Select Two (Multi-Select) Questions

API versioning should be implemented using query parameters only

Why wrong: Versioning via query parameters is uncommon; path or header versioning is preferred.

HTTP PUT method should be used for partial updates to a resource

Why wrong: PUT is for full replacement; PATCH is for partial updates.

Responses should return only HTTP status codes without a body

Why wrong: Responses typically include a body with details or representation of the resource.

YANG models are only used with the Python library ncclient.

Why wrong: ncclient is one tool, not exclusive.

The controller directly pushes configurations to network devices without validation.

Why wrong: YANG models enable validation before pushing.

NETCONF requires JSON encoding for configuration data.

Why wrong: NETCONF uses XML, not JSON.

VXLAN requires MPLS in the underlay

Why wrong: VXLAN can run over any IP network.

VXLAN uses IP-in-IP encapsulation

Why wrong: VXLAN uses MAC-in-UDP.

VXLAN operates at Layer 2 only

Why wrong: VXLAN is an overlay over Layer 3.

Bidirectional Forwarding Detection (BFD) implementation

Why wrong: BFD is not part of OSPF itself.

DUAL algorithm processing time

Why wrong: DUAL is used by EIGRP, not OSPF.

Avoid API versioning to keep the API simple

Why wrong: Incorrect: Versioning is important for evolution.

Include the HTTP method in the URI path, e.g., /getDevices

Why wrong: Incorrect: The HTTP method should be used via the verb, not the path.

Always use file-based transfer for large payloads

Why wrong: Incorrect: REST can handle large payloads via streaming or chunking.

Chain of Responsibility

Why wrong: Incorrect: This is a behavioral pattern, not specific to microservices.

Singleton

Why wrong: Incorrect: Singleton is a general OOP pattern.

Reduces network latency because it uses a lighter protocol.

Why wrong: Model-driven protocols may add overhead.

Requires no additional learning beyond CLI commands.

Why wrong: Model-driven approaches require understanding of YANG models.

Easier to debug because it uses the same syntax as CLI.

Why wrong: Different syntax, not easier.

Automatically enforce QoS policies on switches.

Why wrong: Assurance is for monitoring, not enforcement.

Collect NetFlow data from all network devices.

Why wrong: Assurance uses multiple data sources, not just NetFlow.

Client certificate exchange

Why wrong: Not commonly used with Cisco APIs.

LDAP bind credentials

Why wrong: LDAP is for directory services, not typical for API auth.

SNMPv3 authentication

Why wrong: SNMP is separate from REST API auth.

Use HTTP with basic authentication.

Why wrong: HTTP transmits credentials in plaintext; HTTPS is required for security.

Embed API keys in the URL query string.

Why wrong: API keys in URLs are exposed in logs and browser history; they should be sent in headers over HTTPS.

Implement rate limiting to prevent abuse.

Why wrong: Rate limiting is a control for availability, not a security mechanism for authentication or confidentiality.

Run all tasks without checking for errors

Why wrong: Error handling is important.

Hardcode device IPs in the playbook

Why wrong: IPs should be in inventory.

Sleep for a fixed amount of time between requests

Why wrong: Fixed sleep may not adapt to dynamic limits.

Ignore the limit and send requests faster

Why wrong: Will cause more blocks.

Building the routing table using OSPF

Why wrong: Control plane function.

Maintaining ARP cache entries

Why wrong: Control plane function.

Establishing OSPF neighbor adjacencies

Why wrong: Control plane function.

Use the ADD instruction instead of COPY to copy local files into the image.

Why wrong: COPY is preferred over ADD for local files because ADD has additional features (like tar extraction) that can be unexpected.

Combine multiple RUN commands into a single RUN statement to reduce image layers.

Why wrong: While reducing layers can be beneficial, combining commands into one RUN is not always best; it can reduce cacheability. The recommended practice is to minimize layers but not at the expense of readability.

Use the EXPOSE instruction to secure the container by limiting exposed ports.

Why wrong: EXPOSE is documentation only; it does not actually open or secure ports. Security is achieved via -p flag or network policies.

Enable verbose logging for all build steps to detect anomalies.

Why wrong: Verbose logging may expose sensitive information and does not directly prevent supply chain attacks.

Sign all build artifacts with a GPG key.

Why wrong: Signing verifies the integrity of the artifact itself but does not protect against compromised dependencies.

It requires procedural scripts

Why wrong: Declarative avoids procedural steps.

Idempotency is not a concern

Why wrong: Declarative models are idempotent.

You specify the exact steps to achieve the state

Why wrong: That's imperative.

Send credentials as plain text in every request.

Why wrong: Insecure; use tokens.

Poll the API every second to get real-time updates.

Why wrong: Polling is inefficient; use webhooks.

Embed API keys directly in the URL query parameters.

Why wrong: Exposes keys; use headers.

Store secrets in ConfigMaps for easy retrieval.

Why wrong: Secrets should be stored in Kubernetes Secrets, not ConfigMaps, and encrypted at rest.

Disable RBAC to simplify management and reduce overhead.

Why wrong: Disabling RBAC removes access control, making the cluster vulnerable to unauthorized actions.

Use default service accounts for all pods to avoid misconfiguration.

Why wrong: Default service accounts often have excessive permissions; custom accounts with least privilege are recommended.

IaC eliminates the need for manual review of configuration changes before deployment.

Why wrong: Manual review is still often part of the process for safety.

IaC requires that all network devices be replaced with software-based equivalents.

Why wrong: IaC manages existing hardware, not replaces it.

IaC is only applicable to virtual network functions, not physical devices.

Why wrong: Physical devices can be managed via IaC using APIs or SSH.

Lower CPU usage on devices

Why wrong: Not necessarily.

Binary data encoding

Why wrong: NETCONF uses XML, not binary.

Simple polling mechanism

Why wrong: SNMP is simpler for polling.