989 questions total · 14pages · All types, answers revealed
TLS uses asymmetric encryption (public key) to securely exchange a symmetric key for bulk encryption.
A CI/CD pipeline for a microservice application includes stages: code commit, build Docker image, push to registry, deploy to staging, run integration tests, and deploy to production. The team wants to ensure that if integration tests fail, the pipeline stops and does not proceed to production. Which CI/CD concept is used to enforce this behavior?
Stage gates control progression based on conditions.
Why this answer
Stage gates are conditional checkpoints in a CI/CD pipeline that evaluate predefined criteria before allowing the pipeline to proceed to the next stage. In this scenario, the integration test stage acts as a gate: if the tests fail, the gate blocks the pipeline from advancing to the production deployment stage, ensuring only validated code reaches production.
Exam trap
Cisco often tests the distinction between pipeline control mechanisms (stage gates) and deployment strategies (rolling updates), so candidates mistakenly choose a deployment method when the question is about conditional pipeline flow.
How to eliminate wrong answers
Option B (Rolling update) is wrong because it is a deployment strategy that gradually replaces instances of an application with a new version, not a mechanism to halt a pipeline based on test results. Option C (Container orchestration) is wrong because it refers to managing container lifecycles (e.g., scaling, scheduling) using tools like Kubernetes, not to pipeline conditional logic. Option D (Artifact management) is wrong because it involves storing and versioning build outputs (e.g., Docker images) in a registry like Docker Hub or Nexus, not enforcing pipeline flow control.
A Kubernetes pod needs to read configuration data such as database hostname, which is non-sensitive and may change across environments. Which resource should be used to store this data and inject it into the pod?
ConfigMap is designed for non-sensitive configuration.
Why this answer
ConfigMap stores non-sensitive configuration data. Secret stores sensitive data. Deployment and Service are for workload and networking.
A network administrator wants to use EEM on an IOS XE device to send a syslog message whenever a specific CLI command is entered. Which event detector should be used?
Correct. EEM can match CLI commands and execute actions.
Why this answer
EEM can trigger on CLI command entry using 'cli match' event.
In a Docker Compose file, you want to ensure that the 'web' service starts only after the 'db' service is healthy. Which key should you use under the 'web' service?
depends_on with condition: service_healthy ensures the dependent service is healthy before starting.
Why this answer
In Docker Compose, the `depends_on` key with the `condition: service_healthy` option ensures that the `web` service starts only after the `db` service has passed its health check. This is defined in the `db` service using a `healthcheck` directive, and Compose waits for the healthy state before starting dependent services.
Exam trap
The trap here is that candidates often assume `depends_on` alone (without `condition: service_healthy`) guarantees the dependent service is ready, but it only waits for the container to start, not for it to be healthy.
How to eliminate wrong answers
Option A is wrong because `networks` defines which Docker networks a service connects to, not startup ordering or dependency health. Option B is wrong because `links` is a legacy feature for network connectivity between containers (like an alias) and does not control startup order or health status; it has been superseded by user-defined networks.
An engineer is automating the configuration of SNMP on Cisco routers using Ansible. Which two modules are commonly used for this purpose? (Select TWO)
This module can push arbitrary CLI commands including SNMP-related ones.
Why this answer
The cisco.ios.ios_config module is correct because it allows you to push raw CLI configuration lines to Cisco IOS devices, including SNMP-related commands like 'snmp-server community' or 'snmp-server host'. The cisco.ios.ios_snmp_server module is correct because it is a dedicated Ansible module that provides structured, idempotent management of SNMP server settings (e.g., communities, hosts, traps) without requiring raw CLI lines.
Exam trap
Cisco often tests the distinction between general-purpose modules like ios_config and purpose-built modules like ios_snmp_server, expecting candidates to recognize that both can configure SNMP but the dedicated module is more appropriate for structured automation.
Which THREE are characteristics of OSPF? (Choose three.)
Cost is derived from bandwidth.
Why this answer
Which TWO commands are used to view information about Docker containers? (Select two.)
Streams container logs for monitoring.
Why this answer
docker ps -a lists all containers (including stopped), and docker logs -f shows logs of a container.
Refer to the exhibit. A Python script uses the YANG model to configure the interface. After applying this JSON payload via a PATCH request, what is the expected operational state of the interface?
enabled: false sets admin down.
Why this answer
The PATCH request applies the provided JSON payload, which sets the interface's 'enabled' leaf to 'false' (or equivalent YANG leaf for administrative state). In YANG models for interfaces (e.g., RFC 8343 or Cisco native models), setting 'enabled' to false places the interface in an administratively down state. The PATCH operation is valid for modifying interface configuration, and the payload explicitly changes the administrative state to down, overriding any previous configuration.
Exam trap
Cisco often tests the distinction between administrative state (controlled by the 'enabled' leaf) and operational state (which includes protocol status), and the trap here is that candidates may assume PATCH cannot modify administrative state or that the interface remains up if only a partial payload is sent.
How to eliminate wrong answers
Option A is wrong because PATCH is a standard HTTP method allowed on interfaces in RESTCONF/NETCONF for partial updates; there is no restriction against using PATCH on interface resources. Option B is wrong because the JSON payload explicitly sets the 'enabled' leaf to false, which changes the administrative state; the interface does not remain as previously configured. Option D is wrong because the payload sets 'enabled' to false, which results in an administratively down state, not up; protocol state is irrelevant when the interface is administratively down.
Refer to the exhibit. A developer receives this response when making a POST request to the Cisco DNA Center API to create a new device. What is the most likely issue?
The error message clearly indicates the missing parameter 'ipAddress'.
Why this answer
The error response includes a field 'missingParameters' with the value 'ipAddress', which explicitly indicates that the request body did not include the required 'ipAddress' field. Cisco DNA Center's API for device creation requires this field to identify the device on the network. Without it, the API cannot proceed with adding the device, resulting in a 400 Bad Request.
Exam trap
Cisco often tests the ability to read API error responses carefully, where candidates might overlook the 'missingParameters' field and incorrectly assume a token or endpoint issue instead of a missing required field.
How to eliminate wrong answers
Option B is wrong because the API endpoint is likely correct; a wrong endpoint would typically return a 404 Not Found or a different error message, not a 'missingParameters' error. Option C is wrong because if the IP address were already in use, the API would return a conflict error (e.g., 409 Conflict) with a message like 'Device already exists', not a missing field error. Option D is wrong because an expired token would result in a 401 Unauthorized or 403 Forbidden response, not a 400 Bad Request with parameter validation details.
Refer to the exhibit. A developer is parsing the output of 'show ip route' using Python. Which regular expression would extract the prefix '10.0.1.0/24'?
Correctly anchors at line start and captures prefix.
Why this answer
The regex `^S\s+(\d+\.\d+\.\d+\.\d+/\d+)` matches lines starting with 'S' (static route) followed by whitespace, then captures the entire prefix including both the IP address and subnet mask in CIDR notation (e.g., 10.0.1.0/24). This ensures the extracted string is exactly the prefix as it appears in the 'show ip route' output.
Exam trap
Cisco often tests the distinction between capturing only the IP address versus the full CIDR prefix, leading candidates to pick options that omit the subnet mask (like Option B) or use overly broad patterns (like Option C) that match unintended fields.
How to eliminate wrong answers
Option A is wrong because `\d+/\d+` matches only digits separated by a slash (e.g., 10/24), which does not match the dotted-decimal IP address format. Option B is wrong because `.*` is greedy and `(\d+\.\d+\.\d+\.\d+)` captures only the IP address without the subnet mask (/24), so the prefix is incomplete. Option C is wrong because `\S+` captures any non-whitespace characters after 'S', which could include the next field (e.g., the next-hop IP) rather than the prefix, and it does not anchor to the start of the line, risking false matches.
Which HTTP method is used to partially update a resource in a RESTful API?
PATCH is used for partial updates.
Why this answer
PATCH is used for partial updates, while PUT replaces the entire resource.
Match each YAML structure to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Scalar mapping
List item
Comment line
Nested mapping
Block scalar (literal)
Why these pairings
In YAML, a mapping (dictionary) uses key: value pairs; a sequence (list) uses '- ' items; a scalar is a single value. The distractors swap definitions or apply collection concepts to scalars.
PortFast eliminates the learning/listening delays.
Why this answer
The 'spanning-tree portfast' command on a switch interface connected to an end host (like a PC) allows that port to bypass the listening and learning states and transition directly to the forwarding state. This is correct because PortFast is designed for access ports that connect to end devices, which do not participate in spanning tree, thereby eliminating the 30-second delay (15 seconds for listening, 15 seconds for learning) and providing immediate connectivity.
How to eliminate wrong answers
Option A is wrong because PortFast does not disable STP on the interface; STP remains active, and the port can still send and receive BPDUs (though it will not transition through the usual states). Option B is wrong because PortFast does not prevent the interface from entering the blocking state; if a BPDU is received on a PortFast-enabled port, the port will still move to the blocking state (unless BPDU guard is also configured). Option D is wrong because BPDU guard is a separate command (spanning-tree bpduguard enable) that shuts down the port upon receiving a BPDU, while PortFast alone does not enforce this behavior.
Option E is wrong because PortFast is not related to Rapid Spanning Tree Protocol (RSTP); it is a Cisco proprietary enhancement for classic STP (802.1D) and also works with RSTP, but it does not enable RSTP itself.
An engineer is configuring Cisco IOS XE device programmability using RESTCONF. Which THREE of the following are required to enable and use RESTCONF on the device?
RESTCONF runs over HTTP/HTTPS, so the server must be enabled.
Why this answer
To enable RESTCONF on Cisco IOS XE, the following are required: enable the HTTP/HTTPS server (option B) to allow RESTCONF communication; enable the 'restconf' feature (option C) to activate RESTCONF services; and enable the 'netconf-yang' feature (option E) because RESTCONF relies on the YANG infrastructure provided by netconf-yang. Option A is incorrect because RESTCONF can use any YANG model, not only Cisco native models. Option D is incorrect because the RESTCONF API endpoint is '/restconf', not '/rest'.
You are deploying a new data center network using Cisco Nexus switches. The design uses Virtual Port Channel (vPC) to provide redundancy and increased bandwidth to servers with dual-homed NICs. The two vPC peer switches are NX1 and NX2, and they are connected via a peer-link. The servers are configured with active/standby NIC teaming. After the deployment, you notice that some ARP requests from servers are not being responded to, leading to connectivity issues. Analysis shows that when a server sends an ARP request for its default gateway (which is a virtual IP on the vPC), only one of the peer switches responds, but the response does not reach the server intermittently. The vPC is correctly configured, and the peer-gateway feature is enabled. What is the most likely cause?
Peer-gateway only responds to ARP on vPC member ports, not on peer-link.
Why this answer
With active/standby NIC teaming, the server sends ARP requests for the default gateway from the active NIC. If the active NIC is connected to NX2 (the standby vPC peer for that server's MAC), NX2 receives the ARP request and forwards it over the peer-link to NX1. The peer-gateway feature allows a vPC peer to respond to ARP requests for the virtual gateway IP, but it does not respond to ARP requests received over the peer-link (only to those received on a vPC member port).
Therefore, NX1 does not respond, and the ARP request times out, causing intermittent connectivity.
How to eliminate wrong answers
Option A is wrong because HSRP is not used in a vPC design; the virtual gateway IP is typically configured as a routed interface on both peers with the peer-gateway feature, and split-brain is prevented by the vPC keepalive and peer-link, not by HSRP. Option B is wrong because STP does not block the vPC peer-link; vPC uses a special STP configuration where the peer-link is always forwarding, and STP is not the cause of intermittent ARP failures. Option C is wrong because MAC pinning is not relevant to ARP responses; MAC pinning ensures traffic from a server is forwarded by the correct vPC member switch, but the issue here is about ARP request forwarding and response behavior, not MAC address location.
A developer is using NETCONF to retrieve the running configuration of a network device. Which operation should be used?
This retrieves configuration from a specified datastore.
Why this answer
The <get-config> operation retrieves configuration from a datastore (e.g., running).
A team uses Git for source control. They want to ensure that all code committed to the main branch passes unit tests and linting. Which Git workflow practice best ensures this?
Pre-commit hooks run tests locally before commit, and CI blocks merges that fail tests.
Why this answer
Pre-commit hooks run unit tests and linting locally before a commit is created, preventing failing code from entering the repository. A CI pipeline then verifies the same checks on the remote branch before allowing a merge to main, ensuring only passing code is integrated. This combination enforces quality gates at both the developer workstation and the server side, directly addressing the requirement to block failing commits.
Exam trap
Cisco often tests the distinction between a workflow that merely organizes branches (like GitFlow or trunk-based development) and one that actively enforces quality gates (like pre-commit hooks combined with CI), leading candidates to confuse branching strategies with automated validation mechanisms.
How to eliminate wrong answers
Option B is wrong because trunk-based development with feature toggles focuses on short-lived branches and hiding incomplete features behind flags, but it does not inherently enforce unit tests or linting before merging to main. Option C is wrong because feature branching with manual merge relies on human review and does not automatically run or block commits based on test or lint results, leaving the main branch vulnerable to failing code. Option D is wrong because GitFlow with hotfix branches is a branching model that structures releases and patches but provides no built-in mechanism to enforce unit tests or linting before commits reach main.
In a CI/CD pipeline for network changes, which practice best ensures that a configuration push does not disrupt production traffic?
Canary deployment limits blast radius.
Why this answer
Canary deployment is the correct practice because it gradually introduces the configuration change to a small subset of devices or traffic before full rollout. This allows monitoring for adverse effects and automatic rollback if issues arise, minimizing the risk of production disruption. In a CI/CD pipeline for network changes, this approach aligns with incremental validation and risk mitigation.
Exam trap
Cisco often tests the misconception that 'push all changes at once' is efficient and safe, but the trap here is that it ignores the principle of incremental risk reduction, which is fundamental to CI/CD best practices for network automation.
How to eliminate wrong answers
Option A is wrong because disabling rollback removes the safety net to revert a failed configuration push, increasing the risk of prolonged disruption. Option C is wrong because pushing all changes at once maximizes the blast radius and makes it difficult to isolate the cause of any failure. Option D is wrong because skipping validation bypasses critical checks (e.g., syntax, reachability, or policy compliance), which can directly cause misconfigurations that disrupt traffic.
Match each CI/CD concept to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Automatically build and test code changes
Automatically deploy to staging after CI
Automatically deploy to production after CI
Compile source code into artifacts
Sequence of automated steps for delivery
Why these pairings
Continuous Integration (CI) focuses on merging and automated testing. Continuous Delivery (CD) ensures code is always ready for production deployment but requires manual approval. Continuous Deployment (CDep) automates deployment to production after tests pass.
Common confusions involve swapping definitions of CI and CD or CDep.
Which wireless security standard provides the strongest encryption and is recommended for enterprise networks as of 2023?
Correct. WPA3 provides the best security.
Why this answer
WPA3 is the latest standard with stronger encryption (SAE) and is recommended for modern networks.
An administrator is configuring DNS records for a company's domain. Which three DNS record types are most commonly used to map hostnames to IP addresses or aliases? (Choose three.)
AAAA record maps a hostname to an IPv6 address.
Why this answer
The A record maps a hostname to an IPv4 address, the AAAA record maps a hostname to an IPv6 address, and the CNAME record maps an alias hostname to the canonical (true) hostname. These three are the most common DNS record types used for hostname-to-IP or alias resolution in both IPv4 and IPv6 networks.
Exam trap
Cisco often tests the distinction between forward-mapping records (A, AAAA, CNAME) and service-specific or reverse records (MX, PTR), leading candidates to mistakenly include MX or PTR when the question explicitly asks for hostname-to-IP or alias mapping.
Which THREE of the following are common design patterns for microservices? (Choose three.)
Correct: Circuit Breaker is used for fault tolerance.
Why this answer
The Circuit Breaker pattern (B) is a common microservices design pattern that prevents cascading failures by monitoring for failures and opening a circuit to stop requests to a failing service, allowing it to recover. It is widely implemented in frameworks like Netflix Hystrix or Resilience4j, where states (closed, open, half-open) control request flow and timeout thresholds.
Exam trap
Cisco often tests the distinction between general software design patterns (like Singleton or Chain of Responsibility) and patterns specifically designed for microservices architecture, such as Circuit Breaker, Service Registry, and API Gateway.
In a docker-compose.yaml file, which key is used to define the container image to be built from a Dockerfile in the current directory?
'build' specifies the build context for creating an image.
Why this answer
The 'build' key specifies the path to the Dockerfile context; 'image' specifies a pre-built image from a registry.
A developer needs to ensure that microservice A can securely communicate with microservice B over HTTPS within a Kubernetes cluster. What is the simplest approach?
ClusterIP services are internal and can be used with TLS termination within the cluster for secure communication.
Why this answer
Using a ClusterIP Service for microservice B provides a stable DNS name within the cluster, allowing microservice A to communicate over HTTPS without exposing the service externally. This approach leverages Kubernetes' internal service discovery and can be paired with a service mesh or mutual TLS (mTLS) for secure communication, meeting the requirement for simplicity and security.
Exam trap
The trap here is that candidates often assume external-facing components like Ingress or LoadBalancer are required for HTTPS, but Kubernetes internal services can use HTTPS with ClusterIP and proper certificate management, which is simpler and more secure for east-west traffic.
How to eliminate wrong answers
Option A is wrong because an Ingress resource with TLS termination is designed for external traffic entering the cluster, not for internal service-to-service communication within the same cluster, and it adds unnecessary complexity. Option B is wrong because exposing microservice B via a LoadBalancer Service makes it publicly accessible, which is overkill and insecure for internal communication, and it introduces external dependencies. Option C is wrong because connecting directly using the pod IP over HTTP bypasses service abstraction, making the communication insecure (no HTTPS) and brittle, as pod IPs can change on restarts.
A developer is designing a microservices architecture for a network monitoring application. Which of the following is a key advantage of microservices over a monolithic architecture?
Each microservice can be deployed and scaled independently, improving resource utilization.
Why this answer
Microservices architecture enables each service to be deployed, updated, and scaled independently without affecting other services. This is a key advantage over monolithic architectures, where any change requires rebuilding and redeploying the entire application. For a network monitoring application, independent scalability allows resource-intensive services (e.g., packet capture) to scale separately from lightweight services (e.g., alerting).
Exam trap
Cisco often tests the misconception that microservices simplify communication or reduce latency, when in reality they introduce network overhead and complexity, making independent deployability and scalability the primary advantage.
How to eliminate wrong answers
Option A is wrong because microservices typically use inter-process communication (e.g., HTTP/REST, gRPC, or message queues), which introduces higher latency compared to in-process function calls in a monolithic application. Option B is wrong because microservices split the codebase into multiple smaller repositories, each maintained by separate teams, making the overall system more complex to manage than a single monolithic codebase. Option D is wrong because inter-service communication in microservices is inherently complex, requiring handling of network failures, serialization, and service discovery (e.g., via Consul or Kubernetes DNS), unlike monolithic architectures where components communicate via direct function calls.
For VLAN creation, a mandatory 'interface' field (e.g., port membership) or 'vlanType' is required.
Why this answer
The REST API request is targeting the creation of a network interface on a Cisco Catalyst 9000 switch running IOS XE. The 400 Bad Request indicates a missing required field in the JSON payload. According to the Cisco IOS XE REST API documentation for the `/api/v1/interface` endpoint, the `interface` field (which specifies the interface name, e.g., 'GigabitEthernet1/0/1') is mandatory when creating a new interface.
Without it, the API cannot determine which interface to configure, resulting in a 400 error.
Exam trap
Cisco often tests the distinction between the `interface` field (the actual interface identifier) and the `name` field (which is not used in this API), leading candidates to incorrectly choose `name` as the missing field.
How to eliminate wrong answers
Option A is wrong because `vlanId` is only required when configuring a VLAN interface (e.g., a subinterface or SVI), not for a physical interface creation. Option B is wrong because `description` is an optional field used for administrative labeling and is not required for the API to process the request. Option D is wrong because `name` is not a standard field in the IOS XE REST API interface payload; the correct field is `interface` which holds the interface identifier.
Refer to the exhibit. A network engineer runs a script that queries the Cisco DNA Center site health API. The response shows Branch1 with a healthScore of 10. What is the most likely action to improve Branch1's health?
Low health score indicates problems at the site.
Why this answer
A healthScore of 10 on a scale of 0–100 indicates severe degradation, typically caused by network device failures, link flaps, or connectivity loss. Investigating the network devices and connectivity at Branch1 is the correct first step to identify and resolve the root cause, such as a down switch or a routing issue.
Exam trap
Cisco often tests the misconception that API response issues (like authentication or version) are the cause of low health scores, when in fact the API is correctly reporting a real network fault that must be investigated on the infrastructure side.
How to eliminate wrong answers
Option B is wrong because increasing the number of clients would likely worsen the health score by adding more load to an already failing network, and client count is not a direct lever for improving device or site health. Option C is wrong because the script successfully queried the API and received a valid response (healthScore of 10), so the authentication token is valid and not the issue. Option D is wrong because the API version is irrelevant to the health score value; using a different version would not change the underlying network condition that caused the low score.
In HTTP/2, which feature allows multiple concurrent requests and responses to be interleaved on a single connection, improving performance?
Multiplexing allows multiple streams on one connection.
Which TWO of the following are essential steps in a typical Git workflow when collaborating on a feature branch? (Choose two.)
Merging integrates the feature back into the main branch.
Why this answer
Creating a branch isolates work, and merging integrates it back. While rebasing is common, the question asks for essential steps; merge is more fundamental than rebase.
A developer is designing an API that needs to support rate limiting per API key. The application is deployed on multiple instances. Which approach ensures consistent rate limiting across all instances?
Redis provides a shared counter accessible from all instances.
Why this answer
A distributed cache like Redis provides a shared, atomic counter that all application instances can read and increment, ensuring consistent rate limiting across a multi-instance deployment. Redis supports atomic operations like INCR and EXPIRE, which are essential for implementing sliding window or token bucket algorithms without race conditions.
Exam trap
Cisco often tests the misconception that local counters or environment variables can be used for distributed state, when in fact they lack the shared, atomic, and persistent storage required for multi-instance rate limiting.
How to eliminate wrong answers
Option A is wrong because a local in-memory counter is per-instance and cannot synchronize across multiple instances, leading to inconsistent rate limits. Option B is wrong because a file-based lock introduces severe performance bottlenecks and is not designed for high-throughput distributed systems; it also fails to provide atomic counters. Option C is wrong because environment variables are static configuration values and cannot be dynamically updated or shared across instances to track real-time request counts.
In a Dockerfile, which instruction is used to set an environment variable that will be available at runtime?
ENV sets environment variables for the container runtime.
Why this answer
ENV sets environment variables in the image that persist when the container runs.
Which TWO of the following are valid branching strategies in Git? (Choose two.)
A comprehensive branching model with master, develop, feature, release, and hotfix branches.
Why this answer
GitFlow is a valid branching strategy that defines a strict model for managing releases, hotfixes, and feature development using dedicated branches like 'develop', 'release/*', and 'hotfix/*'. It is widely used in enterprise environments to maintain a clean history and support parallel development.
Exam trap
Cisco often tests the distinction between actual branching strategies (like GitFlow and Feature branching) and Git's internal mechanisms (like copy-on-write) or non-standard terms (like linear or monolithic branching) to see if candidates confuse implementation details with workflow models.
A network administrator automates the provisioning of Meraki MX security appliances using the Meraki Dashboard API. The Python script reads a CSV file with site details and creates VLANs, firewall rules, and VPN settings. Recently, the script started throwing an HTTP 429 error. The script is single-threaded and makes fewer than 10 requests per second. Which of the following is the most likely cause of the 429 error?
Rate limits are applied at multiple levels; organization-level limit may be lower.
Why this answer
The HTTP 429 (Too Many Requests) error indicates the client has exceeded the rate limit imposed by the Meraki Dashboard API. Even though the script makes fewer than 10 requests per second, the organization-level rate limit can be lower than the default API key limit. Option D is correct because the organization's rate limit overrides the default, and the script's request rate may still exceed that lower threshold.
Exam trap
The trap here is that candidates assume the default API key rate limit is the only constraint, overlooking that the organization-level rate limit can be lower and is the actual cause of the 429 error.
How to eliminate wrong answers
Option A is wrong because an API key revocation would return a 401 Unauthorized error, not a 429. Option B is wrong because the script makes fewer than 10 requests per second, so a 5 requests per second limit would not be exceeded; the error would only occur if the script actually surpassed that rate. Option C is wrong because Meraki cloud maintenance typically returns a 503 Service Unavailable error, not a 429 rate-limit error.
A Cisco Webex bot needs to receive real-time notifications when new messages are posted in a space. Which API feature should the bot use?
Webhooks provide real-time notifications.
Why this answer
Webex Webhooks allow real-time event notifications; the bot registers a webhook with a target URL that receives POST requests when events occur.
A network engineer is planning to use model-driven programmability with YANG models. Which three statements about YANG models are correct?
Correct. pyang can parse and display YANG models.
Why this answer
A is correct because pyang is a command-line tool that validates and converts YANG models into various formats (e.g., tree, UML, YIN), enabling engineers to explore the structure and semantics of YANG modules. It is widely used in network automation workflows to inspect model hierarchies and dependencies before implementing NETCONF or RESTCONF configurations.
Exam trap
Cisco often tests the distinction between vendor-specific (Cisco native) and vendor-neutral (OpenConfig) YANG models, and the trap here is assuming OpenConfig is vendor-specific because it is often associated with Cisco devices, when in fact it is an open standard.
Refer to the exhibit. The Docker image built from this Dockerfile is larger than expected. Which optimization should be recommended?
Multi-stage builds allow copying only necessary artifacts, significantly reducing the final image size.
Why this answer
Multi-stage builds allow you to use multiple FROM statements in your Dockerfile. You can compile or install dependencies in an intermediate stage using a full-featured base image, then copy only the necessary artifacts (e.g., compiled code, libraries) into a final, minimal runtime image. This dramatically reduces the final image size by discarding build tools, temporary files, and unnecessary layers from the earlier stages.
Exam trap
Cisco often tests the misconception that reducing the number of layers (Option B) or using a smaller base image (Option A) is the primary way to shrink image size, when in fact multi-stage builds are the correct, targeted solution for removing build-time artifacts that inflate the final image.
How to eliminate wrong answers
Option A is wrong because while using a smaller base image like python:3.9-alpine can reduce image size, it is not always the best optimization when the image is larger than expected due to leftover build artifacts or unnecessary dependencies; the question specifically asks for an optimization to address an unexpectedly large image, and multi-stage builds are the standard solution for removing build-time cruft. Option B is wrong because combining RUN and COPY layers does not inherently reduce the final image size; Docker layers are cached and combining them can actually break caching and increase rebuild time, and the size issue is typically caused by including unnecessary files, not by the number of layers. Option C is wrong because the EXPOSE instruction is purely documentation; it does not add any data to the image or affect its size, so removing it has zero impact on image size.
A developer needs to partially update a Meraki network's configuration, changing only the time zone. Which HTTP method should be used on the network resource?
PATCH applies partial modifications.
Why this answer
PATCH is used for partial updates in REST APIs.
Correct. NX-API uses POST to /ins with the CLI commands in the body.
Why this answer
NX-API uses POST to /ins with a JSON or XML payload containing the CLI commands.
An organization uses a private Docker registry with TLS. A developer attempts to pull an image and receives the error: "x509: certificate signed by unknown authority". What is the most likely cause and solution?
This establishes trust in the registry's certificate.
Why this answer
The error 'x509: certificate signed by unknown authority' occurs because the Docker client does not recognize the certificate authority (CA) that signed the registry's TLS certificate. The correct solution is to add the CA certificate to the client's trust store, typically by placing it in /etc/docker/certs.d/<registry_hostname>:<port>/ca.crt on Linux or the equivalent Docker certs directory on other platforms. This allows the Docker daemon to validate the registry's certificate during the TLS handshake.
Exam trap
The trap here is that candidates may confuse a certificate trust issue with a hostname mismatch or think disabling TLS is an acceptable workaround, but Cisco specifically tests the understanding that the correct enterprise-grade fix is to trust the CA, not to weaken security.
How to eliminate wrong answers
Option B is wrong because using the registry's IP address instead of hostname does not resolve a certificate trust issue; it may cause a hostname mismatch error if the certificate is issued to a specific hostname, but the root cause is the untrusted CA, not the address format. Option C is wrong because disabling TLS verification (e.g., setting 'insecure-registries' in Docker daemon config) bypasses security entirely and is not a best practice; it exposes the connection to man-in-the-middle attacks and is not the intended fix for a missing CA certificate. Option D is wrong because using HTTP instead of HTTPS would eliminate TLS entirely, but the registry is configured with TLS and likely rejects plain HTTP connections; this also compromises security and does not address the trust issue.
A team uses GitHub for version control and wants Jenkins to automatically run tests when changes are pushed to the main branch. Which trigger should be configured in the Jenkins job?
A webhook sends an HTTP POST to Jenkins when changes are pushed, triggering the job immediately.
Why this answer
D is correct because a GitHub webhook sends an HTTP POST payload to Jenkins whenever a push event occurs on the main branch, triggering the Jenkins job in real time. This is the most efficient and immediate way to automate CI/CD pipelines in response to code changes, avoiding the need for polling or manual intervention.
Exam trap
Cisco often tests the distinction between event-driven triggers (webhooks) and polling-based triggers (Poll SCM), where candidates mistakenly choose Poll SCM because it is a familiar Jenkins feature, but the question explicitly asks for automatic triggering on push, which webhooks handle without delay.
How to eliminate wrong answers
Option A is wrong because a cron job on the Jenkins server would run builds on a fixed schedule, not in response to a specific Git push event, leading to unnecessary builds or delays. Option B is wrong because Poll SCM every minute checks the repository periodically, which introduces latency and wastes resources compared to an event-driven webhook; it also does not guarantee immediate triggering. Option C is wrong because a manual build trigger requires a user to click 'Build Now' in Jenkins, which defeats the purpose of automated CI when changes are pushed.
A network automation engineer wants to retrieve a list of all network devices from Cisco DNA Center. Which HTTP method and URL path should be used with the DNAC intent API?
Correct: GET retrieves the list of network devices.
Why this answer
The intent API uses GET to retrieve data, and /dna/intent/api/v1/network-device is the correct path for listing network devices.
A DevOps engineer wants to automate the configuration of network devices using Ansible. Which file format is commonly used for Ansible playbooks?
Ansible playbooks are written in YAML, which is human-readable and easy to parse.
Why this answer
Ansible playbooks are written in YAML (YAML Ain't Markup Language) because YAML is human-readable, supports complex data structures like lists and dictionaries, and is designed for configuration files. YAML's indentation-based syntax aligns with Ansible's declarative automation model, making it the default and recommended format for defining tasks, variables, and handlers in playbooks.
Exam trap
Cisco often tests the distinction between Ansible inventory files (which can use INI or YAML) and playbook files (which exclusively use YAML), causing candidates to incorrectly associate INI with playbooks.
How to eliminate wrong answers
Option A is wrong because INI files are used for Ansible inventory definitions (e.g., listing hosts and groups), not for playbooks; playbooks require a structured format that supports sequences and mappings, which INI lacks. Option C is wrong because XML is verbose, less human-readable, and not natively supported by Ansible for playbooks; Ansible uses YAML for its simplicity and readability. Option D is wrong because JSON, while valid for some Ansible configurations (e.g., dynamic inventory scripts), is not the standard format for playbooks; YAML is preferred for its cleaner syntax and reduced boilerplate.
Which of the following is a private IPv4 address range as defined by RFC 1918?
10.0.0.0/8 is a private range.
Why this answer
Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
A team is designing a CI/CD pipeline that uses the Cisco ACI REST API to deploy tenant policies. Which best practice should be followed for secure credential management?
Secrets management services like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault provide secure storage.
Why this answer
Storing credentials in a secrets management service and referencing them in the pipeline is a security best practice. Hardcoding or storing in plain text is insecure.
A developer is deploying a microservice to a Kubernetes cluster. The application needs to read a database password securely without hardcoding it in the image. Which Kubernetes resource should be used?
Secret is designed for sensitive data like passwords.
Why this answer
(Secret) is correct because Kubernetes Secrets are specifically designed to store sensitive data such as database passwords, API keys, and certificates. They can be mounted as files or injected as environment variables into pods, ensuring the password is never hardcoded in the container image. Secrets are base64-encoded and can be encrypted at rest using etcd encryption or external KMS providers, providing a secure mechanism for managing credentials.
Exam trap
Cisco often tests the distinction between ConfigMaps and Secrets, trapping candidates who assume that base64 encoding provides security or that ConfigMaps can safely store passwords because they are 'just configuration.'
How to eliminate wrong answers
Option A is wrong because ConfigMaps are intended for non-sensitive configuration data (e.g., plain text settings) and do not provide encryption or access control for secrets; storing a password in a ConfigMap would expose it in plaintext. Option B is wrong because a ServiceAccount is an identity for pods to authenticate to the Kubernetes API server, not a resource for storing secret data like passwords. Option C is wrong because a PersistentVolume is used for persistent storage of application data (e.g., files, databases) and has no mechanism for securely storing or injecting credentials into a pod.
A Kubernetes Deployment manages a set of identical pods. You update the container image to a new version. The rollout gets stuck. Which kubectl command should you use to view the rollout status and determine the cause?
This command specifically reports the rollout status.
Why this answer
The `kubectl rollout status deployment/my-deployment` command is specifically designed to track the progress of a rollout and report its current state, including whether it is stuck or progressing. It provides real-time status updates and can surface underlying issues like image pull errors or resource constraints that cause the rollout to hang, making it the correct tool for diagnosing a stuck rollout.
Exam trap
Cisco often tests the distinction between commands that show static state (like `describe` or `get pods`) versus commands that monitor dynamic processes (like `rollout status`), trapping candidates who confuse a snapshot of resources with a live status check.
How to eliminate wrong answers
Option B is wrong because `kubectl get pods` only lists pods and their basic status (e.g., Running, Pending), but it does not show the rollout-specific progress, history, or the reason why the rollout is stuck; it lacks the context of the Deployment's rollout strategy. Option C is wrong because `kubectl describe deployment my-deployment` provides detailed configuration and event information about the Deployment, but it does not actively track or report the rollout status in real-time; it shows a snapshot of the current state rather than the progression or blockage of the rollout process.
A developer writes a web application that accepts user input and displays it on a page. To prevent cross-site scripting (XSS), what is the most effective defense?
Output encoding neutralizes script injection.
Why this answer
Output encoding converts special characters (e.g., < >) to HTML entities, so the browser does not interpret them as code. Input validation alone is insufficient for XSS.
A developer is designing a Python script that uses the NSO (Network Services Orchestrator) northbound API. Which data format is natively supported by NSO's RESTCONF API?
RESTCONF supports both JSON and XML encoding.
Why this answer
NSO's RESTCONF API natively supports both JSON and XML data formats, as defined by RFC 8040. RESTCONF uses HTTP methods to manipulate YANG-defined data, and the API can serialize data in either JSON (application/yang-data+json) or XML (application/yang-data+xml) based on the Accept header or Content-Type in the request. This dual-format support allows developers to choose the format that best fits their application's ecosystem.
Exam trap
Cisco often tests the misconception that RESTCONF only supports one format (typically JSON) because of its popularity in modern APIs, but the standard explicitly mandates support for both JSON and XML.
How to eliminate wrong answers
Option A is wrong because YAML is not a natively supported data format for NSO's RESTCONF API; RESTCONF specifically uses JSON and XML as per RFC 8040, and YAML is not defined in the standard. Option B is wrong because while JSON is supported, it is not the only format; RESTCONF also supports XML, so stating 'JSON only' is incorrect. Option C is wrong because XML is supported, but it is not the exclusive format; RESTCONF equally supports JSON, making 'XML only' a false limitation.
A network application requires reliable, ordered delivery of data and uses a three-way handshake to establish a connection. Which transport protocol is being used?
TCP provides reliable, ordered delivery and uses a three-way handshake.
Why this answer
TCP is a connection-oriented protocol that provides reliable, ordered delivery and uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a connection.
A developer is using the Meraki Dashboard API and receives an HTTP 429 status code with a Retry-After header. What is the correct interpretation?
This is the standard rate limiting response.
Why this answer
HTTP 429 status code indicates 'Too Many Requests', meaning the client has exceeded the rate limit imposed by the Meraki Dashboard API. The Retry-After header specifies the number of seconds the client must wait before sending a new request to avoid further throttling. This is a standard rate-limiting mechanism defined in RFC 6585.
Exam trap
Cisco often tests the distinction between HTTP 429 (rate limiting) and 503 (server unavailable), and candidates may confuse Retry-After with a suggestion rather than a mandatory wait period.
How to eliminate wrong answers
Option A is wrong because an invalid API key would result in a 401 Unauthorized or 403 Forbidden status, not 429. Option C is wrong because a 429 status specifically indicates rate limiting, not server unavailability (which would be 503 Service Unavailable), and retrying immediately would continue to exceed the limit. Option D is wrong because a successful request returns a 2xx status code, and a response that is too large would typically result in a 413 Payload Too Large or be handled via pagination, not a 429.
Which TWO of the following are features of the DNA Center 'Platform' API category?
Correct. Platform APIs include task management.
Why this answer
The Platform category includes event notifications and task management.
A network administrator is troubleshooting BGP path selection for a route received from two different ISPs. The routes have the same local preference and AS-path length, but one route has a shorter MED value. Which route will be preferred?
Lower MED is preferred.
Why this answer
In BGP path selection, when routes have the same local preference and AS-path length, the next tiebreaker is the Multi-Exit Discriminator (MED) value. A lower MED value is preferred because it indicates a more desirable entry point into the neighboring AS. Therefore, the route with the shorter MED will be selected.
Exam trap
Cisco often tests the order of BGP path selection steps, and the trap here is that candidates may confuse MED with local preference or AS-path length, or incorrectly think that prefix length or bandwidth plays a role in BGP best-path selection.
How to eliminate wrong answers
Option A is wrong because prefix length (most specific route) is not a BGP path selection attribute; it is used in the routing table for longest-prefix match, not for BGP best-path decision. Option B is wrong because bandwidth is not a standard BGP attribute and is not considered in the BGP path selection algorithm; BGP relies on configured metrics like MED, not physical link speed. Option D is wrong because the question states both routes have the same local preference, so this attribute cannot differentiate them; higher local preference would only matter if they were different.
A company is designing a new branch network. They want to segment traffic into separate broadcast domains to improve security and reduce broadcast traffic. Which technology should be used to achieve this?
VLANs create separate broadcast domains.
Why this answer
VLANs (Virtual Local Area Networks) segment a physical network into multiple logical broadcast domains at Layer 2. By assigning different VLANs to different groups of devices, broadcast traffic is confined to the VLAN, reducing unnecessary propagation and improving security by isolating traffic between segments.
Exam trap
Cisco often tests the misconception that subnetting alone can create broadcast domains, but subnetting is a Layer 3 concept while VLANs are the Layer 2 technology that actually isolates broadcast traffic at the data link layer.
How to eliminate wrong answers
Option A is wrong because Spanning Tree Protocol (STP) prevents loops in redundant Layer 2 topologies by blocking specific ports; it does not create broadcast domains. Option B is wrong because subnetting operates at Layer 3 (IP addressing) to create separate IP networks, but it does not inherently segment broadcast domains at Layer 2; VLANs are the Layer 2 mechanism for broadcast domain separation. Option C is wrong because EtherChannel aggregates multiple physical links into a single logical link for increased bandwidth and redundancy; it does not affect broadcast domain segmentation.
A team is using Git for version control. A developer accidentally committed a sensitive file. Which Git command should be used to remove the file from the repository history while keeping it locally?
This rewrites history to remove the file from all commits, effectively erasing it from the repository.
Why this answer
Git filter-branch, because it rewrites the entire repository history to remove a file from all commits, effectively purging it from the version history while leaving the local working copy untouched. This is the standard Git approach for permanently deleting sensitive data (e.g., passwords, API keys) from the repository's history.
Exam trap
Cisco often tests the distinction between removing a file from future commits (git rm --cached) versus purging it from all history (git filter-branch), trapping candidates who confuse 'keeping locally' with 'removing from history'.
How to eliminate wrong answers
Option A is wrong because git rebase -i (interactive rebase) can only rewrite a linear range of commits, not the entire history, and it does not provide a built-in mechanism to remove a file from all commits without manual, error-prone editing. Option B is wrong because git reset --soft moves the HEAD pointer and leaves changes staged, but it does not remove a file from the repository history; it only affects the current branch's commit pointer and index. Option C is wrong because git rm --cached removes a file from the index (staging area) and future commits, but it does not remove the file from existing commit history, so the sensitive file remains accessible in previous commits.
Refer to the exhibit. An engineer applied this configuration to a Cisco switch port connected to an application server. The server runs a critical business application that should not be disrupted. However, after applying the configuration, the port goes into errdisable state. What is the most likely cause?
BPDU guard errdisables a port if it receives a BPDU, which can happen if the server runs STP or is connected to another switch.
Why this answer
BPDU guard is enabled on the switch port (implicitly or explicitly via spanning-tree bpduguard enable). When the application server sends BPDU frames—perhaps because it is running a software bridge, virtualization host, or has a misconfigured NIC—the switch detects these frames on a port configured with portfast and immediately errdisables the port to prevent a potential bridging loop. This matches the symptom of the port going into errdisable state after applying the configuration.
Exam trap
Cisco often tests the misconception that BPDU guard is only for trunk ports or that PortFast is incompatible with access ports, but the trap here is that candidates overlook how a server can generate BPDU frames (e.g., from a virtual switch or bridging software) and that BPDU guard on an access port will errdisable it.
How to eliminate wrong answers
Option A is wrong because a non-existent VLAN would cause the port to remain in a down or inactive state, not errdisable; the switch would still allow the port to be administratively up but traffic would not pass. Option B is wrong because spanning-tree portfast is specifically designed for access ports (and edge ports) to bypass the listening/learning states; it is fully compatible and commonly used on server-facing access ports. Option C is wrong because switchport mode access is correct for a server connection that belongs to a single VLAN; it is not inherently incorrect and would not cause errdisable by itself.
A developer is using Git for source control. They have made changes to a file and want to temporarily save the changes without committing, then work on a different branch. Which Git command should they use?
Correct: Stashing saves changes for later use.
Why this answer
`git stash` temporarily saves uncommitted changes (both staged and unstaged) to a stack, reverting the working directory to the last commit. This allows the developer to switch branches without losing work, then later reapply the changes with `git stash pop` or `git stash apply`.
Exam trap
Cisco often tests the distinction between temporarily saving work (`git stash`) versus permanently committing or discarding changes, and the trap here is that candidates may think `git checkout` can switch branches regardless of dirty state, ignoring the conflict risk.
How to eliminate wrong answers
Option A is wrong because `git checkout other-branch` will fail if there are uncommitted changes that conflict with the target branch, or it may carry the changes to the other branch unintentionally. Option B is wrong because `git commit -m 'temp'` creates a permanent commit in the commit history, which is not a temporary save and would require later cleanup (e.g., rebase or reset). Option C is wrong because `git reset --hard` discards all uncommitted changes permanently, which is destructive and does not save the work for later use.
A company is implementing an API gateway for its microservices. Which TWO security features should be enabled at the gateway to protect backend services?
Authenticates API requests.
Why this answer
JWT validation at the API gateway ensures that only requests with valid, unexpired, and properly signed JSON Web Tokens are forwarded to backend microservices. This offloads authentication and token verification from individual services, enforcing a consistent security boundary and preventing unauthorized access.
Exam trap
Cisco often tests the distinction between security features that protect the API layer (JWT validation, rate limiting) versus network-level or backend-specific features (DPI, connection pooling), leading candidates to confuse operational optimizations with security controls.
Which TWO of the following are characteristics of Model-Driven Programmability with YANG models?
YANG models represent data as a tree structure.
Why this answer
YANG models define a hierarchical data tree structure that organizes configuration and state data in a parent-child relationship, mirroring the structure of the device's operational and configuration data. This hierarchical representation allows for precise, path-based access to individual data nodes, which is fundamental to model-driven programmability.
Exam trap
Cisco often tests the misconception that YANG models are tied to a single protocol or encoding format, leading candidates to incorrectly associate YANG exclusively with NETCONF or JSON.
An engineer is tasked with automating the backup of running configurations from 50 routers. Which approach is most scalable?
Automates and scales.
Why this answer
An Ansible playbook with the ios_config module's backup option is the most scalable approach because it uses a push-based automation model that can manage all 50 routers from a single control node, leveraging SSH for secure transport and idempotent configuration management without requiring any agent on the routers.
Exam trap
Cisco often tests the misconception that SNMP can be used for configuration backup, but SNMP is designed for read-only monitoring of OIDs, not for retrieving or storing entire configuration files, which requires a file transfer or CLI-based method.
How to eliminate wrong answers
Option A is wrong because manually SSHing to each router is not scalable for 50 devices, introduces human error, and defeats the purpose of automation. Option B is wrong because scheduling a cron job on each router to SCP the config requires individual configuration on every device, does not centralize management, and still relies on per-router setup, which is not scalable. Option C is wrong because SNMP is designed for monitoring and retrieving MIB data, not for capturing full running configurations; it lacks the ability to reliably back up the entire configuration file and is not a standard method for configuration backup.
A developer is deploying a containerized application using Docker Compose. Which TWO statements about Docker Compose are correct?
This is the behavior of docker-compose up.
Why this answer
`docker-compose up` is the primary command that builds images if needed, (re)creates containers, starts them, and attaches to their output. This behavior is documented in the Docker Compose CLI reference and is fundamental to how Compose orchestrates multi-service deployments.
Exam trap
Cisco often tests the misconception that Docker Compose is only for swarm mode or that it requires JSON files, when in fact it works standalone and uses YAML as its native format.
A developer needs to enforce HTTPS for a web application. Which security measure should be implemented in the application or reverse proxy?
This ensures all HTTP traffic is redirected to HTTPS and encrypted.
Why this answer
Enforcing HTTPS requires the reverse proxy or application to terminate incoming SSL/TLS connections (decrypting traffic at the proxy) and then redirect any HTTP requests to HTTPS using a 301 or 302 redirect. This ensures all client traffic is encrypted in transit, meeting security best practices and compliance requirements like PCI DSS.
Exam trap
Cisco often tests the distinction between security measures that protect data in transit (HTTPS/SSL termination) versus those that protect data at rest or during processing (input validation, parameterized queries), leading candidates to confuse application-layer defenses with transport-layer encryption.
How to eliminate wrong answers
Option B is wrong because parameterized queries prevent SQL injection attacks, not enforce HTTPS encryption. Option C is wrong because CORS (Cross-Origin Resource Sharing) configuration controls which domains can access resources via browser cross-origin requests, not transport-layer encryption. Option D is wrong because input validation sanitizes user-supplied data to prevent injection or malformed input, but does not enforce encrypted communication between client and server.
A network engineer is using the Cisco DNA Center API to get site health. The API endpoint returns a large dataset with pagination. The response includes the header 'X-Page-Total-Count'. To retrieve all pages efficiently, what should the engineer implement?
This efficiently retrieves all pages by iterating through page numbers.
Why this answer
The Cisco DNA Center API uses pagination with a page parameter and returns a 'X-Page-Total-Count' header indicating the total number of pages. By implementing a loop that increments the page parameter until all pages are retrieved, the engineer can efficiently fetch all data without overwhelming the API or missing records, using the total count to know when to stop.
Exam trap
Cisco often tests the distinction between REST API pagination patterns (offset/limit vs. page-based with total count) and the trap here is that candidates assume all APIs use 'next' links (like in HAL or JSON:API), but Cisco DNA Center uses explicit page parameters and headers.
How to eliminate wrong answers
Option A is wrong because setting a high limit parameter may exceed the API's maximum allowed limit, causing the request to fail or return truncated data; Cisco DNA Center APIs enforce a maximum page size (e.g., 500 or 1000 records) to prevent server overload. Option C is wrong because the Cisco DNA Center pagination response does not include 'next' links in the response body; it relies on explicit page and total count headers, making recursive following of links inapplicable. Option D is wrong because polling at regular intervals is designed for monitoring changes over time, not for retrieving a complete static dataset; it introduces unnecessary latency and potential data duplication.
Which TWO of the following Python exception handling statements are valid? (Choose two.)
Correct syntax: `except ExceptionType as variable`.
Why this answer
Options A and C are valid Python exception handling statements. Option A uses the correct `as` keyword to bind the exception instance. Option C shows proper syntax with multiple except blocks, where a generic `except:` can follow a specific except.
Option B is invalid because it uses the obsolete comma syntax (`except ZeroDivisionError, e`), removed in Python 3. Option D is invalid because you cannot catch multiple exception types with a single `as` variable using a tuple; the syntax is not supported. Option E is invalid because a bare `except:` clause is considered poor practice and is not a valid 'exception handling statement' in this context—it catches all exceptions without specificity.
Exam trap
Cisco often tests Python 2 vs Python 3 syntax changes, specifically the comma-based exception binding. Candidates may also mistakenly think that catching multiple exceptions with a tuple or using a bare except is valid.
A CI/CD pipeline includes stages for security scanning. Which TWO tools or services are specifically designed for dependency vulnerability scanning?
Snyk is a popular dependency scanning tool.
Why this answer
Snyk is a dedicated security tool that integrates into CI/CD pipelines to scan dependencies for known vulnerabilities using databases like the National Vulnerability Database (NVD) and its own proprietary intelligence. It continuously monitors open-source libraries and container images, providing automated fix pull requests and blocking builds when critical vulnerabilities are found.
Exam trap
Cisco often tests the distinction between tools that perform a specific security function (like dependency scanning) versus general-purpose CI/CD or container tools that can only facilitate security scanning through external integrations.
Authorization header carries credentials like Basic or Bearer tokens.
Why this answer
The Authorization header is the standard HTTP header used to transmit credentials (such as Basic, Bearer, or Digest tokens) to authenticate a REST API client. RFC 7235 defines this header as the mechanism for carrying authentication information from the client to the server, making it the correct choice for passing credentials in the HTTP header.
Exam trap
The trap here is that candidates often confuse the Cookie header with the Authorization header because both can carry tokens, but Cisco tests the specific RFC-defined purpose of the Authorization header for direct credential transmission in REST APIs.
How to eliminate wrong answers
Option B (Host) is wrong because the Host header specifies the target domain and port of the request, as defined in RFC 7230, and has no role in authentication. Option C (Content-Type) is wrong because it indicates the media type of the request body (e.g., application/json) and is used for content negotiation, not for passing credentials. Option D (Cookie) is wrong because while cookies can carry session tokens, they are designed for state management and are not the standard header for direct credential transmission in REST API authentication; the Authorization header is the explicit and preferred method.
A developer wants to use Cisco NX-API on a Nexus switch to execute a CLI command via JSON. What must be enabled on the switch first?
This enables the NX-API feature.
Why this answer
The 'feature nxapi' command enables NX-API on NX-OS.
A junior developer is writing a Python script to gather interface statistics from a Cisco IOS-XE device using NETCONF. They use the 'ncclient' library and successfully connect. They want to retrieve the operational status of all interfaces. Which YANG model and XPATH expression should they use to get the operational data?
Interfaces-state contains operational data per IETF standard.
Why this answer
The 'ietf-interfaces' YANG model defines the '/interfaces-state' container specifically for operational state data (e.g., status, counters), as per RFC 7223. The XPATH '/interfaces-state/interface' retrieves the list of all interfaces with their operational status, which is exactly what the developer needs. The 'ncclient' library can filter using this XPATH to get read-only operational data from a NETCONF-enabled Cisco IOS-XE device.
Exam trap
Cisco often tests the distinction between configuration and operational data in YANG models, and the trap here is that candidates confuse '/interfaces/interface' (configuration) with '/interfaces-state/interface' (operational state), or they pick a too-broad XPATH like '/interfaces-state' instead of the specific list node.
How to eliminate wrong answers
Option B is wrong because 'cisco-native' is a proprietary Cisco model for configuration data, not operational state, and '/native/interface' would return configured interfaces, not their operational status. Option C is wrong because '/interfaces/interface' under 'ietf-interfaces' targets the configuration container, which holds intended settings, not operational state (status, counters). Option D is wrong because '/interfaces-state' is the correct container, but the XPATH is too broad—it returns the entire container rather than the list of interfaces; the developer needs '/interfaces-state/interface' to get each interface's operational data.
A network administrator is deploying a wireless network that supports the latest security standards and high throughput. Which TWO of the following are true regarding Wi-Fi 6 (802.11ax) compared to Wi-Fi 5 (802.11ac)?
OFDMA allows multiple users to share channels efficiently.
Why this answer
Wi-Fi 6 (802.11ax) introduces Orthogonal Frequency Division Multiple Access (OFDMA), which subdivides a channel into smaller resource units (RUs) to serve multiple clients simultaneously, significantly improving efficiency in dense environments compared to Wi-Fi 5's OFDM that allocates the entire channel to a single user per transmission.
Exam trap
Cisco often tests the misconception that Wi-Fi 6 only uses 20 MHz channels or only operates on 5 GHz, confusing it with older standards like 802.11b/g or 802.11a, while the key differentiator is OFDMA and mandatory WPA3 support.
An application requires reliable, ordered delivery of data. Which transport protocol should be used?
TCP ensures reliable, ordered data transfer.
Why this answer
TCP provides reliability, ordered delivery, and connection-oriented communication.
In the OAuth 2.0 authorization code flow, what does the client receive after the user grants authorization?
The code is the intermediate credential.
Why this answer
In the OAuth 2.0 authorization code flow, after the user grants authorization, the authorization server redirects the client with an authorization code in the query string. This code is a temporary credential that the client must exchange for an access token by sending it along with its client credentials to the token endpoint. The authorization code itself is not the final token; it is a one-time-use intermediary that prevents the access token from being exposed to the user agent.
Exam trap
Cisco often tests the distinction between what is received immediately after user authorization (the authorization code) versus what is obtained after the subsequent token exchange (access token and optionally a refresh token), causing candidates to mistakenly select the access token.
How to eliminate wrong answers
Option B is wrong because a client secret is a static credential pre-shared between the client and authorization server, not something received after user authorization. Option C is wrong because a refresh token is issued only after the client exchanges the authorization code for an access token at the token endpoint, not immediately upon user grant. Option D is wrong because the access token is not directly returned to the client after user authorization; the client must first exchange the authorization code for it via a back-channel request to the token endpoint.
Which THREE practices help ensure idempotent network automation? (Select three)
This ensures the module only takes action if the current state does not match the desired state.
Why this answer
Using the 'state' parameter in Ansible modules (e.g., 'state: present' or 'state: absent') explicitly declares the desired end state of a resource. This allows the module to compare the current state against the desired state and only make changes if necessary, ensuring that running the playbook multiple times produces the same result without unintended side effects.
Exam trap
Cisco often tests the misconception that simply running a command multiple times or appending configuration ensures idempotency, when in fact true idempotency requires state checking and declarative desired-state definitions.
An application requires reliable, ordered delivery of data with flow control and retransmission of lost segments. Which transport layer protocol should the developer choose and what is a key characteristic of this protocol?
TCP is connection-oriented and uses a SYN-SYN/ACK-ACK handshake.
Why this answer
TCP provides reliability, ordering, flow control, and retransmission. It uses a three-way handshake to establish a connection.
A network engineer wants to use NETCONF to change the hostname of a Cisco device. Which operation should be used?
edit-config modifies config.
Why this answer
The <edit-config> operation is used to modify configuration data in NETCONF.
Refer to the exhibit. An engineer uses NETCONF to configure an interface. After applying this configuration, the interface is administratively up. However, the interface does not pass traffic. What is the most likely cause?
The ietf-ip model requires prefix-length, not netmask.
Why this answer
NETCONF uses YANG models that define IP address configuration with the leaf 'prefix-length' (an integer), not 'netmask'. The 'netmask' field is not a valid leaf in the standard ietf-interfaces or ietf-ip YANG model for IPv4 addresses, so the NETCONF server will either reject the configuration or apply it incorrectly, leaving the interface without a proper IP address and unable to pass traffic.
Exam trap
Cisco often tests the distinction between CLI-style 'netmask' and YANG-model 'prefix-length' in NETCONF/RESTCONF questions, trapping candidates who assume the old CLI syntax works in model-driven APIs.
How to eliminate wrong answers
Option A is wrong because the interface type (e.g., 'iana-if-type:ethernetCsmacd') is a valid YANG identity and a misspelling would cause a validation error, but the question states the configuration was applied and the interface is administratively up, so the type is correct. Option B is wrong because the 'enabled' field in the ietf-interfaces YANG model is defined as a boolean (leaf type 'boolean'), so using a string would cause a schema violation and the configuration would not be accepted; the interface being up indicates the boolean was correctly used. Option D is wrong because the interface name (e.g., 'GigabitEthernet0/0/0') is a standard Cisco interface name and is valid; if it were invalid, the NETCONF server would reject the edit, but the interface is administratively up, confirming the name is correct.
Practice 200-901 by domain
Target a specific domain to shore up weak areas.