Cisco CCNA Automation (200-901 CCNAAUTO) Practice Exam

What the Cisco CCNA Automation (200-901 CCNAAUTO) exam covers

• Software Development and Design117 questions
• Understanding and Using APIs166 questions
• Cisco Platforms and Development112 questions
• Application Deployment and Security113 questions
• Infrastructure and Automation155 questions
• Network Fundamentals48 questions

Free Cisco CCNA Automation (200-901 CCNAAUTO) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 711.

1. Question 1Software Development and Design

   Which version control system is standard for collaborative software development?

   • ADNS
   • BFTP
   • CGitCorrect
   • DSNMP
   ✓ Correct answer: C

   Git is a distributed version control system (DVCS) that allows multiple developers to work on the same codebase simultaneously, track changes over time, branch for new features, and merge code through pull requests. Platforms like GitHub and GitLab are built on top of Git, making it the industry-standard tool for collaborative software development.

   Why the other options are wrong

   • ADNS (Domain Name System) resolves hostnames to IP addresses and has no role in tracking or managing source code changes.
   • BFTP (File Transfer Protocol) transfers files between hosts but provides no versioning, branching, or collaboration features needed for software development.
   • DSNMP (Simple Network Management Protocol) is used to monitor and manage network devices, not to version-control or collaborate on source code.
2. Question 2Cisco Platforms and DevelopmentSelect all that apply

   Which TWO actions reduce load on a Cisco network controller's API while keeping data current? (Choose TWO)

   • ARequest only the fields/resources actually neededCorrect
   • BSubscribe to event notifications instead of constant pollingCorrect
   • CFetch the full configuration database on each loop
   • DPoll every endpoint on a 1-second timer
   ✓ Correct answer: A, B

   Fetching only the specific fields or resources a script actually needs - rather than pulling the full configuration database each loop - minimizes response payload size and server-side processing. Subscribing to event notifications means the controller pushes updates when state changes occur, eliminating the need for constant polling and dramatically reducing the number of API requests the controller must handle.

   Why the other options are wrong

   • CFetching the full configuration database on each loop transfers far more data than necessary and places maximum read load on the controller's API on every iteration.
   • DPolling every endpoint on a 1-second timer generates a continuous high-frequency request storm that can saturate the controller's API and degrade its performance for other clients.
3. Question 3Infrastructure and Automation

   For a Python automation script that calls several REST APIs, which design choice best handles transient network failures without crashing?

   • ACatch exceptions and implement retries with exponential backoff and a timeoutCorrect
   • BAssume every call always succeeds and ignore errors
   • CHard-code a fixed sleep of one hour after every call
   • DRetry instantly forever in a tight loop with no limit
   ✓ Correct answer: A

   Transient network failures such as timeouts, brief 5xx errors, or dropped connections are best handled by catching the exception and retrying with exponential backoff plus a bounded timeout and a maximum retry count. This recovers from temporary issues without overwhelming the server or hanging the script indefinitely.

   Why the other options are wrong

   • BAssuming every call always succeeds and ignoring errors guarantees the script crashes or misbehaves the moment any call fails.
   • CHard-coding a fixed one-hour sleep after every call makes the script unusably slow and still does nothing to handle an actual failure.
   • DRetrying instantly forever in a tight loop with no limit can hammer the server, spike CPU, and hang the script whenever the endpoint stays down.
4. Question 4Application Deployment and Security

   While migrating an app into containers, configuration that differs per environment should be supplied how, per twelve-factor principles?

   • ABaked permanently into the image at build time
   • BThrough environment variables injected at runtimeCorrect
   • CHardcoded inside the application source
   • DStored in a public Git repository
   ✓ Correct answer: B

   The twelve-factor app methodology (factor III: Config) states that configuration that varies between deployments - such as database URLs, credentials, and hostnames - must be stored in environment variables, not in code or images. This keeps a single image promotable across dev, staging, and production simply by supplying different variables at container start time.

   Why the other options are wrong

   • ABaking configuration permanently into the image couples the image to one environment, forcing a separate build per deployment target and violating twelve-factor principles.
   • CHardcoding values inside the application source makes them visible in version control and requires a code change and rebuild to alter any environment-specific value.
   • DStoring configuration in a public Git repository exposes secrets to anyone with repository access and still requires the image to be rebuilt or reconfigured to consume different values.
5. Question 5Software Development and Design

   Why should passwords be stored as salted hashes rather than encrypted or plaintext?

   • ASalted one-way hashing prevents reversal and defeats precomputed rainbow tablesCorrect
   • BHashing makes stored passwords load and compare faster at login time
   • CEncryption is simply impossible to apply to string values
   • DPlaintext passwords are required for the OAuth flow to work
   ✓ Correct answer: A

   Cryptographic hash functions are one-way - a hash cannot be reversed to recover the original password. Adding a unique random salt per user ensures that two users with the same password produce different hash values, making precomputed lookup tables (rainbow tables) ineffective. Purpose-built password hashing algorithms such as bcrypt, scrypt, or Argon2 are intentionally slow to compute, further resisting brute-force attacks. Encryption is reversible, so a stolen encryption key would expose all passwords.

   Why the other options are wrong

   • BPassword hashing functions are intentionally slow to resist brute force; they are designed to be slower, not faster, at authentication time.
   • CEncrypting strings is entirely possible and common; the reason not to encrypt passwords is that encryption is reversible, so a stolen key exposes them all.
   • DOAuth does not require stored plaintext passwords; it relies on authorization servers and tokens, and password storage format is an independent concern.
6. Question 6Cisco Platforms and Development

   In Cisco IOS XE RESTCONF, which URI path prefix is used to access the root of the configuration and operational data resources?

   • A/api/v1/data
   • B/restconf/dataCorrect
   • C/yang/config
   • D/netconf/get
   ✓ Correct answer: B

   RFC 8040 specifies that the RESTCONF root resource is `/restconf` and the datastore resource for both configuration and operational data is at `/restconf/data`. Appending a YANG-modeled path such as `/restconf/data/Cisco-IOS-XE-native:native/hostname` allows reading or writing a specific data node. The `/restconf/operations` path is used for invoking YANG-modeled RPCs. IOS XE follows this standard path structure.

   Why the other options are wrong

   • A/api/v1/data resembles the Cisco Meraki or Catalyst Center API path style; it is not the RESTCONF standard URI prefix defined in RFC 8040.
   • C/yang/config is not a valid or recognized URI prefix in RESTCONF or any Cisco platform implementation.
   • D/netconf/get is not a valid URI; NETCONF uses XML RPCs over SSH, not HTTP URI paths.
7. Question 7Software Development and Design

   A REST client sends a PATCH request to /users/42 with only {"email":"new@x.com"}. What is the intended semantic of PATCH compared to PUT?

   • APATCH applies a partial update to the resource, while PUT replaces the entire resource representationCorrect
   • BPATCH is always idempotent while PUT is never idempotent under any circumstances
   • CPATCH always creates a brand new resource while PUT is only ever used to read one
   • DPATCH and PUT are completely identical and fully interchangeable in any REST API
   ✓ Correct answer: A

   With PATCH a client sends only the fields to change, so unspecified fields are left intact. PUT expects the complete representation and replaces the stored resource with what is sent, typically clearing or defaulting omitted fields.

   Why the other options are wrong

   • BPUT is defined as idempotent while PATCH may or may not be, depending on the patch document, so this has it backwards.
   • CPATCH modifies an existing resource and does not read; PUT can create or replace but is not read-only.
   • DPATCH and PUT have distinct semantics (partial versus full replacement) and are not interchangeable.
8. Question 8Understanding and Using APIs

   A Cisco Meraki Dashboard API uses an organization-scoped API key passed in a header. Which header carries this key by convention for Meraki?

   • AX-Cisco-Meraki-API-KeyCorrect
   • BAuthorization: Basic
   • CCookie
   • DX-Forwarded-For
   ✓ Correct answer: A

   Meraki's REST API expects the API key in the X-Cisco-Meraki-API-Key request header (newer usage also accepts an Authorization Bearer header), which the platform uses to authorize the call against the organization.

   Why the other options are wrong

   • BBasic authentication encodes a username and password, which is not how Meraki API keys are presented.
   • CThe Cookie header carries session cookies, not the Meraki API key.
   • DX-Forwarded-For records the originating client IP through proxies and is unrelated to authentication.
9. Question 9Cisco Platforms and Development

   A developer is building automation against Cisco UCS servers and wants a single API to manage both standalone and centrally managed infrastructure from the cloud. Which Cisco platform provides this?

   • ACisco IntersightCorrect
   • BCisco Webex
   • CCisco ThousandEyes
   • DCisco Umbrella
   ✓ Correct answer: A

   Intersight provides SaaS-delivered, RESTful APIs (using OpenAPI/Swagger definitions and key-based signed requests) to manage Cisco UCS servers, HyperFlex clusters, and other infrastructure at scale from the cloud, including both standalone and Intersight-managed modes.

   Why the other options are wrong

   • BWebex is a collaboration platform for messaging and meetings, not server management.
   • CThousandEyes provides network and application performance monitoring, not UCS management.
   • DUmbrella is a cloud security/DNS-layer protection platform, not server management.
10. Question 10Infrastructure and Automation

    In a Terraform configuration, what is the primary purpose of the state file (terraform.tfstate)?

    • ATo map the resources defined in configuration to the real-world objects that have been provisionedCorrect
    • BTo store the provider plugin binaries used during apply so they need not be downloaded again
    • CTo hold the encrypted SSH keys used to connect to the managed hosts during provisioning runs
    • DTo cache the rendered HTML documentation for each module so plans can display it more quickly
    ✓ Correct answer: A

    Terraform uses the state file to record metadata and the mapping between resource addresses in your configuration and the actual provisioned resources, enabling it to compute diffs during plan and to update or destroy resources accurately. Losing or corrupting state breaks Terraform's ability to track infrastructure.

    Why the other options are wrong

    • BProvider plugins are downloaded to the .terraform directory, not stored in state.
    • CTerraform does not store managed-host SSH keys in the state file as a design purpose.
    • DState has nothing to do with documentation; it is a JSON record of resource mappings.

Related Cisco resources

• Cisco CCNA Automation (200-901 CCNAAUTO) study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Cisco CCNP Security SCOR (350-701) practice examRelated
• Cisco CCST Cybersecurity (100-160) practice examRelated
• Cisco Cybersecurity Associate (200-201 CBROPS) practice examRelated

Cisco CCNA Automation (200-901 CCNAAUTO) practice exam FAQ