100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 780
A Cisco Secure Access API client sends a request with an expired bearer token. The response is HTTP `401 Unauthorized`. Which remedial action addresses that specific response?
- Inspect permissions for an already authenticated client, as this code always means 403 Forbidden
- Change the request method to DELETE to remove the rejected resource
- Treat the response as a successful HTTP 200 and use its payload without authentication
- Refresh or replace the invalid credentials and retry the authorized request
Explanation
Correct Answer
D:HTTP 401 indicates missing or unacceptable authentication. Obtain a valid token with the proper scope before retrying.
Incorrect Answers
A:403 Forbidden is the usual response when an authenticated identity lacks permission. An expired token is an authentication problem yielding 401.
B:DELETE is a resource-removal operation and does not correct an expired or missing API authentication token.
C:A 401 response is an error, not a success status. The original action cannot be assumed completed.
Question 781
A Cisco controller endpoint documents bearer-token authentication over HTTPS. The client has obtained a valid API access token and must send it with an HTTP GET without placing it in the URL. Which request header is correct?
- `Content-Type: Bearer <token>`
- `Authorization: Bearer <token>`
- `Accept: Bearer <token>`
- `Host: Bearer <token>`
Explanation
Correct Answer
B:The Authorization header carries the Bearer authentication scheme and token. HTTPS protects that header in transit when TLS validation is enforced.
Incorrect Answers
A:Content-Type describes the request body media type (such as application/json); it is not the standardized bearer authorization field.
C:Accept advertises which response representation the client wants and cannot serve as the bearer-authentication header.
D:Host identifies the target HTTP authority; it does not authenticate the caller with a bearer credential.
Question 782
An HTTPS API client sends a JSON configuration object in a request body to a Cisco controller. The server must know the media type of the **submitted body**, not the preferred response format. Which request header states the body type?
- Accept: application/json
- Authorization: Bearer <token>
- Set Content-Type: application/json
- Content-Encoding: gzip when no compression is used
Explanation
Correct Answer
C:Content-Type: application/json identifies the request body as a JSON document so the API can interpret the submitted representation; Accept is for response negotiation.
Incorrect Answers
A:Accept describes desired response formats; it does not declare the representation type of this request body.
B:Authorization provides credentials or a token, not the MIME type of the JSON document being submitted.
D:Content-Encoding describes applied representation coding and cannot substitute for a JSON media-type declaration.
Question 783
A Cisco REST client sends a GET request and prefers the server to return JSON instead of XML. The question concerns **response media-type negotiation**, not the format of a request body. Which header expresses that preference?
- Set Accept: application/json
- Content-Type: application/json with no request body
- Authorization: Bearer <token>
- Cache-Control: no-store
Explanation
Correct Answer
A:Accept: application/json tells the server that the client prefers a JSON response representation, distinct from the Content-Type of any submitted body.
Incorrect Answers
B:Content-Type identifies the media type of a supplied request representation and does not by itself express the desired response type.
C:An authorization header supplies access credentials, not the response representation type accepted by the client.
D:Cache-Control requests caching behavior but does not negotiate the server response format as JSON.
Question 784
A network automation service sends an authentication token and sensitive policy JSON in API requests over a shared corporate network. Which transport protection validates the server certificate and encrypts both the token and body in transit?
- Plain HTTP with Base64-encoded Authorization credentials
- HTTPS with certificate validation disabled permanently
- SSH on a separate terminal without protecting the REST connection
- Use HTTPS with valid TLS certificate checks
Explanation
Correct Answer
D:HTTPS with valid TLS certificate verification protects the transport confidentiality and integrity of the HTTP headers and body and validates the intended API server identity.
Incorrect Answers
A:Base64 only encodes credentials and HTTP does not encrypt either the token or the policy payload in transit.
B:TLS encryption without authenticating the intended server allows man-in-the-middle risks and fails the stated certificate-checking requirement.
C:An SSH session elsewhere does not encrypt an independent plaintext API HTTP request or validate its web server identity.
Question 785
A caller successfully authenticates to a Cisco REST API, but its role lacks the permission needed to read a restricted resource. The API responds with status 403. Which interpretation explains the result?
- 401 Unauthorized, indicating missing or invalid credentials for authentication
- 404 Not Found, proving the requested object does not exist
- 201 Created, indicating a new resource was stored successfully
- Interpret HTTP 403 Forbidden
Explanation
Correct Answer
D:HTTP 403 Forbidden means the server refuses to authorize the understood request, including when an authenticated caller lacks permission for the resource.
Incorrect Answers
A:401 primarily challenges authentication; the scenario explicitly says the user is authenticated but lacks authorization.
B:A 404 indicates resource absence or obscured existence, while the stated 403 indicates the server understands but refuses permission.
C:201 is a successful creation response and cannot describe a forbidden request due to insufficient permissions.
Question 786
An administrator needs a repeatable ordered set of Ansible tasks for Cisco routers, written in YAML and reviewed before deployment. Which Ansible document type defines those plays and tasks?
- Write only an Ansible inventory with host groups but no plays
- Store task YAML in a secrets vault without a playbook document
- Use an Ansible YAML playbook
- Define only a Terraform HCL resource declaration
Explanation
Correct Answer
C:Ansible playbooks describe ordered plays and tasks in YAML so a reviewed sequence can be applied reproducibly. The inventory supplies target devices separately, and network modules perform the actual changes.
Incorrect Answers
A:Inventory identifies target devices and variables, but does not define an ordered YAML sequence of plays/tasks.
B:Vault protects sensitive variables; it does not replace the playbook structure that tells Ansible what tasks to run.
D:Terraform describes infrastructure resources using its own configuration language, rather than the Ansible plays and tasks requested.
Question 787
A network team has one playbook but must choose which router hostnames and connection variables it targets. Which Ansible component stores groups and target host inventory?
- Put the hostnames exclusively in role task files and remove the inventory
- Use Ansible Vault alone as the router group list
- Use an Ansible inventory
- Set the desired routers in Terraform state and assume Ansible inherits them automatically
Explanation
Correct Answer
C:Ansible inventory identifies hosts and groups and can store connection variables for the targets of a playbook. It does not itself define the ordered configuration tasks that a playbook contains.
Incorrect Answers
A:Role tasks declare actions; inventory maintains the selected hosts/groups and connection variables needed to target those actions.
B:Vault encrypts data but is not the host-group and target selection mechanism for an Ansible run.
D:Terraform state is not the Ansible inventory unless an explicit integration constructs the appropriate inventory.
Question 788
A task must interact with Cisco IOS devices through supported SSH/HTTP network connections rather than run an arbitrary shell script on each router. Which Ansible network module approach fits?
- Execute ordinary local shell tasks on the control node and assume they configure every router
- Use only an inventory file without network tasks
- Run supported Ansible network modules over remote connections
- Write a Terraform provider block instead of using Ansible network connection plugins
Explanation
Correct Answer
C:Ansible can execute automation modules against network devices without hand-configuring each.
Incorrect Answers
A:Local shell commands do not supply the supported device-connection and network-configuration semantics required for IOS targets.
B:Inventory lists devices but does not execute Cisco IOS configuration operations on them.
D:Terraform provisioning configuration is different from running Ansible network modules on supported remote device connections.
Question 789
A playbook requires a reusable enable password and API token, but repository viewers must not see plaintext credentials. Which protected secrets mechanism can store those values for authorized playbook use?
- Commit enable passwords as plaintext variables in the repository inventory
- Place tokens in cleartext task arguments and rely on git history protection
- Obfuscate tokens by renaming YAML variables without encrypting their values
- Use an approved protected secrets mechanism such as Ansible Vault
Explanation
Correct Answer
D:Ansible Vault or an approved protected secret-management mechanism encrypts sensitive playbook variables or obtains them from a controlled vault, keeping reusable credentials out of plaintext repository source.
Incorrect Answers
A:An inventory with unencrypted credentials still exposes secrets to repository readers.
B:Task arguments stored unencrypted remain visible in source and past revisions.
C:A different variable name does not protect the actual reusable secret in the repository.
Question 790
A baseline Ansible job runs twice against the same correct IOS state. The second execution should report no unnecessary changes. Which class of idempotent modules and state checks achieves that outcome?
- Run command tasks that always push configuration lines regardless of actual device state
- Use idempotent Ansible modules and checks
- Change the inventory hostname order before each execution
- Decrypt vault passwords again and assume this prevents device configuration changes
Explanation
Correct Answer
B:Idempotent modules report no change when the required state is already present.
Incorrect Answers
A:Unconditional commands can report or cause changes on repeat runs even when the desired state is already present.
C:Ordering target names has no bearing on whether device configuration matches the requested state.
D:Secret retrieval supports authentication but does not make the network configuration operation idempotent.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
