Cisco DevNet Associate 200-901 (200-901) — Questions 376–450

Status codes are the primary signal of success or failure in HTTP. Checking them first prevents the code from misinterpreting an error payload as valid data. For example, a 404 or 500 may return a different JSON shape than a 200, so branching on the status code avoids schema errors and lets the program route to error handling cleanly.

WPA3 mandates SAE (Simultaneous Authentication of Equals), replacing WPA2's PSK handshake and providing forward secrecy plus 192-bit Enterprise mode. That stronger encryption and resistance to offline dictionary attacks make it the recommended enterprise standard, satisfying the 2023 requirement.

AAAA records map a hostname to an IPv6 address, satisfying the requirement to resolve names to IP addresses. Where A records handle IPv4, AAAA provides the 128-bit equivalent, making it one of the standard hostname-to-address mappings alongside A and CNAME.

Circuit Breaker isolates failing downstream dependencies by tripping to an open state after a threshold of errors, returning fallback responses instead of cascading timeouts. This satisfies the stem's requirement for a common microservices design pattern, preventing a single unavailable service from exhausting threads and degrading the entire distributed system.

The build key names the directory containing the Dockerfile, so Compose builds the image from that context rather than pulling a prebuilt one. Specifying image alone would only tag or fetch an existing image, failing the requirement to build from the current directory.

Each microservice runs as a separate deployable unit, so teams can release and scale it independently without rebuilding the whole application. A monolith must be deployed and scaled as one artefact, which is the constraint this advantage directly addresses.

A healthScore of 10 is very low, indicating genuine degradation rather than a reporting quirk. The score aggregates device reachability, client onboarding and performance, so examining Branch1's devices and links is the appropriate first diagnostic step.

Configuring the deploy stage to depend on a successful security scan, and having the scan return a non-zero exit code on findings, causes the pipeline to halt before deployment. This enforces the gate automatically without manual intervention. It is the standard way to make quality checks mandatory in CI/CD.

NETCONF uses SSH as its transport, and the default port is 830. After the SSH connection is established, the server and client exchange <hello> messages to advertise capabilities and session IDs. This handshake is mandatory before any RPCs can be sent, so opening the SSH session and exchanging hellos is a required step.

HTTP/2 multiplexing lets many request/response streams share one TCP connection, interleaving frames so no stream blocks another. This removes HTTP/1.1's head-of-line queuing per connection, directly satisfying the stem's requirement for concurrent, interleaved exchanges on a single connection.

Merging the feature branch into master integrates completed work into the mainline, satisfying the collaboration requirement that changes reach the shared repository. In a typical Git workflow, the branch's commits are combined via merge, making the feature available to all collaborators before the branch is deleted.

Redis provides a shared, centralised counter store that every application instance reads and writes atomically, so per-API-key request counts remain consistent regardless of which instance handles a request. This satisfies the stem's multi-instance constraint, unlike in-memory limiting, which fragments state across instances and permits exceeding the intended quota.

Webhooks let the bot register a target URL with the /webhooks API; Webex then pushes HTTP POST notifications when messages are posted in the space. This satisfies the real-time requirement without polling, unlike continuously querying the messages endpoint.

PATCH sends only the changed attribute, here the time zone, leaving all other network settings untouched. PUT would require submitting the complete network configuration, risking unintended overwrites, so PATCH satisfies the partial-update constraint in the stem.

The x509 error means the registry's certificate chains to a CA absent from the client's trust store. Installing that CA certificate into the Docker daemon's trusted certificates directory lets the client validate the registry's TLS chain, resolving the pull failure described in the stem.

A GitHub webhook pushes an event to Jenkins the moment code is pushed to main, triggering the job automatically. This satisfies the requirement for tests to run on push, unlike polling, which introduces delay and unnecessary load.

The Content-Type header declares the media type of the entity body in the request, so setting it to application/json tells Cisco DNA Center to parse the create-site payload as JSON rather than form-encoded or plain text. Without it, the server may reject the request with 415 Unsupported Media Type or misinterpret the body, making this the correct header for the scenario.

Retrieving devices is a read operation, so GET is correct; the intent API path /dna/intent/api/v1/network-device returns the device inventory collection. POST would create resources and PUT would replace them, so GET against that exact path satisfies the stem's requirement.

Ansible playbooks are written in YAML, a human-readable data-serialisation format using indentation-based structure. This satisfies the stem's requirement for the file format commonly used to define Ansible automation tasks, since YAML's declarative syntax maps directly onto Ansible's task, play and inventory constructs.

Hard-coded credentials in pipeline scripts or repositories leak through logs and version control. A dedicated secrets management service stores the ACI credentials externally and injects them at runtime, so the pipeline references the secret rather than embedding it, satisfying the secure credential management requirement.

Digital signatures bind the released artifact to a private key that only the trusted pipeline can use, so a stolen account credential alone cannot forge a valid release. Consumers who verify the signature reject artifacts not signed by the expected key. This provides the cryptographic guarantee that a compromised account cannot publish malicious code that passes verification.

Pinning exact versions with == ensures that every environment installs the same package versions, preventing unexpected behavior from newer releases. This is a cornerstone of reproducible builds. When combined with a virtual environment, it guarantees that the dependencies resolved during development match those in testing and production, which is essential for collaborative projects and consistent API interactions.

The requests library exposes the numeric HTTP status code of the server's reply through the status_code attribute, so a script can compare it against values such as 200, 401, or 429 and branch its retry logic accordingly. This is the standard, documented way to read the code without parsing the raw message, making it the right choice for a Webex integration that must react to rate limiting or authentication failures.

Output encoding converts user-supplied characters into safe HTML entities before rendering, so injected script tags are displayed as text rather than executed. This directly neutralises the stored or reflected XSS vector described in the stem.

NSO's RESTCONF northbound API natively supports both JSON and XML payloads, satisfying the requirement for formats the interface accepts without conversion. YAML is used for service models but is not a native RESTCONF media type.

TCP guarantees reliable, ordered delivery through sequence numbers, acknowledgements and retransmission, and establishes connections via the three-way SYN, SYN-ACK, ACK handshake. This satisfies the stem's explicit requirements for both ordered reliable delivery and handshake-based connection establishment, which connectionless UDP cannot provide.

HTTP 429 signals the Meraki Dashboard API rate limit has been exceeded. The Retry-After header specifies the number of seconds the client must wait before issuing another request; retrying earlier risks further throttling. This is a throttling response, not an authentication or server error.

Task management belongs to the Platform API category, exposing asynchronous job operations such as checking task status and results. It lets callers track long-running operations initiated through other DNA Center APIs, distinct from Intent or Know Your Network categories.

Multi-Exit Discriminator is evaluated after local preference and AS-path length in BGP best-path selection, and a lower MED is preferred. Since both routes tie on the earlier attributes, the shorter MED wins, satisfying the stem's stated tie-breaking condition.

NETCONF runs over an SSH subsystem and Cisco IOS XE listens on TCP port 830 for NETCONF sessions. The ncclient library's connect method uses the SSH transport by default, so specifying port 830 with SSH is the correct combination for retrieving configuration from the device.

VLANs logically partition a single physical switch into isolated Layer 2 segments, each forming its own broadcast domain. This directly satisfies the requirement to separate broadcast domains, cutting broadcast traffic and enforcing segmentation between groups without additional hardware.

git filter-branch rewrites commits across the entire repository history, stripping the sensitive file from every past commit while leaving the working copy untouched. Simpler commands such as git rm only affect future commits, so the file would persist in earlier history.

The json module's load() function reads a file object and deserializes JSON data into a Python dictionary. This directly allows access to the 'username' key. It is the standard, correct approach for parsing a JSON file in Python, handling the conversion from JSON text to native Python objects seamlessly.

git stash saves uncommitted working-tree and index changes onto a stack and reverts the working directory to HEAD, letting the developer switch branches cleanly. The changes are reapplied later with git stash pop, satisfying the temporary-save requirement.

JWT validation at the gateway verifies token signature, issuer, audience and expiry before forwarding requests, so unauthenticated or tampered calls never reach backend microservices. This satisfies the stem's requirement to enable security features at the gateway that protect backend services.

AppRole authentication requires exchanging a `role_id` and `secret_id` at the login endpoint for a Vault client token. That token is then presented in the `X-Vault-Token` header on subsequent requests. This is the documented flow and correctly separates authentication from secret retrieval, making it the right sequence for the CI job.

YANG models represent data as a tree structure.

Ansible's ios_config module with the backup parameter retrieves running configurations from each device and stores them locally, using SSH rather than screen-scraping. Executing one playbook against a 50-router inventory satisfies the scalability constraint, since parallel host execution replaces 50 manual sessions, and Microsoft Entra ID integration is unnecessary for device-level CLI automation.

Terminating SSL/TLS at the reverse proxy decrypts incoming traffic there, then a redirect rule rewrites any HTTP request to HTTPS, so every client connection is forced onto TLS. This directly satisfies the requirement to enforce HTTPS across the web application.

Twelve-factor apps store configuration in the environment, so reading the token from an environment variable lets the same artifact run in lab and production with different values. This removes secrets from source code and enables per-environment configuration without rebuilding or editing files, satisfying the stated requirement.

This command uses the correct HTTP method (GET) and sets the Accept header to 'application/yang-data+json', which tells the RESTCONF server to return the data in JSON format according to the YANG data model. The URL path correctly targets the specific interface using the ietf-interfaces module.

Snyk scans manifest and lock files against vulnerability databases, flagging known CVEs in third-party packages and their transitive dependencies. This directly satisfies the pipeline's dependency vulnerability scanning stage, unlike SAST or container image scanning tools.

The Authorization header carries credentials, typically as a Bearer token or Basic scheme, in the HTTP request. It satisfies the stem's requirement for passing credentials in the header, unlike Content-Type or Accept, which describe payload format and response preferences.

NX-API is disabled by default on Nexus switches and must be activated with the command 'feature nxapi' in configuration mode. Enabling this feature starts the HTTP/HTTPS listener that accepts JSON-formatted CLI requests, satisfying the stem's prerequisite.

Interfaces-state contains operational data per IETF standard.

The Retry-After header is the standard HTTP mechanism for a server to tell a client how many seconds to wait before making another request. Cisco Webex APIs return this header on 429 responses, so the script should read its value and sleep for that duration before retrying, avoiding further throttling and potential temporary blocking.

An A record maps a hostname to an IPv4 address. Querying for an A record returns the IPv4 address needed to establish the HTTP connection. This is the standard record type for IPv4 resolution and directly answers the scenario's requirement.

The candidate datastore allows a configuration to be staged without affecting the running configuration. After edit-config loads the candidate, the validate operation checks syntax and constraints, and commit applies it atomically. This sequence ensures the change is applied only if validation succeeds, which matches the requirement for validated, atomic deployment.

TCP establishes a connection, sequences segments, acknowledges receipt and retransmits lost data, guaranteeing ordered, reliable delivery. UDP offers neither ordering nor delivery guarantees. The stem's requirement for reliable, ordered delivery therefore maps directly to TCP's transport-layer mechanisms.

The client receives a short-lived authorization code, which it then exchanges at the token endpoint for access and ID tokens. This satisfies the flow's security constraint: tokens are never exposed to the user agent via the front channel, only the single-use code, which is bound to the client and redirect URI.

This ensures the module only takes action if the current state does not match the desired state.

TCP's sequence numbers and acknowledgements guarantee ordered delivery, while windowing provides flow control and unacknowledged segments are retransmitted — exactly the reliability the application demands. The three-way handshake establishes the connection state these mechanisms depend on before any data flows.

Codes in the 4xx class indicate the request itself was flawed, such as 400 for malformed syntax, 401 for missing credentials, 403 for insufficient permission, or 404 for an unknown resource. The script should inspect these codes and avoid blind retries, since resending the same request typically reproduces the same failure until the request is corrected.

The `<edit-config>` operation writes configuration changes into the running datastore, which is exactly what altering a hostname requires. It targets the specified configuration node and applies the new value, satisfying NETCONF's requirement for modifying device configuration rather than merely retrieving state with `<get-config>`.

The three-way handshake consists of SYN, SYN-ACK, and ACK. The client initiates with SYN, the server responds with SYN-ACK, and the client completes the handshake by sending an ACK. This ACK acknowledges the server's SYN and establishes the connection, allowing data transfer to begin.

Identifies the resource.

The Meraki Dashboard API returns pagination metadata in the HTTP Link response header, using rel="next" to point at the following page. A client that reads this header and keeps following the next URL will traverse every page without hand-building offsets or page numbers, which is exactly what the scenario requires.

HTTP 200 means the request succeeded and the response body carries the requested device list, satisfying the engineer's goal of retrieving devices via the Cisco DNA Center REST API. Other 2xx codes also signal success, but 200 specifically confirms data is returned.

GET requests retrieve data without modifying server state, satisfying the read-only requirement for listing devices. The endpoint `/networks/{networkId}/devices` correctly scopes the query to a specific network via the `networkId` path parameter, returning its device collection as JSON. POST, PUT, or DELETE would alter resources, and omitting the network scope would target the wrong resource hierarchy.

Placing the version in the URI path creates a distinct endpoint per version, so clients calling /v1/resource remain unaffected when /v2 is introduced. This satisfies the backward-compatibility constraint by letting old and new contracts coexist without breaking existing consumers.

The NETCONF edit_config() operation writes changes into the candidate datastore, satisfying the requirement to modify configuration without immediately affecting the running state. commit() then promotes the candidate to running, which the stem explicitly demands. This two-step sequence matches the candidate-to-running workflow that NETCONF's distinct datastores enforce.

Netmiko abstracts SSH transport for multi-vendor network devices, handling prompt detection and enable-mode escalation that raw Paramiko requires manually. It satisfies the stem's SSH-based interaction constraint across multiple device types, unlike RESTCONF or SNMP libraries.

Restricting file permissions limits which local users can read the credentials, and excluding the file from version control prevents accidental commits that would expose secrets to anyone with repository access. Together these controls reduce the attack surface for a deployed configuration file. They complement, rather than replace, token-based authentication.

The `-L` flag instructs curl to follow HTTP 3xx redirects by reissuing the request to the URL in the Location header. Because the original request used `-I` (HEAD), curl will still issue HEAD requests on the redirect chain, so it will not print a body; to see the final body, the developer should also drop `-I` or use `-o`/`-O` with `-L`. In this scenario, adding `-L` is the correct mechanism to resolve the 301 automatically.

It is administratively down, so no traffic can pass.

The Retry-After header is a standard HTTP response header that indicates how many seconds the client should wait before making a follow-up request. When the Webex API returns 429 Too Many Requests, it includes Retry-After so the client can pause accordingly, avoiding further throttling and ensuring the script respects the service's rate limits.

Declarative models require the operator to define the intended end state, such as interfaces up with specific VLANs, leaving the tool to reconcile actual against desired. This contrasts with imperative models that list sequential commands.

YANG provides standardised, hierarchical data models that NETCONF encodes in XML, giving automation tools machine-readable schema and validation. SNMP's flat MIB structure and opaque OIDs cannot express configuration intent this precisely, satisfying the structured-model benefit.

Tokens expire after a defined lifetime, and protected calls then return an authentication error. Detecting that response and logging in again to refresh the token keeps the script running unattended, which is essential for long-lived automation that cannot rely on a single token lasting forever.

TFTP runs over UDP port 69 with no authentication or encryption, making it the simplest option for copying a configuration file across the same network. FTP and SCP require credentials, violating the stem's no-authentication constraint.

Namespaces partition a single cluster into logically isolated virtual clusters, so each team's objects, quotas and RBAC bindings stay scoped to their own boundary. This directly satisfies the stem's requirement that one team deploy applications without interfering with other teams sharing the same cluster.

NETCONF maps YANG data-exists violations to the in-use error-tag, meaning the target datastore already holds the node being created. The edit is rejected because the configuration being added already exists, so the engineer must merge or replace rather than create it.

MVC directly satisfies the stem's three-component split: the Model handles data and business rules, the View renders the UI, and the Controller processes input and mediates between them. This separation of concerns is precisely the interconnected Model-View-Controller architecture the question describes.

HTTP 429 signals rate limiting, so retrying immediately would worsen the condition. Exponential backoff progressively increases the delay between retries, satisfying the stem's best-practice requirement by giving the server time to recover while respecting its rate limits.

UDP is connectionless and low-latency; packet loss is acceptable in this scenario.