157 free Cisco 200-901 CCNAAUTO practice questions from the CertStash pack of 631, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 157 free here, all 631 in the pack, and each step includes the one before it.
Get all 631 questions (US$39) · Download the first 10 as a PDF
Question 1
Which two concepts describe test-driven development? (Choose two.)
Show answer and explanation
Correct answer: B, E. It enables code refactoring; Write a test before writing code.
Test-driven development is fundamentally characterized by writing tests before writing implementation code (option E), and this practice enables safer code refactoring because existing tests verify that refactored code maintains correct behavior (option B). User acceptance testers do not typically develop test requirements in TDD; developers write unit tests first. Tests are not created when code is ready for release; they drive development from the start. Implementation is not driven by testing release candidates; it is driven by incremental test cycles during active development.
Why the other options are wrong
- A. User acceptance testers develop acceptance tests, not the unit tests that drive TDD.
- C. Tests are created before code is written, not when code is ready for release.
- D. TDD uses incremental testing during development, not testing of release candidates.
Question 2
Which task is performed because the test-driven development approach is being used?
Show answer and explanation
Correct answer: C. refactoring code that is covered by existing tests
Refactoring code that is covered by existing tests is a characteristic task performed because of test-driven development. TDD creates a safety net of tests that allows developers to confidently restructure and improve code without fear of breaking functionality. Creating test scenarios based on continuous development is a general practice not specific to TDD. Writing code without violations is a general coding standard. Testing existing software before developing new code describes regression testing, not a TDD-specific task.
Why the other options are wrong
- A. This describes general testing practices, not a task specific to TDD.
- B. This is a general coding standard, not something enabled by TDD.
- D. This describes regression testing, which is not unique to TDD.
Question 3
What is the first development task in test-driven development?
Show answer and explanation
Correct answer: B. Write a failing test case for a desired function.
The first task in test-driven development is to write a failing test case for a desired function. This test expresses the requirement before any implementation exists, which is the defining characteristic of TDD. Writing code to implement a function comes after the test is written. Reverse engineering is not part of TDD. Writing a passing test for existing code does not make sense in the context of TDD's workflow, which starts with failing tests for unimplemented features.
Why the other options are wrong
- A. Implementation code is written second, after the test is written first.
- C. Reverse engineering is not part of the TDD process.
- D. Tests are failing initially; they do not pass before implementation.
Question 4
In test-driven development, what are two of the green bar patterns? (Choose two.)
Show answer and explanation
Correct answer: C, E. triangulate; fake it
In test-driven development, triangulate and fake it are recognized patterns used to reach the green bar (passing tests). Triangulate refers to writing multiple test cases that lead to generalizing the implementation beyond a single simple solution. Fake it means implementing the simplest possible code (often a hard-coded return value) that makes the test pass, to be refined later. Another test is not a green bar pattern. Break is a red bar pattern, not a green bar pattern. Starter test is also a red bar pattern, not a green bar pattern.
Why the other options are wrong
- A. Another test is not a named green bar pattern in TDD.
- B. Break is a red bar pattern in TDD, not a green bar pattern.
- D. Starter test is not an established TDD green bar pattern.
Question 5
In the test-driven development model, what is changed after a test fails?
Show answer and explanation
Correct answer: C. code
In the test-driven development cycle, when a test fails, the code is changed to make the test pass. This is the core cycle: write a failing test, then modify the implementation code to satisfy that test. The schedule and project requirements are not changed in response to a failing unit test. The test itself is not changed after it fails; a failing test indicates the implementation is incomplete, so the code must be modified to match the test's expectations.
Why the other options are wrong
- A. Development schedules are not adjusted based on individual test failures.
- B. Project requirements are not changed when a test fails.
- D. The test is not changed; the code is written to satisfy the test.
Question 6
What is a benefit of test-driven development?
Show answer and explanation
Correct answer: D. increased code quality
Increased code quality is a well-established benefit of test-driven development. TDD produces more thoroughly tested code with higher confidence in correctness, better documentation through tests, and code designed for testability, all of which result in higher quality. Strict adherence to product requirements is not what TDD delivers; its tests check the behaviour developers specify, not compliance with a requirements document. Faster releases with minimal features describes agile practices but is not a specific benefit of TDD itself. Early customer involvement is more aligned with agile ceremonies than with TDD specifically.
Why the other options are wrong
- A. Strict adherence to product requirements is not a benefit that TDD provides.
- B. TDD does not inherently produce faster releases or minimize features.
- C. Customer involvement is facilitated by agile processes, not specifically by TDD.
Question 7
Which two statements describe the advantages of using a version control system? (Choose two.)
Show answer and explanation
Correct answer: A, C. It allows for branching and merging so that different tasks are worked on in isolation before they are merged into a feature or master branch; It allows multiple engineers to work against the same code and configuration files and manage differences and conflicts.
Version control systems enable branching and merging, allowing developers to work on different tasks in isolated branches before integrating them into a shared codebase (option A), and they allow multiple engineers to collaborate on the same files while managing changes and resolving conflicts (option C). Providing tooling to automate builds and infrastructure provisioning is the function of CI/CD systems, not version control. Tracking user stories and managing backlogs is the role of project management tools. Writing effective unit tests is a developer practice, not enabled by version control software itself.
Why the other options are wrong
- B. Build automation and infrastructure provisioning are CI/CD concerns, not version control.
- D. User story tracking is performed by project management tools, not version control.
- E. Version control does not directly enable or help developers write unit tests.
Question 8
What are two advantages of version control software? (Choose two.)
Show answer and explanation
Correct answer: B, C. It allows new team members to access the current code and history; It supports comparisons between revisions of source code files.
Version control systems allow new team members to access the current code and the full development history (option B), and they support detailed comparisons between different revisions of source code files to understand what changed and why (option C). Version control systems typically work best with text-based files and do not efficiently support binary format file tracking and comparison. Wiki collaboration is a documentation tool feature, separate from version control. Hosting old packaged applications is a software distribution concern, not an advantage of version control.
Why the other options are wrong
- A. Version control is optimized for text files, not efficient for binary format comparisons.
- D. Wiki collaboration is a separate documentation tool, not a version control feature.
- E. Hosting packaged applications is a distribution function, not a version control advantage.
Question 9
Before which process is code review performed when version control is used?
Show answer and explanation
Correct answer: B. merge of code
With version control, code review usually happens through a pull or merge request before a branch is merged into the main line. Developers commit freely on their own branch, and review is the gate that decides whether those commits are merged. So review comes before the merge.
Why the other options are wrong
- A. Checking out code only retrieves it and does not need a review.
- C. Developers commit locally and on feature branches as they work, and review normally happens later, before merging.
- D. Creating a branch starts new work, so there is nothing to review yet.
Question 10
What is an advantage of a version control system?
Show answer and explanation
Correct answer: A. facilitates resolving conflicts when merging code
A primary advantage of version control systems is that they facilitate resolving conflicts when code from different branches or developers is merged together. Version control provides tools and mechanisms to identify and resolve these merge conflicts. While version control can support other practices, it does not ensure unit tests are written, it does not stop files from being overwritten (that takes file locking or access control), and it does not force trunk-based development, which is a team practice choice.
Why the other options are wrong
- B. Version control does not enforce or ensure that unit tests are written; testing practices are separate from version control.
- C. Version control does not prevent code or configuration files from being overwritten; that is the job of file locking or access control.
- D. Version control is a tool that can support trunk-based development but does not force teams to adopt this practice.
What people say about the full 200-901 pack 5.0 from 2
Question 11
Which technology is responsible for resolving a host name to an IP address?
Show answer and explanation
Correct answer: A. DNS
The Domain Name System (DNS) translates human-readable host names such as api.meraki.com into IP addresses that devices use to send packets. A client sends a query, usually over UDP port 53, to a resolver, which returns the matching A (IPv4) or AAAA (IPv6) record. When a script or application fails with a name resolution error, the problem lies in DNS configuration or reachability rather than in the target service itself.
Why the other options are wrong
- B. SNMP monitors and manages network devices and does not resolve names.
- C. DHCP assigns IP addresses and options to hosts but does not translate host names.
- D. NTP synchronizes clocks between devices.
Question 12
What are two functions of a routing table on a network device? (Choose two.)
Show answer and explanation
Correct answer: B, C. It lists the routes to a particular destination; It lists the static and dynamic entries.
A routing table lists the routes to particular destinations by mapping destination networks to their next hops, and it contains both static entries (manually configured) and dynamic entries (learned through routing protocols). These are the core functions that enable routers to make forwarding decisions.
Why the other options are wrong
- A. Listing routes that drop traffic is not a core function of a routing table; traffic filtering is the job of access lists and firewall rules.
- D. Routing tables contain all known routes regardless of hop distance, not just one-hop neighbors.
- E. Routing tables are not limited to entries more than two hops away; they contain routes of all distances.
Question 13
An engineer needs to retrieve a list of locally available Firepower Threat Defense upgrade packages by using the Firepower Management Center REST API. The engineer uses a GET request with the URL:
/api/fmc_platform/v1/updates/upgradepackages/f413afeb-e6f6-75f4-9169-6d9bd49s625e
What does `f413afeb-e6f6-75f4-9169-6d9bd49s625e` represent?
Show answer and explanation
Correct answer: B. package UUID
In the Firepower Management Center REST API, upgrade packages live under the platform services path /api/fmc_platform/v1/updates/upgradepackages. A GET on that collection lists the upgrade packages stored on the FMC, and appending an identifier, as in /upgradepackages/{objectId}, retrieves one specific package. The UUID at the end of this URL is therefore the identifier of an upgrade package. This upgrade packages path has no /domain/ segment; where an FMC path is domain scoped, the domain UUID follows /domain/, as in /api/fmc_config/v1/domain/{domainUUID}/.
Why the other options are wrong
- A. A container UUID identifies a parent object, such as a device or policy, in nested configuration paths; here the UUID follows upgradepackages and names a package.
- C. A domain UUID appears after a /domain/ segment, and this upgradepackages path has no such segment.
- D. Object UUID is a generic description; in this endpoint the identifier specifically names an upgrade package, which is what package UUID states.
Question 14
Which platform has an API that has the capability to obtain a list of vulnerable software on user devices?
Show answer and explanation
Correct answer: A. Cisco Advanced Malware Protection
Cisco Advanced Malware Protection (AMP) for Endpoints, now Cisco Secure Endpoint, tracks the applications installed on each managed computer and flags those with known vulnerabilities (CVEs). Its API includes a vulnerabilities resource that returns the list of vulnerable software observed across endpoints, along with the affected computers. Security teams use it to automate patch prioritization and reporting.
Why the other options are wrong
- B. Cisco Umbrella provides DNS-layer security and reports on domains and requests, not installed software.
- C. Cisco ISE handles network access control and posture rather than inventorying vulnerable applications through its API.
- D. Cisco Firepower inspects network traffic for threats and does not list vulnerable software installed on user devices.
Question 15
Which advantage does the agile process offer compared to waterfall software development?
Show answer and explanation
Correct answer: A. to add or update features with incremental delivery
Agile's key advantage is the ability to add or update features with incremental delivery throughout the development cycle. This allows for frequent releases, early feedback, and the ability to respond to changing requirements, unlike waterfall which requires completion of each phase before moving to the next.
Why the other options are wrong
- B. Viewing the full scope of end-to-end work is an advantage of waterfall, which requires detailed upfront planning, not agile.
- C. Having each phase end before the next begins is characteristic of waterfall, not agile.
- D. Fixing issues at the end of the development cycle is a waterfall approach; agile emphasizes continuous testing and early issue resolution.
Question 16
What is a procedural component of CI/CD pipelines?
Show answer and explanation
Correct answer: B. Every test must pass for the pipeline to continue its execution.
A core procedural component of CI/CD pipelines is that tests must pass before the pipeline continues execution. This gate ensures code quality and prevents broken code from progressing through the deployment stages. Failed tests act as a blocker to prevent faulty code from being deployed.
Why the other options are wrong
- A. While artifact bundling occurs in CI/CD, it is not a procedural gate requirement like test passage.
- C. Allowing some tests to fail while continuing execution contradicts the quality assurance purpose of CI/CD pipelines.
- D. Release labels identifying builds are essential, not optional, for tracking and auditing deployments.
Question 17
What are two considerations when selecting the `best route` for a network device to reach its destination? (Choose two.)
Show answer and explanation
Correct answer: C, D. metrics; administrative distance
When selecting the best route, network devices consider metrics (option C), which measure route quality such as hop count, bandwidth, and delay, and administrative distance (option D), which determines the trustworthiness of a routing protocol. These two factors are used by routing protocols to determine which path is optimal for reaching a destination.
Why the other options are wrong
- A. MAC addresses are used for Layer 2 switching, not for routing decisions which operate at Layer 3.
- B. While IP addresses are involved in routing, the IP address itself is not a consideration factor in route selection; rather, routing is based on network destinations and metrics.
- E. Subnet masks define network boundaries but are not direct considerations in selecting between multiple routes to the same destination.
Question 18
Which model-driven programmability protocol does Cisco IOS XE Software support?
Show answer and explanation
Correct answer: A. gNMI
Cisco IOS XE supports several model driven programmability interfaces that read and write YANG modeled data, namely NETCONF, RESTCONF and gNMI. gNMI, the gRPC Network Management Interface, runs over gRPC and lets a client get and set configuration and subscribe to streaming telemetry using the same YANG models. Of the options listed, gNMI is the only one that is a model driven management protocol supported by IOS XE.
Why the other options are wrong
- B. SOAP is a general web services messaging protocol and is not one of the model driven interfaces of IOS XE.
- C. SSH is a secure transport for command line sessions and for NETCONF, not a model driven protocol in its own right.
- D. CORBA is a legacy distributed object standard and is not used for programmability on IOS XE.
Question 19
Which application should be used to externally access all applications deployed in the same host machine with a single public IP address and port, when each application listens on different local ports?
Show answer and explanation
Correct answer: A. reverse proxy
A reverse proxy sits in front of the applications on the host and accepts all client traffic on a single public IP address and port, such as 443. It then inspects each request (for example the hostname or URL path) and forwards it to the correct application listening on its own local port, returning the response to the client. This lets many applications share one external entry point without exposing their internal ports. Tools such as NGINX and HAProxy are commonly deployed this way in front of containers or services on the same machine.
Why the other options are wrong
- B. A load balancer spreads requests for one service across several backend instances; it is not the tool for mapping one public port to different applications by path or hostname.
- C. DNS only resolves names to IP addresses and cannot forward traffic to different local ports.
- D. A firewall permits or blocks traffic by policy and does not route requests to individual applications by content.
Question 20
What are two benefits of managing network configuration via APIs? (Choose two.)
Show answer and explanation
Correct answer: D, E. reduction in network changes performed manually; increased scalability and consistency of network changes
Managing network configuration through APIs enables reduction of manual changes by automating provisioning tasks, and it provides increased scalability and consistency across network infrastructure by applying configurations uniformly and programmatically. These benefits address operational efficiency and standardization challenges in network management.
Why the other options are wrong
- A. API management does not inherently lock out manual configuration; both manual and automated approaches can coexist, and security relies on access controls, not management method alone.
- B. Device configuration complexity is not inherently reduced by using APIs; the underlying complexity remains, though the management interface may change.
- C. APIs complement rather than eliminate legacy protocols like SNMP; many deployments continue using both for backward compatibility and specific monitoring needs.
Question 21
A company wants to automate the orders processed on its website using API. The network device that supports the solution must:
• support XML encoding
• support distributed transactions
• support YANG data models
• support software redundancy
Which requirement prevents the use of RESTCONF for the solution?
Show answer and explanation
Correct answer: C. distributed transactions
RESTCONF (RFC 8040) is an HTTP-based protocol that exposes YANG-modeled data with XML or JSON encoding, so it meets the XML and YANG requirements. What it lacks is NETCONF's transaction model: there is no candidate datastore, no lock, and no confirmed commit spanning several devices, so each RESTCONF request is applied on its own. Coordinated, all-or-nothing changes across multiple devices (distributed, network-wide transactions) require NETCONF, which makes this the requirement that rules RESTCONF out.
Why the other options are wrong
- A. Software redundancy is a property of the device platform and is unrelated to the choice of management protocol.
- B. RESTCONF is built around YANG data models, so it fully supports this requirement.
- D. RESTCONF supports both XML and JSON encoding.
Question 22
What are two properties of private IP addresses? (Choose two.)
Show answer and explanation
Correct answer: B, C. They are more secure than public IP addresses; They are not globally unique.
Private IPv4 ranges defined in RFC 1918 (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) are reused by countless organizations, so they are not globally unique and are never routed on the public Internet. Because of that, hosts using private addresses cannot be reached directly from the Internet; inbound connections must pass through NAT or a proxy at the edge. This hidden position makes them more secure than public addresses, which are directly reachable by anyone on the Internet.
Why the other options are wrong
- A. Private addresses are not routed on the Internet, so they need NAT before traffic can reach it.
- D. Every address within a single local network must be unique, so duplicates there cause conflicts.
- E. Private ranges are free for anyone to use and are not assigned or tracked by an Internet registry.
Question 23
A file that already exists in a local repository is updated.
Which command must be executed to ensure that the changes in the file are included in the next Git commit?
Show answer and explanation
Correct answer: C. git add
The `git add` command stages modified files so their changes are included in the next commit. When a file already exists in the repository and is updated locally, `git add` must be executed to add those changes to the staging area before committing them.
Why the other options are wrong
- A. git update is not a standard git command; the correct command is git add.
- B. git merge is used to combine branches, not to stage changes in the current branch.
- D. git rebase is used to reapply commits on a different base, not to stage file changes for committing.
Question 24
A developer is attempting to retrieve all the messages from a Cisco Webex space. The server responds by sending the first 1,000 messages. The developer must make additional requests to retrieve the rest of the messages.
Which API constraint is described in this scenario?
Show answer and explanation
Correct answer: C. pagination
Pagination is the API constraint that divides large result sets into smaller chunks or pages returned across multiple requests. The scenario describes receiving 1,000 messages initially and needing to make additional requests to retrieve remaining messages, which is the definition of pagination.
Why the other options are wrong
- A. Payload limiting refers to restrictions on request or response body size, not the division of results across multiple requests.
- B. Throttling refers to rate limiting enforcement over time to prevent abuse, not the segmentation of results.
- D. Rate limiting restricts the number of requests a client can make within a time period, not how results are segmented.
Question 25
When a Cisco IOS XE networking device is configured using RESTCONF, what is the default data-encoding method?
Show answer and explanation
Correct answer: C. XML
Cisco IOS XE devices using RESTCONF default to XML as the data-encoding method. While JSON is increasingly used and supported in modern implementations, the RESTCONF standard on Cisco IOS XE platforms has XML as the default encoding. YAML and x-form-encoding are not standard RESTCONF encodings for Cisco devices.
Why the other options are wrong
- A. Although JSON is supported and commonly used, it is not the default encoding for RESTCONF on Cisco IOS XE.
- B. YAML is not a standard data encoding method for RESTCONF.
- D. x-form-encoding is not a valid RESTCONF data encoding method.
Question 26
Which device is used to transport traffic from one broadcast domain to another broadcast domain?
Show answer and explanation
Correct answer: C. router
A broadcast domain is the set of devices that receive each other's Layer 2 broadcasts, typically one VLAN or subnet. Routers do not forward broadcasts, so each router interface marks the edge of a broadcast domain. To move traffic from one broadcast domain to another, a router, or a Layer 3 switch acting as one, receives the packet, looks up the destination IP address in its routing table and forwards it out the interface toward the other network.
Why the other options are wrong
- A. A Layer 2 switch forwards frames within one broadcast domain and floods broadcasts to all ports in that VLAN; it does not route between domains.
- B. A proxy server relays application requests on behalf of clients; it is not the device that forwards traffic between broadcast domains.
- D. A load balancer spreads requests across a pool of servers and is not the device used to connect broadcast domains.
Question 27
Which method should be used to safely store the API keys?
Show answer and explanation
Correct answer: B. encrypted in a configuration file that is separate from the code
API keys must be stored securely using encryption and separated from source code to prevent exposure. Storing them in encrypted configuration files that are external to the codebase follows security best practices, allowing different credentials per environment while protecting sensitive data from version control systems and accidental commits.
Why the other options are wrong
- A. Environment variables alone do not guarantee encryption; keys can still be exposed if the system is compromised or logs are not properly secured.
- C. Storing API keys in plain text within code is a critical security vulnerability that exposes credentials to anyone with repository access.
- D. Encrypting keys within the code itself does not separate them from the codebase and still poses a security risk compared to external encrypted configuration.
Question 28
What is an example of a network interface hardware address?
Show answer and explanation
Correct answer: D. MAC address
A MAC (Media Access Control) address is a hardware address burned into network interface cards that uniquely identifies a device on a local network segment. Workstation names, IP addresses, and domain names are all logical identifiers used at higher layers of the network stack, not physical hardware addresses.
Why the other options are wrong
- A. Workstation name is a logical identifier assigned by the operating system, not a hardware address.
- B. IP address is a logical Layer 3 address used for routing across networks, not a hardware address.
- C. Domain name is a logical identifier used for DNS resolution, not a hardware address.
Question 29
Which REST architectural constraint indicates that no client context should be stored on the server between requests?
Show answer and explanation
Correct answer: B. stateless
The stateless constraint is the REST principle that requires the server to not store any client context between requests. Each request must contain all information necessary for the server to understand and process it independently, without relying on previous interactions.
Why the other options are wrong
- A. Cacheable refers to the ability to cache responses to improve efficiency, not the absence of server-side state.
- C. Uniform interface defines how clients and servers communicate through standardized conventions, not whether state is stored.
- D. Client-server is the separation of concerns between client and server roles, not the requirement that servers remain stateless.
Question 30
What does a load balancer distribute in a network environment?
Show answer and explanation
Correct answer: B. incoming traffic across multiple servers
A load balancer distributes incoming traffic across multiple servers to optimize resource utilization, maximize throughput, and prevent any single server from becoming overloaded. This is the primary purpose and function of load balancers in network environments.
Why the other options are wrong
- A. Load balancers do not distribute TCP connections to routers; they distribute client requests to servers.
- C. This describes switch architecture, not the function of a load balancer.
- D. Load balancers manage incoming connections, not outgoing connections.
Question 31
Which action does the Git command git merge allow the developer to perform?
Show answer and explanation
Correct answer: A. Combine multiple sequences of commits into one unified history
The git merge command combines multiple lines of development (sequences of commits) into one unified history. It integrates changes from one branch into another, creating a merge commit that unifies the commit histories from both branches.
Why the other options are wrong
- B. Pushing changes to a remote repository is the function of git push, not git merge.
- C. Creating, listing, renaming, and deleting branches is the function of git branch, not git merge.
- D. Switching between branches is the function of git checkout, not git merge.
Question 32
On which network plane is routing protocol traffic handled?
Show answer and explanation
Correct answer: D. control plane
Routing protocol traffic is handled on the control plane, which encompasses the traffic and protocols that devices use to build and maintain the forwarding paths through the network. This includes routing protocols like OSPF and BGP that determine how data flows through the network.
Why the other options are wrong
- A. The management plane handles administrative traffic like SSH and SNMP, not routing protocols.
- B. The data plane carries user traffic destined for end hosts, not control or routing information.
- C. There is no standard authentication plane in network architecture models.
Question 33
A group of software developers wants to improve its collaboration with the operations team. The group wants to deliver release-ready code that merges code changes back to the main branch and runs the automated testing as often as possible.
Which DevOps concept does this scenario represent?
Show answer and explanation
Correct answer: C. continuous integration
Continuous integration (CI) is the practice of merging every developer's changes into the main branch frequently, often several times a day, with each merge triggering an automated build and test run. Problems surface quickly while the change is still small, and the main branch stays in a release-ready state that operations can trust. That frequent merge plus automated testing is exactly the behavior the scenario describes, and it forms the foundation that delivery and deployment pipelines build on.
Why the other options are wrong
- A. Continuous delivery extends CI by keeping every build ready to release through automated release preparation, which goes beyond frequent merging and testing.
- B. Version control tracks changes to code but does not by itself merge often or run automated tests.
- D. Continuous deployment automatically pushes every passing change to production, which the scenario does not describe.
Question 34
A business needs to create a simulated environment that mimics a production infrastructure to make changes to the OSPF process and analyze the impact.
What should be used?
Show answer and explanation
Correct answer: A. Cisco VIRL / Cisco CML
Cisco VIRL (Virtual Internet Routing Lab) and Cisco CML (Modeling Labs) provide simulated network environments that accurately replicate production infrastructure, allowing engineers to make configuration changes such as OSPF modifications and analyze their impact without affecting real devices.
Why the other options are wrong
- B. DevNet Sandbox labs are pre-built learning environments, not customizable simulations for specific topology testing.
- C. pyATS is a testing and validation framework, not a simulation environment for infrastructure modeling.
- D. Puppet is a configuration management tool, not a network simulation platform.
Question 35
Access to the management interface of devices must be restricted by using SSH and HTTPS.
Which two ports must be included in the ACLs for the protocols to work? (Choose two.)
Show answer and explanation
Correct answer: A, D. 22; 443
SSH operates on port 22 and HTTPS operates on port 443. These are the standard ports for secure shell access and secure HTTP communication respectively. Port 23 is Telnet (insecure), port 80 is HTTP (unencrypted), and port 880 is not a standard management protocol port.
Why the other options are wrong
- B. Port 23 is used for Telnet, which is insecure and not suitable for restricted management access.
- C. Port 80 is used for unencrypted HTTP, not the secure HTTPS protocol required.
- E. Port 880 is not a standard port for SSH or HTTPS management interfaces.
Question 36
Which tool allows changes to the configuration management toolset to be tested?
Show answer and explanation
Correct answer: C. Cisco VIRL
Cisco VIRL (Virtual Internet Routing Lab), now known as Cisco Modeling Labs, provides a simulated network environment where configuration management changes can be tested before deployment to production devices. It allows engineers to build and test network topologies with realistic device behavior.
Why the other options are wrong
- A. pyATS is a testing framework for validating network state and functionality, not for testing configuration management tool changes.
- B. NAPALM is an abstraction library for device interaction, not a testing tool for configuration changes.
- D. Ansible is a configuration management tool itself, not a testing platform for validating configuration changes.
Question 37
An automation script fails to connect to an internal server exactly 1 out of 2 times it is executed. This behavior is seen from different clients.
Which networking device must be at fault?
Show answer and explanation
Correct answer: A. load balancer
A load balancer distributing connections across multiple backend servers would cause exactly one-in-two failures if one server is down or misconfigured. The consistent 50% failure rate across different clients points to a balancing problem rather than issues with individual clients, switches, or routers.
Why the other options are wrong
- B. A faulty laptop would not cause failures across different clients executing the script.
- C. A switch malfunction would typically cause broader connectivity issues, not a consistent 50% failure rate.
- D. A router problem would affect network routing uniformly and not produce a predictable 50% failure pattern.
Question 38
Which product provides network controller-level management features?
Show answer and explanation
Correct answer: B. Cisco DNA Center
Cisco DNA Center is Cisco's intent-based networking platform that provides network controller-level management features, enabling centralized management, automation, and analytics across the entire network infrastructure. It offers policy-based provisioning, assurance, and automation capabilities at the controller level.
Why the other options are wrong
- A. Cisco ISE provides identity and access management services, not controller-level network management.
- C. Cisco UCS Manager manages Cisco UCS compute infrastructure, not network controller functions.
- D. Cisco NX-OS is an operating system for network devices, not a management platform.
Question 39
A developer creates a script that configured multiple Cisco IOS XE devices in a corporate infrastructure. The internal test environment is unavailable, and no maintenance window is available to test on a low-priority production environment.
Which resource is used to test the code before it is applied to the production environment?
Show answer and explanation
Correct answer: D. Cisco DevNet Sandbox
Cisco DevNet Sandbox provides free, on-demand access to real or simulated Cisco devices and environments for testing and development without requiring internal lab resources or production access. It is specifically designed for developers to test code before deploying to production.
Why the other options are wrong
- A. Code Exchange is a repository for sharing code samples and tools, not a testing environment.
- B. Cisco Support provides technical assistance but is not a resource for testing developer scripts.
- C. DevNet Learning Labs provide educational content and guided exercises but are not designed as a sandbox testing environment for custom scripts.
Question 40
What are two advantages of YANG-based approaches for infrastructure automation? (Choose two.)
Show answer and explanation
Correct answer: A, C. multi-platform vendor abstraction; designed to reflect networking concepts
YANG provides multi-platform vendor abstraction by defining a standardized data model that works across different vendors' network devices and platforms, reducing vendor lock-in. YANG is also specifically designed to reflect and model networking concepts, making it natural for expressing network configurations and operational state.
Why the other options are wrong
- B. YANG is a data modeling language; it does not compile to executables that run on devices, it defines data structures used by management protocols.
- D. YANG does not map to JavaScript; it is language-agnostic and used with protocols like NETCONF and RESTCONF.
- E. YANG is not command-line driven; it is a data model language used with programmatic interfaces like NETCONF and RESTCONF.
Question 41
What is a feature of XML compared to other data formats?
Show answer and explanation
Correct answer: A. It uses tags to define the structure.
XML structures data with opening and closing tags, such as <interface><name>Gi1</name></interface>, nesting elements inside one another to form a tree. Attributes can be added to tags, and namespaces distinguish elements from different models, which is why NETCONF and many YANG-based interfaces use XML. JSON, by contrast, uses braces and key-value pairs, and YAML relies on indentation.
Why the other options are wrong
- B. XML does not use parentheses for key-value pairs; JSON uses braces and colons for them.
- C. Indentation defines structure in YAML, while XML whitespace has no structural meaning.
- D. XML namespaces prevent name collisions between vocabularies; they do not represent lists.
Question 42
Which protocol runs over TCP port 23?
Show answer and explanation
Correct answer: D. Telnet
Telnet uses TCP port 23 to provide a remote command-line session to a device. It sends everything, including usernames and passwords, in clear text, which is why SSH has replaced it for device management in most networks. Knowing the well-known ports is essential for writing firewall rules, reading packet captures and troubleshooting automation scripts that fail to connect: SSH uses 22, Telnet 23, HTTP 80, HTTPS 443 and NETCONF over SSH 830.
Why the other options are wrong
- A. SSH uses TCP port 22.
- B. NETCONF over SSH uses TCP port 830.
- C. HTTP uses TCP port 80.
Question 43
On which port does NETCONF operate by default?
Show answer and explanation
Correct answer: D. 830
RFC 6242 defines NETCONF over SSH and assigns TCP port 830 as the default port for NETCONF sessions. A NETCONF client opens an SSH connection to port 830 and requests the netconf subsystem, then exchanges XML encoded hello messages and RPCs with the device. On Cisco IOS XE, enabling netconf-yang starts the NETCONF server listening on port 830, although the port can be changed in configuration.
Why the other options are wrong
- A. TCP port 23 is used by Telnet for unencrypted remote terminal sessions, not by NETCONF.
- B. TCP port 443 is HTTPS, which RESTCONF uses; NETCONF runs over SSH on port 830.
- C. Port 822 is not assigned to NETCONF; the default NETCONF over SSH port is 830.
Question 44
Which standard supported by Cisco IOS XE and Cisco NX-OS is used for automating the configuration of multiple devices across a network?
Show answer and explanation
Correct answer: D. NETCONF/YANG
NETCONF with YANG is the standards-based, model-driven programmability stack supported by both Cisco IOS XE and Cisco NX-OS. YANG data models describe the configuration and operational data in a structured, vendor-neutral way, and NETCONF (RFC 6241) carries that data over SSH on port 830 with operations such as get-config and edit-config, plus candidate datastores and commit for safe, transactional changes. Because every device exposes the same structured interface, tools such as Ansible, NSO or Python's ncclient can configure many devices consistently across the network.
Why the other options are wrong
- A. SNMP is used mainly for monitoring with MIBs and is not paired with YANG for configuration automation on these platforms.
- B. Syslog only exports log messages and cannot push configuration.
- C. The CLI is unstructured text meant for humans, so it is not the standard model-driven interface.
Question 45
A developer has addressed a bug that was found in the production code of an application. A separate file named 'bug427896191v_fix' has been created with the changes to the code.
Which Git command must be used to incorporate the bug fix into the production code?
Show answer and explanation
Correct answer: C. git merge-file
The git merge-file command performs a three-way merge at the level of individual files: it takes the current file, a common base version and another version, and writes the combined result into the current file. With the fix saved as a separate file, git merge-file incorporates its changes into the production source file, marking any overlapping edits with conflict markers for the developer to resolve. The merged file is then committed like any other change.
Why the other options are wrong
- A. git rebase replays commits of a branch onto another base and does not work on a standalone file.
- B. git cat-file displays the content or type of objects stored in the repository and changes nothing.
- D. git bisect performs a binary search through history to find the commit that introduced a bug; it does not apply a fix.
Question 46
Which two encoding formats do YANG interfaces support? (Choose two.)
Show answer and explanation
Correct answer: A, B. XML; JSON
YANG defines the structure of configuration and state data, and that data is serialized for transport in XML or JSON. RFC 7950 defines the XML encoding used by NETCONF, and RFC 7951 defines the JSON encoding of YANG data, which RESTCONF supports alongside XML. A client working with a YANG based interface therefore sends and receives XML or JSON documents that follow the model, depending on the protocol and the media type it requests.
Why the other options are wrong
- C. XHTML is a markup language for web pages and is not an encoding defined for YANG modeled data.
- D. BER is an ASN.1 encoding used by protocols such as SNMP, not an encoding for YANG modeled data.
- E. Plain text has no defined mapping to YANG data nodes, so it is not a supported encoding for model driven interfaces.
Question 47
What is a requirement when authenticating a RESTCONF API session with a router that runs Cisco IOS XE Software?
Show answer and explanation
Correct answer: D. Basic authentication must be used.
Cisco IOS XE devices require basic authentication for RESTCONF API sessions. Basic authentication uses HTTP Authorization header with base64-encoded username and password credentials, which is the standard and supported method for authenticating RESTCONF connections on IOS XE.
Why the other options are wrong
- A. RESTCONF API sessions require authentication for security and access control.
- B. While OAuth exists, IOS XE RESTCONF specifically uses basic authentication, not OAuth.
- C. The X-Auth-Token header approach is used by some APIs but not the standard requirement for IOS XE RESTCONF sessions.
Question 48
Which HTTP response code should be returned when the request is completed, but there is no content to send for the request?
Show answer and explanation
Correct answer: B. 204
HTTP 204 No Content is the correct status code for successful requests where the server has fulfilled the request but has no content to return to the client. This is commonly used for DELETE operations or successful updates that don't need to return a response body. 100 is informational, 302 is a redirect, and 402 is a payment required error.
Why the other options are wrong
- A. 100 Continue is an informational status code used during request processing, not for successful completion.
- C. 302 Found is a redirect status code, not used when a request completes with no content.
- D. 402 Payment Required is an error status code indicating a payment issue, not a successful completion.
Question 49
Which service provides a directory lookup for IP addresses and host names?
Show answer and explanation
Correct answer: A. DNS
The Domain Name System is a distributed directory that maps host names to IP addresses and back. When an application needs to reach a name such as www.cisco.com, it asks a DNS resolver, which returns the matching A or AAAA record, while reverse lookups use PTR records to find the name for an address. DNS normally uses port 53 and is the service that provides lookups between IP addresses and host names.
Why the other options are wrong
- B. NAT rewrites IP addresses in packets, for example private to public, and performs no name lookups.
- C. SNMP is used to monitor and manage network devices, not to look up host names.
- D. DHCP assigns IP addresses and settings to hosts automatically; it does not answer name to address lookups.
Question 50
Which two statements about JSON and XML are true? (Choose two.)
Show answer and explanation
Correct answer: C, E. JSON objects are collections of key-value pairs; The syntax of XML contains tags, elements, and attributes.
JSON objects are collections of key-value pairs, making option C correct. XML syntax contains tags, elements, and attributes, making option E correct. JSON does not use tags, elements, and attributes in the way XML does; instead it uses a simpler key-value structure. XML objects are not collections of key-value pairs, and JSON arrays are ordered collections, not unordered sets of key-value pairs.
Why the other options are wrong
- A. JSON syntax does not contain tags, elements, and attributes; this describes XML structure.
- B. XML objects are not collections of key-value pairs; they use a hierarchical tag-based structure.
- D. JSON arrays are ordered collections of values, not unordered sets of key-value pairs.
Question 51
Which Cisco platform is used to manage data center infrastructure through third-party tools and system integrations?
Show answer and explanation
Correct answer: C. Cisco Intersight
Cisco Intersight is a SaaS platform for managing data center infrastructure such as UCS servers, HyperFlex, storage and hypervisors. It is built around an open REST API with SDKs and certified content for Ansible, Terraform, PowerShell and Python, and it integrates with third-party systems including ServiceNow for ITSM, Splunk for monitoring, and NetApp, Pure Storage and Hitachi storage arrays. That combination of external tooling and system integrations is what lets operators manage the data center from Intersight and from the tools they already use.
Why the other options are wrong
- A. Cisco DNA Center manages enterprise campus and branch networks, not data center compute infrastructure.
- B. Cisco UCS Manager manages a single UCS domain locally and is not the platform built around third-party tool and system integrations.
- D. Cisco UCS Director is an end-of-life on-premises orchestration product that has been superseded by Intersight.
Question 52
In which two ways is an application characterized when interacting with a webhook? (Choose two.)
Show answer and explanation
Correct answer: A, E. receiver; listener
When an application interacts with a webhook, it operates in two key roles. The application is a receiver because it receives the webhook callback from the external service when an event occurs. The application is also a listener because it is passively listening for and waiting to receive these event notifications. The other terms do not accurately describe webhook interactions: transaction monitor and codec relate to different technologies, and processor describes general computation rather than webhook-specific roles.
Why the other options are wrong
- B. Transaction monitor is transaction processing middleware, not a role an application plays when interacting with webhooks.
- C. Codec refers to encoding and decoding mechanisms, not a characterization of webhook interaction.
- D. Processor is too generic and does not specifically describe how an application interacts with webhooks.
Question 53
What is the purpose of the first three pairs of digits in a MAC address?
Show answer and explanation
Correct answer: C. indicates vendor of the network card or adapter
The first three pairs of digits (first 24 bits) of a MAC address represent the Organizationally Unique Identifier (OUI), which identifies the vendor or manufacturer of the network interface card. The remaining three pairs identify the specific device manufactured by that vendor.
Why the other options are wrong
- A. Packet forwarding priority is defined by QoS markings and VLAN priority bits, not the MAC address vendor portion.
- B. Routing identifiers are based on IP addresses and routing protocols, not MAC addresses.
- D. IP addresses are separate from MAC addresses and are not represented in hexadecimal form within the MAC address itself.
Question 54
Which operation is performed with YANG model-driven programmability in NX-OS?
Show answer and explanation
Correct answer: A. configure a device with native and OpenConfig-based models
YANG model-driven programmability in NX-OS enables configuration of devices using both native NX-OS models and standards-based OpenConfig models. This allows operators to work with multiple data models simultaneously, providing flexibility in how devices are managed and configured programmatically.
Why the other options are wrong
- B. Bootstrapping a factory-default device is an initial provisioning task unrelated to YANG model-driven programmability operations.
- C. Sending CLI commands and retrieving JSON output describes traditional CLI-based automation, not model-driven programmability which uses structured APIs.
- D. Running native Linux commands on the device is a container or host OS feature, not an operation of YANG model-driven programmability.
Question 55
What is used in Layer 2 switches to direct packet transmission to the intended recipient?
Show answer and explanation
Correct answer: A. MAC address
Layer 2 switches use MAC addresses to build MAC address tables (CAM tables) that map MAC addresses to switch ports, enabling them to forward frames directly to the appropriate physical port where the destination device is connected.
Why the other options are wrong
- B. IPv6 addresses operate at Layer 3 and are not used by Layer 2 switches for forwarding decisions.
- C. Spanning Tree Protocol (STP) prevents loops in switch topologies but does not direct individual packet transmission.
- D. IPv4 addresses operate at Layer 3 and are not used by Layer 2 switches for forwarding decisions.
Question 56
What is a benefit of using edge computing in an IoT implementation?
Show answer and explanation
Correct answer: A. high speed in data processing
Edge computing places compute resources close to where IoT data is produced, for example in a gateway, a router or a small server at the site. Data can then be filtered, analyzed and acted on locally instead of making a round trip to a distant cloud data center, which cuts latency and gives fast data processing for time sensitive decisions. Sending only summarized results upstream also reduces the bandwidth an IoT deployment consumes.
Why the other options are wrong
- B. Distributing compute to many edge locations adds design and management work, so lower network design complexity is not the benefit.
- C. Edge nodes add hardware and operational cost at each site, so lower network design cost is not what edge computing delivers.
- D. Edge computing is chosen for fast local processing; availability of network components depends on redundancy design, not on edge computing.
Question 57
A developer is writing an application that uses a REST API and the application requires a valid response from the API.
Which element of the response is used in the conditional check?
Show answer and explanation
Correct answer: E. status code
The status code is the primary element used in conditional checks when validating REST API responses. It indicates success (2xx), redirection (3xx), client error (4xx), or server error (5xx), and developers typically check this code first to determine if the response is valid before processing the body.
Why the other options are wrong
- A. The body contains the data payload but cannot be safely processed if the status indicates an error.
- B. Headers contain metadata but are not the primary element for validation conditionals.
- C. Link is not a standard response element used in conditional checks.
- D. The URL is part of the request, not the response used for validation.
Question 58
Which two elements are foundational principles of DevOps? (Choose two.)
Show answer and explanation
Correct answer: A, D. organizing cross-functional teams over organizational silos; automating over documenting
DevOps foundationally emphasizes organizing cross-functional teams that break down organizational silos between development and operations, enabling collaboration and shared responsibility (option A). Automation is a core DevOps principle that reduces manual processes and enables continuous integration and deployment (option D). Option B is a software architecture pattern that may be used in DevOps but is not a foundational principle of DevOps itself. Option C describes containerization, which is a deployment tool commonly used in DevOps but not a foundational principle. Option E addresses cost optimization, which is a benefit but not a core founding principle.
Why the other options are wrong
- B. Microservices architecture is an implementation pattern, not a foundational principle of DevOps.
- C. Containers are a deployment technology commonly used in DevOps but not a founding principle.
- E. Infrastructure cost optimization is a potential benefit but not a foundational DevOps principle.
Question 59
What is a benefit of using a code review process in application development?
Show answer and explanation
Correct answer: D. eliminates common mistakes during development
In a code review, other developers read a change before it is merged, looking for bugs, security issues, unclear logic and departures from team standards. Catching these problems early removes common mistakes before they reach testing or production, where they cost far more to fix, and spreads knowledge of the code across the team. The review adds a step to the workflow, so its value is fewer defects rather than faster delivery.
Why the other options are wrong
- A. A review adds a step before code is merged, so it does not speed up the deployment of new features.
- B. Version control comes from tools such as Git; a code review is a quality process that usually runs on top of such a tool.
- C. Waiting for reviewers adds time before code is merged, so quick deployment is not the benefit of a review.
Question 60
A company wants to accelerate the adoption of technologies that will simplify its operations. Staff have different skill levels and are looking for a single site to find easy-to-consume beginner, intermediate, and advanced multidomain use cases.
Which site should be used?
Show answer and explanation
Correct answer: B. DevNet Automation Exchange
DevNet Automation Exchange is Cisco's library of ready-to-use automation use cases, grouped into Walk, Run and Fly levels that map to beginner, intermediate and advanced, and covering multiple domains such as enterprise networking, data center, security and collaboration. It is the single site built for teams with mixed skill levels who want easy-to-consume use cases to speed up the adoption of automation.
Why the other options are wrong
- A. DevNet Ecosystem Exchange is a catalog of partner and developer solutions and integrations built on Cisco platforms, not a skill-graded library of use cases.
- C. DevNet Creations showcases individual apps, demos and projects built by developers; it is not organized by skill level as a single place for multidomain use cases.
- D. The DevNet Support Forum is for asking questions and getting help with Cisco APIs and tools, not for browsing curated use cases.
Question 61
Which API must an engineer use to change a netmask on a Cisco IOS XE device?
Show answer and explanation
Correct answer: C. RESTCONF/YANG
RESTCONF exposes the YANG data models of a Cisco IOS XE device over HTTPS, so an engineer can change interface settings such as the IPv4 address and netmask directly on the device. The request targets the interface resource under the ietf-interfaces or Cisco IOS XE native model and sends the new address and mask with a PUT or PATCH. This is the device level API for this change, while the other options are management platforms for different products or controllers.
Why the other options are wrong
- A. The Meraki Dashboard API manages Meraki cloud managed devices, not the configuration of a Cisco IOS XE device.
- B. The SD-WAN API manages an SD-WAN fabric through its controller and is not the API used to edit a netmask directly on an IOS XE device.
- D. DNA Center is a controller with its own northbound REST API; the question asks for the API on the IOS XE device itself, which is RESTCONF with YANG.
Question 62
Which traffic is handled on the control plane?
Show answer and explanation
Correct answer: A. BGP
The control plane is where a network device builds its picture of the network: routing protocols such as BGP, OSPF and EIGRP exchange reachability information there, and the results populate the routing and forwarding tables. BGP sessions between peers are therefore control plane traffic. The data plane then uses those tables to forward user packets, while the management plane carries the protocols administrators and tools use to configure and monitor the device.
Why the other options are wrong
- B. SMB is file sharing traffic between hosts, which a router simply forwards on the data plane.
- C. NTP keeps device clocks synchronized and is treated as management plane traffic.
- D. NETCONF configures and retrieves device data, so it belongs to the management plane.
Question 63
What are two roles of an artifact repository in a CI/CD pipeline? (Choose two.)
Show answer and explanation
Correct answer: A, B. stores files needed and generated during the build process; provides traceable, searchable, and manageable binary files
Artifact repositories store files generated during the build process (compiled binaries, packages, dependencies) and provide traceability, searchability, and management of these binary files. These are the two core roles that enable version control and reproducible builds.
Why the other options are wrong
- C. Artifact repositories are not required specifically for public cloud CI/CD pipelines; they work with any infrastructure.
- D. Comparing and merging source code changes is the role of version control systems, not artifact repositories.
- E. Managing open source software is a separate concern from artifact repositories' primary function of storing build outputs.
Question 64
An engineer must configure Cisco Nexus devices and wants to automate this workflow. The engineer enables the Cisco NX-OS REST API to configure the devices by using an Ansible playbook. Before running the code, which resource must be used to verify that the code works correctly?
Show answer and explanation
Correct answer: D. Cisco Modeling Labs
Cisco Modeling Labs (formerly VIRL) provides a virtualized environment where Cisco Nexus devices and other network equipment can be simulated, allowing engineers to test and verify Ansible playbooks and REST API configurations before deploying to production hardware.
Why the other options are wrong
- A. The Cisco NX-OS SDK is for software development, not for simulating devices to test playbooks.
- B. Cisco Learning Labs are educational resources, not simulation environments for testing code.
- C. Cisco Code Exchange is a repository for sharing code examples, not a testing or simulation environment.
Question 65
What is a principle of a code review process?
Show answer and explanation
Correct answer: C. Naming standards must be consistent.
A code review checks changes against agreed team standards before they are merged, and consistent naming of variables, functions and classes is one of the core things reviewers enforce. Consistent conventions make code readable, searchable and easier for anyone on the team to maintain. Reviews also look for defects, security problems and adherence to style guides, sharing knowledge between developers along the way, so that quality problems are caught early rather than in production.
Why the other options are wrong
- A. Reviews normally happen before code is merged into the shared branch so problems are fixed beforehand.
- B. A review exists to stop flawed code from reaching production, even if that slows delivery.
- D. Any qualified peer can review code; sign-off by a technical lead is a team policy choice, not a principle of the process.
Question 66
Which type of threat occurs when an attacker can send hostile data to an interpreter within an application?
Show answer and explanation
Correct answer: D. injection
Injection, as described by OWASP, occurs when untrusted data is sent to an interpreter as part of a command or query, and the interpreter executes it. SQL injection, OS command injection and LDAP injection are common forms: hostile input changes the meaning of the query or command so the attacker can read or modify data or run commands. Parameterized queries, input validation and least privilege accounts are the standard defenses.
Why the other options are wrong
- A. Sensitive data exposure is about failing to protect data, for example with weak or missing encryption, not about sending hostile data to an interpreter.
- B. Broken authentication covers flaws in login and session handling, such as weak credentials or exposed session IDs, not hostile input to an interpreter.
- C. Cross-site scripting delivers malicious script to other users' browsers through the application's pages; the threat that targets an interpreter in the application is injection.
Question 67
Which principle is a value from the manifesto for Agile software development?
Show answer and explanation
Correct answer: D. customer collaboration over contract negotiation
The Agile Manifesto states that developers value 'customer collaboration over contract negotiation'. This reflects Agile's emphasis on working closely with customers and adapting to their needs throughout development rather than being bound by rigid contractual requirements determined upfront.
Why the other options are wrong
- A. The Agile Manifesto values 'individuals and interactions over processes and tools', the opposite of this statement.
- B. The Agile Manifesto values 'working software over comprehensive documentation', the opposite of this statement.
- C. The Agile Manifesto values 'responding to change over following a plan', the opposite of this statement.
Question 68
What is the purpose of the Cisco VIRL software tool?
Show answer and explanation
Correct answer: C. to simulate and model networks
Cisco VIRL (Virtual Internet Routing Lab) is a software tool designed to simulate and model network topologies and configurations. It allows users to create virtual network environments for testing, learning, and validation before deploying to production networks.
Why the other options are wrong
- A. Configuration compliance verification is performed by tools like Cisco ISE and Cisco DNA Center, not VIRL.
- B. API workflow automation is handled by tools like Cisco Intersight and custom automation frameworks, not VIRL.
- D. Application performance testing requires performance testing tools, not a network simulation tool.
Question 69
A new application is being developed that must be hardware independent. The application includes an administrative component which is accessed using a Windows desktop GUI. Installation and management of the environment must be fully automated.
Which application deployment type meets the requirements?
Show answer and explanation
Correct answer: C. container
Containers meet all stated requirements: they are hardware-independent through standardized container images that run on any Docker-compatible system, support Windows desktop GUI components, and enable fully automated installation and management through container orchestration and infrastructure-as-code tools. Containers are the more modern and efficient choice for these specific requirements. Option A (virtual machines) requires more overhead and is less portable. Option B (Python environment) does not address the Windows GUI requirement. Option D (bare metal) is hardware-dependent and difficult to automate.
Why the other options are wrong
- A. Virtual machines carry a full guest operating system, so they are heavier and less portable than containers for this requirement.
- B. A Python environment cannot host a Windows desktop GUI application component.
- D. Bare metal is hardware-dependent and contradicts the hardware independence requirement.
Question 70
Which platform has an API that can be used to obtain a list of vulnerable software on user devices?
Show answer and explanation
Correct answer: D. Cisco Advanced Malware Protection
Cisco Advanced Malware Protection (AMP) for Endpoints, now Cisco Secure Endpoint, tracks the applications installed on managed computers and flags versions with known vulnerabilities. Its REST API exposes this data, including a vulnerabilities endpoint that lists vulnerable software found on connectors together with the affected computers and the related CVEs. A developer who needs a list of vulnerable software on user devices can therefore query the AMP API directly instead of collecting it from each endpoint.
Why the other options are wrong
- A. Cisco Umbrella provides DNS layer security and reporting; its API does not inventory the software installed on user devices.
- B. Cisco Firepower inspects network traffic for threats and does not keep a list of vulnerable software installed on endpoints.
- C. Cisco ISE controls network access and device posture, but it is not the platform whose API reports vulnerable software on endpoints.
Question 71
What is the benefit of edge computing?
Show answer and explanation
Correct answer: A. It reduces network latency by moving processing closer to the data source.
Edge computing moves processing out of a central data center and closer to the devices that generate the data, such as sensors, cameras and machines. Because data no longer has to cross the wide area network to be processed, responses arrive faster and network latency drops, which matters for real time control and analytics. Central systems are still used for aggregation, long term storage and wider analysis, so edge computing complements central processing rather than replacing it.
Why the other options are wrong
- B. Data velocity is the rate at which sources produce data; edge computing processes that data closer to the source but does not lower the rate.
- C. Spreading processing across many edge sites increases the number of systems to secure, so it does not simplify security.
- D. Edge deployments still rely on central systems for aggregation, storage and analytics, so they do not remove central processing.
Question 72
What is a benefit of version control?
Show answer and explanation
Correct answer: B. keeps track of all changes to the files
A version control system records every change made to the files it tracks, together with who made the change, when, and why. That history lets a team review how the code evolved, compare versions, find the change that introduced a bug, and roll back to an earlier state when something goes wrong. Tools such as Git also let several people work on the same files at the same time through branches and merges, so tracking changes is the benefit, not restricting access.
Why the other options are wrong
- A. Version control lets several developers change the same file in parallel and then merges their work, so it does not prevent shared editing.
- C. Version control exists to share files and history among collaborators, often through a shared remote repository.
- D. Version control tracks file contents and history; it does not keep a list of the data types used inside the files.
Question 73
Which action resolves a 401 error in response to an HTTP GET that is issued to retrieve a configuration statement using RESTCONF on a CSR 1000V?
Show answer and explanation
Correct answer: D. Check the authentication credentials.
A 401 Unauthorized error indicates that the request lacks valid authentication credentials. The server is rejecting the request because it cannot verify the client's identity. Checking and correcting the authentication credentials (username, password, API key, certificate, or token) is the direct resolution. The HTTP method, MIME types, and transport protocol are not factors in authentication failures.
Why the other options are wrong
- A. Changing from GET to PUT would not resolve an authentication issue; the problem is credentials, not the HTTP method.
- B. MIME type headers are unrelated to authentication failures; they deal with content negotiation, not identity verification.
- C. While HTTPS is more secure than HTTP, a 401 error indicates an authentication problem, not a protocol issue. RESTCONF already requires HTTPS, so the transport is not the cause.
Question 74
What is a benefit of organizing code into modules?
Show answer and explanation
Correct answer: C. enables the reuse of code
Organizing code into modules enables the reuse of code across different parts of an application or in different projects. Modules encapsulate functionality that can be imported and used multiple times, eliminating duplication. Modularity does not by itself shorten code, make code multifunctional or improve performance; its direct benefit is code reuse.
Why the other options are wrong
- A. While modularity may reduce code repetition, it doesn't directly reduce overall code length.
- B. Modules don't inherently make code multifunctional; they organize existing functionality.
- D. Modular organization doesn't improve runtime performance, though it may improve maintainability.
Question 75
What is a capability of the AXL API?
Show answer and explanation
Correct answer: C. It authenticates users who exist in Cisco Unified Communications Manager.
The Administrative XML (AXL) API is a SOAP interface to the Cisco Unified Communications Manager configuration database, used to add, update, retrieve and remove items such as users, phones and lines. Among its operations is doAuthenticateUser, which checks a user's credentials or PIN against the users that exist in CUCM. That makes authenticating CUCM users a capability of AXL, alongside its core provisioning functions.
Why the other options are wrong
- A. Signing a user in to an extension mobility phone is done through the Extension Mobility API, not AXL.
- B. Collecting service logs such as Tomcat logs is handled by the Serviceability APIs.
- D. AXL requests are sent over HTTPS only; plain HTTP is not supported.
Question 76
Which HTTP response status code means `Forbidden`?
Show answer and explanation
Correct answer: C. 403
HTTP 403 Forbidden indicates that the server understood the request but refuses to authorize it. The client is authenticated but does not have permission to access the requested resource. This is distinct from 401 Unauthorized, which indicates authentication failure. 500 is a server error, 401 is unauthorized, and 502 is a bad gateway error.
Why the other options are wrong
- A. 500 Internal Server Error indicates a server-side problem, not a permission issue.
- B. 401 Unauthorized indicates authentication failure, not permission denial.
- D. 502 Bad Gateway indicates a problem with upstream servers, not a permission issue.
Question 77
Which description of a default gateway is true?
Show answer and explanation
Correct answer: B. It is a device that receives IP packets that have no explicit next-hop in the routing table.
A default gateway is a network device that receives IP packets destined for networks not explicitly listed in the routing table. When a device needs to send traffic to an unknown destination network, it forwards the packet to the default gateway for further routing.
Why the other options are wrong
- A. Security features that deny traffic describe access control lists or firewall rules, not the default gateway's primary function.
- C. Address translation between public and private addresses is the function of NAT (Network Address Translation), not a default gateway.
- D. Receiving Layer 2 frames with unknown destination addresses describes a switch's flooding behavior, not a default gateway's function at Layer 3.
Question 78
Which configuration management tool has an agentless capability?
Show answer and explanation
Correct answer: C. Ansible
Ansible is an agentless configuration management tool that uses SSH or other standard protocols to communicate with managed devices, requiring no agent software to be installed on target hosts. Puppet and Chef both require agents installed on managed nodes. CFEngine also requires agent installation on target systems.
Why the other options are wrong
- A. Puppet requires an agent to be installed and running on all managed nodes.
- B. CFEngine requires agent installation on managed hosts to receive and apply configurations.
- D. Chef requires a Chef client agent to be installed on managed nodes.
Question 79
Which two types of NAT are used in a network? (Choose two.)
Show answer and explanation
Correct answer: B, E. static NAT; dynamic NAT
Static NAT maps a single private IP address to a single fixed public IP address, while Dynamic NAT maps private addresses to public addresses from a pool, with the mapping changing based on availability. These are the two primary categories of NAT used in networks.
Why the other options are wrong
- A. Routed NAT is not a standard NAT classification; routing and NAT are separate network functions.
- C. Multicast NAT is not a standard NAT type; NAT typically operates on unicast addresses.
- D. Normal NAT is not a formally recognized NAT category in networking standards.
Question 80
What is the difference between YAML and JSON data structure?
Show answer and explanation
Correct answer: B. YAML uses indentation; JSON uses brackets and braces
YAML and JSON differ fundamentally in their syntax approach. YAML uses indentation (whitespace) to define structure and hierarchy, making it human-readable without requiring explicit delimiters. JSON uses brackets and braces to explicitly denote objects and arrays, making structure definition syntactically explicit rather than relying on whitespace.
Why the other options are wrong
- A. YAML uses indentation not spaces alone; JSON uses brackets and braces, not parentheses.
- C. This reverses the correct distinction; YAML uses indentation while JSON uses brackets and braces.
- D. Neither YAML nor JSON use parentheses as structural delimiters; this description is incorrect for both formats.
Question 81
Which detail is included in a routing table?
Show answer and explanation
Correct answer: D. destination next hop or outgoing interface
A routing table contains entries that specify the destination network and the next hop (neighboring router) or outgoing interface through which packets destined for that network should be forwarded. This information is essential for routers to make forwarding decisions.
Why the other options are wrong
- A. Broadcast addresses are associated with subnets but are not typically stored as individual entries in routing tables.
- B. TCP or UDP port numbers are Layer 4 transport layer information, not included in Layer 3 routing tables.
- C. IP protocol numbers identify protocols carried within IP packets but are not entries within routing tables.
Question 82
How does requesting a synchronous API operation differ from requesting an asynchronous API operation?
Show answer and explanation
Correct answer: D. clients can access the results immediately
The key difference between synchronous and asynchronous API operations is that synchronous operations return results immediately in the response, allowing the client to proceed with the result data right away. Asynchronous operations, by contrast, require clients to poll for status, subscribe to webhooks, or receive task IDs for later retrieval. Synchronous APIs block until completion and return the result directly, providing immediate access to operation results.
Why the other options are wrong
- A. Receiving a task ID for further processing is characteristic of asynchronous operations, not synchronous ones.
- B. Subscribing to webhooks for operation results is an asynchronous pattern, not a synchronous one.
- C. Polling for status is an asynchronous pattern; synchronous calls return results immediately without polling.
Question 83
Which type of HTTP method is used by the Meraki and Webex Teams APIs to send webhook notifications?
Show answer and explanation
Correct answer: A. HTTP POST
Webhooks use HTTP POST requests to send notifications to a specified endpoint. When Meraki and Webex Teams APIs send webhook notifications, they push data to the registered URL using POST, which allows the receiving service to process the event asynchronously.
Why the other options are wrong
- B. HTTP GET is used to retrieve data from a server, not to send notifications to a client.
- C. HTTP HEAD is used to request headers only without a response body, unsuitable for webhook notification delivery.
- D. HTTP PUT is used to update existing resources, not to deliver webhook notifications to endpoints.
Question 84
Which OWASP threat takes advantage of a web application that the user has already authenticated to execute an attack?
Show answer and explanation
Correct answer: D. CSRF
Cross-Site Request Forgery (CSRF) is an attack that exploits the trust between a user and a web application they are already authenticated to. The attacker tricks the authenticated user into performing unwanted actions on that application without their knowledge. This leverages the existing authentication session to execute malicious commands.
Why the other options are wrong
- A. Phishing is a social engineering attack attempting to steal credentials, not exploiting existing authentication.
- B. Denial of Service attacks overwhelm systems with traffic but do not exploit prior authentication.
- C. Brute force attacks attempt to guess credentials through repeated attempts, not exploiting authenticated sessions.
Question 85
Into which type of Python data structure should common data formats be parsed?
Show answer and explanation
Correct answer: C. dictionary
Common data formats like JSON and YAML are hierarchical and contain key-value pairs that map naturally to Python dictionaries. While sequences and lists can store data, dictionaries provide the semantic structure needed to represent the nested, labeled nature of most common data formats.
Why the other options are wrong
- A. Sequences are ordered collections but lack the key-value mapping necessary for structured data formats.
- B. Sets are unordered and have no key-value pairs, making them unsuitable for parsing structured data.
- D. Lists are ordered but cannot represent the labeled hierarchical structure found in common data formats.
Question 86
What is the outcome of executing this command? git clone ssh://john@example.com/path/to/my-project.git
Show answer and explanation
Correct answer: A. creates a local copy of a repository called "my-project"
The git clone command creates a local copy of a remote repository. The URL provided points to a remote repository called 'my-project', and cloning it downloads the entire repository history and working files to the local machine. This is the fundamental purpose of the clone operation.
Why the other options are wrong
- B. git clone does not initiate a new repository; it copies an existing remote repository.
- C. git clone copies the entire repository, not just a single branch.
- D. git clone creates a local repository copy, not a new branch.
Question 87
Which mechanism is used to consume a RESTful API design when large amounts of data are returned?
Show answer and explanation
Correct answer: C. pagination
Pagination is the standard mechanism used to handle large datasets in RESTful APIs by dividing results into smaller, manageable pages that clients can request sequentially. This approach improves performance, reduces bandwidth usage, and allows efficient data retrieval from endpoints returning substantial amounts of information.
Why the other options are wrong
- A. Data sets is a generic term that does not describe a specific API consumption mechanism.
- B. Scrolling is a client-side UI pattern that may use pagination under the hood, but it is not the API mechanism itself.
- D. Blobs refer to binary large objects used for storage, not a mechanism for consuming APIs with large data returns.
Question 88
What are two use cases where webhooks are effective? (Choose two.)
Show answer and explanation
Correct answer: C, D. Inform a previously defined chat channel after a deployment fails; Send an email to a customer of an online store after payment is complete.
Webhooks are event-driven callbacks that notify external systems when specific events occur. They are effective for informing external systems about events (such as notifying a chat channel when deployment fails) and for triggering actions based on those events (such as sending an email after payment completion). Filtering response information, managing session timeouts, and changing response formats are all operations performed by the API consumer or within API logic, not use cases for webhooks.
Why the other options are wrong
- A. Filtering information from an API response is something a client application does with the response data, not a webhook use case.
- B. Closing sessions based on time is a session management concern, not a webhook use case.
- E. Changing the response format or content type is a client-side concern or API configuration, not a webhook use case.
Question 89
Which platform is run directly on top of a hypervisor?
Show answer and explanation
Correct answer: B. virtual machines
Virtual machines run directly on top of a hypervisor. The hypervisor is the virtualization layer that sits between the physical hardware and the virtual machines and manages multiple virtual machine instances. Option A refers to physical hardware that runs without virtualization. Option C refers to containers, which run on top of an operating system, not directly on a hypervisor. Option D refers to applications, which run within operating systems or containers.
Why the other options are wrong
- A. Bare metal systems run directly on physical hardware without any hypervisor layer.
- C. Containers run on top of an operating system, not directly on the hypervisor.
- D. Applications run within operating systems or container environments, not on the hypervisor itself.
Question 90
Which two details are captured from the subnet mask? (Choose two.)
Show answer and explanation
Correct answer: A, D. portion of an IP address that refers to the subnet; part of an IP address that refers to the host
A subnet mask splits an IPv4 address into two parts. The bits set to 1 mark the network or subnet portion, and the bits set to 0 mark the host portion. With 192.168.10.25 and a mask of 255.255.255.0, the first three octets identify the subnet and the last octet identifies the host within it. A device uses this split to decide whether a destination is on its local subnet or must be sent to the default gateway.
Why the other options are wrong
- B. The default gateway is configured separately and cannot be derived from the mask.
- C. The mask marks which bits form the host part but does not assign a unique ID to the host.
- E. The mask describes address structure only and says nothing about a host's physical or interface connection.
Question 91
What is an advantage of using network programmability?
Show answer and explanation
Correct answer: D. It provides for more scalable and replicable network provisioning.
Network programmability lets engineers define device configuration as code or data and push it through APIs, scripts and automation tools instead of typing commands on each device. The same template or playbook can be applied to tens or thousands of devices, stored in version control and rerun whenever a site or service is added. This makes provisioning far more scalable and replicable, with consistent results and fewer manual errors.
Why the other options are wrong
- A. Programmability exists to replace slow, error prone manual configuration; it does not make manual configuration faster.
- B. Programmability often relies on abstraction, such as controllers and cloud APIs, so avoiding abstraction is not an advantage it offers.
- C. Programmatic interfaces work alongside the CLI, which remains available on the devices.
Question 92
During which step of the CI/CD pipeline for infrastructure automation is code from multiple developers combined to compile and test different components?
Show answer and explanation
Correct answer: A. integration
The integration step in a CI/CD pipeline is where code from multiple developers is combined, compiled, and tested together to verify that different components work correctly together. This stage detects conflicts and issues that arise from merging contributions from various team members.
Why the other options are wrong
- B. Deployment is the stage where tested code is released to production environments, not where initial combination and testing occurs.
- C. Development is where individual developers write code, not where code from multiple developers is combined and tested.
- D. Testing is a separate stage that occurs after integration; integration itself includes testing as part of the combined code verification process.
Question 93
Which line is an example of the start of a chunk from a unified diff?
Show answer and explanation
Correct answer: B. @@ -88,10 +88,6 @@
The unified diff format uses @@ markers with line number ranges in the format @@ -start,count +start,count @@. Option B correctly shows this syntax with line numbers (88 and 10 for the first file, 88 and 6 for the second file), representing the starting line and number of lines affected in each version.
Why the other options are wrong
- A. This uses an invalid timestamp format; unified diff uses line numbers, not ISO 8601 timestamps.
- C. This mixes timestamps with line numbers, which is not valid unified diff syntax.
- D. This uses timestamps instead of line numbers; unified diff requires numeric line ranges only.
Question 94
A developer is working on a new feature and made changes on a branch named 'branch-413667549a-new'.
When merging the branch to production, conflicts occurred.
Which Git command must the developer use to recreate the pre-merge state?
Show answer and explanation
Correct answer: D. git merge --abort
When a merge stops because of conflicts, git merge --abort cancels the merge and tries to reconstruct the state of the branch and working tree as it was before the merge started. The developer can then resolve the problem differently, for example by rebasing the feature branch or coordinating with the other author, and retry later. It is the documented way to back out of a conflicted merge before any commit is made.
Why the other options are wrong
- A. The --no-edit option only accepts the auto-generated merge commit message and does not undo anything.
- B. The --commit option tells Git to create the merge commit, which moves forward rather than back.
- C. Git merge has no revert option; reverting is done with the separate git revert command.
Question 95
Package updates from a local server fail to download. However, the same updates work when a much slower external repository is used.
Why are local updates failing?
Show answer and explanation
Correct answer: D. The update utility is trying to use a proxy to access the internal resource.
When local repository downloads fail but external ones succeed despite being slower, the issue is typically that the update utility is configured to use a proxy for internet access. The proxy may be blocking or misconfiguring access to the internal local server, while still allowing access to external repositories through its own routing rules.
Why the other options are wrong
- A. Disk space issues would affect both local and external repository access equally.
- B. An internet connection that is too slow would not cause local server failures; it would only affect external repositories.
- C. Internet outages do not prevent local server access; local network resources are independent of external connectivity.
Question 96
After a project is migrated to a new codebase, the `old_project` directory must be deleted. This directory has multiple read-only files, and it must be deleted recursively without prompting for confirmation.
Which Bash command must be used?
Show answer and explanation
Correct answer: B. rm -rf old_project
The rm -rf command removes files and directories recursively (-r) and forces removal without prompting (-f), making it suitable for deleting read-only files. Option A uses rmdir with -p, which only works on empty directories and does not force removal of read-only files. Option C uses rm -r without the -f flag, which will prompt for confirmation on protected files. Option D uses rmdir, which only removes empty directories and cannot handle read-only files.
Why the other options are wrong
- A. rmdir only removes empty directories and cannot delete read-only files or perform prompt-free recursive deletion.
- C. rm -r prompts for confirmation when encountering read-only files, violating the no-prompt requirement.
- D. rmdir only removes empty directories and cannot handle directories with files or read-only content.
Question 97
Which two use cases are supported by Meraki APIs? (Choose two.)
Show answer and explanation
Correct answer: B, C. Build a custom Captive Portal for Mobile Apps; Configure network devices via the Dashboard API.
The Meraki API supports building custom Captive Portals for Mobile Apps to enhance network access control and user experience, and it enables configuration of network devices through the Dashboard API for programmatic network management. These are core supported use cases within Meraki's API ecosystem.
Why the other options are wrong
- A. Meraki's Scanning API supplies location data from Wi-Fi and Bluetooth, not from LoRaWAN devices, so this use case as stated is not supported.
- D. Deploying applications onto Meraki devices is not a supported Meraki API function; devices are managed through the dashboard, not used as application platforms.
- E. Retrieving live camera streams is not a standard Meraki API capability; camera access is typically limited to dashboard viewing and specific integrations.
Question 98
Which device is a system that monitors and controls incoming and outgoing network traffic based on predetermined security rules?
Show answer and explanation
Correct answer: D. firewall
A firewall is a security device or service that sits between networks and inspects the traffic passing in and out. It permits or denies each connection according to a predefined rule set, based on criteria such as source and destination addresses, ports, protocols, connection state and, in next generation firewalls, applications and users. Monitoring and controlling incoming and outgoing traffic against these predetermined security rules is the defining job of a firewall.
Why the other options are wrong
- A. A router forwards packets between networks based on its routing table; filtering traffic against security rules is not its defining role.
- B. A switch forwards frames within a LAN based on MAC addresses and does not enforce a security rule set on traffic.
- C. A load balancer distributes requests across servers for performance and availability rather than enforcing security rules.
Question 99
Which status code is used by a REST API to indicate that the submitted payload is incorrect?
Show answer and explanation
Correct answer: A. 400
The 400 Bad Request status code indicates that the server cannot process the request due to client-side errors, such as malformed syntax or invalid payload structure. This is the standard code returned when submitted data is incorrect or malformed.
Why the other options are wrong
- B. 403 Forbidden indicates the client lacks permission to access the resource, not that the payload is incorrect.
- C. 405 Method Not Allowed indicates the HTTP method used is not supported for that resource.
- D. 429 Too Many Requests indicates rate limiting has been triggered, not payload validation issues.
Question 100
Which implementation creates a group of devices on one or more LANs that are configured to communicate as if they were attached to the same wire?
Show answer and explanation
Correct answer: B. VLAN
A virtual LAN (VLAN) groups devices into a single logical broadcast domain regardless of their physical location. Hosts in the same VLAN, whether connected to one switch or spread across several switches joined by trunk links, communicate as if they were plugged into the same wire, sharing broadcasts and Layer 2 reachability. Devices in different VLANs are isolated at Layer 2 and need a router or Layer 3 switch to talk to each other. This logical grouping is what lets administrators segment users by function rather than by physical cabling.
Why the other options are wrong
- A. A WLAN is a wireless network and does not by itself create a logical group of hosts across wired LANs.
- C. IPsec encrypts and authenticates IP traffic between endpoints; it does not create a shared Layer 2 segment.
- D. HSRP provides a redundant virtual default gateway and does not group hosts into a broadcast domain.
Question 101
What is a benefit of a distributed version control system?
Show answer and explanation
Correct answer: C. allows users to work on the codebase even when not connected to the Internet
A key benefit of distributed version control systems (like Git) is that each developer has a complete copy of the repository locally, allowing them to work on the codebase, make commits, and perform version control operations without requiring a network connection to a central server. This enables offline work and development continuity.
Why the other options are wrong
- A. While distributed VCS may encourage frequent commits, this is not a primary technical benefit unique to distributed systems.
- B. Code quality standards are enforced through CI/CD pipelines and code review processes, not by the version control system itself.
- D. Testing enforcement is a CI/CD pipeline responsibility, not a feature provided by distributed version control systems.
Question 102
What is a benefit of using functions in the code for the development process?
Show answer and explanation
Correct answer: D. faster code development
Functions enable faster code development by promoting code reuse, reducing duplication, and allowing developers to work on modular components independently. Developers can write and test functions once, then use them multiple times throughout the codebase, significantly accelerating the development process.
Why the other options are wrong
- A. User experience depends on application functionality and design, not on the internal use of functions in development.
- B. Functions organize code for reuse; they do not by themselves make code run faster, because performance depends on algorithm efficiency.
- C. Code compilation difficulty is not directly affected by function usage; it depends on language and compiler configuration.
Question 103
Which platform is used to programmatically create a space and invite users for collaboration?
Show answer and explanation
Correct answer: C. Cisco Webex
Cisco Webex provides REST APIs for its messaging service, so applications can create spaces, called rooms in the API, add people to them through memberships, and post messages. A bot or integration can create a space with a POST to the rooms endpoint and then invite users by creating memberships with their email addresses. This is the platform built for programmatic team collaboration among the options listed.
Why the other options are wrong
- A. Cisco Intersight manages data center infrastructure such as servers and hyperconverged systems, not collaboration spaces.
- B. Cisco Finesse is the agent and supervisor desktop for contact centers and does not create collaboration spaces.
- D. Cisco Unified Communications Manager provides call control and its APIs manage telephony configuration, not collaboration spaces.
Question 104
How does a developer create and switch to a new branch called `my-bug-fix` to develop a product fix?
Show answer and explanation
Correct answer: A. git checkout -b my-bug-fix
The command git checkout -b my-bug-fix creates a new branch called my-bug-fix and immediately switches the working tree to it in one step. The -b option tells git checkout to create the named branch at the current commit before checking it out, which is the usual way to start work on a fix in isolation. Newer Git versions offer git switch -c for the same result, but among the commands listed only git checkout -b both creates and switches.
Why the other options are wrong
- B. git branch has no -b option, so this command fails instead of creating and switching to the branch.
- C. git branch my-bug-fix creates the branch but leaves the developer on the current branch, so a separate checkout is still needed.
- D. git checkout my-bug-fix only switches to a branch that already exists; it does not create a new one.
Question 105
A developer needs to prepare the file README.md in the working tree for the next commit operation using Git.
Which command needs to be used to accomplish this?
Show answer and explanation
Correct answer: B. git add README.md
The git add README.md command stages the file README.md for the next commit. The 'add' command moves changes from the working tree to the staging area, preparing them to be included in the next commit operation.
Why the other options are wrong
- A. The syntax 'git -a' is not a valid Git command; the correct command is 'git add'.
- C. The syntax 'git add README.md staging' is not valid; the staging area is implicitly used by git add with no additional argument.
- D. git commit creates a commit from staged changes; it does not prepare files for committing.
Question 106
What are two advantages of the Model-View-Controller software design pattern? (Choose two.)
Show answer and explanation
Correct answer: A, B. allows for multiple views of the same model; separates responsibilities of the code, which makes future modifications easier
The Model-View-Controller pattern allows multiple views to present the same underlying data model, enabling different user interfaces or data representations. It also separates concerns by dividing code into distinct components (the model handles data, the view handles presentation and the controller handles logic), making the codebase easier to maintain and modify.
Why the other options are wrong
- C. MVC is a software design pattern and does not directly simplify network automation; automation tools and frameworks handle that.
- D. MVC is independent of CI/CD deployment mechanisms; it does not inherently make code easier to deploy.
- E. MVC does not reduce the need for error handling; proper error management is required regardless of design pattern.
Question 107
Which protocol runs over TCP port 22?
Show answer and explanation
Correct answer: A. SSH
SSH (Secure Shell) is the protocol that runs over TCP port 22. It provides secure remote access to network devices and servers with encrypted communication. While NETCONF can run over SSH, it does not natively run on port 22 by default. HTTP uses port 80, and Telnet uses port 23.
Why the other options are wrong
- B. NETCONF runs over SSH on its own default port, 830, so it is not the protocol that natively runs on port 22.
- C. HTTP runs over TCP port 80, not port 22.
- D. Telnet runs over TCP port 23, not port 22.
Question 108
Which two situations align with infrastructure as code principles? (Choose two.)
Show answer and explanation
Correct answer: D, E. easily reproducible systems; repeatable processes
Infrastructure as code defines servers, networks and their configuration in version-controlled files that tools such as Terraform or Ansible apply automatically. Because the definition is code, the same environment can be rebuilt identically at any time, making systems easily reproducible. The process of applying that code is also repeatable: running the same definition produces the same result every time, whether for testing, scaling out or disaster recovery, without manual steps that vary from one engineer to another.
Why the other options are wrong
- A. Hand-built snowflake servers that cannot be replicated are exactly what infrastructure as code eliminates.
- B. Infrastructure as code abstracts away specific hardware rather than tying releases to it.
- C. Infrastructure as code aims to minimize configuration drift, not maximize it.
Question 109
A developer needs a list of clients connected to a specific device in a Meraki network. After making a REST API call, the developer receives an unfamiliar response code.
Which Cisco DevNet resource should be used to identify the meaning of the response code?
Show answer and explanation
Correct answer: A. API documentation
API documentation is the primary resource for understanding HTTP response codes and their meanings from a specific API provider. The Meraki API documentation would contain detailed explanations of all response codes returned by the Meraki REST API. Code Exchange is a repository for code samples, Learning Labs are tutorials for learning concepts, and Sandbox is an environment for testing; none of these is designed to explain API response codes.
Why the other options are wrong
- B. Code Exchange is a repository of code examples and integrations, not a reference for understanding API response codes.
- C. Learning Labs are educational tutorials designed to teach DevNet concepts, not to document specific API response codes.
- D. Sandbox is a testing environment where you can experiment with APIs, not a reference guide for understanding response codes.
Question 110
Why would a developer compare a current version of code to a previous version?
Show answer and explanation
Correct answer: B. to troubleshoot code failures
When code that used to work starts failing, comparing the current version with the last known good version, for example with git diff, shows exactly which lines changed. That narrows the search for the cause to a small set of modifications instead of the whole codebase, which makes troubleshooting much faster. The same idea underlies git bisect, which repeatedly compares versions to locate the commit that introduced a failure.
Why the other options are wrong
- A. The repository as a whole acts as the single source of truth; a diff between versions does not provide it.
- C. Authorship is tracked with git log or git blame rather than by comparing two versions of the code.
- D. Collaboration is supported by branching, pull requests and shared repositories, not by the act of diffing versions.
Question 111
Which protocol must be allowed on the firewall so that NTP services work properly?
Show answer and explanation
Correct answer: D. UDP
NTP (Network Time Protocol) operates over UDP port 123 and requires UDP to be allowed through the firewall for proper time synchronization. UDP is the transport layer protocol used by NTP for its time synchronization communications.
Why the other options are wrong
- A. NTP uses UDP, not TCP, for its communications.
- B. ICMP is used for ping and diagnostic messages, not for NTP time synchronization.
- C. BGP is a routing protocol, not related to NTP functionality.
Question 112
In Python, which expression checks whether the script returns a success status code when the Requests library is used?
Show answer and explanation
Correct answer: A. response.status_code == requests.codes.ok
The Requests library uses response.status_code to access the HTTP status code, and requests.codes.ok is the correct constant for checking a successful response (200 status). Option A correctly combines both the proper attribute name and the proper constant reference.
Why the other options are wrong
- B. response.code is not a valid attribute in the Requests library; the correct attribute is status_code.
- C. requests.ok does not exist as a constant; the correct reference is requests.codes.ok.
- D. Using != instead of == checks for failure status codes, not success.
Question 113
What is a capability of the NETCONF protocol?
Show answer and explanation
Correct answer: C. allows XML messages to be exchanged via the SSH protocol
NETCONF, defined in RFC 6241, is a network management protocol that exchanges XML encoded remote procedure call messages between a client and a device. Its mandatory transport is SSH, defined in RFC 6242, and devices commonly listen on TCP port 830 for NETCONF sessions. Through these XML messages a client can retrieve configuration and state data, edit configuration, and lock or commit datastores, all modeled with YANG.
Why the other options are wrong
- A. NETCONF is a management protocol for reading and changing device data; it is not a mechanism for executing Python scripts.
- B. NETCONF encodes its messages and content in XML; JSON encoding is offered by RESTCONF, not NETCONF.
- D. NETCONF runs over SSH and has no web based interface; RESTCONF is the HTTP based alternative.
Question 114
What is a comparison of YAML and JSON?
Show answer and explanation
Correct answer: B. JSON does not support comments and YAML does.
YAML supports comments that begin with a hash sign and run to the end of the line, so configuration files written in YAML can carry notes for the people who maintain them. JSON has no comment syntax at all, and a standard JSON parser rejects a file that contains one. This is one reason YAML is preferred for human edited configuration such as Ansible playbooks and inventories, while JSON is common for machine to machine data exchange through APIs.
Why the other options are wrong
- A. JSON has the stricter and more uniform syntax; YAML offers several ways to write the same data, so it is not the more consistent of the two.
- C. YAML is the less verbose format, because it relies on indentation instead of braces, brackets and quoted keys.
- D. Configuration management tools such as Ansible use YAML for playbooks, so JSON is not the more common choice there.
Question 115
Which action do webhooks enable an application to perform?
Show answer and explanation
Correct answer: D. Implement a push model.
Webhooks enable applications to implement a push model where a server sends data to a client as events occur, rather than the client continuously polling for updates. This push-based delivery of real-time data is the defining characteristic and primary function of webhooks.
Why the other options are wrong
- A. Webhooks do not affect request rate limits; rate limiting is a separate API constraint.
- B. Webhooks receive data from external services, not populate restricted data within the application.
- C. Real-time delivery is a result of the push model rather than the action itself; what webhooks enable an application to do is implement a push model of communication.
Question 116
Which CI/CD tool is an automation tool used to build, test, and deploy software?
Show answer and explanation
Correct answer: D. Jenkins
Jenkins is an open source automation server built for continuous integration and continuous delivery. A Jenkins pipeline, usually defined in a Jenkinsfile kept with the code, can check out source from a repository, compile it, run the automated tests and deploy the result, with hundreds of plugins connecting it to other tools. Because it orchestrates the whole build, test and deploy flow, it is the CI/CD automation tool among the options.
Why the other options are wrong
- A. Git is a distributed version control system that stores code history; it does not build, test or deploy software.
- B. Gradle is a build tool that compiles and packages code, often called from a pipeline, but it is not the CI/CD automation server itself.
- C. Nagios monitors hosts and services and raises alerts; it is not used to build, test or deploy software.
Question 117
What are two benefits of using classes over functions when writing applications? (Choose two.)
Show answer and explanation
Correct answer: C, E. variable reusability; code organization
A class bundles related data and the functions that act on it into one unit, which organizes code around the objects it models, such as a Device class holding a hostname and the methods that connect to and configure it. Attributes stored on the instance (self.hostname, self.session) persist for the life of the object and are reused by every method without being passed in each time, whereas a plain function's local variables disappear when it returns. This organization and variable reuse make larger applications easier to extend and maintain.
Why the other options are wrong
- A. Readability depends on how the code is written and is not a property that classes provide over functions.
- B. Using classes does not make code more compatible with other systems or versions.
- D. Classes add some overhead and do not make code run faster than functions.
Question 118
Which tool is used to block all traffic to the domain by using a single API call?
Show answer and explanation
Correct answer: C. Cisco Umbrella
Cisco Umbrella provides DNS-based security that blocks all traffic to specified domains with a single API call at the DNS level. This cloud-based solution intercepts domain requests and can instantly prevent access organization-wide by updating the policy through its API.
Why the other options are wrong
- A. Cisco Firepower is a firewall platform that blocks traffic based on rules and policies but requires more granular configuration than a single API call.
- B. Cisco AMP focuses on endpoint protection and malware defense, not domain-level traffic blocking.
- D. Cisco ISE is an identity and access management platform, not designed for domain-level blocking with a single API call.
Question 119
A local Docker alpine image has been created with an image ID of a391665405fe and tagged as `latest`.
Which command creates a running container based on the tagged image, with the container port 80 bound to port 8080 on the host?
Show answer and explanation
Correct answer: D. docker run -p 8080:80 alpine:latest
The docker run command creates and starts a new container from an image. The -p flag specifies port mapping in the format host:container, so -p 8080:80 binds host port 8080 to container port 80. Option A uses docker build, which builds images rather than running containers. Option B uses docker exec, which runs commands in already-running containers. Option C uses docker start, which starts stopped containers but does not accept port mappings.
Why the other options are wrong
- A. docker build creates images, not containers, and does not accept the -p port mapping flag.
- B. docker exec runs commands in existing containers and cannot create new containers or map ports.
- C. docker start restarts stopped containers but does not accept port mapping parameters.
Question 120
A developer has created a new image to use in a Docker build and has added a tag for the image by using the command:
$ docker tag 84fe411926287 local/app:0.4
Which command must be executed next to build the Docker image using the tag?
Show answer and explanation
Correct answer: D. $ docker build -t local/app:0.4
The docker build command with the -t flag is used to build a Docker image and assign a tag to it. After tagging an image with docker tag, the next step is to build the image using that tag as the reference. The -t flag in docker build specifies the tag for the resulting image. Options A and C use docker build and docker run with incorrect flags (-p is for port mapping, not tagging).
Why the other options are wrong
- A. The -p flag is for port mapping, not for building images with tags.
- B. docker run starts a container from an image; it does not build an image.
- C. docker run with -p is for running containers with port mapping, not for building images.
Question 121
A developer is reviewing a code that was written by a colleague. It runs fine, but there are many lines of code to do a seemingly simple task repeatedly.
Which action organizes the code?
Show answer and explanation
Correct answer: C. Using functions, rewrite any pieces of code that are repeated.
Using functions to rewrite repeated code pieces is the most direct way to organize and improve code. This approach, known as the DRY (Don't Repeat Yourself) principle, eliminates redundancy, improves maintainability, and reduces the total lines of code without changing functionality.
Why the other options are wrong
- A. Removing tests does not organize code logic and may introduce bugs; tests ensure quality.
- B. Reverse engineering is unnecessarily complex when the code already runs fine; refactoring is the appropriate approach.
- D. A loop only repeats a block in one place, while a function lets the same logic be reused wherever it is needed, which is what organizes repeated code.
Question 122
While developing a real-time VoIP application on a Cisco Webex platform, users report that their voice gets chopped or parts of the conversation drop out.
Which network constraint is impacting the application?
Show answer and explanation
Correct answer: A. jitter
Jitter is the variation in delay between packet arrivals and is the primary cause of chopped or dropped voice segments in VoIP applications. When jitter is high, packets arrive at inconsistent intervals, causing audio playback interruptions and voice quality degradation.
Why the other options are wrong
- B. Capacity constraints typically cause overall service degradation but manifest as consistent quality issues rather than intermittent voice dropout.
- C. Delay alone causes latency but does not typically produce the chopping effect described; jitter is the variance in delay that causes this symptom.
- D. Latency refers to overall delay rather than the variation in delay; jitter is the specific metric that causes voice to chop or drop out.
Question 123
What is the purpose of a firewall in application deployment?
Show answer and explanation
Correct answer: B. limits traffic to only ports required by the application
When an application is deployed, a firewall is placed in front of it to enforce which traffic may reach it. Rules allow only the ports and protocols the application needs, such as TCP 443 for a web front end, and block everything else. Limiting exposed ports this way shrinks the attack surface and stops unwanted connections to services that should not be reachable from outside.
Why the other options are wrong
- A. Adding TLS to an application that lacks it is done by a reverse proxy or load balancer that terminates TLS, not by a firewall.
- C. Translating a hostname to an IP address is the job of DNS, not a firewall.
- D. Forwarding traffic to a pool of application instances is the job of a load balancer, not a firewall.
Question 124
What are two benefits of using VLANs? (Choose two.)
Show answer and explanation
Correct answer: B, C. enables the logical grouping of devices that belong to different Layer 2 devices; segments the broadcast domain
A VLAN groups switch ports into one logical Layer 2 network regardless of physical location, so devices connected to different switches can belong to the same group when the VLAN is carried over trunks. Each VLAN is its own broadcast domain, so creating VLANs splits one large broadcast domain into smaller ones, which reduces unnecessary broadcast traffic and isolates groups of devices from each other. Logical grouping and broadcast domain segmentation are the two core benefits.
Why the other options are wrong
- A. VLANs do not decide which devices may join the network; that is done with port security, 802.1X or access control.
- D. VLANs isolate groups of devices from each other, so they do not make every device reachable from every host.
- E. VLANs divide a broadcast domain into smaller ones rather than extending it.
Question 125
What is the meaning of the HTTP status code 204?
Show answer and explanation
Correct answer: B. server successfully processed request; no content returned
HTTP 204 No Content means the server successfully processed the request but has no body to return. It is common after a successful DELETE, or a PUT or PATCH that changes a resource without echoing it back, and many network APIs, including RESTCONF, use it to confirm a configuration change. A client should treat 204 as success and not try to parse a response body, because none is sent.
Why the other options are wrong
- A. A newly created resource is reported with 201 Created.
- C. The standard success response with a body is 200 OK.
- D. Invalid query parameters are reported with a 4xx error such as 400 Bad Request.
Question 126
A new application is being developed with specific platform requirements. The platform and application deployment and the ongoing platform management must be fully automated. The application includes a large database component that has significant disk I/O requirements.
Which application deployment type meets the requirements?
Show answer and explanation
Correct answer: B. virtual machine
Virtual machines meet the requirements of platform automation, full deployment automation, and ongoing management automation while providing the performance characteristics needed for demanding disk I/O operations typical of large database components. VMs offer better resource dedication and I/O performance compared to containers.
Why the other options are wrong
- A. Python virtual environments are for Python package isolation, not application deployment infrastructure.
- C. Bare metal deployment is difficult to automate fully and does not provide the flexibility needed for different environments.
- D. While containers are automatable, they share the host kernel and may not provide adequate performance isolation for significant disk I/O requirements.
Question 127
An application calls a REST API and expects a result set of more than 550 records, but each time the call is made, only 25 are returned.
Which feature limits the amount of data that is returned by the API?
Show answer and explanation
Correct answer: A. pagination
Pagination is the mechanism that breaks large result sets into smaller chunks returned across multiple API calls. When an API returns only 25 records despite 550+ being available, pagination is limiting the data per response, requiring subsequent calls with different page or offset parameters to retrieve additional records.
Why the other options are wrong
- B. Payload limit relates to request body size constraints, not response record counts.
- C. Service timeouts would cause the request to fail entirely, not return a partial result set.
- D. Rate limiting restricts the number of requests allowed in a time period, not the records per response.
Question 128
What is the purpose of a MAC address?
Show answer and explanation
Correct answer: C. to uniquely identify a network interface in a LAN
A MAC address is a 48 bit Layer 2 address assigned to a network interface, normally burned in by the manufacturer. Within a LAN, Ethernet frames are delivered by MAC address: switches learn which port each MAC address is on and forward frames accordingly. Because the address belongs to the interface rather than the device as a whole, a router or switch with several interfaces has several MAC addresses, and MAC addresses are not carried beyond the local network.
Why the other options are wrong
- A. A switch has many interfaces, each with its own MAC address, so a MAC address identifies an interface, not the switch as a whole.
- B. A router has a MAC address on each of its interfaces, so a MAC address identifies an interface rather than the router itself.
- D. MAC addresses are only meaningful within the local network; devices are identified across the Internet by IP addresses.
Question 129
Why is refactoring done during test-driven development?
Show answer and explanation
Correct answer: B. to improve maintainability and readability
In test driven development the cycle is red, green, refactor: write a failing test, write just enough code to pass it, then refactor. The refactor step improves the internal structure of the code, for example by removing duplication, renaming for clarity and splitting long methods, without changing its behavior. Because the tests already pass, they confirm that the cleanup broke nothing, and the result is code that is easier to read and maintain.
Why the other options are wrong
- A. Refactoring usually breaks large objects and long methods into smaller, focused pieces rather than enlarging them.
- C. Explaining how objects were used before is the job of documentation and comments, not the purpose of refactoring.
- D. Refactoring removes duplicated code; it never sets out to create duplication.
Question 130
Where is an IP packet routed if the packet does not match any routes in the routing table?
Show answer and explanation
Correct answer: D. default gateway
When an IP packet does not match any specific routes in the routing table, it is forwarded to the default gateway. The default gateway is the router responsible for handling packets destined for networks not explicitly listed in the routing table.
Why the other options are wrong
- A. Firewalls filter traffic based on rules, not routes.
- B. Load balancers distribute traffic across servers; they are not routing destinations.
- C. Central switches operate at Layer 2 and do not handle unmatched routing decisions.
Question 131
Which two items are Cisco DevNet resources? (Choose two.)
Show answer and explanation
Correct answer: C, E. API Documentation; Sandbox
Cisco DevNet is Cisco's developer program, and two of its core resources are API documentation and sandboxes. The documentation on developer.cisco.com describes the APIs and SDKs of Cisco platforms such as Meraki, Webex, Catalyst Center and ACI, with reference guides and examples. The DevNet Sandbox provides free, ready to use lab environments, both always on and reservable, where developers can run code against real Cisco platforms without needing their own equipment.
Why the other options are wrong
- A. TAC Support is Cisco's Technical Assistance Center for product support cases, not a DevNet developer resource.
- B. Software Research is not a DevNet offering; DevNet provides documentation, sandboxes, learning labs and code exchange.
- D. Bitbucket is a Git hosting service owned by Atlassian, not a resource provided by Cisco DevNet.
Question 132
Which OWASP threat occurs when untrusted data is supplied as input to an interpreter as part of a command or query?
Show answer and explanation
Correct answer: C. injection
Injection attacks occur when untrusted data is supplied as input to an interpreter (such as SQL, command shells, or other code interpreters) as part of a command or query. The malicious input becomes part of the executed command, allowing attackers to manipulate application behavior. This is a fundamental vulnerability class in the OWASP top ten.
Why the other options are wrong
- A. Broken authentication relates to flawed credential verification, not to interpreter input handling.
- B. Data exposure is about sensitive data becoming accessible, not about malicious command injection.
- D. Cross-site scripting involves injecting scripts into web pages viewed by other users, not interpreter command injection.
Question 133
What are two characteristics of Bare Metal environments that are related to application deployment? (Choose two.)
Show answer and explanation
Correct answer: B, C. suitable for legacy applications that do not support virtualization; provides workloads with access to hardware features
Bare metal environments are suitable for legacy applications that do not support virtualization, providing direct hardware access for compatibility with older systems (option B). They provide workloads with direct access to hardware features, enabling high performance and specialized hardware utilization for demanding applications (option C). Option A is incorrect because bare metal is not specifically designed for containers; containers typically run on operating systems. Option D is false because bare metal can be integrated with cloud services. Option E is incorrect because bare metal does not provide a hypervisor; it eliminates the hypervisor layer entirely.
Why the other options are wrong
- A. Bare metal is not specifically designed for containers; it runs applications directly on hardware.
- D. Bare metal environments can coexist with and integrate into cloud services like PaaS and SaaS.
- E. Bare metal does not include a hypervisor; it removes virtualization entirely for direct hardware access.
Question 134
What is a characteristic of the Cisco Finesse platform?
Show answer and explanation
Correct answer: C. Applications are added to the platform from the desktop remotely.
Cisco Finesse is a browser based agent and supervisor desktop for Cisco contact center solutions. It is built as a gadget container based on the OpenSocial standard, so administrators and developers can add applications to the desktop as gadgets that are hosted remotely and loaded into the browser. This lets organizations bring third party and custom applications into the agent's desktop without installing client software on each workstation.
Why the other options are wrong
- A. Invoking services when a network event occurs describes event driven automation, such as EEM on IOS, not the Finesse desktop.
- B. A ready-to-go HD video and audio conferencing platform describes Webex Meetings, not the Finesse contact center desktop.
- D. An enterprise class instant messaging engine describes Cisco Unified Communications Manager IM and Presence, not Finesse.
Question 135
What should a CI/CD pipeline aim to achieve?
Show answer and explanation
Correct answer: A. to require minimal manual interaction
A CI/CD pipeline automates the path from a code commit to a running release: it builds the code, runs automated tests, and deploys or delivers the result. The aim is a process that runs with minimal manual interaction, so every change is validated the same way, human error is reduced and releases can happen frequently and predictably. Manual gates may exist in some pipelines, but automation of the routine steps is the goal.
Why the other options are wrong
- B. Manual testing before deployment is what a pipeline replaces with automated tests; it is not the aim of CI/CD.
- C. CI/CD enables frequent, on-demand releases rather than tying deployments to a fixed monthly schedule.
- D. Fast feedback comes from the automated build and test results, not from a documented feedback process, which is not the pipeline's aim.
Question 136
Which two commands download and execute an Apache web server container in Docker with a port binding 8080 in the container to 80 on the host? (Choose two.)
Show answer and explanation
Correct answer: C, D. docker run -p 80:8080 httpd; docker pull httpd
The official Apache image on Docker Hub is named httpd, so docker pull httpd downloads it. Docker's publish flag uses the format -p host_port:container_port, so binding container port 8080 to host port 80 is written docker run -p 80:8080 httpd, which starts the container with that mapping. Remembering that the host side comes first is the key to reading any -p option correctly.
Why the other options are wrong
- A. The Apache image is named httpd, so there is no official image called apache to pull.
- B. The -p 8080:80 form maps host port 8080 to container port 80, which is the reverse of what is required.
- E. There is no Apache image named https; the image is httpd.
Question 137
How do XML and JSON compare regarding functionality?
Show answer and explanation
Correct answer: D. JSON natively supports arrays and XML does not natively support arrays.
JSON has a native array type written with square brackets, so an ordered list of values maps directly to a list in the host language. XML has no array construct: a list is represented by repeating an element, and the receiving code has to know or infer that the repeated elements form a collection. This difference in how collections are expressed is the functional comparison that holds, while the other statements reverse the usual strengths of the two formats.
Why the other options are wrong
- A. JSON maps more directly to host language structures such as dictionaries and lists, while XML needs extra parsing logic to turn elements into native types.
- B. JSON is generally considered easier to read than XML because it has no closing tags and less markup.
- C. JSON has native strings, numbers, booleans, null, objects and arrays, while plain XML treats all content as text unless a schema adds types.
Question 138
Which Cisco product provides malware and content filtering through DNS?
Show answer and explanation
Correct answer: D. Cisco Umbrella
Cisco Umbrella enforces security at the DNS layer. Devices send their DNS queries to Umbrella's recursive resolvers, which check each requested domain against threat intelligence and content categories before an answer is returned. Requests for malware, phishing or command and control domains, and for content categories the organization blocks, are refused or redirected to a block page, so the connection is stopped before it is ever made.
Why the other options are wrong
- A. The ASA Firepower module inspects network traffic inline with intrusion prevention and file policies; it is not a DNS based filtering service.
- B. Cisco AMP detects and responds to malware on endpoints and in files, not by filtering DNS requests.
- C. Cisco ISE provides identity based network access control and posture checks, not DNS based malware and content filtering.
Question 139
Which HTTP code group is issued when a request is received successfully, understood, and processed?
Show answer and explanation
Correct answer: A. 2xx
HTTP status codes are grouped by their first digit, and the 2xx class means the request was successfully received, understood and accepted by the server, as defined in RFC 9110. Common examples are 200 OK for a successful retrieval, 201 Created when a POST creates a new resource, and 204 No Content when the server succeeds but returns no body. A client that receives any 2xx code can treat the operation as having succeeded.
Why the other options are wrong
- B. The 3xx class signals redirection: the client must take further action, such as following a new location, to complete the request.
- C. The 4xx class signals a client error, such as bad syntax, missing authentication or a resource that does not exist.
- D. The 5xx class signals a server error, where the server failed to fulfil a request that appeared valid.
Question 140
What is the function of an IP address in networking?
Show answer and explanation
Correct answer: D. represents the unique ID that is assigned to one host on a network
An IP address is a unique identifier assigned to a host on a network that enables the host to communicate with other devices. It functions as the logical address at Layer 3 that distinguishes one device from another on the network infrastructure.
Why the other options are wrong
- A. MAC addresses represent network connections on devices, not IP addresses.
- B. Access control lists and firewall rules specify traffic types, not IP addresses.
- C. This describes a URI or URL, not the function of an IP address.
Question 141
What is the purpose of a MAC address on a network device?
Show answer and explanation
Correct answer: C. unique hardware address that identifies the network interface of a device
A MAC address is a unique hardware address that identifies the network interface card (NIC) of a device on a local network. It is burned into the hardware during manufacturing and is used for Layer 2 communication within the same network segment.
Why the other options are wrong
- A. While MAC addresses are unique, they are hardware addresses, not network addresses; network addresses are IP addresses.
- B. MAC addresses are not provided by DHCP; they are permanently assigned to hardware.
- D. MAC addresses are not provided by switches; they are manufacturer-assigned hardware identifiers.
Question 142
What are two benefits of model-driven programmability? (Choose two.)
Show answer and explanation
Correct answer: C, E. models decoupled from transport, protocol, and encoding; model-driven APIs for abstraction and simplification
Model-driven programmability delivers two key benefits: models are decoupled from transport, protocol, and encoding (option C), allowing the same model to work across multiple platforms and methods, and it provides model-driven APIs for abstraction and simplification (option E), enabling developers to work with standardized, vendor-agnostic interfaces. These benefits reduce complexity and increase portability.
Why the other options are wrong
- A. While APIs may benefit from design improvements, this is not a specific benefit of model-driven programmability itself.
- B. Model-driven programmability explicitly enables multiple transport, protocol, and encoding choices, not a single fixed choice.
- D. Being structured and human friendly is not what model-driven programmability delivers as a benefit; its benefits are models decoupled from transport and model-driven APIs for abstraction.
Question 143
Which API is used to obtain data about voicemail ports?
Show answer and explanation
Correct answer: B. Cisco Unified Communications Manager
Voicemail ports are configured in Cisco Unified Communications Manager, where they connect the call control system to a voicemail server such as Cisco Unity Connection. CUCM exposes its configuration through the Administrative XML (AXL) API, which provides operations to list, get, add and update voicemail ports along with other telephony objects. A developer who needs data about voicemail ports therefore queries the CUCM API rather than a messaging, contact center or endpoint API.
Why the other options are wrong
- A. The Webex Teams API manages messaging spaces, memberships and messages, not call control objects such as voicemail ports.
- C. Finesse gadgets extend the contact center agent desktop and do not expose voicemail port configuration.
- D. The Webex Devices API controls collaboration endpoints and their settings, not voicemail ports on a call control server.
Question 144
In DNS, which record specifies an alias that refers to another name that ultimately resolves to an IP address?
Show answer and explanation
Correct answer: A. CNAME
A CNAME (Canonical Name) record creates an alias that points to another domain name, which ultimately resolves to an IP address. It allows multiple names to reference the same resource without creating duplicate A records.
Why the other options are wrong
- B. NS records specify nameservers responsible for a domain, not aliases to other names.
- C. There is no AAA record type; the similar AAAA record specifies an IPv6 address, not an alias.
- D. SOA records contain authoritative information about a zone, not alias references.
Question 145
Which protocol is used for clock synchronization between network devices?
Show answer and explanation
Correct answer: D. NTP
The Network Time Protocol (NTP) synchronizes the clocks of network devices against a reliable time source, using UDP port 123 and a hierarchy of strata. Consistent time across routers, switches and servers is essential for correlating log messages, validating certificates and authentication tokens, and making sense of telemetry and troubleshooting data. Devices are typically pointed at internal NTP servers that in turn track an authoritative external source.
Why the other options are wrong
- A. FTP transfers files between a client and a server.
- B. NNTP distributes and reads Usenet news articles.
- C. BGP exchanges routing information between autonomous systems.
Question 146
What are two benefits of implementing common data structures when working with APIs in remote systems? (Choose two.)
Show answer and explanation
Correct answer: D, E. enforces standardized data structures; leverages code that is easily managed and reused
When systems exchange data through APIs, agreeing on common data structures (for example a shared JSON schema or a standard YANG model) means every client and server represents the same information in the same way. That enforces standardized structures, so parsing logic is predictable and integration errors drop. It also lets developers write parsing and processing code once and reuse it across many devices and services, keeping the codebase easier to manage as the number of remote systems grows.
Why the other options are wrong
- A. Common data structures standardize how data is shaped; they do not restrict developers to a single schema type.
- B. Shared structures promote multivendor interoperability rather than prevent it.
- C. Security in RESTful services comes from authentication, authorization and encryption, not from the shape of the data.
Question 147
What is a benefit of a CI/CD pipeline for infrastructure?
Show answer and explanation
Correct answer: A. removes manual errors
A CI/CD pipeline for infrastructure treats network and server configuration as code: changes are committed to a repository, automatically validated and tested, and then deployed by the pipeline in the same way every time. Because people no longer type the changes by hand on each device, typing mistakes, skipped steps and inconsistent settings are removed. The result is repeatable, auditable infrastructure changes with far fewer manual errors.
Why the other options are wrong
- B. Pipelines exist to automate steps; enabling more manual steps is the opposite of their purpose.
- C. Operations teams still design, monitor and own the infrastructure; the pipeline automates their changes rather than replacing them.
- D. Pipelines aim for consistent, repeatable deployments, not variety between them.
Question 148
Which Cisco platform provides organization-wide automation, security, policy enforcement, and agility across wired and wireless networks?
Show answer and explanation
Correct answer: B. Cisco DNA Center
Cisco DNA Center, now Cisco Catalyst Center, is the controller and management platform for enterprise campus and branch networks. It automates device provisioning, applies consistent security and access policy through software defined access, and provides assurance analytics across both the wired and wireless network from a single dashboard. That combination of organization wide automation, security, policy enforcement and agility across wired and wireless infrastructure is exactly what it was designed to deliver.
Why the other options are wrong
- A. Cisco SD-WAN manages connectivity across the wide area network between sites, not the wired and wireless campus network as a whole.
- C. Cisco ACI automates the data center fabric and its application policies, not enterprise wired and wireless access networks.
- D. Cisco Umbrella is a cloud DNS security service, not a network automation and policy platform.
Question 149
An engineer deploys a Cisco CSR 1000 V instance to a virtual machine. The engineer must output the device configuration in JSON format.
Which protocol is used for this task?
Show answer and explanation
Correct answer: D. RESTCONF
RESTCONF (RFC 8040) is an HTTP-based protocol that exposes a device's YANG-modeled configuration and state data as web resources. On a CSR 1000V running IOS XE, a GET to /restconf/data/Cisco-IOS-XE-native:native with the Accept header set to application/yang-data+json returns the running configuration encoded in JSON. RESTCONF supports both JSON and XML encodings, so the client chooses JSON simply through the media type it requests.
Why the other options are wrong
- A. YANG is the data modeling language that describes the data; it is not a protocol that retrieves anything.
- B. NETCONF exchanges data encoded in XML over SSH, so it does not output the configuration as JSON.
- C. SNMP retrieves MIB variables and cannot return the device configuration as a JSON document.
Question 150
A developer is working on a feature for a new application. The changes in the existing branch named 'feat00304' must be integrated into a single commit with the current working primary branch named 'prodapp411926287'.
Which git command must be used?
Show answer and explanation
Correct answer: B. git merge --squash feat00304
Running git merge --squash feat00304 from the primary branch takes all the changes made on the feature branch and applies them to the working tree and index as one combined set of changes. Git does not create a merge commit and does not record the feature branch as a parent, so the developer finishes with a single git commit that holds the whole feature. This is the standard way to integrate a branch into the current branch as exactly one commit.
Why the other options are wrong
- A. git rebase replays commits onto another base; it does not combine the branch into a single commit on the primary branch.
- C. git push sends commits to a remote repository and has no option that squashes a branch into one local commit.
- D. git checkout has no --squash option, so this command fails.
Question 151
Which two query types does a client make to a DNS server? (Choose two.)
Show answer and explanation
Correct answer: B, C. PTR; AAAA
Clients make two primary query types to DNS servers: PTR queries (reverse lookups to resolve IP addresses to hostnames) and standard queries like AAAA (to resolve hostnames to IPv6 addresses). These represent the forward and reverse query operations used in DNS resolution.
Why the other options are wrong
- A. Inverse queries are an obsolete DNS query type no longer used in modern systems.
- D. ACK is a TCP acknowledgment flag, not a DNS query type.
- E. DISCOVER is a DHCP message type, not a DNS query type.
Question 152
A company is looking for a cloud deployment which will only use the on-premise infrastructure, is user self-service, and is easy to scale.
Which cloud solution should be selected for these requirements?
Show answer and explanation
Correct answer: B. private
A private cloud runs cloud services on infrastructure dedicated to one organization, and it can be built entirely on the company's own on-premises hardware. It still offers the defining cloud characteristics, including on-demand self-service for users through a portal or API and rapid elasticity to scale resources up and down. A company that wants self-service and easy scaling while using only its on-premises infrastructure should therefore choose a private cloud.
Why the other options are wrong
- A. Multicloud means using services from several cloud providers, which goes beyond the company's on-premises infrastructure.
- C. A hybrid cloud combines on-premises resources with a public cloud, so it does not stay on the on-premises infrastructure alone.
- D. A public cloud runs on a provider's shared infrastructure, not on the company's own premises.
Question 153
When using the Bash shell, how is the output of the devnet command saved to a file named `output.txt`?
Show answer and explanation
Correct answer: A. devnet > output.txt
The > operator redirects standard output to a file. The command devnet > output.txt executes devnet and saves all output to output.txt. Option B uses the pipe operator |, which sends output to another command rather than a file. Option C uses the input redirection operator <, which reads from a file. Option D uses the background operator &, which runs a command in the background without redirecting output.
Why the other options are wrong
- B. The pipe operator | sends output to another command, not to a file.
- C. The input redirection operator < reads from a file as input, not for writing output.
- D. The background operator & runs a command in the background and does not redirect output to a file.
Question 154
What is the Git command to delete a local branch named `experiment` without a warning?
Show answer and explanation
Correct answer: D. git branch -D experiment
The Git command to delete a local branch named 'experiment' without a warning is `git branch -D experiment`. The `-D` flag forces deletion without requiring the branch to be fully merged, and it does not issue warnings. The `-d` flag (lowercase) refuses to delete the branch if it is not fully merged. The other options use non-standard or incorrect Git flags.
Why the other options are wrong
- A. The `-rm` flag is not a valid Git branch deletion option.
- B. The `-n` flag is not used for branch deletion; in other Git commands such as git add and git clean it means a dry run.
- C. The `-f` flag is not the correct flag for branch deletion; it's used for forcing other operations.
Question 155
Which two NETCONF operations cover the RESTCONF GET operation? (Choose two.)
Show answer and explanation
Correct answer: A, B. <get>; <get-config>
RFC 8040 maps RESTCONF methods onto NETCONF operations. A RESTCONF GET reads data from the server, and in NETCONF terms that read is performed by get-config, which returns configuration data from a datastore, and by get, which returns configuration together with operational state data. Depending on whether the client asks for config, nonconfig or all content, a RESTCONF GET corresponds to one or both of these operations.
Why the other options are wrong
- C. There is no get-update operation in NETCONF; reads use get and get-config.
- D. NETCONF has no modify-config operation; configuration is changed with edit-config.
- E. There is no edit operation in NETCONF; edit-config changes configuration and maps to RESTCONF POST, PUT, PATCH and DELETE, not GET.
Question 156
Which Cisco DevNet resource allows access to products in a development lab to explore, learn, and build applications that use Cisco APIs?
Show answer and explanation
Correct answer: B. DevNet Sandbox
The DevNet Sandbox is Cisco's offering that provides free, accessible development lab environments where developers can experiment with Cisco products, APIs, and technologies without requiring their own hardware. It allows hands-on learning and application development using live Cisco network devices and platforms.
Why the other options are wrong
- A. DevNet Code Exchange is a repository for sharing code samples and applications, not a lab environment for accessing products.
- C. DevNet Communities provide forums and discussion spaces for networking and knowledge sharing, not physical or virtual lab access.
- D. DevNet Automation Exchange is a marketplace for sharing automation content, not a sandbox environment for product exploration.
Question 157
Which HTTP error code series relates to redirection?
Show answer and explanation
Correct answer: D. 300
HTTP status codes are grouped by series based on their first digit. The 3xx series (300-399) specifically designates redirection responses, indicating that further action is needed to complete the request, such as following a redirect location header.
Why the other options are wrong
- A. 4xx codes represent client errors, not redirects.
- B. 5xx codes represent server errors, not redirects.
- C. 2xx codes represent successful responses, not redirects.
That was 157 of 631.
The full Cisco 200-901 CCNAAUTO pack has all 631 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 225 free as one PDF by email. Get the Half Pack →
