hardMultiple ChoiceObjective-mapped
200-901 Practice Question: A DevNet engineer responsible for automating…
You are a DevNet engineer responsible for automating configuration management across a Cisco SD-WAN fabric. You have been using the vManage REST API to retrieve device inventory and template lists. You generate an API token with read/write scope and successfully execute GET requests to /dataservice/device and /dataservice/template/device to list devices and templates. Now you want to attach a specific template to a device using POST /dataservice/template/device/config/attach. Your Python script uses the correct URL and includes the token in the Authorization header. The request body contains the device UUID and template UUID retrieved earlier. However, the API returns an HTTP 403 Forbidden error. You have verified that the device UUID and template UUID are correct and that the template exists. The vManage server logs indicate no high resource usage. What is the most likely cause of the 403 error?
⚠ Common exam trap
Cisco often tests the misconception that a 403 Forbidden always means an authorization or scope issue, when in fact it can be a state-based rejection like attempting to attach an already-attached template.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The template is already attached to the device.
The HTTP 403 Forbidden error in Cisco SD-WAN vManage API occurs when attempting to attach a template that is already attached to the device. The API enforces idempotency and prevents duplicate attachments, returning 403 instead of 409 or 400 to indicate a state-based rejection. This is a known behavior, not a permission issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The vManage version does not support the attach API.
Why it's wrong here
Incorrect. The user successfully used GET APIs, so the vManage version supports the attach endpoint. A 403 is not a version mismatch error.
- ✓
The template is already attached to the device.
Why this is correct
Correct. The 403 Forbidden is returned when the template is already attached to the device, as the API enforces idempotency and prevents duplicate attachments.
- ✗
The device is not part of any template group.
Why it's wrong here
Incorrect. Attaching a template to a device does not require the device to be in a template group; templates can be attached individually. A group membership issue would likely return a different error.
- ✗
The API token has been issued only with read scope for the attach operation.
Why it's wrong here
Incorrect. The token was generated with read/write scope and worked for GET requests. The 403 here is not a permission issue but a state-based rejection due to duplicate attachment.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.