Courseiva

Cisco DevNet Associate 200-901 (200-901) — Questions 451–525

989 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 14

Page 8
451
Multi-Selecthard

Which TWO are components of a REST API request? (Choose two.)

Select 2 answers
A.URI
B.Status code
C.Payload
D.HTTP method
E.Query string
AnswersA, D

Identifies the resource.

Why this answer

A REST API request is defined by the combination of a URI (Uniform Resource Identifier) and an HTTP method. The URI identifies the specific resource (e.g., /api/users/123) on the server, while the HTTP method (GET, POST, PUT, DELETE, etc.) specifies the desired action to be performed on that resource. Together, they form the fundamental components that the client sends to the server to initiate a request.

Exam trap

Cisco often tests the distinction between request components and response components, and the trap here is that candidates mistakenly include status codes or payloads as request components, when in fact status codes are only in responses and payloads are optional in requests.

Full explanation →
452
MCQeasy

A company uses Cisco Meraki APs and an internal web application hosted on AWS. The application store customer payment data. The security team discovers that sensitive application logs are being transmitted in plaintext over the network to the SIEM. The DevOps team wants to improve security without changing the application code because it is proprietary and cannot be modified. Which solution should be recommended?

A.Modify the application to send logs via syslog over TLS
B.Enable HTTPS on the SIEM receiver to ensure logs are encrypted during transmission
C.Enable TLS on the web application to encrypt data in transit
D.Set up a site-to-site VPN between the Meraki network and AWS to encrypt all traffic, including logs
AnswerD

VPN encrypts all traffic between networks without modifying applications.

Why this answer

A site-to-site VPN between the Meraki network and AWS encrypts all traffic traversing the link, including the sensitive application logs sent to the SIEM, without requiring any changes to the proprietary application code. This solution operates at the network layer, ensuring that even if the application transmits logs in plaintext, the entire payload is encrypted by the VPN tunnel. Meraki Auto VPN and AWS VPN Gateway can establish an IPsec tunnel, providing confidentiality for all data in transit between the on-premises network and the AWS VPC.

Exam trap

Cisco often tests the distinction between application-layer encryption (e.g., TLS/HTTPS) and network-layer encryption (e.g., VPN), leading candidates to mistakenly choose options that encrypt the wrong traffic or require code changes, when the correct answer is a network-level solution that secures all traffic without modifying the application.

How to eliminate wrong answers

Option A is wrong because modifying the application to send logs via syslog over TLS requires changing the application code, which the DevOps team explicitly cannot do due to the proprietary nature of the application. Option B is wrong because enabling HTTPS on the SIEM receiver only secures the SIEM's web interface; it does not encrypt the log transmission from the application to the SIEM, as the logs are still sent in plaintext over the network. Option C is wrong because enabling TLS on the web application encrypts data between clients and the web server, but the sensitive logs are generated and transmitted by the application server to the SIEM, not during web client interactions; this does not address the log transmission issue.

Full explanation →
453
MCQeasy

An administrator is using the Cisco Intersight API to manage server profiles. The API returns the following error: '{"error": "Forbidden", "message": "Insufficient privileges"}'. What is the most likely cause?

A.The server profile ID is incorrect.
B.The request body is malformed.
C.The OAuth2 token has insufficient scopes.
D.The API key has expired.
AnswerC

A 403 Forbidden with 'Insufficient privileges' explicitly indicates lack of required scopes.

Why this answer

The error 'Forbidden' with message 'Insufficient privileges' directly indicates that the authenticated user or API client does not have the required permissions to perform the requested operation. In Cisco Intersight, access control is managed via OAuth2 scopes assigned to API keys; if the token lacks the specific scope (e.g., 'server-profile-write') needed for the API call, the server returns this 403 Forbidden error. Option C correctly identifies that the OAuth2 token has insufficient scopes.

Exam trap

The trap here is that candidates confuse 403 Forbidden with 401 Unauthorized, assuming any privilege error means the API key is expired or invalid, when in fact the token is valid but lacks the required OAuth2 scopes.

How to eliminate wrong answers

Option A is wrong because an incorrect server profile ID would typically result in a 404 Not Found error, not a 403 Forbidden. Option B is wrong because a malformed request body would produce a 400 Bad Request error with details about parsing failures, not a privilege-related error. Option D is wrong because an expired API key would cause a 401 Unauthorized error, not a 403 Forbidden; the token is valid but lacks the necessary authorization scopes.

Full explanation →
454
MCQeasy

An automation engineer is using the Cisco DNA Center REST API to retrieve a list of network devices. The API call returns HTTP status code 200. What does this indicate?

A.The request succeeded but no content is returned.
B.The request was created successfully.
C.The request was successful and data is returned.
D.The request failed due to a client error.
AnswerC

Standard success response with body.

Why this answer

HTTP status code 200 indicates a successful GET request where the server has processed the request and is returning the requested data in the response body. In the context of the Cisco DNA Center REST API, a 200 response to a GET /network-device call means the list of network devices was successfully retrieved and is included in the response payload.

Exam trap

Cisco often tests the distinction between 200 OK and 204 No Content, expecting candidates to know that 200 always includes a response body while 204 explicitly does not, even though both are successful.

How to eliminate wrong answers

Option A is wrong because HTTP 200 does not mean 'no content' — that is indicated by status code 204 (No Content), which is used for successful requests that intentionally return no body. Option B is wrong because a 201 (Created) status code indicates successful creation of a resource, not a retrieval; 200 is used for successful GET, PUT, or DELETE operations that return data. Option D is wrong because client errors are represented by 4xx status codes (e.g., 400 Bad Request, 401 Unauthorized), not 2xx success codes.

Full explanation →
455
MCQeasy

A developer needs to retrieve the list of devices from a Meraki network using the Meraki Dashboard API. Which HTTP method and endpoint should be used?

A.POST /networks/{networkId}/devices
B.GET /devices
C.GET /organizations/{organizationId}/networks
D.GET /networks/{networkId}/devices
AnswerD

Correct endpoint.

Why this answer

The Meraki Dashboard API uses RESTful conventions: to retrieve a list of devices within a specific network, you send a GET request to the endpoint `/networks/{networkId}/devices`. This follows the standard pattern of using GET for read operations and scoping the resource under the network identifier.

Exam trap

Cisco often tests the distinction between GET and POST for read vs. create operations, and the trap here is that candidates may confuse the endpoint for listing networks (`/organizations/{organizationId}/networks`) with the endpoint for listing devices, or assume a top-level `/devices` path exists without understanding the hierarchical resource model.

How to eliminate wrong answers

Option A is wrong because POST is used to create resources, not retrieve them; sending a POST to `/networks/{networkId}/devices` would attempt to add a new device, not list existing ones. Option B is wrong because `/devices` is not a valid top-level endpoint in the Meraki API; device resources are always nested under a network or organization context. Option C is wrong because `/organizations/{organizationId}/networks` returns a list of networks, not devices; it retrieves the networks within an organization, which is a different resource entirely.

Full explanation →
456
MCQeasy

A developer is designing a REST API that will be used by multiple client applications. The API must support versioning to ensure backward compatibility. Which approach should the developer use to implement API versioning?

A.Embed the version in the URI, e.g., /v1/resource
B.Use different HTTP methods for different versions
C.Pass the version as a query parameter, e.g., ?version=1
D.Use a custom HTTP header to specify the version
AnswerA

Correct: URI versioning is straightforward and widely adopted.

Why this answer

Embedding the version in the URI (e.g., /v1/resource) is the most common and straightforward approach for REST API versioning. It makes the version explicit in the URL, allowing clients to directly target a specific version without requiring special header handling or query parameter parsing. This method is widely adopted in industry APIs (e.g., GitHub, Twilio) and ensures backward compatibility by keeping older endpoints accessible under their original URI path.

Exam trap

Cisco often tests the misconception that query parameters or custom headers are more 'RESTful' or flexible, but the exam expects URI-based versioning as the simplest and most compatible approach for backward compatibility.

How to eliminate wrong answers

Option B is wrong because HTTP methods (GET, POST, PUT, DELETE) define the action on a resource, not the version; using different methods for different versions violates REST principles and confuses clients. Option C is wrong because passing the version as a query parameter (e.g., ?version=1) can be cached incorrectly by proxies and CDNs, and it clutters the URL without providing a clean, hierarchical resource structure. Option D is wrong because using a custom HTTP header (e.g., Accept-Version) requires clients to implement additional header logic, reduces discoverability, and is not as transparent or testable as URI-based versioning.

Full explanation →
457
MCQmedium

You are a network automation engineer using the Cisco DNA Center REST API to retrieve health scores for all sites in your network. You call the 'GET /dna/intent/api/v1/site-health' endpoint with parameters to filter by time range. The response returns only the first 20 sites out of a total of 150 sites. You notice that the response includes a 'totalRecords' field showing 150, but only 20 objects are in the 'response' array. You recall that the API documentation mentions pagination support. To avoid manually looping through all pages, you want to implement a robust solution that efficiently retrieves all site health data. Which approach should you take?

A.Change the endpoint to 'GET /dna/intent/api/v1/network-device' which returns all devices without pagination.
B.Export the site health data using the 'POST /dna/intent/api/v1/site-health/export' endpoint.
C.Increase the 'pageSize' parameter to 150 to retrieve all records in a single request.
D.Use the 'nextPageUri' field provided in the response to iterate through all pages until no more pages are available.
AnswerD

Correct. Following the pagination links (nextPageUri) is the standard and reliable method to retrieve all records.

Why this answer

The Cisco DNA Center REST API implements pagination using a 'nextPageUri' field in the response, which provides the direct URL to the next page of results. By following this field iteratively until it is null or absent, you can efficiently retrieve all 150 site health records without manually constructing pagination parameters or looping through page numbers, ensuring a robust and maintainable solution.

Exam trap

Cisco often tests the misconception that you can simply increase the 'pageSize' parameter to retrieve all records at once, but the trap is that API endpoints enforce a maximum page size, and the correct pattern is to use the provided 'nextPageUri' field to iterate through pages.

How to eliminate wrong answers

Option A is wrong because the 'GET /dna/intent/api/v1/network-device' endpoint returns network device data, not site health data, and it also uses pagination; it does not return all devices without pagination. Option B is wrong because the 'POST /dna/intent/api/v1/site-health/export' endpoint is designed for exporting data to a file (e.g., CSV), not for programmatic retrieval of all records in a single API response, and it may not support the same filtering or real-time access. Option C is wrong because the 'pageSize' parameter typically has a maximum limit (often 500 or less, but in many Cisco APIs the default max is 20 or 50), and setting it to 150 may exceed the allowed maximum, causing the request to fail or be truncated; even if accepted, it is not a guaranteed or recommended practice for large datasets.

Full explanation →
458
MCQhard

A developer is using the ncclient library in Python to connect to a network device via NETCONF. Which operation should be used to modify the running configuration and commit the changes?

A.validate() followed by get_config()
B.get_config() followed by copy_config()
C.edit_config() followed by commit()
D.discard_changes() followed by edit_config()
AnswerC

edit_config modifies, commit confirms changes.

Why this answer

In NETCONF, the `edit-config()` operation is used to modify the running configuration, and the `commit()` operation is required to make those changes permanent when the device operates in candidate configuration mode. The ncclient library provides these methods to align with the NETCONF protocol's standard operations.

Exam trap

Cisco often tests the distinction between candidate and running datastores, and the trap here is that candidates assume `edit_config()` alone commits changes, forgetting that a separate `commit()` is required when the device uses a candidate configuration model.

How to eliminate wrong answers

Option A is wrong because `validate()` checks the syntactic correctness of a configuration but does not modify it, and `get_config()` retrieves configuration data without making changes. Option B is wrong because `get_config()` retrieves configuration, and `copy_config()` copies a configuration from one datastore to another (e.g., running to startup), but neither directly modifies the running configuration with a commit step. Option D is wrong because `discard_changes()` reverts uncommitted changes in a candidate datastore, and `edit_config()` modifies the configuration; performing `discard_changes()` before `edit_config()` would discard any pending changes but does not achieve a commit of new modifications.

Full explanation →
459
MCQmedium

A network automation engineer is writing a Python script to configure multiple devices. Which library is most appropriate for SSH-based interactions?

A.requests
B.socket
C.Netmiko
D.paramiko
AnswerC

Netmiko is the standard library for network device SSH automation.

Why this answer

Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It provides high-level methods for sending commands, handling prompts, and managing device interactions, making it the most appropriate choice for automating configuration tasks across multiple devices.

Exam trap

Cisco often tests the distinction between Paramiko (a general SSH library) and Netmiko (a network-device-specific library built on Paramiko), leading candidates to choose Paramiko because they recognize it as an SSH library without considering the higher-level abstractions Netmiko provides for network automation.

How to eliminate wrong answers

Option A is wrong because the requests library is designed for HTTP/HTTPS API calls, not for SSH-based interactions. Option B is wrong because the socket library provides low-level network communication primitives and lacks the SSH protocol handling needed for device configuration. Option D is wrong because while Paramiko is a valid SSH library, it requires manual handling of authentication, channel management, and command output parsing, making it less suitable than Netmiko for multi-device automation scenarios.

Full explanation →
460
MCQmedium

An Ansible playbook fails with the error: "mapping values are not allowed here". The relevant YAML snippet is: --- - name: Configure interface ios_config: lines: - ip address 10.0.0.1 255.255.255.0 parents: interface GigabitEthernet0/1 What is the most likely cause of this error?

A.The indentation of `parents:` is incorrect relative to `lines:`
B.The `ios_config` module requires a provider statement
C.The `lines:` item should be a list of strings
D.The `parents:` value must be enclosed in quotes
AnswerA

In YAML, keys under the same mapping must have the same indentation; `parents:` seems misaligned.

Why this answer

The error 'mapping values are not allowed here' occurs in YAML when a key-value pair is incorrectly indented relative to its parent. In this snippet, `parents:` is indented at the same level as `lines:`, but it should be a sibling of `lines:` under the same dictionary key. The correct indentation requires `parents:` to be aligned with `lines:` (both at the same indentation level under `ios_config:`), but the error suggests that `parents:` is placed where YAML expects a scalar value, breaking the mapping structure.

Exam trap

Cisco often tests YAML indentation rules by presenting a snippet where `parents:` is incorrectly indented under `lines:`, leading candidates to mistakenly focus on module requirements or quoting instead of the structural YAML error.

How to eliminate wrong answers

Option B is wrong because the `ios_config` module does not require a `provider` statement in modern Ansible versions; authentication is handled via connection parameters like `ansible_user` and `ansible_password`, not a deprecated `provider` dictionary. Option C is wrong because `lines:` is already a list of strings (the single item `- ip address 10.0.0.1 255.255.255.0` is correctly formatted as a list element), so this is not the cause of the YAML parsing error. Option D is wrong because YAML does not require quotes around scalar values like `interface GigabitEthernet0/1` unless they contain special characters; the error is purely about indentation, not quoting.

Full explanation →
461
MCQeasy

A system administrator wants to use the Cisco Intersight API to collect hardware inventory from a set of UCS servers managed by Intersight. The administrator needs to retrieve the serial numbers, memory, and CPU information. The administrator has an API key with the appropriate permissions. The administrator uses a Python script with the requests library to send a GET request to https://intersight.com/api/v1/compute/PhysicalSummaries. The request returns HTTP 200 with a list of objects. However, each object only contains the 'Moid' and 'Name' fields; the serial number and hardware details are missing. What should the administrator do to get the full inventory details?

A.Change the endpoint to /api/v1/compute/PhysicalSummary?details=true.
B.Add the '?expand=*' query parameter to the request to include all fields.
C.Use the 'Moid' from each summary object to send individual GET requests to /api/v1/compute/PhysicalSummaries/{Moid} for full details.
D.Generate a new API key with broader permissions.
AnswerC

This retrieves the full object with all fields, including serial number and hardware details.

Why this answer

The `/api/v1/compute/PhysicalSummaries` endpoint returns a list of summary objects containing only the 'Moid' and 'Name' fields by design. To retrieve the full hardware inventory details (serial numbers, memory, CPU), the administrator must use the 'Moid' from each summary object to send individual GET requests to the specific resource endpoint `/api/v1/compute/PhysicalSummaries/{Moid}`. This is a common RESTful API pattern where list endpoints provide lightweight summaries, and full details require fetching each resource individually.

Exam trap

Cisco often tests the misconception that adding a query parameter like `?expand=*` or `?details=true` will magically include all fields in a list response, when in reality the correct approach is to fetch individual resources by their unique identifier (Moid).

How to eliminate wrong answers

Option A is wrong because the endpoint `/api/v1/compute/PhysicalSummary?details=true` does not exist; Intersight API does not support a `details` query parameter on this endpoint, and the correct endpoint for full details is the individual resource endpoint using the Moid. Option B is wrong because the `?expand=*` query parameter is not a valid parameter in the Intersight REST API; Intersight uses a different mechanism (e.g., `$select` or `$expand` in OData-style queries) but `expand=*` is not supported and would be ignored or cause an error. Option D is wrong because the API key permissions are not the issue—the administrator already has appropriate permissions (as stated), and the missing fields are due to the endpoint design, not authorization.

Full explanation →
462
MCQmedium

Based on the exhibit, which interface is in a state that prevents it from sending or receiving IP traffic?

A.GigabitEthernet0/2
B.GigabitEthernet0/0
C.GigabitEthernet0/1
D.None of the interfaces are down
AnswerC

It is administratively down, so no traffic can pass.

Why this answer

Interface GigabitEthernet0/1 is in the 'administratively down' state, as indicated by the 'down' status in the 'Status' column and the 'down' in the 'Protocol' column. This means the interface has been manually disabled with the 'shutdown' command, preventing it from sending or receiving any IP traffic. In contrast, interfaces that are 'up/up' can forward traffic, while 'up/down' indicates a Layer 1 issue but still allows Layer 2 control plane traffic.

Exam trap

Cisco often tests the distinction between 'administratively down' (Status: down) and 'up/down' (Status: up, Protocol: down), where candidates mistakenly assume any 'down' protocol means no IP traffic is possible, but only the administratively down state explicitly prevents all traffic due to manual shutdown.

How to eliminate wrong answers

Option A is wrong because GigabitEthernet0/2 shows 'up' in both Status and Protocol columns, meaning it is fully operational and can send/receive IP traffic. Option B is wrong because GigabitEthernet0/0 shows 'up' in Status and 'down' in Protocol, indicating a Layer 1 connectivity issue (e.g., no cable or faulty transceiver) but the interface is not administratively disabled; it still attempts to send/receive Layer 2 frames, though IP traffic may fail due to the protocol being down. Option D is wrong because GigabitEthernet0/1 is indeed in a state that prevents IP traffic (administratively down), so not all interfaces are operational.

Full explanation →
463
Multi-Selectmedium

Which TWO of the following are characteristics of a declarative automation model? (Select exactly 2.)

Select 2 answers
A.It requires procedural scripts
B.You specify the desired end state
C.Idempotency is not a concern
D.The tool handles ordering and dependencies
E.You specify the exact steps to achieve the state
AnswersB, D

Declarative defines what, not how.

Why this answer

In a declarative automation model, you specify the desired end state of the system, not the steps to achieve it. This is a core characteristic because the automation tool (e.g., Ansible, Terraform, Puppet) interprets the desired state and determines the necessary actions to reach it, making option B correct.

Exam trap

Cisco often tests the distinction between declarative and imperative models by presenting options that sound plausible but reverse the roles, such as confusing 'specify the end state' with 'specify the exact steps', or assuming idempotency is irrelevant in declarative models.

Full explanation →
464
Multi-Selectmedium

Which TWO of the following are benefits of using NETCONF over SNMP for network automation? (Select exactly 2.)

Select 2 answers
A.Structured data models (YANG)
B.Lower CPU usage on devices
C.Binary data encoding
D.Transactional configuration changes
E.Simple polling mechanism
AnswersA, D

YANG provides standardized data models.

Why this answer

NETCONF uses YANG (RFC 6020/7950) to define structured, hierarchical data models, enabling consistent and predictable configuration and state data retrieval. This contrasts with SNMP's flat MIB structure, which is less flexible for complex automation tasks. Option D is correct because NETCONF supports candidate configurations and confirmed commits (RFC 6241, Section 8.4), allowing transactional changes that can be validated and rolled back atomically, whereas SNMP lacks built-in transaction support.

Exam trap

Cisco often tests the misconception that NETCONF is 'lighter' than SNMP, but the trap here is that NETCONF's XML and SSH overhead actually increase CPU usage, while SNMP's binary encoding and UDP make it more efficient for simple monitoring tasks.

Full explanation →
465
MCQmedium

An engineer needs to transfer a router configuration file to a server in the same network using a simple protocol that does not require authentication. Which protocol is best?

A.SCP
B.TFTP
C.FTP
D.HTTP
AnswerB

TFTP has no authentication and is simple to implement.

Why this answer

TFTP (Trivial File Transfer Protocol) is the best choice because it is a lightweight, connectionless protocol that operates over UDP (port 69) and does not require any authentication or user credentials. It is commonly used for transferring router configuration files and IOS images in local network environments where simplicity and speed are prioritized over security.

Exam trap

Cisco often tests the distinction between TFTP and SCP, where candidates mistakenly choose SCP because it is secure, overlooking the explicit requirement for a protocol that does not require authentication.

How to eliminate wrong answers

Option A (SCP) is wrong because it relies on SSH for authentication and encryption, requiring credentials and adding overhead that is unnecessary for a simple, unauthenticated transfer. Option C (FTP) is wrong because it typically requires username/password authentication and uses TCP, making it more complex and less suitable for a no-authentication requirement. Option D (HTTP) is wrong because while it can be used without authentication, it is designed for web content transfer and often involves more overhead (TCP-based) and is not the standard protocol for router configuration file transfers in a local network.

Full explanation →
466
MCQmedium

A Kubernetes environment has multiple teams sharing the same cluster. One team wants to deploy applications without interfering with other teams' resources. Which Kubernetes resource should be used to isolate the team's resources?

A.ServiceAccount
B.NodePort
C.ConfigMap
D.Namespace
AnswerD

Namespaces isolate resources.

Why this answer

Namespaces provide logical isolation within a cluster. Each team can have its own namespace with separate policies and resource quotas.

Full explanation →
467
MCQhard

When using NETCONF to edit the configuration of a Cisco IOS XE device, an engineer receives an <rpc-error> with error-tag 'in-use' and error-app-tag 'data-exists'. What does this error indicate?

A.The NETCONF session was closed due to a timeout.
B.The RPC message was malformed.
C.The configuration being added already exists on the device.
D.The device does not have the required user permissions.
AnswerC

data-exists indicates duplicate data.

Why this answer

The error-tag 'in-use' combined with the error-app-tag 'data-exists' in NETCONF indicates that the configuration operation (e.g., <edit-config> with operation 'create') attempted to add a configuration element that already exists in the running datastore. NETCONF uses these standardized error tags per RFC 6241 to signal that the requested operation cannot be completed because the target data node is already present, preventing duplicate configuration entries.

Exam trap

Cisco often tests the distinction between NETCONF <edit-config> operations (create vs. merge vs. replace) and their corresponding error tags, leading candidates to confuse 'in-use' with permission or syntax errors.

How to eliminate wrong answers

Option A is wrong because a session timeout would generate an <rpc-error> with error-tag 'session-timeout' or 'transport-error', not 'in-use'. Option B is wrong because a malformed RPC message would produce error-tag 'malformed-message' or 'operation-failed', not 'in-use'. Option D is wrong because insufficient permissions would result in error-tag 'access-denied' or 'authorization-error', not 'in-use'.

Full explanation →
468
MCQhard

In a Docker Compose file with multiple services, one service depends on another to be healthy before starting. Which key should be used to express this dependency and ensure the dependent service is started first?

A.depends_on
B.volumes
C.networks
D.links
AnswerA

depends_on ensures services start in order.

Why this answer

depends_on in Docker Compose controls startup order. 'links' is legacy, 'networks' defines networks, 'volumes' mounts volumes.

Full explanation →
469
MCQmedium

In software architecture, which pattern separates an application into three interconnected components: Model (data), View (UI), and Controller (input logic)?

A.MVC (Model-View-Controller)
B.Microservices
C.Event-driven
D.REST
AnswerA

MVC separates data, presentation, and control logic.

Why this answer

The MVC pattern explicitly separates an application into three interconnected components: Model (data and business logic), View (user interface), and Controller (handles user input and updates the Model/View). This is the foundational architectural pattern for many web frameworks like Django, Ruby on Rails, and Spring MVC, where the Controller receives HTTP requests, interacts with the Model, and selects the appropriate View for rendering.

Exam trap

Cisco often tests that candidates confuse MVC with REST or Microservices because both involve separation of concerns, but MVC is specifically about internal component separation within a single application, not about service decomposition or API design.

How to eliminate wrong answers

Option B (Microservices) is wrong because it decomposes an application into independently deployable services, each with its own data and logic, rather than separating a single application into Model, View, and Controller components. Option C (Event-driven) is wrong because it relies on event producers and consumers communicating asynchronously via an event bus, not on a three-component separation of data, UI, and input logic. Option D (REST) is wrong because it is an architectural style for designing networked APIs using HTTP methods and stateless communication, not a pattern for structuring internal application components.

Full explanation →
470
MCQhard

A developer uses the requests library to call an API. The API returns 429 Too Many Requests. What is the best practice to handle this?

A.Ignore the status code and proceed
B.Immediately retry the request
C.Use exponential backoff and retry
D.Wait a fixed amount of time and retry
AnswerC

Standard practice.

Why this answer

Implement retry with exponential backoff to respect rate limiting.

Full explanation →
471
MCQhard

A developer is building a chat application that requires low-latency communication, and occasional packet loss is acceptable. Which transport protocol should the developer choose?

A.UDP
B.RTP
C.QUIC
D.TCP
AnswerA

UDP is connectionless and low-latency; packet loss is acceptable in this scenario.

Why this answer

UDP is the correct choice because it provides low-latency, connectionless communication without retransmission or congestion control, making it ideal for real-time chat applications where occasional packet loss is acceptable. Unlike TCP, UDP does not require a handshake or acknowledgment, minimizing delay and overhead.

Exam trap

Cisco often tests the distinction between transport protocols and application-layer protocols, so candidates may confuse RTP (which is not a transport protocol) with UDP, or assume QUIC is a transport protocol when it is actually an application-layer protocol built on UDP.

How to eliminate wrong answers

Option B (RTP) is wrong because RTP is an application-layer protocol that typically runs over UDP to deliver real-time media, but it is not a transport protocol itself; the question asks for a transport protocol. Option C (QUIC) is wrong because QUIC, while offering lower latency than TCP, is built on top of UDP and includes reliability and congestion control features that are unnecessary when packet loss is acceptable, and it is not a pure transport protocol in the OSI model. Option D (TCP) is wrong because TCP's reliability mechanisms (retransmission, flow control, congestion avoidance) introduce latency and overhead that conflict with the requirement for low-latency communication, and its connection-oriented nature is unsuitable when occasional packet loss is acceptable.

Full explanation →
472
MCQeasy

A team is deploying a new microservice on Cisco Container Platform. The microservice needs to access a database hosted on a separate VM. The security policy requires that only the microservice can communicate with the database, and all traffic must be encrypted. The team is using Kubernetes network policies and mutual TLS. During testing, the microservice cannot reach the database. The database team reports that the database is reachable from other services. What is the most likely cause?

A.A Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP
B.The database server is not listening on the expected port
C.The mutual TLS certificates are expired or not trusted
D.The Istio sidecar proxy is misconfigured and rejecting traffic due to a missing ServiceEntry
AnswerA

Network policies can restrict traffic; a default deny or misconfigured policy could block the connection.

Why this answer

The most likely cause is that a Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP. Since the database is reachable from other services, the issue is specific to the microservice pod's network access. A NetworkPolicy that does not explicitly allow egress traffic to the database IP will default to denying that traffic, preventing the microservice from reaching the database even though the database itself is operational.

Exam trap

Cisco often tests the default-deny behavior of Kubernetes NetworkPolicy, where candidates mistakenly assume that no policy means all traffic is allowed, but the trap is that once a policy selects a pod, all unallowed traffic is implicitly denied, including egress to external IPs.

How to eliminate wrong answers

Option B is wrong because the database is reachable from other services, indicating it is listening on the expected port. Option C is wrong because mutual TLS certificate issues would typically cause authentication failures or connection resets, not a complete inability to reach the database (the microservice would still establish a TCP connection). Option D is wrong because Istio sidecar proxy misconfiguration or a missing ServiceEntry would affect service mesh routing, but the question states the team is using Kubernetes network policies and mutual TLS, not explicitly Istio; moreover, a missing ServiceEntry would cause traffic to be rejected at the proxy level, but the core issue is network-level egress blocking, which is more directly addressed by NetworkPolicy.

Full explanation →
473
MCQmedium

A Python script uses the `requests` library to fetch device details from Cisco DNA Center. The API returns a JSON response with nested objects. To extract the management IP address from the response stored in variable `data`, which code snippet is correct? The JSON structure is: { "response": [ { "managementIpAddress": "192.168.1.1", "hostname": "router1" } ] }

A.data.managementIpAddress
B.data['response']['managementIpAddress']
C.data.get('response')[0].get('managementIpAddress')
D.data['response'][0]['managementIpAddress']
AnswerD

Correctly indexes into the list and retrieves the management IP.

Why this answer

The response contains a list under key 'response'; correct access is via data['response'][0]['managementIpAddress'].

Full explanation →
474
MCQeasy

Which HTTP method should be used to partially update an existing resource in a REST API?

A.PUT
B.DELETE
C.POST
D.PATCH
AnswerD

PATCH is used for partial updates.

Why this answer

PATCH is used for partial updates, while PUT replaces the entire resource.

Full explanation →
475
MCQmedium

A developer is using the Meraki Dashboard API and notices that some requests return a 429 status code. What is the most likely cause?

A.The organization ID is incorrect.
B.The request payload is too large.
C.The API key is invalid.
D.The rate limit of 5 requests per second has been exceeded.
AnswerD

Meraki enforces a 5 req/s rate limit.

Why this answer

Meraki API rate limits at 5 calls per second; exceeding this returns 429 Too Many Requests.

Full explanation →
476
MCQmedium

A university IT department manages a Cisco Meraki network with 200 MR access points and 50 MS switches. They use the Meraki dashboard API to automate network provisioning. A new student dormitory was added, and the team needs to create a new network and claim devices. They have a Python script that uses the Meraki API to create the network and then claim devices by serial numbers. The script successfully creates the network but fails when claiming devices with a 400 error: 'Device serial number is not valid or already claimed'. The serial numbers are correct and unused. The API key has full organization access. The script uses the endpoint 'POST /networks/{networkId}/devices/claim' with the correct body. What is the most likely cause of the failure?

A.The API key does not have permission to claim devices.
B.The serial numbers contain a typo.
C.The devices have not been added to the organization's inventory first.
D.The devices are not Meraki MR or MS models.
AnswerC

Devices must be claimed into the organization before being assigned to a network.

Why this answer

In the Meraki API workflow, devices must first be added to the organization's inventory via the 'POST /organizations/{organizationId}/inventory/devices' endpoint before they can be claimed into a specific network. The 400 error 'Device serial number is not valid or already claimed' occurs when the serial numbers are not present in the organization's inventory, even if they are correct and unused. The script successfully creates the network but fails at the claim step because the devices have not been inventoried at the organization level.

Exam trap

Cisco often tests the distinction between organization-level inventory and network-level claiming, trapping candidates who assume that claiming a device automatically adds it to the organization's inventory or that a valid serial number is sufficient without prior inventory registration.

How to eliminate wrong answers

Option A is wrong because the API key has full organization access, which includes permission to claim devices; a permission issue would typically result in a 403 Forbidden error, not a 400 error. Option B is wrong because the question explicitly states that the serial numbers are correct and unused, so a typo is not the cause. Option D is wrong because the devices are MR and MS models, which are supported by the Meraki dashboard API for claiming; the error message does not indicate an unsupported model.

Full explanation →
477
MCQhard

A network automation team uses Ansible to manage Cisco ACI fabrics. They have a playbook that creates application profiles using the 'aci_ap' module. Recently, they started using a new Python script that directly uses the Cisco ACI REST API to perform the same tasks. The script often fails with a 403 Forbidden error, although the Ansible playbook works fine. The authentication method is the same: basic authentication over HTTPS. The API user has the same privileges. Which of the following is the most likely cause?

A.The script is not including the APIC cookie in subsequent requests
B.The script is not setting the proper Content-Type header for POST requests
C.The script is using HTTP instead of HTTPS
D.The API user's password was changed between runs
AnswerA

ACI requires a session cookie; missing it results in 403.

Why this answer

The 403 Forbidden error indicates that the APIC is rejecting the request due to authentication or authorization failure. Ansible's 'aci_ap' module automatically handles session cookies by logging in once and reusing the APIC cookie for subsequent requests. The Python script likely fails because it does not capture and include the session cookie returned by the APIC login response in its subsequent REST API calls, causing the APIC to treat each request as unauthenticated.

Exam trap

The trap here is that candidates may confuse a 403 Forbidden with a missing Content-Type or protocol mismatch, but Cisco specifically tests the understanding that APIC requires session cookie management for REST API calls beyond the initial login.

How to eliminate wrong answers

Option B is wrong because a missing or incorrect Content-Type header would typically result in a 400 Bad Request or 415 Unsupported Media Type, not a 403 Forbidden. Option C is wrong because using HTTP instead of HTTPS would cause a connection failure or redirect, not a 403 error, and the question states the authentication method is the same (basic auth over HTTPS). Option D is wrong because if the password were changed between runs, both the Ansible playbook and the script would fail with the same authentication error, not just the script.

Full explanation →
478
Multi-Selectmedium

Which TWO of the following are valid private IPv4 address ranges? (Select two.)

Select 2 answers
A.172.15.0.0/12
B.10.0.0.0/8
C.172.32.0.0/12
D.169.254.0.0/16
E.192.168.0.0/16
AnswersB, E

Correct. 10.0.0.0/8 is private.

Why this answer

RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Full explanation →
479
MCQeasy

When using the Cisco Meraki Dashboard API to create an HTTP webhook for network alerts, which authentication method is required in the request header?

A.Authorization: Bearer <token>
B.Include the API key as a query parameter.
C.Authorization: Basic <base64>
D.X-Cisco-Meraki-API-Key: <your_api_key>
AnswerD

Meraki requires this custom header.

Why this answer

The Cisco Meraki Dashboard API requires authentication via a custom HTTP header named `X-Cisco-Meraki-API-Key`, where the value is your API key. This is the only supported method for authenticating requests to the Meraki API, as documented in the official API reference. Option D correctly specifies this header, making it the required authentication method for creating an HTTP webhook for network alerts.

Exam trap

Cisco often tests the distinction between standard authentication methods (Bearer tokens, Basic Auth) and vendor-specific custom headers, so the trap here is that candidates may assume a common standard like OAuth 2.0 or Basic Auth applies, when the Meraki API explicitly requires its own proprietary header.

How to eliminate wrong answers

Option A is wrong because the Meraki API does not use OAuth 2.0 Bearer tokens; it uses a custom API key header instead. Option B is wrong because passing the API key as a query parameter is insecure and not supported by the Meraki API; the key must be sent in a header. Option C is wrong because HTTP Basic Authentication (Base64-encoded credentials) is not used by the Meraki API; it relies solely on the `X-Cisco-Meraki-API-Key` header.

Full explanation →
480
MCQeasy

Which design principle suggests that a module should be responsible for a single part of the functionality?

A.Separation of Concerns
B.YAGNI (You Aren't Gonna Need It)
C.DRY (Don't Repeat Yourself)
D.KISS (Keep It Simple, Stupid)
AnswerA

This principle dictates that each module should handle a distinct aspect of the application's functionality.

Why this answer

Separation of Concerns (SoC) is the design principle that dictates each module or component should focus on a single, well-defined part of the functionality. In software development, this reduces coupling and increases cohesion, making code easier to maintain, test, and refactor. For example, in a Python Flask web application, separating route handling, business logic, and database access into distinct modules follows SoC.

Exam trap

Cisco often tests the distinction between Separation of Concerns and DRY, as candidates may confuse 'not repeating code' with 'assigning single responsibility' — the trap is that DRY is about code reuse, not module focus.

How to eliminate wrong answers

Option B (YAGNI) is wrong because it advises against adding functionality until it is actually needed, focusing on avoiding over-engineering rather than assigning single responsibilities to modules. Option C (DRY) is wrong because it aims to reduce duplication of code by abstracting repeated logic, not to ensure each module handles one part of functionality. Option D (KISS) is wrong because it advocates for simplicity in design and implementation, but does not specifically address the granularity of module responsibility.

Full explanation →
481
MCQmedium

A DNS AAAA record is used to resolve a hostname to what type of address?

A.Mail exchange server
B.IPv4 address
C.Canonical name alias
D.IPv6 address
AnswerD

Correct. AAAA stands for quad-A and maps to IPv6.

Why this answer

AAAA records map hostnames to IPv6 addresses.

Full explanation →
482
MCQmedium

Refer to the exhibit. A switch has the VLAN configuration shown. If a device is connected to interface Gi0/3 and another to Gi0/5, can they communicate if the switch is not configured with any inter-VLAN routing?

A.Yes, if the default gateway is configured on each device.
B.No, because VLAN 20 is not active on those ports.
C.No, because they are in different VLANs and no routing is configured.
D.Yes, if the devices have IP addresses in the same subnet.
E.Yes, because all ports are on the same switch.
AnswerC

VLANs isolate traffic; inter-VLAN requires layer 3 routing.

Why this answer

Devices in different VLANs (VLAN 10 and VLAN 20) are on separate Layer 2 broadcast domains. Without inter-VLAN routing (either a Layer 3 switch with IP routing enabled or an external router), traffic cannot cross VLAN boundaries, even if the devices share the same physical switch. The switch forwards frames only within the same VLAN unless routing is explicitly configured.

Exam trap

The trap here is that candidates assume all ports on the same switch can communicate by default, overlooking that VLANs create isolated Layer 2 domains that require routing to interconnect.

How to eliminate wrong answers

Option A is wrong because configuring a default gateway on each device only enables them to send traffic to a router; it does not enable the switch to route between VLANs. Option B is wrong because the exhibit shows VLAN 20 is active on Gi0/5 (access VLAN 20), so the port is correctly assigned; the issue is not inactivity but the VLAN mismatch. Option D is wrong because the devices are in different VLANs and thus belong to different subnets by design; even if they had IP addresses in the same subnet, the switch would still isolate them at Layer 2 because VLANs enforce separate broadcast domains.

Option E is wrong because being on the same switch does not imply Layer 3 connectivity; the switch forwards frames only within the same VLAN unless routing is configured.

Full explanation →
483
Multi-Selectmedium

A network engineer needs to create a new subnet that can support at least 50 usable host addresses for a development environment. Which TWO subnet masks would meet this requirement? (Choose two.)

Select 2 answers
A.255.255.255.224 (/27)
B.255.255.255.128 (/25)
C.255.255.255.192 (/26)
D.255.255.255.248 (/29)
E.255.255.255.240 (/28)
AnswersB, C

Correct. /25 provides 2^(32-25)-2 = 126 usable host addresses, which is more than 50.

Why this answer

(255.255.255.128 /25) provides 126 usable host addresses (2^(32-25) - 2 = 126), which exceeds the requirement of 50. Option C (255.255.255.192 /26) provides 62 usable host addresses (2^(32-26) - 2 = 62), also meeting the requirement. Both masks are valid because they yield at least 50 usable IPs for the development subnet.

Exam trap

Cisco often tests the distinction between 'total addresses' and 'usable host addresses' — candidates mistakenly count the network and broadcast addresses as usable, leading them to select a mask like /27 (32 total addresses) thinking it supports 32 hosts instead of the actual 30.

Full explanation →
484
MCQeasy

Using the Cisco DNA Center API, which endpoint should be queried to retrieve the Layer 2 topology for a specific VLAN?

A.GET /dna/intent/api/v1/issues
B.GET /dna/intent/api/v1/topology/l2/{vlanID}
C.GET /dna/intent/api/v1/network-device
D.GET /dna/intent/api/v1/topology/physical-topology
AnswerB

Correct. This returns the L2 topology for the specified VLAN.

Why this answer

Cisco DNA Center provides /dna/intent/api/v1/topology/l2/{vlanID} to retrieve Layer 2 topology information for a given VLAN.

Full explanation →
485
MCQhard

A developer is using a Dockerfile to build an image. The image must be based on a minimal Linux distribution to reduce attack surface. Which base image should be used?

A.alpine:latest
B.ubuntu:latest
C.debian:latest
D.centos:latest
AnswerA

Alpine is a minimal distribution (~5 MB) ideal for security.

Why this answer

Alpine Linux is a minimal Linux distribution designed for security, simplicity, and resource efficiency. Its base image is typically around 5 MB, significantly reducing the attack surface compared to full-featured distributions like Ubuntu, Debian, or CentOS. This makes it the ideal choice for minimizing vulnerabilities in containerized applications.

Exam trap

Cisco often tests the concept that 'minimal' means fewer packages and smaller size, not just a different package manager, and the trap here is that candidates may choose a familiar distribution like Ubuntu or CentOS without considering the attack surface implications of a bloated base image.

How to eliminate wrong answers

Option B (ubuntu:latest) is wrong because Ubuntu includes a large set of pre-installed packages and libraries, resulting in a much larger image size (hundreds of MB) and a broader attack surface. Option C (debian:latest) is wrong because Debian, while stable, also ships with many default utilities and libraries that increase the image footprint and potential vulnerabilities. Option D (centos:latest) is wrong because CentOS, based on RHEL, includes a full userland and package manager, leading to a larger image and unnecessary components that expand the attack surface.

Full explanation →
486
MCQmedium

A developer needs to update an existing resource via a REST API. The update should be partial, meaning only the fields provided in the request body should be changed. Which HTTP method should be used?

A.PATCH
B.DELETE
C.PUT
D.POST
AnswerA

PATCH is the standard HTTP method for partial modifications.

Why this answer

PATCH is used for partial updates to a resource, while PUT replaces the entire resource.

Full explanation →
487
MCQmedium

You manage a network that uses a mix of Cisco IOS and IOS-XE devices. The company wants to implement network automation using RESTCONF and YANG. You have configured RESTCONF on a branch router running IOS-XE 16.12. You can successfully retrieve the interface configuration using a GET request from a Python script. However, when you try to modify the description of an interface using a PATCH request, you receive a 405 Method Not Allowed error. The script uses basic authentication over HTTPS. The URL is correct, and the YANG data payload is valid. What is the most likely reason for the failure?

A.The RESTCONF service on the router is not enabled for write operations.
B.The YANG payload must be in XML format instead of JSON.
C.Basic authentication is not supported for PATCH requests.
D.The PATCH request must target the entire configuration data store, not a specific interface.
AnswerA

The 'restconf' capability may be read-only; you need to enable the 'restconf' agent with write support.

Why this answer

The 405 Method Not Allowed error indicates that the RESTCONF service on the router is not enabled for write operations. By default, RESTCONF on IOS-XE devices may be configured in read-only mode, or the necessary HTTP methods (PATCH, PUT, POST) are not permitted. Since the GET request succeeds but PATCH fails, the service is operational but write access is restricted, often due to missing 'ip http secure-server' or 'restconf' configuration with write permissions.

Exam trap

Cisco often tests the distinction between read-only and read-write RESTCONF configurations, where candidates assume a successful GET implies full functionality, but write operations require explicit enablement.

How to eliminate wrong answers

Option B is wrong because RESTCONF supports both XML and JSON payloads; the error is a 405 Method Not Allowed, not a 400 Bad Request, so the format is not the issue. Option C is wrong because basic authentication is fully supported for all HTTP methods, including PATCH, as long as HTTPS is used; the 405 error is not related to authentication. Option D is wrong because PATCH requests can target a specific resource (e.g., an interface) via its URI; targeting the entire data store would be incorrect and would not cause a 405 error.

Full explanation →
488
MCQmedium

A developer wants to retrieve the current user's Webex profile information. Which API endpoint should be called?

A.GET /v1/people
B.GET /v1/people/me
C.GET /v1/memberships/me
D.GET /v1/rooms/me
AnswerB

Correct. This returns the authenticated user's profile.

Why this answer

The /v1/people/me endpoint returns details about the authenticated user.

Full explanation →
489
Multi-Selectmedium

Which THREE of the following are key principles of Infrastructure as Code (IaC) as applied to network automation?

Select 3 answers
A.Manual configuration is preferred for critical devices.
B.Configuration should be idempotent.
C.Configuration should be validated through automated testing.
D.Temporary scripts should be used for one-time changes.
E.All configuration code should be stored in version control.
AnswersB, C, E

Idempotency ensures consistent state.

Why this answer

Idempotency ensures that applying the same configuration multiple times results in the same final state, preventing unintended changes. In network automation, tools like Ansible or Terraform use idempotent modules (e.g., `ios_config`) to verify the current device state before applying changes, avoiding configuration drift or repeated command failures.

Exam trap

Cisco often tests the misconception that IaC allows manual overrides for critical devices or that one-time scripts are acceptable, but the exam expects you to recognize that all changes must be code-driven, version-controlled, and idempotent to ensure consistency and auditability.

Full explanation →
490
Multi-Selectmedium

A network engineer is troubleshooting an issue where hosts in VLAN 100 cannot reach a server at 10.1.1.100. The switch interfaces are configured as access ports in VLAN 100, and the default gateway is 10.1.1.1. The engineer checks the switch and finds that the ARP table does not contain the server's MAC address. Which two actions should the engineer take to resolve the issue? (Choose two.)

Select 2 answers
A.Ping the server's IP address from the switch management interface.
B.Ping the default gateway from a host in VLAN 100.
C.Check the ARP table on the default gateway router.
D.Check the MAC address table on the switch for the server's MAC.
E.Verify that the switch port connected to the server is in VLAN 100.
AnswersC, E

The hosts need to resolve the server's MAC, not the gateway's. The issue is on the switch or host side.

Why this answer

If the switch port connected to the server is not in VLAN 100, the server will be in a different broadcast domain and will not receive ARP requests from hosts in VLAN 100. This would cause the ARP table on the switch to lack the server's MAC address, as the switch cannot learn it through normal Layer 2 flooding within the VLAN.

Exam trap

Cisco often tests the distinction between the MAC address table (Layer 2 forwarding) and the ARP table (Layer 3 resolution), leading candidates to incorrectly choose checking the MAC address table when the real issue is VLAN membership affecting ARP propagation.

Full explanation →
491
Multi-Selecthard

Which THREE of the following are benefits of using an SDN (Software-Defined Networking) architecture compared to traditional networking? (Choose three.)

Select 3 answers
A.Reduced need for network engineers.
B.Automation of network configuration changes.
C.Faster deployment of new network services.
D.Centralized control and visibility of the network.
E.Built-in encryption for all network traffic.
AnswersB, C, D

Programmability allows automated changes via APIs.

Why this answer

SDN separates the control plane from the data plane, allowing network administrators to automate configuration changes through a centralized controller (e.g., OpenFlow or Cisco APIC-EM). This eliminates the need for manual, device-by-device CLI changes, reducing human error and enabling rapid, consistent updates across the entire network.

Exam trap

Cisco often tests the misconception that SDN eliminates the need for network engineers entirely, but the correct understanding is that SDN automates tasks and centralizes control, not that it removes the human role in network design and troubleshooting.

Full explanation →
492
MCQmedium

Refer to the exhibit. An automation script expects the interface IP address to be configured via DHCP. Based on the output, what is the current configuration source for the IP address?

A.DHCP
B.BOOTP
C.Manual configuration (NVRAM)
D.PPP negotiation
AnswerC

The show output confirms non-volatile memory.

Why this answer

The output shows 'IP address is 192.168.1.1, subnet mask is 255.255.255.0' with no DHCP or BOOTP flags, and the configuration is stored in NVRAM (startup-config). This indicates the IP was manually configured (typed by an administrator) and saved, not obtained via DHCP. Option C is correct because the source is manual configuration from NVRAM.

Exam trap

Cisco often tests the distinction between 'how an IP is assigned' (DHCP vs. manual) and 'where the config is stored' (running-config vs. NVRAM), leading candidates to mistakenly think any saved config implies DHCP when it actually indicates manual configuration.

How to eliminate wrong answers

Option A is wrong because DHCP would show 'IP address negotiated via DHCP' or a DHCP-assigned address with a lease, and the output lacks any DHCP client identifier or lease information. Option B is wrong because BOOTP is a legacy protocol that assigns IP addresses statically from a BOOTP server, and the output shows no BOOTP server interaction or 'bootp' flag. Option D is wrong because PPP negotiation applies to serial interfaces using PPP encapsulation, not to Ethernet interfaces, and the output shows no PPP-related parameters like IPCP negotiation.

Full explanation →
493
MCQhard

In a Python application that uses the ncclient library to manage Cisco devices via NETCONF, the developer encounters an error: 'ncclient.transport.errors.SessionCloseError: session closed on error'. Which of the following is the most likely cause?

A.The NETCONF session timed out due to inactivity
B.The device does not support base NETCONF 1.0
C.The device's SSH key has changed
D.The device does not support the candidate datastore
AnswerA

Idle session timeouts are a common cause of SessionCloseError.

Why this answer

The 'SessionCloseError: session closed on error' in ncclient typically occurs when the NETCONF server (Cisco device) closes the session due to inactivity. NETCONF sessions have a default idle timeout (often 10 minutes on Cisco IOS-XE/IOS-XR). If the client does not send any RPCs or keepalive messages within that period, the server terminates the session, causing this error.

Exam trap

Cisco often tests the distinction between session-level errors (like timeout) and capability/operation errors, tempting candidates to pick a datastore or SSH key issue when the error explicitly mentions 'session closed'.

How to eliminate wrong answers

Option B is wrong because base NETCONF 1.0 (RFC 4741) is widely supported on modern Cisco devices; the error message does not indicate a version mismatch, which would instead produce a 'capability exchange' or 'hello' failure. Option C is wrong because an SSH key change would cause an SSH authentication or host key verification error, not a session closure after the session was already established. Option D is wrong because lack of candidate datastore support would result in an 'operation not supported' error when attempting to use <edit-config> with candidate, not a session closure error.

Full explanation →
494
MCQeasy

Which HTTP method is idempotent and safe?

A.GET
B.DELETE
C.POST
D.PUT
AnswerA

GET is safe and idempotent.

Why this answer

GET is both idempotent and safe because it is designed to retrieve a resource without causing any side effects on the server. According to RFC 7231, a safe method does not modify the resource state, and an idempotent method guarantees that multiple identical requests produce the same result as a single request. GET satisfies both conditions, as it never alters server state and repeating the same GET request returns the same representation.

Exam trap

Cisco often tests the distinction between idempotent and safe by pairing DELETE (idempotent but not safe) or PUT (idempotent but not safe) as distractors, leading candidates to assume that any method that can be repeated safely is also safe, when in fact safety requires no server-side state change.

How to eliminate wrong answers

Option B (DELETE) is wrong because while DELETE is idempotent (repeated calls have the same effect as one call, typically returning 404 after the first deletion), it is not safe because it modifies server state by removing a resource. Option C (POST) is wrong because POST is neither safe nor idempotent; it creates or updates a resource, and multiple identical POST requests can result in multiple resource creations or side effects. Option D (PUT) is wrong because although PUT is idempotent (replacing a resource with the same representation yields the same state), it is not safe because it modifies server state by updating or creating a resource.

Full explanation →
495
MCQeasy

What HTTP method should be used to update only the description field of a network device resource via a REST API?

A.DELETE
B.PUT
C.POST
D.PATCH
AnswerD

PATCH is designed for partial updates to a resource.

Why this answer

PATCH is used for partial updates, whereas PUT replaces the entire resource. GET retrieves, POST creates, DELETE removes.

Full explanation →
496
Multi-Selecthard

A company is implementing a secure CI/CD pipeline. Which THREE practices are essential for securing the pipeline?

Select 3 answers
A.Sign and verify all build artifacts.
B.Allow all container images to be pulled from any public registry.
C.Store secrets (API keys, passwords) in version control.
D.Implement role-based access control (RBAC) on the CI/CD system.
E.Use static application security testing (SAST) tools in the build stage.
AnswersA, D, E

Signing ensures artifacts are not tampered with.

Why this answer

Signing and verifying build artifacts ensures integrity and authenticity, preventing tampered artifacts from being deployed. This is a core supply chain security practice, often implemented using tools like GPG or Sigstore (Cosign) to generate and validate cryptographic signatures. Without verification, an attacker could inject malicious code into the pipeline by replacing a signed artifact with a compromised one.

Exam trap

Cisco often tests the misconception that 'allowing any public registry' is acceptable for speed or convenience, but the correct practice is to restrict registries to trusted, scanned sources to prevent supply chain attacks.

Full explanation →
497
MCQmedium

During a network outage, a technician notices that hosts in VLAN 10 cannot reach the default gateway at 192.168.10.1, but hosts in VLAN 20 can. The switch interfaces are up, and the router is configured with subinterfaces. What is the most likely cause?

A.The trunk link is administratively down.
B.The switchport trunk native VLAN is mismatched.
C.The router subinterface for VLAN 10 is down or misconfigured.
D.The router does not have an IP address configured.
AnswerC

A down or misconfigured subinterface prevents routing for that VLAN.

Why this answer

The router subinterface for VLAN 10 is down or misconfigured. Since hosts in VLAN 10 cannot reach the default gateway but hosts in VLAN 20 can, the issue is isolated to VLAN 10. The router uses subinterfaces to route between VLANs via a trunk link; if the subinterface for VLAN 10 is down (e.g., no 'no shutdown' command) or misconfigured (e.g., wrong VLAN ID or encapsulation), it will not process traffic for that VLAN, while other subinterfaces remain functional.

Exam trap

Cisco often tests the misconception that a trunk link issue or native VLAN mismatch would affect all VLANs equally, when in fact a subinterface-specific problem (like being administratively down or misconfigured) can isolate a single VLAN.

How to eliminate wrong answers

Option A is wrong because if the trunk link were administratively down, all VLANs (including VLAN 20) would be affected, not just VLAN 10. Option B is wrong because a native VLAN mismatch on a trunk would cause issues for untagged traffic (typically VLAN 1) or potential spanning-tree problems, but it would not selectively break only VLAN 10 while VLAN 20 works. Option D is wrong because the router does have IP addresses configured (as implied by the default gateway 192.168.10.1 for VLAN 10 and presumably another for VLAN 20), and the problem is specific to VLAN 10, not a global lack of IP configuration.

Full explanation →
498
Multi-Selectmedium

A developer is using the Meraki Dashboard API to list all networks in an organization. Which TWO of the following are valid methods for pagination?

Select 2 answers
A.offset and limit parameters
B.startingAfter and endingBefore parameters
C.X-Next-Page header
D.page and perPage parameters
E.Link header with rel="next"
AnswersB, E

Correct. These parameters are used for cursor-based pagination.

Why this answer

Meraki supports Link header with rel="next" and the startingAfter/endingBefore parameters for pagination.

Full explanation →
499
MCQhard

Refer to the exhibit. A service engineer runs a 'check-sync' action on the NSO service 'vpn1'. The result shows 'out-of-sync' for device 'pe1'. What does this indicate?

A.The device pe1 is unreachable via NETCONF.
B.The service model in NSO does not have a configuration for pe1.
C.The device pe1 has a hardware failure.
D.The configuration on pe1 differs from the service model defined in NSO.
AnswerD

Check-sync compares device config with service model.

Why this answer

The 'check-sync' action in NSO compares the actual device configuration (retrieved via NETCONF or CLI) against the configuration that NSO's service model expects. An 'out-of-sync' result for device 'pe1' means the running configuration on pe1 does not match the configuration defined by the NSO service model for that device. This is a standard NSO feature to detect configuration drift.

Exam trap

The trap here is confusing 'out-of-sync' with connectivity or hardware issues; Cisco tests whether you understand that NSO's check-sync is a configuration comparison mechanism, not a reachability or health check.

How to eliminate wrong answers

Option A is wrong because 'out-of-sync' does not indicate reachability; if pe1 were unreachable via NETCONF, the check-sync action would fail with a connection error, not return 'out-of-sync'. Option B is wrong because if the service model had no configuration for pe1, NSO would not attempt a check-sync on that device, or the result would indicate 'no configuration' rather than 'out-of-sync'. Option C is wrong because hardware failures are not detected by NSO's configuration synchronization mechanism; NSO operates at the configuration management layer, not the hardware monitoring layer.

Full explanation →
500
MCQhard

A network engineer is designing a REST API using Python Flask to allow provisioning of VPN tunnels. The API must support multiple clients and must be secure. Which approach is most appropriate for authenticating and authorizing API requests?

A.Use OAuth 2.0 with client credentials grant
B.Use HTTP Basic Authentication with a dictionary of usernames and passwords
C.Embed a shared secret in each client's source code
D.Issue API tokens to each client and validate them on each request
AnswerD

API tokens are a standard, secure method for API authentication and can include scopes.

Why this answer

Issuing API tokens (e.g., using Flask's built-in session management or a library like Flask-JWT-Extended) allows the server to validate each request statelessly without storing client credentials on every call. This approach scales well for multiple clients, supports token revocation, and avoids exposing long-lived secrets in transit or at rest, aligning with RESTful statelessness and security best practices.

Exam trap

Cisco often tests the misconception that 'API tokens' are the same as 'shared secrets' or that OAuth 2.0 is always the most secure choice, but the trap here is that for a simple, multi-client provisioning API, issuing and validating API tokens provides the right balance of security, statelessness, and manageability without the overhead of a full OAuth 2.0 framework.

How to eliminate wrong answers

Option A is wrong because OAuth 2.0 with the client credentials grant is designed for server-to-server (machine-to-machine) communication where the client is a confidential client, not for multiple end-user clients provisioning VPN tunnels; it requires a token endpoint and client secrets, adding unnecessary complexity for a simple API. Option B is wrong because HTTP Basic Authentication transmits credentials in plaintext (Base64-encoded) with every request, requiring HTTPS to be secure and forcing the server to maintain a dictionary of plaintext passwords, which violates the principle of least privilege and is not scalable for multiple clients. Option C is wrong because embedding a shared secret in each client's source code exposes the secret to anyone with access to the code (e.g., via version control or decompilation), making it impossible to revoke or rotate without redeploying every client, and it violates the principle of not storing secrets in code.

Full explanation →
501
MCQhard

A developer is using Cisco NSO to create a service. They are evaluating whether to use Python or Java for plan callbacks. Which consideration is most important?

A.Java is preferred due to better integration with NSO's internal data model
B.Python is the only supported language for custom service code in NSO
C.Both are equally supported, but Python has more extensive libraries for networking
D.Python is preferred due to faster execution
AnswerC

Python's rich ecosystem and readability make it a common choice.

Why this answer

Cisco NSO supports both Python and Java for plan callbacks, and the choice between them often hinges on the developer's familiarity and the specific requirements of the service. Python is particularly favored in many networking contexts due to its extensive ecosystem of libraries (e.g., for NETCONF, RESTCONF, or SNMP), which can accelerate development. However, Java is equally supported and may be chosen for performance-critical or deeply integrated components within NSO's Java Native Interface (JNI).

Exam trap

Cisco often tests the misconception that Python is the only or primary language for NSO customizations, when in fact both Python and Java are fully supported, and the choice depends on factors like library availability and developer expertise, not exclusivity or raw performance.

How to eliminate wrong answers

Option A is wrong because Java does not have inherently better integration with NSO's internal data model; both Python and Java interact with NSO's CDB and service models through well-defined APIs (e.g., Python's ncs module and Java's Maapi/TransAPI). Option B is wrong because Python is not the only supported language for custom service code; NSO explicitly supports both Python and Java for plan callbacks and action implementations. Option D is wrong because Python is generally slower in execution than Java (due to being interpreted vs. compiled), so faster execution is not a valid reason to prefer Python.

Full explanation →
502
Multi-Selectmedium

A developer receives HTTP 409 Conflict when updating a network configuration via Cisco NX-OS API. Which two scenarios could cause this error?

Select 2 answers
A.The resource was recently modified by another client.
B.The update conflicts with a lock held by another transaction.
C.The request body contains malformed JSON.
D.The request includes unsupported parameters.
E.The API key used is invalid.
AnswersA, B

A concurrent modification leads to a version conflict, resulting in 409.

Why this answer

HTTP 409 Conflict indicates a request conflicts with the current state of the resource. In the context of Cisco NX-OS API, this error occurs when the resource was recently modified by another client (option A) or when the update conflicts with a lock held by another transaction (option B). Both scenarios involve a state mismatch that the server cannot resolve without client intervention, often requiring the client to re-fetch the resource and retry.

Exam trap

Cisco often tests the distinction between client-side errors (400, 401) and server-side state conflicts (409), so the trap here is confusing a malformed request or authentication failure with a resource state conflict.

Full explanation →
503
MCQhard

A developer uses Kubernetes and wants to expose a deployment named 'web-app' externally via a cloud load balancer. Which Service type should be used?

A.ClusterIP
B.ExternalName
C.NodePort
D.LoadBalancer
AnswerD

Correct. LoadBalancer creates an external load balancer.

Why this answer

The LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that routes external traffic to the 'web-app' deployment's pods. This is the only Service type that directly integrates with a cloud provider's load balancing infrastructure to expose the service externally.

Exam trap

Cisco often tests the misconception that NodePort alone provides external cloud load balancing, but NodePort only exposes the service on node IPs without cloud integration, requiring additional infrastructure for true load balancing.

How to eliminate wrong answers

Option A (ClusterIP) is wrong because it exposes the Service only on a cluster-internal IP, making it unreachable from outside the cluster. Option B (ExternalName) is wrong because it maps a Service to a DNS name (via CNAME) and does not expose any ports or pods externally. Option C (NodePort) is wrong because it exposes the Service on a static port on each node's IP, but it does not provision a cloud load balancer; it requires manual configuration and does not provide cloud-native load balancing features like health checks or auto-scaling.

Full explanation →
504
MCQmedium

In a Kubernetes cluster, a developer needs to ensure that a set of pods can be accessed by other pods using a stable IP address and DNS name, even if pods are recreated. Which resource should be created?

A.ConfigMap
B.Namespace
C.Service
D.Deployment
AnswerC

A Service provides a stable IP and DNS name for a set of pods, abstracting pod IP changes.

Why this answer

A Service in Kubernetes provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that persists across pod restarts and rescheduling. This allows other pods to reliably discover and communicate with the set of pods behind the Service, regardless of individual pod IP changes.

Exam trap

Cisco often tests the misconception that a Deployment alone provides stable networking, but a Deployment only ensures desired pod count and updates, not a fixed network identity — the Service resource is required for that.

How to eliminate wrong answers

Option A is wrong because a ConfigMap is used to inject configuration data (e.g., environment variables, files) into pods, not to provide a stable network endpoint. Option B is wrong because a Namespace is a logical isolation boundary for resources, not a mechanism for stable pod addressing or DNS. Option D is wrong because a Deployment manages pod replicas and updates but does not assign a stable IP or DNS name; pods created by a Deployment get ephemeral IPs that change on recreation.

Full explanation →
505
MCQeasy

Based on the exhibit, which interface is in a down/down state (both Status and Protocol are down)?

A.None
B.GigabitEthernet0/2
C.GigabitEthernet0/0
D.GigabitEthernet0/1
AnswerD

Gig0/1 shows Status down and Protocol down.

Why this answer

The exhibit shows that GigabitEthernet0/1 has both Status and Protocol listed as 'down'. In Cisco IOS, the 'Status' column indicates the line protocol state (Layer 1), and the 'Protocol' column indicates the data link layer state (Layer 2). When both are 'down', the interface is administratively down or has a physical layer issue, such as a disconnected cable or a shutdown command.

Exam trap

Cisco often tests the ability to read the 'show interfaces' output correctly, where candidates may confuse the 'Status' and 'Protocol' columns or misinterpret an 'up/up' state as a problem, leading them to select a wrong interface like GigabitEthernet0/0 or GigabitEthernet0/2.

How to eliminate wrong answers

Option A is wrong because the exhibit clearly shows at least one interface (GigabitEthernet0/1) with both Status and Protocol down, so 'None' is incorrect. Option B is wrong because GigabitEthernet0/2 shows Status as 'up' and Protocol as 'up', indicating a fully operational interface. Option C is wrong because GigabitEthernet0/0 shows Status as 'up' and Protocol as 'up', meaning it is also fully functional.

Full explanation →
506
Multi-Selecthard

A network automation script using NX-API on a Nexus switch fails intermittently with HTTP 500 errors. Which two troubleshooting steps are most effective in diagnosing the issue? (Choose two.)

Select 2 answers
A.Check the length of the JSON payload sent to the API.
B.Ensure the switch is running NX-OS version 9.3(1) or later.
C.Enable NX-API debugging on the switch to capture detailed logs.
D.Verify that the NX-API sandbox feature is enabled and running.
E.Use HTTP instead of HTTPS for the API requests.
AnswersC, D

Debug logs help identify the exact failure point.

Why this answer

Enabling NX-API debugging on the switch (using the 'debug nxapi' command) captures detailed logs of API requests and responses, including HTTP 500 error details. This allows you to pinpoint the root cause, such as malformed payloads, internal server errors, or resource exhaustion. Without debugging, the generic 500 error provides no insight into the specific failure.

Exam trap

Cisco often tests the misconception that HTTP 500 errors are always client-side issues (like payload size) or can be fixed by changing protocols, when in fact they require server-side debugging to diagnose internal failures.

Full explanation →
507
Multi-Selecteasy

Which TWO of the following are valid Python data types?

Select 2 answers
A.array
B.list
C.set
D.dict
E.map
AnswersB, C

List is a built-in Python data type: an ordered, mutable collection.

Why this answer

List and set are both built-in Python data types. List is an ordered, mutable collection, while set is an unordered collection of unique elements. Array is not a built-in data type; it is provided by the array module.

Dict is also a built-in data type, but the question requires selecting exactly two options, and list and set are the correct ones. Map is a built-in function, not a data type.

Exam trap

Cisco often tests the distinction between built-in data types (like list and dict) and modules or functions (like array and map) that are not data types themselves, causing candidates to confuse the array module or map function with actual data types.

Full explanation →
508
MCQmedium

What is the correct Content-Type header value for a RESTCONF request using JSON encoding?

A.application/yang-data+json
B.application/json
C.text/json
D.application/xml
AnswerA

Defined in RFC 8040 for RESTCONF JSON encoding.

Why this answer

RESTCONF uses application/yang-data+json for JSON and application/yang-data+xml for XML. application/json is not specific to YANG data.

Full explanation →
509
Multi-Selectmedium

Which TWO of the following are recommended practices for securing a CI/CD pipeline in a DevOps environment? (Choose two.)

Select 2 answers
A.Store secrets and credentials in a secure vault and inject them at runtime
B.Grant all developers write access to the production environment to enable faster fixes
C.Deploy code to production first, then run security tests to check for issues
D.Scan container images for known vulnerabilities as part of the build pipeline
E.Use the same API token for all pipeline stages to simplify authentication
AnswersA, D

Keeps secrets out of source code and build logs.

Why this answer

Storing secrets (e.g., API keys, database passwords) in a secure vault (like HashiCorp Vault or AWS Secrets Manager) and injecting them at runtime prevents hard-coded credentials in source code or configuration files. This follows the principle of least privilege and ensures that secrets are never exposed in logs, version control, or build artifacts, which is a fundamental security practice for CI/CD pipelines.

Exam trap

Cisco often tests the misconception that security testing can be deferred to post-production (Option C) or that shared credentials simplify management (Option E), but the correct answers emphasize proactive security (scanning early) and credential isolation (vault injection).

Full explanation →
510
MCQmedium

A developer is troubleshooting an HTTP API call that returns a 404 status code. Which of the following is the most likely cause?

A.The server is unavailable due to maintenance
B.The requested URL endpoint does not exist
C.The server encountered an internal error
D.The client lacks proper authentication
AnswerB

404 Not Found means the server cannot find the requested resource.

Why this answer

HTTP 404 indicates the requested resource could not be found on the server.

Full explanation →
511
MCQeasy

A developer wants to run a container in the background with port mapping and a named volume. Which command accomplishes this?

A.docker run -d -p 8080:80 -v myvol:/data --name myapp nginx
B.docker start -d -p 8080:80 -v myvol:/data --name myapp nginx
C.docker run -d -p 8080:80 --mount source=myvol,target=/data --name myapp nginx
AnswerA, C

Correct. The `-v myvol:/data` syntax creates a named volume `myvol` if it doesn't exist and mounts it to `/data`. Combined with `-d`, `-p 8080:80`, and `--name myapp`, it meets all requirements.

Why this answer

Options A and C are both correct. Option A uses the `-v` flag to mount a named volume, which is a shorthand for volume mounting. Option C uses the `--mount` flag; when `type=volume` is omitted, it defaults to a volume mount, so `--mount source=myvol,target=/data` is equivalent to `-v myvol:/data`.

Both commands create a new container in detached mode (`-d`), map port 8080 on the host to port 80 in the container (`-p 8080:80`), mount the named volume `myvol` to `/data`, and name the container `myapp`. Option B is incorrect because `docker start` only starts an existing container and cannot create a new one or specify port mapping or volumes.

Exam trap

This question tests whether you know that both `-v` and `--mount` (without explicit `type=volume`) are valid syntaxes for mounting a named volume. Candidates often mistakenly believe `--mount` requires `type=volume` or that only one syntax is correct.

How to eliminate wrong answers

Option B is wrong because `docker start` is used to start an existing stopped container, not to create a new one; it does not accept `-p`, `-v`, or `--name` flags for initial configuration, so it cannot set up port mapping or named volumes. Option C is wrong because while `--mount` can achieve volume mounting, the syntax `source=myvol,target=/data` is incorrect — the correct `--mount` syntax requires `type=volume` (e.g., `--mount type=volume,source=myvol,target=/data`); omitting `type=volume` causes Docker to treat the source as a bind mount path, not a named volume.

Full explanation →
512
MCQhard

A developer is implementing OAuth 2.0 for a Cisco Webex integration that needs to send messages on behalf of a user. The integration runs on a server with no user interface. Which OAuth 2.0 flow should be used?

A.Implicit flow
B.Client Credentials flow
C.Authorization Code flow with PKCE
D.Device Code flow
AnswerB

Server-to-server without user context; suitable for non-interactive apps.

Why this answer

For a server-to-server scenario without a user interface, the client credentials grant is appropriate, even though Webex typically uses authorization code for user context. However, the question implies a machine-to-machine scenario; client credentials flow is for server-to-server where no user is present.

Full explanation →
513
MCQmedium

Which Git branching strategy typically involves a long-lived 'develop' branch where feature branches are merged, and releases are created from a 'release' branch?

A.GitFlow
B.GitHub Flow
C.Trunk-based development
D.Feature branch workflow
AnswerA

Involves develop and release branches.

Why this answer

GitFlow is correct because it defines a long-lived 'develop' branch for integrating feature branches, and a separate 'release' branch for preparing releases. This strategy uses dedicated branches for features, releases, and hotfixes, with strict merging rules back to 'develop' and 'main'.

Exam trap

Cisco often tests the distinction between GitFlow's multiple long-lived branches (develop, release, main) and simpler workflows like GitHub Flow or trunk-based development, where candidates mistakenly assume any workflow with feature branches is GitFlow.

How to eliminate wrong answers

Option B (GitHub Flow) is wrong because it uses a single long-lived 'main' branch with short-lived feature branches, and releases are created directly from 'main' without a dedicated 'release' branch. Option C (Trunk-based development) is wrong because it relies on a single trunk branch (often 'main' or 'trunk') with very short-lived feature branches, and no long-lived 'develop' or 'release' branches. Option D (Feature branch workflow) is wrong because it typically merges feature branches directly into a shared branch (e.g., 'main') without a separate long-lived 'develop' branch or a dedicated 'release' branch.

Full explanation →
514
MCQhard

A network engineer is configuring a wireless network for a hospital that requires high throughput and minimal interference from neighboring networks. Which set of 2.4 GHz channels should be used for non-overlapping coverage?

A.1, 6, 11
B.2, 7, 12
C.1, 5, 9
D.1, 3, 5
AnswerA

These are the standard non-overlapping channels.

Why this answer

In the 2.4 GHz ISM band, channels 1, 6, and 11 are the only three non-overlapping channels, each separated by 25 MHz, which prevents co-channel interference. This configuration maximizes throughput and minimizes interference from neighboring networks, making it ideal for high-density environments like hospitals.

Exam trap

Cisco often tests the misconception that any set of channels spaced 5 apart (e.g., 1, 6, 11) is the only valid set, but candidates may mistakenly think channels like 2, 7, 12 or 1, 5, 9 are also non-overlapping due to misunderstanding of channel width and regulatory restrictions.

How to eliminate wrong answers

Option B is wrong because channels 2, 7, and 12 are not all non-overlapping; channel 12 is not available for use in the United States (FCC restricts it to low-power or indoor-only use) and overlaps with channel 11. Option C is wrong because channels 1, 5, and 9 overlap; channel 5 overlaps with channels 1 and 9, causing interference. Option D is wrong because channels 1, 3, and 5 all overlap; adjacent channels (e.g., 1 and 3) have significant frequency overlap, leading to co-channel interference.

Full explanation →
515
MCQhard

A developer needs to use Postman to test an API that uses Basic authentication. How should the credentials be configured in Postman?

A.Send the credentials in the request body as JSON
B.Use the Authorization tab, select Basic Auth, and enter username and password
C.Set the Authorization header to 'Bearer base64(username:password)'
D.Add a query parameter 'auth' with base64-encoded credentials
AnswerB

Postman will automatically encode and set the header.

Why this answer

Postman's Authorization tab provides a Basic Auth type that automatically encodes credentials. The raw base64-encoded string is the underlying mechanism but is handled by Postman. Basic auth does not use bearer tokens.

Full explanation →
516
MCQeasy

A developer is deploying a containerized application to a Kubernetes cluster. To ensure that the application can securely access a third-party API, what is the best practice for storing the API key?

A.Store it as a Kubernetes Secret and mount it as an environment variable.
B.Hardcode the API key in the Docker image.
C.Use a service account token.
D.Store it in a ConfigMap and reference it from the pod.
AnswerA

Kubernetes Secrets are designed for sensitive data and can be mounted as environment variables.

Why this answer

Kubernetes Secrets are designed for sensitive data and can be mounted as environment variables. Option B is insecure because hardcoding keys in images exposes them. Option C is incorrect because service account tokens are for cluster authentication, not external APIs.

Option D is incorrect because ConfigMaps are for non-sensitive configuration data.

Full explanation →
517
MCQhard

A Kubernetes pod needs to run a database that requires persistent storage. Which volume type should be used to store data that persists beyond the pod lifecycle?

A.emptyDir
B.PersistentVolumeClaim
C.configMap
D.hostPath
AnswerB

PVC provides durable storage that persists beyond pod.

Why this answer

PersistentVolumeClaim requests persistent storage that survives pod restarts. emptyDir is ephemeral, hostPath ties to a node, configMap is for configuration.

Full explanation →
518
MCQmedium

A developer is using the Cisco Webex API to send a message to a specific room. They have the room ID. Which endpoint and method should they use?

A.PUT /v1/messages/{messageId}
B.POST /v1/messages with roomId in the body
C.POST /v1/rooms with roomId in the body
D.GET /v1/messages?roomId=...
AnswerB

This is the correct endpoint and method to send a message.

Why this answer

To send a message to a Webex room, the correct endpoint is POST /v1/messages with roomId in the body.

Full explanation →
519
MCQmedium

A developer is writing an application that needs to send a large amount of data reliably over a network. Which transport layer protocol should the developer use?

A.TCP
B.ICMP
C.HTTP
D.UDP
AnswerA

TCP ensures reliable data transfer through acknowledgments and retransmissions.

Why this answer

TCP (Transmission Control Protocol) is the correct choice because it provides reliable, connection-oriented data delivery with acknowledgments, retransmission, and sequencing. This ensures that large amounts of data are transmitted without loss or corruption, which is critical for applications requiring data integrity.

Exam trap

Cisco often tests the distinction between transport-layer protocols (TCP vs. UDP) and higher-layer protocols (HTTP), so the trap here is that candidates might choose HTTP because it is commonly used for data transfer, forgetting that it is not a transport-layer protocol.

How to eliminate wrong answers

Option B (ICMP) is wrong because ICMP is a network-layer protocol used for error reporting and diagnostics (e.g., ping), not for reliable data transport. Option C (HTTP) is wrong because HTTP is an application-layer protocol that relies on TCP for reliable transport; it is not a transport-layer protocol itself. Option D (UDP) is wrong because UDP is connectionless and does not guarantee delivery, ordering, or retransmission, making it unsuitable for reliable large-data transfers.

Full explanation →
520
MCQmedium

A developer is using Python requests library to interact with a Cisco IOS XE device's REST API. The call returns a 400 Bad Request status. The payload is correctly formatted JSON. What is the most likely cause?

A.The authentication credentials are missing or incorrect in the request header
B.The device's API service is not enabled
C.The requested URL path is incorrect
D.The JSON payload contains a syntax error
AnswerA

400 Bad Request commonly indicates missing or invalid authentication headers.

Why this answer

A 400 Bad Request status from a Cisco IOS XE REST API indicates a client-side error, typically related to malformed syntax or missing required elements. Since the JSON payload is confirmed as correctly formatted, the most likely cause is missing or incorrect authentication credentials in the request header, as the API requires valid credentials (e.g., Basic Auth with username:password encoded in Base64) to process the request. Without proper authentication, the server rejects the request with a 400 status before even evaluating the payload.

Exam trap

Cisco often tests the distinction between 400 Bad Request (client-side syntax/header issues) and 401 Unauthorized (invalid credentials), tricking candidates into assuming authentication errors always return 401, when in fact missing or malformed authentication headers can trigger a 400.

How to eliminate wrong answers

Option B is wrong because if the API service is not enabled, the device would typically return a 404 Not Found or a connection refusal, not a 400 Bad Request. Option C is wrong because an incorrect URL path would result in a 404 Not Found status, not a 400 Bad Request, as the server would not find the resource. Option D is wrong because the question explicitly states the JSON payload is correctly formatted, so a syntax error cannot be the cause.

Full explanation →
521
MCQhard

A developer wants to automate the provisioning of a UCS server using Cisco Intersight. Which authentication method is recommended for programmatic access?

A.Basic authentication with username and password
B.API Key with HMAC signing
C.Session token from Intersight UI
D.OAuth2 with client credentials
AnswerB

Intersight recommends API keys with HMAC signing for automated access.

Why this answer

Cisco Intersight recommends API key authentication with HMAC signing for programmatic access because it provides a secure, non-interactive method for automation scripts and tools. The API key consists of a key ID and a secret, and each request must include an HMAC signature generated from the request details, ensuring integrity and authenticity without exposing static credentials over the network.

Exam trap

Cisco often tests the distinction between interactive (session-based) and non-interactive (API key) authentication, leading candidates to mistakenly choose session tokens or basic auth because they are familiar from other Cisco platforms like UCS Manager or APIC.

How to eliminate wrong answers

Option A is wrong because basic authentication transmits the username and password in plaintext (Base64-encoded) with each request, which is insecure and not recommended for programmatic access to Intersight. Option C is wrong because a session token obtained from the Intersight UI is tied to a user session and requires interactive login, making it unsuitable for automated, headless provisioning workflows. Option D is wrong because OAuth2 with client credentials is not the standard or recommended method for Intersight; Intersight uses API key-based HMAC signing as its primary programmatic authentication mechanism.

Full explanation →
522
MCQmedium

A network team uses an Ansible playbook to automate the configuration of multiple Cisco IOS XE devices. The playbook includes the 'ios_config' module. Which of the following best describes the purpose of the 'provider' parameter in the ios_config module?

A.It defines the connection details for the device.
B.It identifies the name of the playbook being used.
C.It specifies the configuration lines to be applied.
D.It sets the timeout for the module execution.
AnswerA

Provider includes transport credentials.

Why this answer

The 'provider' parameter in the ios_config module is a dictionary that encapsulates the connection details required to access the network device, such as hostname, username, password, port, and transport protocol (e.g., SSH). This allows the module to establish a session with the Cisco IOS XE device before applying configuration changes. Without the provider, the module would not know how to reach or authenticate to the target device.

Exam trap

Cisco often tests the distinction between the 'provider' parameter (connection details) and the 'lines' parameter (configuration commands), leading candidates to mistakenly think 'provider' specifies the configuration content.

How to eliminate wrong answers

Option B is wrong because the playbook name is defined in the playbook file itself (e.g., the name field under a play), not in the ios_config module's provider parameter. Option C is wrong because the configuration lines to be applied are specified using the 'lines' or 'parents' parameters within the ios_config module, not the provider. Option D is wrong because timeout settings are configured via a separate 'timeout' parameter in the provider dictionary or directly in the module, not as the primary purpose of the provider parameter.

Full explanation →
523
MCQeasy

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

A.NetFlow
B.Syslog
C.Ansible
D.SNMP
AnswerC

Ansible is designed for configuration management and automation.

Why this answer

Ansible is the correct tool because it is an agentless automation platform that uses SSH to push configuration changes, such as VLAN deployment, to network devices. It allows engineers to define the desired state of VLANs in YAML playbooks and apply them consistently across multiple switches without manual intervention.

Exam trap

Cisco often tests the distinction between monitoring protocols (NetFlow, Syslog, SNMP) and automation tools (Ansible, Puppet, Chef), leading candidates to mistakenly choose SNMP because they recall it can write configurations, but they overlook its lack of idempotency and scalability for multi-switch VLAN deployment.

How to eliminate wrong answers

Option A is wrong because NetFlow is a network protocol used for traffic monitoring and analysis, not for configuration deployment. Option B is wrong because Syslog is a standard for message logging and does not provide any mechanism to push configuration changes to devices. Option D is wrong because SNMP is primarily used for monitoring and reading device statistics via MIBs, and while it can write some configuration values (SNMP SET), it is not designed for reliable, idempotent, or scalable VLAN deployment across multiple switches.

Full explanation →
524
MCQhard

A Kubernetes cluster is configured with a NetworkPolicy that allows ingress traffic only from pods with label 'app: frontend'. A new backend service needs to communicate with the database pod. What must be done to allow this?

A.Delete the existing NetworkPolicy
B.Add label 'app: backend' to the database pod
C.Modify the NetworkPolicy to include an additional rule allowing from pods with label 'app: backend'
D.Create a new NetworkPolicy for the database
AnswerC

Modifying the existing NetworkPolicy to add an ingress rule that allows pods with label 'app: backend' is the correct approach. It permits the needed traffic while preserving the existing restriction that only 'app: frontend' pods are allowed by default. This is the most secure and appropriate solution.

Why this answer

The existing NetworkPolicy only allows ingress from pods with label 'app: frontend'. To allow the backend service (which presumably has label 'app: backend') to communicate with the database pod, the best practice is to modify the existing NetworkPolicy to include an additional ingress rule that allows pods with label 'app: backend'. This preserves the existing security restrictions while permitting the new traffic.

Deleting the policy (option A) would remove all ingress restrictions, which is less secure and not necessary unless explicitly required. Option B only adds a label to the database pod and does not affect the NetworkPolicy's source selection. Option D creates a new policy, but because NetworkPolicies are additive, the existing policy still denies traffic from the backend, so a new policy alone would not work unless it selects the same pod and explicitly allows the traffic; modifying the existing policy is simpler and more appropriate.

Exam trap

Candidates may think that deleting the restrictive NetworkPolicy is the easiest solution, but the question asks what 'must be done' to allow the backend service while maintaining security. The correct approach is to add an ingress rule to the existing policy for the backend label, not to remove all restrictions.

How to eliminate wrong answers

Option B is wrong because adding the label 'app: backend' to the database pod does not change the source of traffic; the NetworkPolicy filters based on the source pod's labels, not the destination pod's labels. Option C is wrong because modifying the NetworkPolicy to include an additional rule for pods with label 'app: backend' would allow the backend service to reach the database, but this is not the only correct approach; the question asks 'what must be done', and deleting the policy is a valid and simpler solution, but the answer explicitly marks A as correct, so C is not the required action. Option D is wrong because creating a new NetworkPolicy for the database does not override the existing policy; Kubernetes NetworkPolicies are additive, so the existing policy would still block traffic from pods without the 'app: frontend' label, and the new policy would only add additional rules, not remove the restriction.

Full explanation →
525
MCQeasy

Which tool is specifically designed for model-driven programmability using YANG data models?

A.NETCONF
B.SNMP
C.CLI
D.Ansible
AnswerA

NETCONF is a protocol designed for model-driven management with YANG.

Why this answer

NETCONF is the correct answer because it is a network management protocol specifically designed to operate with YANG data models, using XML or JSON encoding to transport configuration and state data. YANG defines the structure of the data, and NETCONF provides the operations (get, edit-config, etc.) to manipulate that data in a model-driven, programmatic way. This makes NETCONF the standard tool for model-driven programmability in modern network automation.

Exam trap

Cisco often tests the distinction between a protocol that natively uses YANG (NETCONF) versus tools that can work with YANG but are not designed specifically for it (like Ansible), so the trap here is assuming any automation tool that supports YANG qualifies as 'specifically designed' for model-driven programmability.

How to eliminate wrong answers

Option B (SNMP) is wrong because SNMP uses MIBs (Management Information Bases) defined by SMI (Structure of Management Information), not YANG data models, and it is primarily used for monitoring rather than model-driven configuration. Option C (CLI) is wrong because CLI is a human-oriented, command-line interface that is not model-driven and does not use YANG; it relies on proprietary, device-specific commands. Option D (Ansible) is wrong because Ansible is an automation tool that can use YANG models indirectly via modules (e.g., ios_config), but it is not specifically designed for model-driven programmability using YANG; it is a general-purpose configuration management tool.

Full explanation →
Page 6

Page 7 of 14

Page 8

All pages

1234567891011121314

Practice 200-901 by domain

Target a specific domain to shore up weak areas.

Application Deployment and SecuritySoftware Development and DesignUnderstanding and Using APIsCisco Platforms and DevelopmentNetwork FundamentalsInfrastructure and Automation
See all domains with question counts →