Scenario practice questions

A company has a microservices application deployed on Kubernetes. There are three services: frontend, backend, and database. The frontend is exposed via an Ingress. The API gateway is used for authentication. Recently, after updating the backend service, users are experiencing 401 Unauthorized errors when accessing endpoints that previously worked. The authentication mechanism uses JWT tokens issued by an external identity provider. The JWT tokens are validated by the API gateway. The backend service itself does not validate tokens; it relies on the gateway to forward user identity via headers. The development team checked the logs and found that the backend is receiving requests with the correct JWT from the gateway but still returning 401. What is the most likely cause?

Trap 1: The Ingress controller is stripping the Authorization header before…

Logs show backend receives the correct JWT, so header is present.

Trap 2: The API gateway's JWT signing key has changed and the backend is…

If the key changed, the gateway would fail to validate tokens, not the backend.

Trap 3: The new backend version uses a different HTTP method for the…

Method mismatch would cause 405 or similar, not 401.

A
The Ingress controller is stripping the Authorization header before forwarding to the backend.
Why wrong: Logs show backend receives the correct JWT, so header is present.
B
The API gateway's JWT signing key has changed and the backend is using the old key.
Why wrong: If the key changed, the gateway would fail to validate tokens, not the backend.
C
The new backend version uses a different HTTP method for the affected endpoints.
Why wrong: Method mismatch would cause 405 or similar, not 401.
D
The backend service code now attempts to validate the JWT itself and fails.
Likely the update added token validation code that is not properly configured.

Question 2mediummultiple choice

A developer is building a REST API for a Cisco DNA Center application. The API must allow external partners to retrieve network device inventory. Which security mechanism should be implemented to ensure that only authorized partners can access the API while maintaining the ability to revoke access for a specific partner without affecting others?

Trap 1: Whitelist partner IP addresses in the API gateway firewall

IP whitelisting is inflexible and does not authenticate the application, only the network address.

Trap 2: Require HTTP basic authentication with a shared username and…

Basic auth with shared credentials cannot be revoked per partner; changing the password affects all.

Trap 3: Implement OAuth 2.0 with client credentials grant

OAuth 2.0 is more complex and not necessary for simple partner access; also, revocation per client is possible but heavyweight.

A
Use unique API keys per partner
API keys are simple to manage and can be revoked individually without impacting other partners.
B
Whitelist partner IP addresses in the API gateway firewall
Why wrong: IP whitelisting is inflexible and does not authenticate the application, only the network address.
C
Require HTTP basic authentication with a shared username and password
Why wrong: Basic auth with shared credentials cannot be revoked per partner; changing the password affects all.
D
Implement OAuth 2.0 with client credentials grant
Why wrong: OAuth 2.0 is more complex and not necessary for simple partner access; also, revocation per client is possible but heavyweight.

Read the full DNS explanation →

Question 3easymultiple choice

A developer is trying to access an internal corporate web API at http://api.internal.company.com from their workstation, which has the IP configuration: IP address 192.168.1.100, subnet mask 255.255.255.0, default gateway 192.168.1.1, and DNS server 192.168.1.2. The developer can ping the DNS server (192.168.1.2) successfully, but when they try to curl the API endpoint, the command times out. The developer also confirms that the API server is up and reachable from other devices on the same subnet. Which action should the developer take to resolve this issue?

Trap 1: Disable the local firewall on the workstation to allow all outbound…

While a firewall could block traffic, it is not the most likely cause since DNS queries succeed. Disabling the firewall is a security risk and not a targeted solution.

Trap 2: Renew the DHCP lease to obtain a new IP address.

Renewing DHCP may not resolve the issue since the IP configuration appears correct and DNS is reachable.

Trap 3: Restart the network interface card (NIC) to reset the connection.

Restarting the NIC might temporarily reset the connection, but it doesn't address the root cause of routing to the API subnet.

A
Disable the local firewall on the workstation to allow all outbound traffic.
Why wrong: While a firewall could block traffic, it is not the most likely cause since DNS queries succeed. Disabling the firewall is a security risk and not a targeted solution.
B
Renew the DHCP lease to obtain a new IP address.
Why wrong: Renewing DHCP may not resolve the issue since the IP configuration appears correct and DNS is reachable.
C
Restart the network interface card (NIC) to reset the connection.
Why wrong: Restarting the NIC might temporarily reset the connection, but it doesn't address the root cause of routing to the API subnet.
D
Check the default gateway configuration. Ensure it is set to 192.168.1.1 and that the gateway can route traffic to the API's subnet.
The default gateway is likely missing or misconfigured, preventing traffic to the API subnet. Verifying its setting and reachability resolves the issue.

Question 4hardmultiple choice

During a code review, a developer notices that a function has multiple nested if-else statements. Which refactoring technique would improve maintainability?

Trap 1: Introduce parameter object

This refactoring addresses long parameter lists, not conditional complexity.

Trap 2: Decompose conditional

Decompose conditional breaks a complex conditional into separate methods, but it still retains the conditional structure.

Trap 3: Extract method

Extract method reduces duplication but does not remove the conditional logic itself.

A
Introduce parameter object
Why wrong: This refactoring addresses long parameter lists, not conditional complexity.
B
Decompose conditional
Why wrong: Decompose conditional breaks a complex conditional into separate methods, but it still retains the conditional structure.
C
Replace conditional with polymorphism
Polymorphism allows each subclass to implement its own behavior, eliminating the need for complex conditionals.
D
Extract method
Why wrong: Extract method reduces duplication but does not remove the conditional logic itself.

Study the full Python automation breakdown →

Question 5hardmultiple choice

A Python script using the Cisco ACI Toolkit (aciToolkit) fails with 'LoginError: unable to login to APIC'. The APIC is reachable via HTTPS. What is the most likely cause?

Trap 1: The APIC has reached its maximum session limit.

Session limit would produce a different error (e.g., 'max sessions reached'), and is less common than configuration errors.

Trap 2: The script uses HTTP instead of HTTPS.

The aciToolkit defaults to HTTPS and will raise a different error if HTTP is forced.

Trap 3: The APIC is running an unsupported firmware version.

Firmware version is not a direct cause of login failure; the toolkit supports a range of versions.

A
The APIC has reached its maximum session limit.
Why wrong: Session limit would produce a different error (e.g., 'max sessions reached'), and is less common than configuration errors.
B
The script uses HTTP instead of HTTPS.
Why wrong: The aciToolkit defaults to HTTPS and will raise a different error if HTTP is forced.
C
The script uses an incorrect APIC domain (e.g., 'apic' instead of the FQDN).
The aciToolkit's login() requires the correct APIC domain; an incorrect domain prevents proper authentication.
D
The APIC is running an unsupported firmware version.
Why wrong: Firmware version is not a direct cause of login failure; the toolkit supports a range of versions.

Read the full REST/YANG explanation →

Question 6mediummulti select

A developer is troubleshooting a Cisco RESTCONF API call that returns a 409 Conflict error. Which two scenarios could cause this? (Choose two.)

Trap 1: Authentication token is missing.

Missing token results in 401 Unauthorized.

Trap 2: The resource does not exist.

A missing resource would give 404, not 409.

Trap 3: The request contains invalid data types.

Invalid data types result in 400 Bad Request.

A
Authentication token is missing.
Why wrong: Missing token results in 401 Unauthorized.
B
The resource's current state conflicts with the requested change (e.g., trying to delete a resource that is in use).
State conflicts, like deleting a resource that is referenced, cause 409.
C
The resource already exists and the request attempts to create a duplicate.
Creating a duplicate resource is a typical cause of 409.
D
The resource does not exist.
Why wrong: A missing resource would give 404, not 409.
E
The request contains invalid data types.
Why wrong: Invalid data types result in 400 Bad Request.

Question 7mediummulti select

A developer receives HTTP 409 Conflict when updating a network configuration via Cisco NX-OS API. Which two scenarios could cause this error?

Trap 1: The request body contains malformed JSON.

Malformed JSON results in a 400 Bad Request, not 409.

Trap 2: The request includes unsupported parameters.

Unsupported parameters typically cause a 400 Bad Request.

Trap 3: The API key used is invalid.

An invalid API key results in 401 Unauthorized.

A
The resource was recently modified by another client.
A concurrent modification leads to a version conflict, resulting in 409.
B
The update conflicts with a lock held by another transaction.
Locking conflicts cause a 409 Conflict error.
C
The request body contains malformed JSON.
Why wrong: Malformed JSON results in a 400 Bad Request, not 409.
D
The request includes unsupported parameters.
Why wrong: Unsupported parameters typically cause a 400 Bad Request.
E
The API key used is invalid.
Why wrong: An invalid API key results in 401 Unauthorized.