables.
D.Store the keys in a JSON file committed to the repository.
AnswerC

Pipeline secrets are encrypted and not exposed in logs, providing secure storage.

Why this answer

CI/CD platforms (e.g., Jenkins, GitLab CI, GitHub Actions) provide built-in mechanisms to store secrets as encrypted environment variables or pipeline secrets. These values are masked in logs and never exposed in source code, ensuring API keys remain confidential throughout the pipeline execution.

Exam trap

Cisco often tests the misconception that storing secrets in a separate configuration file (like a JSON or .env file) is acceptable as long as it is not committed, but the trap is that any file-based storage in the repository—even if ignored—risks accidental exposure, whereas pipeline secrets are designed specifically for secure injection without file persistence.

How to eliminate wrong answers

Option A is wrong because sharing keys via email exposes them in transit and at rest in mail servers, violating security best practices and potentially leading to unauthorized access. Option B is wrong because hardcoding keys in source code embeds them in version control history, making them accessible to anyone with repository access and violating the principle of not storing secrets in code. Option D is wrong because committing a JSON file with keys to the repository stores secrets in plaintext in version control, which can be easily read by anyone with access to the repository history.

Full explanation →
321
MCQeasy

Which HTTP method is considered both safe and idempotent?

A.POST
B.PUT
C.PATCH
D.GET
E.DELETE
AnswerD

Correct: GET is safe and idempotent.

Why this answer

GET is both safe and idempotent according to HTTP semantics (RFC 7231). Safe means it must not cause side effects on the server, and idempotent means multiple identical requests produce the same result as a single request. GET is designed solely for retrieval of a resource, so it satisfies both properties.

Exam trap

Cisco often tests the distinction between 'safe' and 'idempotent' as separate properties, trapping candidates who assume that idempotent methods like PUT or DELETE are also safe, or that PATCH is idempotent because it modifies a resource.

How to eliminate wrong answers

Option A is wrong because POST is neither safe nor idempotent; it creates or modifies resources and repeated submissions can create multiple resources or different side effects. Option B is wrong because PUT is idempotent but not safe; it modifies or replaces a resource at a specific URI, which is a side effect. Option C is wrong because PATCH is neither safe nor idempotent; it applies partial modifications, and repeated requests can have different outcomes depending on the current state of the resource.

Option E is wrong because DELETE is idempotent but not safe; it removes a resource, which is a side effect.

Full explanation →
322
Multi-Selecteasy

Which TWO of the following are characteristics of the YANG data modeling language that make it suitable for network automation? (Select two)

Select 2 answers
A.YANG defines data types and constraints
B.YANG is human-readable only
C.YANG is a markup language like XML
D.YANG supports both configuration and operational state data
E.YANG can be used with NETCONF and RESTCONF
AnswersA, E

YANG provides a type system and constraints to ensure data validity.

Why this answer

YANG is a data modeling language that defines the structure, syntax, and semantics of configuration and state data, including explicit data types (e.g., string, uint32) and constraints (e.g., range, pattern, mandatory). This strict typing and validation ensure that network devices receive well-formed data, reducing errors in automation workflows.

Exam trap

Cisco often tests the distinction between a data modeling language (YANG) and a serialization format (XML/JSON), so candidates mistakenly select 'YANG is a markup language like XML' because they associate YANG with XML-based NETCONF messages.

Full explanation →
323
MCQeasy

In a Postman collection, a developer stores the base URL of a Meraki API as a variable. Which Postman feature allows this?

A.Tests
B.Environments
C.Pre-request Scripts
D.Collections
AnswerB

Environments store key-value pairs.

Why this answer

Environments allow defining variables like base_url that can be reused across requests.

Full explanation →
324
MCQeasy

A developer is building a dashboard that displays the health status of network devices managed by Cisco ACI. The developer uses the ACI REST API to query the APIC (Application Policy Infrastructure Controller). The developer sends a GET request to https://apic-ip/api/class/fabricHealthInst.json returns a JSON object with health scores. The dashboard works for a small set of devices, but when scaled to 500 devices, the API responses become slower and sometimes time out. The developer needs to optimize the data retrieval to keep the dashboard responsive. Which approach should the developer use?

A.Break the request into multiple smaller requests, each fetching a subset of devices.
B.Add a query parameter to sort the results by health score to reduce processing time.
C.Switch from JavaScript to Python for the backend to handle larger responses more efficiently.
D.Use the ACI event subscription mechanism to receive health updates only when changes occur.
AnswerD

Subscriptions push updates, reducing the need for frequent polling.

Why this answer

The ACI REST API supports an event subscription mechanism (e.g., WebSocket-based subscriptions) that pushes updates only when the health score of a device changes, rather than requiring the dashboard to poll the APIC repeatedly. This drastically reduces network overhead and server load, especially when scaling to 500 devices, as it eliminates the need for frequent full GET requests to /api/class/fabricHealthInst.json.

Exam trap

Cisco often tests the distinction between polling (synchronous GET requests) and event-driven subscriptions (asynchronous push) to evaluate understanding of API optimization patterns, and the trap here is that candidates mistakenly think breaking requests into smaller chunks or changing languages will solve scalability issues, when the real solution is to avoid unnecessary data retrieval altogether.

How to eliminate wrong answers

Option A is wrong because breaking a single request into multiple smaller requests increases the total number of HTTP transactions and overhead, which can exacerbate latency and timeout issues rather than solving them. Option B is wrong because sorting results by health score does not reduce the processing time for the APIC; the server still must fetch and process all records before sorting, and the bottleneck is typically in data retrieval and response size, not ordering. Option C is wrong because switching from JavaScript to Python does not address the root cause of slow API responses; the performance issue is due to polling frequency and response size, not the programming language used for the backend.

Full explanation →
325
MCQhard

Refer to the exhibit. What is the most effective action to eliminate both vulnerabilities in the container image?

A.Rebuild the image using the same base image but update the OS packages.
B.Add a .dockerignore file to exclude vulnerable libraries.
C.Only run the container with read-only root filesystem.
D.Switch the base image to a distroless base image that does not include openssl and curl.
AnswerD

Removes these libraries entirely, as they are not needed by the application.

Why this answer

Switching to a distroless base image removes unnecessary packages like openssl and curl entirely, eliminating the vulnerabilities they introduce. Distroless images contain only the application and its runtime dependencies, reducing the attack surface by excluding OS package managers and shell utilities that are common sources of CVEs. This approach directly addresses both vulnerabilities by ensuring the vulnerable components are not present in the image at all.

Exam trap

Cisco often tests the misconception that updating packages (Option A) is sufficient, when the real goal is to eliminate the vulnerable components entirely, not just patch them.

How to eliminate wrong answers

Option A is wrong because rebuilding with the same base image and updating OS packages only patches known vulnerabilities but does not remove the packages themselves; future vulnerabilities in those packages would still require updates, and the attack surface remains. Option B is wrong because a .dockerignore file controls which files are sent to the Docker build context, not which packages are installed in the image; it cannot exclude pre-installed libraries like openssl or curl from the base image. Option C is wrong because running the container with a read-only root filesystem prevents writes at runtime but does not remove the vulnerable binaries from the image; an attacker could still exploit the vulnerable openssl or curl processes if they are executed.

Full explanation →
326
MCQeasy

In the Ansible playbook snippet, what connection method is typically used for the ios_config module to communicate with the devices?

A.local
B.network_cli
C.netconf
D.httpapi
AnswerB

The ios_config module requires the network_cli connection to send CLI commands over SSH.

Why this answer

The ios_config module is designed for Cisco IOS devices and requires a persistent network connection to send configuration commands. The network_cli connection method establishes an SSH session that remains open for the duration of the playbook task, allowing the module to send multiple CLI commands and handle prompts. This is the recommended connection method for ios_config because it supports privilege escalation and command responses needed for configuration changes.

Exam trap

Cisco often tests the distinction between connection methods by making candidates think 'local' is correct because it runs on the control node, but the trap is that ios_config requires a persistent SSH session to the device, which only network_cli provides.

How to eliminate wrong answers

Option A is wrong because 'local' connection runs the module on the control node without opening a persistent SSH session to the device, which prevents ios_config from properly handling interactive prompts and privilege escalation. Option C is wrong because 'netconf' uses XML-based NETCONF protocol over SSH, which is not supported by the ios_config module (it is used with the ios_netconf module instead). Option D is wrong because 'httpapi' uses RESTCONF or other HTTP-based APIs, which are not applicable to the CLI-based ios_config module.

Full explanation →
327
MCQhard

A Kubernetes cluster runs a microservice that needs to read configuration values from a ConfigMap and sensitive database credentials from a Secret. The pod manifest references both resources. How should the Secret be mounted to avoid exposing sensitive data in logs or environment variables?

A.Hardcoding the credentials in the ConfigMap
B.Using a sidecar container to fetch secrets via API
C.Using envFrom with secretRef
D.Using a volume mount with a secret volume
AnswerD

Correct. Mounting as files avoids exposing values in environment.

Why this answer

Mounting a Secret as a volume stores the data in the tmpfs (RAM-backed filesystem) of the pod, which is not written to disk and is not exposed via environment variables that could be logged or printed by the application. This approach prevents accidental leakage of sensitive data through log outputs or environment variable dumps, as the application must explicitly read the file from the mount point.

Exam trap

Cisco often tests the distinction between environment variable injection and volume mounts for Secrets, trapping candidates who assume envFrom is secure because it avoids file I/O, when in fact it exposes secrets to logging and debugging tools.

How to eliminate wrong answers

Option A is wrong because hardcoding credentials in a ConfigMap defeats the purpose of using Secrets, as ConfigMap data is stored in plaintext and can be easily exposed through logs or API access. Option B is wrong because using a sidecar container to fetch secrets via the Kubernetes API introduces unnecessary complexity and still requires the sidecar to handle the secret data, potentially exposing it in logs or environment variables if not carefully managed. Option C is wrong because using envFrom with secretRef injects secret values as environment variables, which are often logged by applications or debugging tools (e.g., 'env' command) and can be exposed in error messages or process listings.

Full explanation →
328
MCQhard

A developer has a Docker container running a database. They need to inspect the database logs to debug a connection issue. Which command will show the logs in real-time?

A.docker exec my-db tail -f /var/log/mysql
B.docker logs --tail 100 my-db
C.docker logs my-db
D.docker logs -f my-db
AnswerD

Follow mode shows logs in real-time.

Why this answer

The `docker logs -f` command attaches to the container's stdout/stderr streams and follows new output in real-time, which is exactly what is needed to debug a live connection issue. The `-f` flag (short for `--follow`) continuously prints log lines as they are written, allowing the developer to observe database connection attempts and errors as they occur.

Exam trap

Cisco often tests the distinction between `docker exec` (for running commands inside a container) and `docker logs` (for retrieving container output streams), and the trap here is that candidates may mistakenly think they need to exec into the container and use a Linux command like `tail -f` instead of using the native Docker log-following feature.

How to eliminate wrong answers

Option A is wrong because `docker exec` runs a command inside the container, but it does not access the container's log stream; it would require the database to be configured to write logs to a file at that path, and it does not provide the real-time follow behavior of `docker logs -f`. Option B is wrong because `docker logs --tail 100 my-db` shows only the last 100 lines of the log and then exits; it does not follow new log entries in real-time. Option C is wrong because `docker logs my-db` dumps the entire current log buffer to stdout and exits, providing no real-time monitoring capability.

Full explanation →
329
MCQeasy

A developer wants to receive real-time notifications when a new message is posted in a Webex room. Which Webex API resource should they use?

A.Webhooks
B.Memberships API
C.Rooms API
D.Messages API polling
AnswerA

Webhooks provide event-driven notifications for Webex events.

Why this answer

Webhooks provide real-time HTTP callbacks triggered by events in Webex, such as a new message being posted. By registering a webhook on the 'messages' resource with the 'created' event, the developer's server receives a POST request immediately when a message is sent, eliminating the need for polling.

Exam trap

Cisco often tests the distinction between synchronous polling (Messages API) and asynchronous event-driven notifications (Webhooks), trapping candidates who assume polling is acceptable for real-time requirements.

How to eliminate wrong answers

Option B (Memberships API) is wrong because it manages room membership (add/remove/list members) and does not expose message events. Option C (Rooms API) is wrong because it handles room creation, listing, and updates, not real-time message notifications. Option D (Messages API polling) is wrong because polling requires repeated GET requests to check for new messages, which is inefficient and not real-time; Webex explicitly recommends webhooks over polling for event-driven notifications.

Full explanation →
330
MCQhard

A network engineer is configuring EtherChannel between two switches. The switches are connected via four links. The engineer wants to load balance traffic based on source and destination IP addresses. Which configuration command should be used on Cisco IOS?

A.port-channel load-balance src-ip
B.port-channel load-balance dst-ip
C.port-channel load-balance src-dst-mac
D.port-channel load-balance src-dst-ip
AnswerD

Uses both source and destination IP.

Why this answer

The command 'port-channel load-balance src-dst-ip' configures EtherChannel to use both the source and destination IP addresses in the hash algorithm, which is exactly what the engineer needs for load balancing based on source and destination IP addresses. This ensures traffic distribution across the four links by computing a hash on the combination of source and destination IPs, providing a balanced distribution for IP traffic.

Exam trap

The trap here is that candidates often confuse the EtherChannel load-balance keywords, mistakenly selecting 'src-dst-mac' (Layer 2) when the question specifies IP addresses, or picking a single-address option like 'src-ip' or 'dst-ip' instead of the combined 'src-dst-ip' that matches the requirement for both source and destination.

How to eliminate wrong answers

Option A is wrong because 'port-channel load-balance src-ip' only uses the source IP address in the hash, ignoring the destination IP, which would not meet the requirement of load balancing based on both source and destination IP addresses. Option B is wrong because 'port-channel load-balance dst-ip' only uses the destination IP address, similarly failing to consider both source and destination IPs. Option C is wrong because 'port-channel load-balance src-dst-mac' uses source and destination MAC addresses instead of IP addresses, which is used for Layer 2 load balancing and does not satisfy the requirement for IP-based load balancing.

Full explanation →
331
MCQhard

A developer is using the Meraki Dashboard API to retrieve a list of clients for a network. The API returns a 429 error. What should the developer do to handle this correctly?

A.Ignore the error and continue, as 429 is a temporary issue.
B.Wait for the number of seconds specified in the Retry-After header before retrying.
C.Switch to a different base URL to bypass the limit.
D.Increase the request rate by using multiple API keys in parallel.
AnswerB

The Retry-After header indicates how long to wait.

Why this answer

A 429 HTTP status code indicates 'Too Many Requests,' meaning the client has exceeded the rate limit imposed by the Meraki Dashboard API. The correct handling is to respect the Retry-After header, which specifies the number of seconds the client must wait before retrying the request, as per RFC 7231 Section 7.1.3. This ensures compliance with API rate limits and prevents further throttling or temporary blocking.

Exam trap

Cisco often tests the misconception that 429 is a transient error like a 503 Service Unavailable, leading candidates to think they can simply retry immediately or ignore it, rather than understanding that 429 specifically requires honoring the Retry-After header for rate-limit compliance.

How to eliminate wrong answers

Option A is wrong because ignoring a 429 error and continuing will likely result in continued failures or a temporary ban, as the API enforces rate limits to protect server resources. Option C is wrong because switching to a different base URL does not bypass rate limits; rate limits are applied per API key or client, not per URL endpoint. Option D is wrong because increasing the request rate with multiple API keys in parallel would exacerbate the rate-limit violation, and using multiple keys without coordination may still trigger per-key limits or violate the API's terms of service.

Full explanation →
332
MCQmedium

A company uses a blue/green deployment strategy for their web application. The current live version is blue, and a new version green is ready. The load balancer currently routes all traffic to blue. What is the correct next step to switch traffic to green with minimal downtime?

A.Scale down blue pods and scale up green
B.Perform a rolling update from blue to green
C.Delete the blue deployment and create green
D.Update the load balancer to route all traffic to green
AnswerD

This switches traffic instantly with minimal downtime.

Why this answer

In a blue/green deployment, the entire new version (green) is deployed alongside the current live version (blue). The correct next step to switch traffic with minimal downtime is to update the load balancer to route all traffic to green. This instant switch avoids the incremental risk of rolling updates and ensures a clean cutover that can be quickly reverted if issues arise.

Exam trap

Cisco often tests the distinction between deployment strategies, and the trap here is confusing a rolling update (which gradually replaces pods) with a blue/green deployment (which switches traffic at the load balancer level), leading candidates to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because scaling down blue and scaling up green is a manual, non-atomic process that does not leverage the load balancer's routing capability, potentially causing partial traffic loss or mixed-version serving. Option B is wrong because a rolling update gradually replaces blue pods with green pods, which contradicts the blue/green strategy's goal of maintaining two fully separate environments for instant rollback. Option C is wrong because deleting the blue deployment before creating green would cause downtime, as there is no live environment to serve traffic during the deletion and creation process.

Full explanation →
333
Multi-Selectmedium

Which THREE are valid ways to expose ConfigMap data to a pod in Kubernetes?

Select 3 answers
A.As a Kubernetes Secret
B.As environment variables
C.As a container image label
D.As a volume mounted file
E.As a command-line argument
AnswersB, D, E

You can use envFrom or valueFrom to expose as env vars.

Why this answer

Kubernetes allows ConfigMap data to be exposed as environment variables inside a pod using the `env` or `envFrom` field in the pod spec. This is a common method for injecting configuration into containers without modifying the container image.

Exam trap

Cisco often tests the distinction between ConfigMaps and Secrets, and the trap here is that candidates may confuse the purpose of Secrets (sensitive data) with ConfigMaps (non-sensitive data), or incorrectly assume that container image labels can be dynamically injected from runtime objects.

Full explanation →
334
MCQhard

In Cisco DNA Center, which API category includes the ability to deploy a configuration template to devices?

A.Change your network
B.Run your network
C.Know your network
D.Platform
AnswerA

Correct. Template deployment is part of changing the network.

Why this answer

The 'Change your network' category includes template deployment, plug and play, and other configuration changes.

Full explanation →
335
MCQeasy

A developer is creating a Dockerfile for a Python Flask application. The application runs on port 5000. Which directive should be used to document that the container listens on this port?

A.EXPOSE 5000
B.PORT 5000
C.PUBLISH 5000
D.LISTEN 5000
AnswerA

Correct. EXPOSE documents the port the container listens on.

Why this answer

The EXPOSE directive informs Docker that the container listens on specified ports at runtime. It does not actually publish the port but serves as documentation.

Full explanation →
336
MCQhard

A network engineer wants to automate a configuration change on a Cisco IOS XE device when a specific syslog message appears. Which tool should they use?

A.RESTCONF with a Python script polling the device
B.SNMP trap receiver
C.EEM applet configured to match the syslog pattern and execute CLI commands
D.NETCONF with a YANG-based notification subscription
AnswerC

EEM can trigger on syslog events and run commands.

Why this answer

Embedded Event Manager (EEM) can trigger actions based on syslog patterns.

Full explanation →
337
MCQeasy

A Docker container needs to be started in detached mode with port mapping from host port 8080 to container port 80. Which command accomplishes this?

A.docker start -d -p 8080:80 myapp
B.docker run -d -p 8080:80 myapp
C.docker run -it -p 8080:80 myapp
D.docker run -d -p 80:8080 myapp
AnswerB

Correct detached mode and port mapping.

Why this answer

The -d flag runs container in detached mode, -p maps host port to container port.

Full explanation →
338
MCQmedium

A network engineer writes a Python script to handle exceptions when making REST API calls. Which exception type should be caught to handle network connectivity issues (e.g., DNS failure, refused connection)?

A.requests.exceptions.RequestException
B.requests.exceptions.ConnectionError
C.requests.exceptions.HTTPError
D.requests.exceptions.Timeout
AnswerB

ConnectionError specifically indicates network problems like failed DNS or refused connection.

Why this answer

`requests.exceptions.ConnectionError` is specifically raised when the underlying TCP connection fails, which includes scenarios like DNS resolution failures, refused connections, or the remote host being unreachable. This exception is a subclass of `RequestException` and directly maps to network-level issues at the transport layer, making it the precise exception to catch for connectivity problems.

Exam trap

Cisco often tests the distinction between the broad `RequestException` and the specific `ConnectionError`, trapping candidates who choose the base class thinking it covers all errors, when the question explicitly asks for network connectivity issues.

How to eliminate wrong answers

Option A is wrong because `requests.exceptions.RequestException` is the base class for all exceptions in the `requests` library; catching it would be too broad and would also handle non-connectivity errors like HTTP errors or timeouts, which is not the specific requirement. Option C is wrong because `requests.exceptions.HTTPError` is raised only when the server returns an HTTP error status code (e.g., 4xx or 5xx), which indicates an application-level issue, not a network connectivity failure. Option D is wrong because `requests.exceptions.Timeout` is raised when a request exceeds the specified timeout period, which is a timing issue rather than a fundamental network connectivity failure like DNS failure or refused connection.

Full explanation →
339
Multi-Selecthard

Which THREE options are valid methods to expose a Kubernetes service to external traffic?

Select 3 answers
A.ExternalName
B.NodePort
C.ClusterIP
D.Ingress
E.LoadBalancer
AnswersB, D, E

NodePort exposes on node port.

Why this answer

NodePort exposes on each node's IP, LoadBalancer creates external load balancer, Ingress provides HTTP routing. ClusterIP is internal only, ExternalName maps to DNS record.

Full explanation →
340
Multi-Selectmedium

A developer is writing a Dockerfile for a Node.js application. Which TWO instructions are commonly used to define the command that runs when the container starts?

Select 2 answers
A.CMD
B.RUN
C.START
D.ENTRYPOINT
E.EXPOSE
AnswersA, D

CMD specifies the command to run when the container starts.

Why this answer

The CMD instruction in a Dockerfile provides default arguments for the container's entrypoint or defines the command to execute when the container starts. For a Node.js application, CMD is commonly used to specify the startup command, such as `CMD ["node", "app.js"]`, which runs the Node.js process. This instruction can be overridden at runtime by providing a command after `docker run`.

Exam trap

Cisco often tests the distinction between build-time instructions (RUN) and runtime instructions (CMD/ENTRYPOINT), and the trap here is that candidates confuse RUN (which executes during `docker build`) with CMD (which executes during `docker run`).

Full explanation →
341
MCQeasy

A network engineer is troubleshooting connectivity issues and wants to verify the path that packets take from a source to a destination IP address. Which OSI layer is primarily responsible for packet forwarding and routing?

A.Layer 4 - Transport
B.Layer 3 - Network
C.Layer 1 - Physical
D.Layer 2 - Data Link
AnswerB

Network layer is responsible for packet forwarding, routing, and logical addressing.

Why this answer

The Network layer (Layer 3) is responsible for packet forwarding and routing, using logical IP addresses to determine the best path from source to destination. Protocols like IP (IPv4/IPv6) and routing protocols (e.g., OSPF, BGP) operate at this layer to make forwarding decisions. The traceroute command is a common tool that leverages Layer 3 TTL (Time-to-Live) fields to map the path packets take.

Exam trap

Cisco often tests the distinction between Layer 2 switching (MAC-based forwarding within a LAN) and Layer 3 routing (IP-based forwarding between networks), and the trap here is that candidates confuse the Data Link layer's local forwarding with the Network layer's path determination.

How to eliminate wrong answers

Option A is wrong because Layer 4 (Transport) handles end-to-end communication, segmentation, and reliability (e.g., TCP/UDP), not packet forwarding or routing. Option C is wrong because Layer 1 (Physical) deals with the physical transmission of raw bits over a medium (e.g., cables, signals) and has no awareness of paths or addresses. Option D is wrong because Layer 2 (Data Link) is responsible for node-to-node delivery within a single network segment using MAC addresses, not for routing across multiple networks.

Full explanation →
342
MCQmedium

An organization uses Cisco DNA Center and wants to programmatically deploy a configuration template to multiple devices. Which API category should be used?

A.Platform
B.Change your network
C.Run your network
D.Know your network
AnswerB

Template deployment is part of 'change your network' APIs.

Why this answer

The 'change your network' category includes template deployment, plug and play, etc.

Full explanation →
343
MCQeasy

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

A.docker run --port 443 myapp
B.docker run --net host myapp
C.docker run -p 443:443 myapp
D.docker run --expose 443 myapp
AnswerC

-p 443:443 publishes container port 443 to host port 443, allowing external access only on that port.

Why this answer

The `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.

Exam trap

Cisco often tests the distinction between `--expose` (documentation only) and `-p` (actual port publishing), and the trap here is that candidates confuse `--expose` with making a port externally accessible, when in fact it only informs Docker that the container uses that port internally.

How to eliminate wrong answers

Option A is wrong because `--port` is not a valid Docker run flag; the correct flag is `-p` or `--publish`. Option B is wrong because `--net host` makes the container share the host's network stack, exposing all host ports to the container and bypassing Docker's port isolation, which would allow traffic on any port, not just 443. Option D is wrong because `--expose 443` only documents that the container listens on port 443 but does not actually publish the port to the host, so no external traffic can reach the container on that port.

Full explanation →
344
MCQeasy

Which Docker command is used to view the logs of a running container in real-time?

A.docker inspect
B.docker ps -a
C.docker logs -f
D.docker exec -it
AnswerC

The -f flag follows log output in real-time.

Why this answer

docker logs -f follows the log output of a container, similar to tail -f.

Full explanation →
345
MCQeasy

A developer needs to send a message to a Webex room using the API. Which HTTP method and endpoint should they use?

A.GET /v1/messages
B.PUT /v1/messages
C.DELETE /v1/messages
D.POST /v1/messages
AnswerD

This creates a new message.

Why this answer

To send a message, use POST to /v1/messages with the room ID and message body.

Full explanation →
346
Multi-Selectmedium

Which THREE of the following are valid JSON data types? (Choose three.)

Select 3 answers
A.String
B.Number
C.Function
D.Array
E.Date
AnswersA, B, D

Strings are enclosed in double quotes.

Why this answer

JSON (JavaScript Object Notation) is a lightweight data-interchange format that supports only a fixed set of data types as defined by RFC 7159. String is a valid JSON type because it must be enclosed in double quotes and can contain Unicode characters. Number is valid as it includes integers and floating-point values without quotes, following the numeric grammar in the JSON specification.

Exam trap

Cisco often tests the misconception that JSON supports JavaScript-specific types like Function or Date, but JSON is a language-independent format with only six defined types per RFC 7159.

Full explanation →
347
Multi-Selecteasy

Which TWO practices help prevent sensitive data exposure in a CI/CD pipeline? (Select two.)

Select 2 answers
A.Run dependency scanning tools (e.g., Snyk) in the pipeline.
B.Use environment variables to inject secrets at runtime.
C.Hardcode credentials in the source code for simplicity.
D.Commit .env files to the repository with dummy values.
E.Disable HTTPS to avoid certificate management overhead.
AnswersA, B

Dependency scanning identifies known vulnerabilities in libraries.

Why this answer

Using environment variables for secrets (not hardcoding) and scanning dependencies for vulnerabilities help prevent exposure.

Full explanation →
348
MCQeasy

An application developer is using a protocol that does not require a connection setup and has minimal header overhead. Which transport protocol is being used?

A.TCP
B.UDP
C.HTTP
D.ICMP
AnswerB

UDP is connectionless and has minimal overhead.

Why this answer

UDP (User Datagram Protocol) is a connectionless transport-layer protocol that does not require a handshake (no SYN/SYN-ACK/ACK) and has minimal header overhead (only 8 bytes, compared to TCP's 20 bytes). This makes it ideal for applications like DNS queries, streaming media, or real-time communications where low latency is more critical than guaranteed delivery.

Exam trap

Cisco often tests the distinction between transport-layer and application-layer protocols, so candidates mistakenly choose HTTP (an application protocol) instead of recognizing that the question explicitly asks for the transport protocol.

How to eliminate wrong answers

Option A is wrong because TCP requires a three-way handshake to establish a connection and has a larger header (20–60 bytes) with fields for sequence numbers, acknowledgments, and flow control, contradicting the 'no connection setup' and 'minimal header overhead' criteria. Option C is wrong because HTTP is an application-layer protocol, not a transport-layer protocol; it relies on TCP (or rarely UDP via HTTP/3) for transport, so it does not itself define connection setup or header overhead at the transport level. Option D is wrong because ICMP (Internet Control Message Protocol) is a network-layer protocol used for error reporting and diagnostics (e.g., ping), not a transport-layer protocol; it has no concept of port numbers or connection setup, but it is not a transport protocol.

Full explanation →
349
MCQmedium

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

A.Embed secrets directly in the container image using COPY instructions.
B.Pass secrets as build arguments in the Docker build command.
C.Use a secure secret store like HashiCorp Vault and retrieve secrets at runtime via API.
D.Store secrets as environment variables in the Docker Compose file.
AnswerC

A secret store provides dynamic, audited, and encrypted access to secrets without embedding them in code or images.

Why this answer

It follows the principle of secret management by decoupling sensitive data from application code and container images. HashiCorp Vault provides a centralized, encrypted secret store with dynamic secrets, access policies, and audit logging, allowing the microservices to authenticate and retrieve credentials at runtime via its REST API, eliminating the need to hardcode secrets.

Exam trap

Cisco often tests the misconception that environment variables in Docker Compose or build arguments are secure enough for secrets, but the trap here is that these methods leave secrets exposed in plaintext within the image layers, logs, or runtime environment, whereas a dedicated secret store like Vault provides encryption, rotation, and access control.

How to eliminate wrong answers

Option A is wrong because embedding secrets directly in a container image using COPY instructions bakes them into the image layers, making them accessible to anyone with image pull access and violating security best practices. Option B is wrong because build arguments in the Docker build command are visible in the image history via `docker history` and can be exposed through build logs or cached layers, so they are not secure for secrets. Option D is wrong because storing secrets as environment variables in a Docker Compose file leaves them in plaintext within the file and the container's environment, which can be leaked through logs, debugging, or process inspection, and does not provide encryption or access control.

Full explanation →
350
MCQhard

A Kubernetes Service must expose a pod running a database to other pods in the same cluster, but not externally. Which Service type should be used?

A.ClusterIP
B.LoadBalancer
C.ExternalName
D.NodePort
AnswerA

ClusterIP is the default and only accessible from within the cluster.

Why this answer

ClusterIP exposes the service on a cluster-internal IP, making it accessible only within the cluster.

Full explanation →
351
MCQmedium

A company uses a /24 subnet for its office LAN. The network must accommodate 30 hosts per VLAN. Which subnet mask would be most efficient for each VLAN while minimizing wasted IP addresses?

A.255.255.255.224
B.255.255.255.240
C.255.255.255.0
D.255.255.255.128
E.255.255.255.192
AnswerA

This is /27, provides 30 usable hosts, exactly meeting the requirement.

Why this answer

A /27 subnet mask (255.255.255.224) provides 32 total addresses per subnet, with 30 usable host addresses (2^5 - 2 = 30). This exactly meets the requirement of 30 hosts per VLAN without wasting IP addresses, as any larger subnet would leave unused addresses.

Exam trap

Cisco often tests the misconception that the subnet mask must match the exact number of hosts without accounting for the network and broadcast addresses, leading candidates to choose a mask that provides exactly 30 total addresses (like /27) but forget that 2 addresses are reserved.

How to eliminate wrong answers

Option B (255.255.255.240) is wrong because it provides only 14 usable hosts per subnet (2^4 - 2 = 14), which is insufficient for 30 hosts. Option C (255.255.255.0) is wrong because it provides 254 usable hosts, which is far more than needed and wastes IP addresses. Option D (255.255.255.128) is wrong because it provides 126 usable hosts, also wasteful for 30 hosts.

Option E (255.255.255.192) is wrong because it provides 62 usable hosts, which is more than required and inefficient.

Full explanation →
352
Multi-Selectmedium

Which two Meraki Dashboard API features are used to paginate through large result sets? (Choose two.)

Select 2 answers
A.offset and limit parameters
B.page and perPage query parameters
C.startingAfter and endingBefore parameters
D.Retry-After header
E.Link header with rel="next"
AnswersC, E

These cursor parameters allow navigating through pages.

Why this answer

Meraki supports Link header for standard pagination and startingAfter/endingBefore parameters for cursor-based pagination.

Full explanation →
353
MCQeasy

A network engineer is configuring a new switch and needs to ensure that frames from VLAN 10 and VLAN 20 are isolated on the same trunk link to another switch. Which IEEE standard should be configured on the trunk interfaces?

A.802.3
B.802.11
C.802.1Q
D.802.1X
AnswerC

802.1Q is the IEEE standard for VLAN tagging on trunk links.

Why this answer

C is correct because 802.1Q is the IEEE standard that defines VLAN tagging, allowing multiple VLANs (such as VLAN 10 and VLAN 20) to be carried over a single trunk link while maintaining isolation between them. By inserting a 4-byte VLAN tag into the Ethernet frame, 802.1Q enables the receiving switch to identify which VLAN a frame belongs to, ensuring traffic from different VLANs remains separate.

Exam trap

Cisco often tests the distinction between 802.1Q (VLAN tagging) and 802.1X (authentication), so the trap here is confusing a trunking protocol with a security protocol, leading candidates to pick 802.1X when the question is about VLAN isolation on a trunk.

How to eliminate wrong answers

Option A is wrong because 802.3 is the IEEE standard for Ethernet (CSMA/CD) and defines physical layer and MAC sublayer specifications, not VLAN tagging or trunking. Option B is wrong because 802.11 is the IEEE standard for wireless LAN (Wi-Fi) and is unrelated to wired switch trunk links or VLAN isolation. Option D is wrong because 802.1X is the IEEE standard for port-based network access control (authentication), not for VLAN tagging or trunking.

Full explanation →
354
MCQhard

Refer to the exhibit. Based on the YANG model snippet, what is the data type of the 'mask' leaf?

A.inet:ipv4-address
B.inet:ipv4-prefix-length
C.uint8
D.string
AnswerB

The exhibit shows the type as inet:ipv4-prefix-length.

Why this answer

The 'mask' leaf is defined with the type 'inet:ipv4-prefix-length', which represents a decimal integer from 0 to 32 indicating the number of leading 1 bits in the subnet mask (e.g., 24 for /24). This is the correct data type for a prefix length in YANG models, not an IPv4 address or a generic string.

Exam trap

Cisco often tests the distinction between 'inet:ipv4-address' (a full address) and 'inet:ipv4-prefix-length' (the /N notation), tricking candidates who confuse the subnet mask value with its prefix length representation.

How to eliminate wrong answers

Option A is wrong because 'inet:ipv4-address' is a dotted-decimal IPv4 address (e.g., 192.168.1.1), not a prefix length. Option C is wrong because 'uint8' is a generic 8-bit unsigned integer (0-255) but lacks the semantic constraint of 0-32 that 'inet:ipv4-prefix-length' enforces. Option D is wrong because 'string' would allow arbitrary text, which is not appropriate for a numeric prefix length that must be validated as an integer between 0 and 32.

Full explanation →
355
Multi-Selecteasy

A network administrator is deploying a new application that requires high availability and load balancing across multiple servers. The servers are connected to a pair of switches that use StackWise virtual technology. The application team requests that the servers be configured with NIC teaming in active-active mode. Which two requirements must be met for this configuration to work correctly? (Choose two.)

Select 2 answers
A.The two switches must be part of a single stack or virtual switch fabric.
B.Spanning-tree PortFast must be enabled on the switch ports connected to the servers.
C.Both NIC team members must be configured in the same VLAN.
D.The NIC team must use LACP for load balancing.
E.Both NIC team members should connect to the same switch module for consistency.
AnswersA, C

This allows the NIC team to see the two switches as one logical switch and use both links simultaneously.

Why this answer

StackWise virtual technology logically combines two physical switches into a single control plane, allowing NIC teaming in active-active mode to treat the pair as one logical switch. This ensures that both NIC team members can forward traffic simultaneously without loops, as the stack provides a unified Layer 2 topology and prevents MAC flapping between the two switches.

Exam trap

Cisco often tests the misconception that NIC teaming requires LACP or that PortFast is necessary for active-active operation, but the real key is that the switches must be part of a single logical fabric to avoid loops and MAC flapping.

Full explanation →
356
MCQhard

In Cisco DNA Center, which API endpoint is used to retrieve the site hierarchy?

A.POST /dna/intent/api/v1/site
B.GET /dna/intent/api/v1/network-device
C.GET /dna/intent/api/v1/site
D.GET /dna/intent/api/v1/topology
AnswerC

This returns site hierarchy.

Why this answer

The site hierarchy can be retrieved via GET /dna/intent/api/v1/site.

Full explanation →
357
MCQhard

A network administrator is deploying a custom container application on a Cisco Catalyst 9300 switch running IOS XE 16.12. The application is packaged as a .tar file and installed using 'app-hosting install app myapp flash:myapp.tar'. The administrator configures the app-hosting context as follows: app-hosting app myapp app-default-gateway 192.168.1.1 app-vnic gateway0 guest-interface 0 guest-ipaddress 192.168.1.10 netmask 255.255.255.0 app-resource profile custom cpu 1000 memory 2048 storage 5000 The administrator also creates a virtual port group 'vg0' and assigns it to the management interface. The application fails to start with the error: 'Application failed to start: guest interface not ready'. The administrator verifies that the .tar file is valid, the resources are sufficient, and the gateway is reachable. What is the most likely cause of the failure?

A.The application requires a DHCP server, but the configuration uses a static IP address.
B.The guest-interface is not bound to the virtual port group.
C.The .tar file is corrupt despite appearing valid.
D.The CPU allocation of 1000 units is insufficient for the application.
AnswerB

The virtual port group must be explicitly bound to the app-vnic interface; otherwise, the interface remains 'not ready'.

Why this answer

The error 'guest interface not ready' indicates that the virtual network interface defined in the app-hosting configuration is not properly linked to a virtual port group on the switch. In IOS XE, the 'app-vnic gateway0 guest-interface 0' command must be associated with a virtual port group (e.g., 'vpg vg0') using the 'guest-interface 0' binding under the virtual port group configuration. Without this binding, the guest interface remains uninitialized, preventing the container from starting.

Exam trap

Cisco often tests the requirement to explicitly bind the guest interface to a virtual port group, tricking candidates into thinking the error is due to IP addressing or resource issues when the real cause is a missing interface-to-VPG mapping.

How to eliminate wrong answers

Option A is wrong because the configuration explicitly sets a static IP address (192.168.1.10) and a default gateway, which is fully supported for container applications on IOS XE; a DHCP server is not required. Option C is wrong because the administrator verified the .tar file is valid, and a corrupt file would typically cause an installation or integrity error, not a 'guest interface not ready' error. Option D is wrong because 1000 CPU units (equivalent to 1 GHz) is a standard allocation for lightweight container applications on Catalyst 9300 switches, and insufficient CPU would manifest as performance issues or resource exhaustion, not a guest interface readiness failure.

Full explanation →
358
MCQhard

An HTTP/2 connection uses multiple concurrent streams over a single TCP connection. Which feature of HTTP/2 enables this?

A.Binary framing layer
B.Multiplexing
C.Server push
D.Header compression (HPACK)
AnswerB

Correct. Multiplexing allows multiple streams over one TCP connection.

Why this answer

Multiplexing is the HTTP/2 feature that allows multiple concurrent streams to share a single TCP connection. This eliminates head-of-line blocking at the application layer by enabling the interleaving of frames from different streams, so a slow response on one stream does not block others.

Exam trap

Cisco often tests the distinction between the enabling mechanism (binary framing) and the resulting capability (multiplexing), so candidates mistakenly choose 'binary framing layer' because it sounds technical, but it is the foundation, not the feature that directly enables concurrency.

How to eliminate wrong answers

Option A is wrong because the binary framing layer is the mechanism that encodes frames into binary format, but it does not itself enable concurrency; multiplexing uses the framing layer to interleave streams. Option C is wrong because server push is a feature that allows the server to proactively send resources to the client, but it does not enable multiple concurrent streams. Option D is wrong because header compression (HPACK) reduces overhead by compressing HTTP headers, but it has no role in enabling concurrent streams.

Full explanation →
359
MCQmedium

A developer is writing a script that uses a REST API to configure network devices via NETCONF. Which layer of the SDN architecture does NETCONF belong to?

A.Northbound interface
B.Southbound interface
C.Application layer
D.Control layer
AnswerB

Correct. NETCONF is a southbound protocol.

Why this answer

NETCONF is a network management protocol used to install, manipulate, and delete the configuration of network devices. In the SDN architecture, the southbound interface is the layer that connects the control plane to the data plane, and NETCONF operates as a southbound protocol by carrying configuration data from a controller or management system down to network devices.

Exam trap

Cisco often tests the distinction between the protocol itself (NETCONF) and the architectural layer it belongs to, leading candidates to mistakenly select 'Control layer' because they associate NETCONF with the controller, rather than recognizing it as a southbound interface protocol.

How to eliminate wrong answers

Option A is wrong because the northbound interface is the API layer that connects the SDN controller to applications and business logic, not to network devices; NETCONF does not operate at this level. Option C is wrong because the application layer contains the business applications and services that consume northbound APIs, not the protocols that directly configure devices. Option D is wrong because the control layer is the SDN controller itself, which uses southbound protocols like NETCONF to communicate with devices, but NETCONF is not the control layer; it is a protocol used by that layer.

Full explanation →
360
MCQeasy

Which OSI layer is responsible for routing packets across different networks?

A.Layer 1 (Physical)
B.Layer 3 (Network)
C.Layer 4 (Transport)
D.Layer 2 (Data Link)
AnswerB

Layer 3 uses IP addresses to route packets across networks.

Why this answer

The Network layer (Layer 3) is responsible for logical addressing and routing packets between different networks. Protocols like IP (IPv4/IPv6) use routing tables and algorithms (e.g., OSPF, BGP) to determine the best path for forwarding packets across multiple hops. Without Layer 3, traffic could not leave a local broadcast domain.

Exam trap

Cisco often tests the distinction between Layer 2 switching (MAC-based, same network) and Layer 3 routing (IP-based, between networks), and the trap here is confusing the Data Link layer's local forwarding with the Network layer's internetwork routing.

How to eliminate wrong answers

Option A is wrong because Layer 1 (Physical) handles raw bit transmission over physical media (e.g., voltages, frequencies, cables) and has no concept of addressing or routing. Option C is wrong because Layer 4 (Transport) provides end-to-end communication, segmentation, and reliability (e.g., TCP/UDP), but does not perform network-level routing between different subnets. Option D is wrong because Layer 2 (Data Link) uses MAC addresses to forward frames within a single network segment or VLAN, and relies on Layer 3 to route across different networks.

Full explanation →
361
MCQmedium

An application uses the Meraki Dashboard API and receives a 429 Too Many Requests error. What is the most likely cause, and how should the application adjust?

A.The request body is malformed; check JSON syntax.
B.The API key is invalid; regenerate the key.
C.The network is down; check connectivity.
D.The application exceeded the rate limit of 5 calls per second; implement exponential backoff.
AnswerD

429 indicates rate limit; backoff is appropriate.

Why this answer

Meraki API rate limits at 5 calls per second; a 429 indicates rate limit exceeded. The application should implement retry with backoff.

Full explanation →
362
Multi-Selecteasy

Which THREE are valid methods for managing Kubernetes application configuration?

Select 3 answers
A.Helm values.
B.Secrets.
C.Operator custom resources.
D.Environment variables in the Dockerfile.
E.ConfigMaps.
AnswersA, B, E

Used in Helm charts for template configuration.

Why this answer

Helm values (A) are correct because Helm is a package manager for Kubernetes that uses values.yaml files to inject configuration into templates at deployment time, enabling dynamic, environment-specific application configuration without modifying the underlying chart. This is a standard method for managing Kubernetes application configuration in production workflows.

Exam trap

Cisco often tests the distinction between build-time configuration (Dockerfile ENV) and runtime configuration (ConfigMaps, Secrets, Helm values), trapping candidates who think environment variables in the Dockerfile are a valid runtime management method for Kubernetes.

Full explanation →
363
MCQmedium

A company uses a centralized automation server that runs Ansible playbooks. What is the best security practice for storing SSH credentials?

A.Store credentials in a public repository
B.Use Ansible Vault
C.Hardcode credentials in playbooks
D.Use plain text inventory files
AnswerB

Ansible Vault encrypts secrets.

Why this answer

Ansible Vault is the recommended security practice for encrypting sensitive data like SSH credentials. It allows you to store encrypted variables and files within your playbooks or inventory, protecting secrets at rest while enabling decryption at runtime via a password or key file. This avoids exposing credentials in plain text, which is critical for centralized automation servers that may be accessed by multiple users or integrated into CI/CD pipelines.

Exam trap

Cisco often tests the misconception that 'inventory files are safe if stored locally' or that 'hardcoding is acceptable for small teams,' but the exam expects candidates to recognize that any plain text storage of credentials violates security best practices, and Ansible Vault is the standard built-in solution for encryption.

How to eliminate wrong answers

Option A is wrong because storing credentials in a public repository exposes them to unauthorized access, violating the principle of least privilege and potentially leading to security breaches. Option C is wrong because hardcoding credentials in playbooks embeds secrets in plain text within version control, making them visible to anyone with repository access and preventing easy rotation. Option D is wrong because using plain text inventory files stores SSH credentials unencrypted, which is insecure and defeats the purpose of a centralized automation server that should enforce encryption at rest.

Full explanation →
364
Multi-Selecteasy

A software developer is using the Cisco Webex REST API and wants to filter messages by date range. Which two query parameters should be included? (Choose two.)

Select 2 answers
A.since
B.before
C.after
D.end
E.start
AnswersB, C

Used to specify the end date.

Why this answer

The Cisco Webex REST API uses the 'before' and 'after' query parameters to filter messages by date range. 'before' returns messages sent before a specified date/time, and 'after' returns messages sent after a specified date/time, allowing precise range-based filtering.

Exam trap

Cisco often tests the specific parameter names used in the Webex API (before/after) versus generic terms like start/end or since/until, catching candidates who assume common naming conventions from other platforms.

Full explanation →
365
MCQmedium

Which of the following is a private IPv4 address range as defined by RFC 1918?

A.169.254.0.0/16
B.192.167.0.0/16
C.10.0.0.0/8
D.172.32.0.0/16
AnswerC

10.0.0.0/8 is a private IP range.

Why this answer

(10.0.0.0/8) is correct because RFC 1918 reserves this range, along with 172.16.0.0/12 and 192.168.0.0/16, for private IPv4 addressing. These addresses are not routable on the public internet and are intended for use within private networks, such as corporate LANs or home networks.

Exam trap

Cisco often tests the exact boundaries of RFC 1918 ranges, and the trap here is confusing the 172.16.0.0/12 range with the broader 172.0.0.0/8, leading candidates to select 172.32.0.0/16 as a valid private range.

How to eliminate wrong answers

Option A is wrong because 169.254.0.0/16 is the Automatic Private IP Addressing (APIPA) range, used by hosts when DHCP fails, not a private RFC 1918 range. Option B is wrong because 192.167.0.0/16 is not a private range; the correct private range is 192.168.0.0/16, and 192.167.0.0/16 is part of the public address space. Option D is wrong because 172.32.0.0/16 falls outside the RFC 1918 private range 172.16.0.0/12; the private block covers 172.16.0.0 through 172.31.255.255, not 172.32.0.0.

Full explanation →
366
MCQmedium

Which authentication method is used by the Cisco Meraki Dashboard API?

A.JWT token in the Authorization header
B.OAuth 2.0 token in the Authorization header
C.HTTP Basic authentication with username and password
D.API key in the X-Cisco-Meraki-API-Key header
AnswerD

This is the standard authentication for Meraki APIs.

Why this answer

Meraki Dashboard API uses an API key passed in the X-Cisco-Meraki-API-Key header.

Full explanation →
367
MCQhard

A developer is troubleshooting a CI/CD pipeline that automatically deploys configuration changes to network devices. The pipeline includes a stage that runs Python unit tests. Which of the following would be a valid test to include in that stage to validate the configuration before deployment?

A.Test that the configuration can be applied to the device by sending it via NETCONF
B.Test that the configuration file is valid JSON
C.Test that the configuration changes do not break connectivity by pinging the device after deployment
D.Test that the configuration adheres to company naming conventions using a regular expression
AnswerB

Correct. Validating that the configuration file is valid JSON is a fast, isolated unit test that catches syntax errors before deployment.

Why this answer

Validating that the configuration is valid JSON is a simple unit test that can catch syntax errors early. The other options either require network access (which unit tests should avoid) or are not unit-level.

Full explanation →
368
MCQeasy

An engineer needs to identify which hosts are reachable in a 10.0.0.0/24 network using an automated script that does not require any credentials on the target devices. Which protocol is best suited for this task?

A.ICMP
B.CDP
C.SNMP
D.ARP
AnswerA

ICMP echo requests are unauthenticated and can be used to check reachability.

Why this answer

ICMP (Internet Control Message Protocol) is the correct choice because it provides the Echo Request and Echo Reply messages (commonly used by the 'ping' command) that can determine host reachability without requiring any authentication or credentials on the target devices. This makes ICMP ideal for an automated script that needs to probe a 10.0.0.0/24 network for live hosts, as it operates at the network layer and only requires IP connectivity.

Exam trap

Cisco often tests the distinction between protocols that require credentials (SNMP) and those that do not (ICMP), and the trap here is that candidates may choose ARP thinking it can discover hosts without credentials, but ARP only works on the local subnet and does not confirm IP-level reachability across a routed network.

How to eliminate wrong answers

Option B (CDP) is wrong because Cisco Discovery Protocol is a proprietary Layer 2 protocol used to discover directly connected Cisco devices and their capabilities; it requires the target devices to be Cisco devices with CDP enabled and does not test reachability via IP, nor does it work across routers or subnets. Option C (SNMP) is wrong because Simple Network Management Protocol requires credentials (community strings or SNMPv3 authentication) to query managed devices, and the question explicitly states no credentials are allowed. Option D (ARP) is wrong because Address Resolution Protocol resolves IP addresses to MAC addresses on a local broadcast domain; it can only detect hosts on the same subnet and requires an ARP request to be sent, but it does not confirm end-to-end reachability beyond Layer 2 and is not suitable for a /24 network that may span multiple Layer 2 segments.

Full explanation →
369
MCQeasy

An organization uses Cisco Intersight to manage UCS servers. They want to automate the firmware upgrade process. Which Intersight API should be used to trigger a firmware upgrade on a server?

A.POST /api/v1/ntp/Policies
B.POST /api/v1/equipment/Fex
C.POST /api/v1/fabric/EthNetworkPolicies
D.POST /api/v1/compute/Physical
AnswerD

Physical server resource supports firmware actions.

Why this answer

The `/api/v1/compute/Physical` endpoint in Cisco Intersight is used to manage physical compute resources, including triggering firmware upgrades on UCS servers. By sending a POST request to this endpoint with the appropriate action payload (e.g., `"Action": "UpgradeFirmware"`), you can initiate a firmware upgrade on a specific server. This aligns with Intersight's RESTful API design for lifecycle management of UCS infrastructure.

Exam trap

The trap here is that candidates may confuse general management endpoints (like NTP policies or network policies) with the specific compute resource endpoint, assuming any POST to a policy-related API can trigger an action, when in fact only the compute resource endpoint supports firmware upgrade actions.

How to eliminate wrong answers

Option A is wrong because `POST /api/v1/ntp/Policies` is used to create or manage NTP (Network Time Protocol) policies, which control time synchronization settings, not firmware upgrades. Option B is wrong because `POST /api/v1/equipment/Fex` targets Fabric Extender (FEX) equipment, which handles port expansion and does not support firmware upgrade actions for servers. Option C is wrong because `POST /api/v1/fabric/EthNetworkPolicies` is for managing Ethernet network policies (e.g., VLAN, QoS) for fabric interconnects, not for triggering server firmware updates.

Full explanation →
370
Multi-Selectmedium

A network automation solution uses YANG data models to describe network configurations. Which THREE statements about YANG are true? (Select THREE)

Select 3 answers
A.YANG can be used in conjunction with NETCONF and RESTCONF.
B.YANG models are always written in XML syntax.
C.YANG is used to define both configuration and state data.
D.YANG is a data modeling language used to define the structure of data.
E.YANG is a replacement for SNMP.
AnswersA, C, D

Both protocols use YANG models.

Why this answer

YANG is a data modeling language that defines the structure and constraints of configuration and state data, and it is designed to be used with NETCONF (RFC 6241) and RESTCONF (RFC 8040) as the transport protocols. This makes option A correct because YANG models are encoded in XML or JSON and exchanged via these protocols.

Exam trap

Cisco often tests the misconception that YANG is tied to a specific encoding (like XML) or that it replaces SNMP entirely, when in fact YANG is encoding-agnostic and complements SNMP by providing structured, transactional configuration management.

Full explanation →
371
MCQeasy

A network engineer needs to allow HTTPS traffic from the internet to an internal web server. Which type of firewall rule should be applied on the perimeter firewall?

A.Routing protocol configuration
B.Outbound ACL on the inside interface
C.Inbound ACL on the outside interface
D.Static NAT configuration
AnswerC

An inbound ACL on the outside interface permits incoming HTTPS traffic to the web server.

Why this answer

An inbound ACL on the outside interface allows traffic from the internet to reach internal servers while blocking unauthorized access. Option A (routing protocol configuration) does not control traffic filtering. Option B (outbound ACL on inside interface) controls traffic leaving the network, not incoming HTTPS.

Option D (static NAT) translates addresses but does not filter traffic.

Full explanation →
372
MCQeasy

A developer runs the command: docker run -d -p 8080:80 --name web nginx. Which of the following best describes what happens?

A.The container runs in interactive mode, and port 8080 is exposed but not published.
B.The container is removed after stopping, and port mapping is automatic.
C.The container runs in the foreground, and port 80 on the host is mapped to port 8080 in the container.
D.The container runs in detached mode, and host port 8080 is mapped to container port 80.
AnswerD

Correct interpretation of flags.

Why this answer

-d runs container detached, -p maps host port 8080 to container port 80, --name assigns name 'web', and nginx is the image.

Full explanation →
373
MCQeasy

Which header is used in an HTTP request to tell the server the format of the request body?

A.Authorization
B.Content-Type
C.Accept
D.Host
AnswerB

Content-Type indicates the format of the request body.

Why this answer

Content-Type header specifies the media type of the request body, e.g., application/json.

Full explanation →
374
MCQhard

A company has a three-tier data center architecture with access, aggregation, and core layers. The network team is migrating to a leaf-spine architecture to support increasing east-west traffic. The current network uses STP for loop prevention, and the team wants to eliminate STP in the new design. They plan to use VXLAN overlays with BGP EVPN for control plane. During a pilot deployment, the team notices that some legacy servers that rely on traditional VLANs are not reachable across the new fabric. The servers are connected to access switches that are part of the leaf layer. The access switches are configured as VXLAN tunnel endpoints (VTEPs) but the legacy servers are still using traditional VLANs. The team needs to ensure connectivity between the legacy VLAN-based servers and the new VXLAN-based network. What is the best approach to integrate these legacy servers without changing their configuration?

A.Create a separate VRF for legacy VLANs and redistribute into BGP EVPN
B.Implement a Layer 2 gateway (L2GW) on the leaf switches to bridge VLANs to VXLAN using IRB
C.Configure the same VLAN on all leaf switches and use VXLAN to stretch the VLAN across the fabric
D.Reconfigure the legacy servers to use VXLAN encapsulation
AnswerB

IRB provides seamless bridging between VLAN and VXLAN.

Why this answer

An Integrated Routing and Bridging (IRB) interface on the leaf switch acts as a Layer 2 gateway (L2GW), bridging the legacy VLAN to a VXLAN segment. This allows the legacy server, which still uses traditional VLAN tagging, to communicate with the VXLAN-based fabric without any configuration changes on the server. The IRB interface performs the VLAN-to-VXLAN mapping and handles ARP suppression, enabling seamless integration.

Exam trap

The trap here is that candidates often confuse Layer 2 stretching (Option C) with a Layer 2 gateway, not realizing that stretching VLANs across the fabric would reintroduce STP dependencies and does not provide the necessary gateway function for legacy VLAN-based devices.

How to eliminate wrong answers

Option A is wrong because creating a separate VRF for legacy VLANs and redistributing into BGP EVPN does not solve the Layer 2 connectivity issue; VRFs are for Layer 3 isolation, not for bridging VLANs to VXLAN. Option C is wrong because configuring the same VLAN on all leaf switches and using VXLAN to stretch the VLAN across the fabric would require the legacy servers to be in the same broadcast domain, which defeats the purpose of eliminating STP and does not address the need for a gateway between VLAN and VXLAN. Option D is wrong because reconfiguring the legacy servers to use VXLAN encapsulation would require changing their configuration, which the team explicitly wants to avoid.

Full explanation →
375
MCQhard

A DevOps engineer is automating network device configuration using Ansible. The playbook must retrieve the MAC address table from a Cisco switch. Which protocol should the engineer use to fetch this data?

A.SSH with CLI scraping
B.HTTPS with Web UI
C.REST API
D.NETCONF
E.SNMP
AnswerE

SNMP is a standard protocol for retrieving MIB data like MAC tables.

Why this answer

E is correct because SNMP (Simple Network Management Protocol) is specifically designed for reading operational data like MAC address tables from network devices. The engineer can use SNMP GET requests to query the dot1dTpFdbTable (RFC 1493) or the BRIDGE-MIB to retrieve MAC address entries from a Cisco switch efficiently without requiring CLI parsing or web interfaces.

Exam trap

The trap here is that candidates often confuse NETCONF (a configuration protocol) with SNMP (a monitoring protocol), or assume REST API is universally available on all network devices, when in fact SNMP remains the standard for reading operational tables like MAC addresses on traditional Cisco switches.

How to eliminate wrong answers

Option A is wrong because SSH with CLI scraping is fragile, slow, and requires parsing human-readable output (e.g., 'show mac address-table'), which is not a standardized or reliable automation method for data retrieval. Option B is wrong because HTTPS with Web UI is designed for human interaction via a browser, not for programmatic data extraction, and lacks a structured data format for automation. Option C is wrong because REST API is not natively supported on most Cisco switches for MAC address table retrieval; it is typically used for cloud or controller-based devices (e.g., Cisco DNA Center), not direct switch access.

Option D is wrong because NETCONF is a configuration management protocol (RFC 6241) that uses YANG models for structured data, but it is not commonly used for reading dynamic operational tables like MAC addresses; SNMP is the standard for such read-only monitoring.

Full explanation →
Page 4

Page 5 of 14

Page 6

All pages

1234567891011121314

Practice 200-901 by domain

Target a specific domain to shore up weak areas.

Application Deployment and SecuritySoftware Development and DesignUnderstanding and Using APIsCisco Platforms and DevelopmentNetwork FundamentalsInfrastructure and Automation
See all domains with question counts →