350-901 practice questions
Cisco · 350-901 · 300 questions
Original practice questions for the Cisco DEVCOR 350-901 exam, covering professional application development on Cisco platforms including distributed app design, REST API error handling and OAuth2, Cisco platform APIs (Webex, Meraki, DNA Center, FDM, Intersight, UCS, AppDynamics), application deployment and security with Docker and Kubernetes, and infrastructure automation with RESTCONF, Ansible, and Terraform.
This course contains the use of artificial intelligence.
About the 350-901 exam
- Exam fee
- $400 USD
- Time allowed
- 2 hours
- Languages
- English, Japanese
- Format
- Proctored exam, delivered by Pearson VUE
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Software Development and Design · 60 questions
- A city parking portal’s browser UI must show DNA Center wireless health and Meraki SSID status. Where should the integration store platform API tokens and issue those privileged controller calls?
- A municipal operations portal fans request traffic across several identical back-end workers that talk to Cisco controllers. What is the primary job of the load balancer in that design?
- A transit-authority portal stores each clerk’s session only as files on one back-end worker’s local disk while a load balancer can send the next request to any instance. What design change restores free fan-out?
- A county IT portal must show device inventory plus health views from two different Cisco controller families. How should the privileged API sessions be arranged?
- A city’s load balancer still sprays parking-portal traffic at back-end workers that fail a liveness probe and return gateway errors. Which distribution behavior should the design use instead?
- A single VM that polls Meraki sites and transforms JSON for a water-utility dashboard is CPU-saturated. The workers are designed to be identical and stateless behind a load balancer. Which scaling direction matches that constraint?
- A parks-department module both renders HTML and embeds raw UCS and DNA Center API calls in the same unit. What modularity change lets the UI and the controller hop evolve on different clocks?
- A city’s “common Cisco helper” still ships inside every portal release as a versioned library. The team wants that hop to scale and fail without rebuilding the UI. Which modularity choice matches that goal?
- Five identical workers for a civic inventory sync all append to the same local file on a shared mount and capacity stops growing linearly. What is the scalability fix?
- A library-network team runs twenty copies of one deployable that absorbs Meraki load, yet every SSID-enable change still requires rebuilding the inventory UI. What does that design still lack?
- A hybrid city ops app must keep Webex ChatOps usable when the on-premises controller is unreachable, and keep inventory usable when a SaaS Cisco API is down. What HA design property does that require?
- A 911-support portal’s recovery-time objective requires the back-end to resume serving within seconds of a worker failure, and sessions are already shared or stateless. Which HA pattern best matches that requirement?
- A utilities dashboard runs its Cisco-API worker “in the cloud” with one token file, one region, and no degraded path when that hop fails. What does that design still lack?
- A city NOC dashboard consumes Meraki and DNA Center data. Meraki returns 5xx while DNA Center is healthy. Which design response is appropriate?
- A metro IT team must survive loss of an entire data center for its Cisco-API workers, while controllers stay on-premises. Which pattern matches protecting against site loss versus only overflowing stateless workers to cloud?
- A permits portal waits for controller A, then controller B, then a local store before painting the page, and the sum of those round-trips blows the latency budget. Which design change best cuts that latency?
- A worker that polls every Meraki site every second exhausts the published controller quota and starves sibling civic apps. What design move should be chosen before implementation?
- An eight-second UCS inventory sync on the user’s click path blows a city portal’s interactive latency objective. How should that slow Cisco-API work be placed?
- Many clerks opening the same health page would each trigger the same expensive DNA Center query. Which consumer design protects latency and the platform quota?
- A civic inventory table with thousands of rows issues one REST call per row to a Cisco platform API, and the page feels slow even though each call is fast. What latency design change should be preferred?
- Five modules in a municipal portal each hard-code a DNA Center hostname, API version, and a pasted JSON body. A controller move becomes a scavenger hunt. What maintainability fix should the design use?
- A two-thousand-line grab-bag module talks to Webex, Firepower FDM, and a spreadsheet for a city helpdesk app. What structure improves maintainability?
- A permits service cannot be exercised without a live Meraki controller, so every change is expensive. Which maintainability property should the design add?
- A civic Wi-Fi portal still ships idle Meraki location-API calls “in case we need them later,” and every release must understand and patch that surface. What maintainability action fits?
- Operators cannot tell which Cisco platform hop failed for a given city-portal request because the app only emits local print statements. What observability design set should the integration hop expose?
- A city’s network team ships a portal that enables guest SSIDs through a wireless controller API. When an enable fails at 09:14, support must match the same failure on the portal error screen, the portal back-end log, and the outbound controller request log. Which design choice best enables that cross-hop match?
- A parks department app polls Meraki for AP inventory and then parses the JSON locally. Operators need to know whether Meraki is slow or the parser is. Which observability design best answers that question?
- A civic ops dashboard shows a green check because the wireless-health microservice process is listening on its port. Users still see blank charts because the controller returns empty wireless-health payloads. What should the design expose so operators see the real problem?
- A city telemetry service adds a Prometheus label for every client MAC and also stores raw Meraki response bodies inside distributed traces. After a week the metrics store is huge and traces contain PII. What observability design mistake does this illustrate?
- A library Wi-Fi enable request produces this short event log: back-end accepted req-8821; controller-A returned 200; controller-B returned 429; UI showed a generic failure. Where should diagnosis focus first?
- An automation job calls a retrieve-data API for switch inventory. One failure shows a connect-timeout with errno in the client log; another shows HTTP 400 with a body complaining about a bad template field. How should these be classified for next action?
- After a failed SSID change, the portal UI log says 10:00:01, the back-end says 09:59:40, and the controller syslog says 10:02:12, with no shared request id. Why is a “who failed first” story from these lines unreliable?
- A Python worker crashes with JSONDecodeError on an empty body while syncing Firepower FDM objects. Earlier in the same request log, a proxy hop returned 502 and the upstream call completed with 204. What is the sound diagnostic move?
- A ChatOps bot posts room messages through the Webex API. Every thirty seconds the client log shows the identical HTTP 401 Unauthorized, with no intermittent 5xx. What does that regularity most strongly indicate?
- A municipal asset registry must keep device rows consistent with site and owner tables, enforce foreign keys, and support ad-hoc joins under transactions. Which database type best fits that stated need?
- An integration caches full UCS and Intersight compute inventory documents that differ by product family and are almost always read as whole objects after each API revision. Which store type is the best fit?
- Operators ask: which applications and sites share this Catalyst Center controller, and what else fails if that node is removed? The dominant access pattern is walking relationships. Which database type best matches?
- A weekly capacity report must aggregate a few fields across millions of historical interface samples. Point lookups of whole device documents are rare. Which database layout best fits the report?
- The city NOC stores interface counters and hop latency keyed by metric name, timestamp, and device, mostly appending samples and running windowed queries. Which database type is the appropriate choice?
- Inventory must support constrained joins for current device-to-site ownership, while thirty days of poll samples need append-and-window queries. Access patterns fight inside one engine. What is the honest evaluation using only the official database-type families?
- One developer maintains a small tool that enables a single guest SSID and appends an audit line. There is one release train and no independent scale need. Which architectural pattern is justified?
- Architects compare a coarser shared-integration design to independently deployable, narrowly scoped units with decentralized data. In official DEVCOR terms, what distinction are they drawing?
- DNA Center (Catalyst Center) emits a network event that must reach a ticket opener, a ChatOps Webex notifier, and a metrics recorder. The producer must not wait on or know those consumers. Which pattern fits?
- Five containers are labeled microservices, yet they share one database and must always ship on the same release train because any schema change breaks all five. What have the architects actually built?
- Constraints: the ChatOps Webex notifier must scale and release independently from the inventory UI; one small team owns a separate batch reporter with a single weekly change window. Which pairing of official patterns best matches?
- A finished feature branch that adds Meraki SSID helpers should join the shared development line while keeping both histories visible. Which official Git operation is the correct way to combine the branch?
- During merge of a platform-client branch, Git stops because both sides edited the same function. Conflict markers appear in the file. What is the correct resolution path if the intent is to finish the merge?
- A developer made two local commits on a feature branch that have not been pushed. They want the branch pointer moved back and the index updated accordingly. Which official Git tool matches that local rewrite?
- On this blueprint, which Git operation is named for switching the worktree onto another branch or restoring a file path from a revision?
- A bad commit that broke Ansible inventory parsing is already on the shared main branch and teammates have fetched it. How should the team undo that change safely?
- A city parking-meter integration engineer experiments with a local Git commit that was never pushed. Overnight they realize the experiment should not stay in history. Separately, a shared branch already has a bad commit that three other civic apps have pulled. Which actions match those two situations?
- During a merge conflict in the city's Meraki SSID helper repo, an engineer decides the entire conflicting file from the incoming branch is correct. Which resolution completes the merge cleanly?
- The municipal transit team wants to hand operations a rebuildable DNA Center health exporter for the weekend change window. Which statement best describes a proper release package?
- The night before a library Wi-Fi automation change window, a city build pulls a new major of a shared HTTP client because dependencies floated on latest. Which practice would have kept the build reproducible?
- Two defects hit the parks-department automation packages. Package A fails on a clean runner because a required library was never listed. Package B lists two libraries that cannot be installed together. How should those packaging defects be classified?
- The water utility releases a new meter-reading app that talks to Intersight. Two engineers ship builds with different unofficial and official client library versions because the SDK was left unpinned. What should the release process treat the platform client library as?
- A civic design review asks for a sequence diagram of enabling a library-branch SSID through the city's back-end and the Meraki Dashboard API. What must the diagram show to satisfy that request?
- The city clerk's portal waits for a DNA Center wireless-health REST response before rendering. On the sequence diagram, which notation best shows that blocking synchronous call?
- A sequence diagram for the city's Webex ChatOps bot shows only the happy-path 200 from the Webex API. Design review asks how the diagram should also cover a 401 or timeout without turning into application source code. What belongs on the diagram?
- A draft sequence for the city's protected Intersight inventory pull shows the resource GET before any token acquisition hop. What is wrong with that diagram from a Domain 1 sequence perspective?
Using APIs · 60 questions
- A city worker process calls a silent Firepower FDM controller and waits forever, pinning the worker while other municipal jobs starve. What should the REST consumer set to avoid that hang?
- The parks inventory client raises a local socket read deadline before any HTTP status line arrives from Meraki. How does that event differ from receiving an HTTP 408 response body?
- A GET of UCS inventory for the city's data-center audit dies on a read timeout. Which consumer behavior is the robust next step for that idempotent read?
- The city's DNA Center consumer receives HTTP 429 with a Retry-After value of 30 seconds. What is the robust client action before the next attempt?
- A transit-agency integration catches HTTP 429 from the Meraki Dashboard API and immediately reissues the identical request in a tight loop. Why is that control flow wrong?
- Several city workers all wait exactly 2, then 4, then 8 seconds after timeouts to the same controller and stampede together when the window opens. Which pattern reduces that synchronized retry storm?
- A city FDM object-create POST times out; the client cannot tell whether the firewall object was created. Which approach is the robust default for that non-idempotent write?
- A library Wi-Fi automation job sets a 3-second timeout but retries a down DNA Center host without any attempt limit, hanging for many minutes. What belongs in robust timeout handling?
- The municipal Intersight consumer receives HTTP 503 with a Retry-After header during a maintenance blip. Which 2.1 branch should the client take inside its retry budget?
- A city Webex ChatOps integration receives remaining-call and reset-time metadata from the API before it has earned a 429. What should a robust consumer do with that signal?
- Five parallel workers in the city's UCS inventory poller each retry as if they alone owned the entire API rate ceiling and still trip 429. What robust pattern should they use?
- After N consecutive timeouts to the same FDM host, the city automation keeps issuing immediate new attempts and burning its timeout budget. What robust timeout handling should it apply next?
- Creating a network object through the city's FDM API returns HTTP 400 (or 422) because the payload is malformed. What is the correct consumer control flow?
- A Meraki SSID enable call returns HTTP 403 for the city's service account. How should the consumer treat that response compared with a 429?
- A batch job retrieving wireless health for city branch IDs receives HTTP 404 for one identifier. What is the correct control flow for that resource hop?
- A city’s asset-tagging service POSTs a new switch hostname to a Cisco inventory API and receives HTTP 409 Conflict because that name already exists. How should the consumer handle the response?
- A parks-department dashboard calls a Cisco API with a Bearer token, receives HTTP 401, then retries after a token refresh that the authorization server also rejects. What is the correct control-flow choice?
- A water-utility script sends PATCH to a Cisco platform endpoint and receives HTTP 405 Method Not Allowed. What should the consumer do next?
- A city IT integration catches an unrecoverable 4xx from a Cisco API inside a helper and returns an empty “success” object so callers keep running. What is the correct design instead?
- A municipal change-ticket worker receives HTTP 422 Unprocessable Entity from a Cisco configuration API. How should the consumer map that result?
- A library-network tool updates fifty Meraki device names in one batch; one identifier returns an unrecoverable 4xx name conflict. What is the correct control flow?
- A transit-agency client receives HTTP 403 Forbidden on one Cisco API call and HTTP 429 Too Many Requests on another. How should unrecoverable-error control flow treat them?
- A facilities inventory poller GETs a Cisco resource and receives HTTP 410 Gone. What should the consumer do with that identifier?
- A slow Cisco API call finally returns HTTP 403 Forbidden after several seconds. Which consumer action is correct?
- A city NOC client successfully GETs a Cisco site list with Cache-Control: max-age=300. What is the cache-aware optimization for the next two minutes?
- An OAuth token response and a privileged Cisco inventory body both arrive with Cache-Control: no-store. What must the consumer do?
- A municipal automation client still holds a Cisco API representation and its ETag. How should the next GET be constructed to optimize bandwidth?
- After a conditional GET, a Cisco API returns HTTP 304 Not Modified with an empty body. What should the consumer do?
- A Cisco API provides Last-Modified on a GET response but no ETag. How should the consumer optimize the next GET?
- A response from a Cisco health API includes Cache-Control: no-cache. What does that directive mean for the consumer’s stored copy?
- A per-operator Cisco API response is marked Cache-Control: private. Which reuse policy is correct?
- A cached Cisco controller inventory has exceeded its freshness lifetime and was stored with must-revalidate. What must the consumer do before serving it?
- After a successful PUT to a Cisco resource, a follow-up GET returns 200 with a different ETag than the client had cached. What should happen to the old stored body?
- A city script caches a rarely changing Cisco catalog GET, then performs a PATCH on one of those resources. What is the correct cache behavior afterward?
- A Cisco API response includes Expires and Age headers alongside usable Cache-Control. How should a consumer use Expires and Age?
- A developer proposes skipping the OAuth token request because a fresh cached Cisco device list is still within max-age. Which statement is correct?
- A public-works app consumes a Cisco REST API that paginates with a Link header including rel="next". How should the client construct follow-on requests?
- A school-district integration reads a Cisco API that uses limit and offset query parameters. After receiving the first full page, how is the next request constructed?
- A Cisco list API returns a nextPageToken cursor instead of numeric offsets. How should the consumer request the following page?
- An offset/limit Cisco API does not return Link relations or page tokens. The latest response contains fewer items than the requested limit. What should the consumer conclude?
- A city utilities dashboard pages Meraki device inventory for every district pump house. The API returns items and a next link but never a grand total. The developer’s loop waits until a count field appears before fetching more pages. What should the consumer do instead?
- A municipal 311 intake tool walks DNA Center client pages and builds one list for the night’s report. Inside the loop the code does results = page.items on every iteration. What construction mistake does that introduce?
- A parks department sync pulls Webex space memberships where the response only exposes a next URL—no last page index. A developer fires pages 1 through 50 in parallel to “go faster.” What is the correct construction approach?
- A water-utility script pages Intersight server inventory filtered to chassis tagged “lift-station.” On page two the code drops the tag filter and calls a different collection URL that still has a next link. What must the next-page request preserve?
- A transit-ops dashboard asks the Meraki API for limit=100 client records but the server returns 40 and a next pointer. The offset math still adds 100 for the following request. What should drive the next-request step?
- A city open-data portal queries UCS blade inventory with a filter for “cooling-tower” tags. The first page returns HTTP 200 with an empty items array. How should the pagination control flow treat that result?
- While paging Firepower FDM network objects for a municipal firewall audit, the consumer receives HTTP 429 mid-walk. After honoring Retry-After, what should it do with the pagination cursor?
- A harbor-ops app pages AppDynamics metric snapshots using offset += 1 after each 50-item page instead of advancing by the page size the API contract uses. What is the likely construction result?
- A civic permitting portal will use the OAuth2 three-legged authorization code grant so residents approve access to their profile API. What is the first hop the constructed flow must perform?
- After a library-cardholder consents, the municipal app’s redirect URI receives an authorization code. A junior developer places that code in Authorization: Bearer on the first resource GET. Why is that wrong?
- A confidential client for a city GIS portal holds an authorization code after resident consent. Which step correctly obtains the access token?
- The municipal fleet API has returned an access token to the city’s maintenance app after a successful code grant. How should subsequent protected resource calls be authorized?
- An exam-style review for the city’s identity team asks for the official happy-path order of the OAuth2 authorization code grant. Which sequence is correct?
- A wastewater SCADA integration can call a machine-only API with client credentials, but the resident portal must let each homeowner approve data sharing. Why does official DEVCOR task 2.5 require the authorization-code (three-legged) path for that portal?
- A proposed redesign of the city’s permitting SSO returns an access token in the front-channel redirect fragment (implicit-style) and skips the code-for-token exchange. Relative to the official authorization-code happy path, what is wrong?
- During OAuth setup for a parks reservation app, a developer changes the authorize redirect to an ad-hoc localhost URL that was never registered with the authorization server. What grant rule does that violate?
- A school-district parent portal starts an authorization-code grant but omits the state parameter. Which protection is missing from that grant step?
- Where should a confidential municipal client use its client secret during the authorization-code grant?
- After a successful token exchange, a developer caches the authorization code to “renew” access later when the access token expires. What happens if that code is replayed at the token endpoint?
- The city’s confidential client receives an optional refresh token after a successful authorization-code grant. How does refresh relate to the official three-legged sequence?
Cisco Platforms · 60 questions
- A municipal CI pipeline must notify the city’s Webex ops space when a Catalyst switch push fails. Which Webex API construction posts that ChatOps alert?
- After the city’s “NOC-Alerts” Webex space was recreated, a hard-coded roomId in the flood-control bot started failing. What constructed flow should supply the destination for POST /messages?
- A bridge-maintenance ChatOps bot must react when someone types /fail-over in the ops Webex space. Which construction avoids polling GET /messages?
- The city’s Webex webhook fires to the flood-bot with a new message id (plus room/person metadata) when /fail-over is typed. What must the bot do before parsing the command text?
- Operators type /fail-over in a group Webex ops space without @mentioning the municipal bot. The bot’s messages:created webhook never fires for that traffic. Why?
- A municipal NOC ChatOps bot posts outage notices into a Webex ops space around the clock. Which credential should the service present on each Webex API call?
- A city Wi-Fi ChatOps reply must bold the site name, @mention the on-call engineer, and include a dashboard link. Which message body field should the constructed Webex API call use?
- Before a transit-ops ChatOps bot can post into an existing Webex space, which API call correctly adds the bot to that room?
- A parks-department ChatOps bot sits in several Webex spaces, but status automation must react only to messages in one designated ops room. What does setting the webhook filter accomplish?
- City Wi-Fi on-call staff must approve or reject an SSID enable from a Webex ops space without memorizing free-text commands. How should the ChatOps message be constructed?
- A civic firewall automation job must create network objects on a threat-defense device managed by Firepower Device Manager. What is the correct first hop before any object call?
- A municipal security script must create a host network object on FDM for a new kiosk subnet gateway. Which request matches the official create construction?
- After a library branch retires a kiosk network object, automation must remove it from FDM. Which delete construction is correct?
- A city automation DELETE of an FDM network object returns 4xx. The object shows isSystemDefined or is still referenced by an access rule. What should the client do first?
- After a civic script POSTs and DELETEs FDM network objects, traffic still matches the previous policy set. Which follow-up activates the model changes?
- After a successful FDM token response, which header correctly authenticates a subsequent POST or DELETE to /object/networks?
- A county security developer must create and delete network objects using the platform named in DEVCOR task 3.2. Which product and API family is correct?
- For DEVCOR’s official FDM object task, which pair of HTTP verbs matches create and delete of network objects?
- A city library needs the Guest SSID turned on through the Meraki Dashboard API. Which request enables that SSID slot?
- A parks Wi-Fi automation job calls api.meraki.com to manage SSIDs. Which authentication header is the classic Dashboard construction?
- Before enabling an SSID, a civic script must place the correct identifier in the Meraki path /networks/{networkId}/wireless/ssids/{number}. How should networkId be resolved?
- Two city networks both broadcast a friendly name Guest. Automation must enable the Guest SSID on one network via Dashboard. What goes in the path segment {number}?
- After GETting a Meraki SSID slot, a developer enables it by PUTting the entire GET payload back unchanged except flipping enabled. Dashboard rejects the call. What is the sounder enable construction?
- A municipal ticket says enable the Lobby SSID on the Meraki network. Which API action correctly does that job?
- A downtown wayfinding service must retrieve Meraki Wi-Fi and BLE location observations in near real time. How does that location data typically arrive?
- A civic location receiver is configured in Meraki Dashboard, but no observations arrive. Meraki first GETs the POST URL during setup. What must the receiver return for that handshake?
- A museum analytics service consumes Meraki Scanning POSTs. Which fields should the constructed consumer treat as the core location retrieve?
- A city location HTTPS receiver accepts Meraki Scanning POSTs. Besides TLS, what authenticates that the JSON came from that Meraki network?
- A data-center civic ops tool must retrieve compute inventory summaries from Cisco Intersight SaaS. Which construction matches the official retrieve task?
- An unattended civic script retrieves Intersight inventory every night. Which authentication approach matches the classic Intersight API-key scheme candidates should recognize?
- A city data-center inventory job must list servers claimed in Intersight. Which retrieve targets that compute inventory?
- A municipal Intersight client must retrieve only the server named library-r720. Which query option narrows the GET on the server?
- A civic dashboard only needs each Intersight server’s Name and Serial. Which query option keeps the payload small?
- A city Intersight inventory has thousands of compute objects. How should the constructed client finish a complete collection retrieve?
- After a filtered Intersight list, a transit script needs full detail for one server. Which retrieve addresses that single object?
- A civic UCS Manager Python job must provision from a template. What is the first constructed authentication hop?
- When a municipal UCS script provisions “given a template,” which object is that template?
- Which UCS Manager method creates named service-profile instances from a given template?
- A parks UCS script instantiates a service profile from a template but the blade never boots the new identity. What step is still required?
- When calling UCS instantiate-from-template, how must the script address the template and destination org?
- What depth does DEVCOR expect for a constructed UCS Manager Python provision script?
- Official task 3.5 asks you to provision a UCS server from a template. Which platform API is the correct constructed answer?
- A civic Python script will retrieve wireless health from Cisco DNA Center. How does authentication work on the constructed hops?
- Which Cisco DNA Center Intent path retrieves overall client health including wireless for a municipal assurance script?
- After GET client-health, how should the script display the official wireless health numbers?
- A city script needs DNA Center client-health at a specific past moment. Which timestamp query shape is correct?
- What should a constructed DNA Center script print to truly “display wireless health” for operators?
- A colleague says Catalyst Center replaced Cisco DNA Center and all health API paths changed. What is the accurate DEVCOR stance?
- For DEVCOR task 3.6 wireless health, which constructed focus is correct?
- What three-job order should a constructed DNA Center wireless-health Python script follow?
- Which AppDynamics capability instruments a municipal application process for DEVCOR 3.7?
- What unit does AppDynamics follow when instrumenting application work such as login or checkout?
- When a slow business transaction crosses a threshold, which AppDynamics capability helps a developer see where time was spent?
- Which AppDynamics capability alerts when instrumented application traffic departs from learned normal?
- How does AppDynamics show where a Cisco-API-consuming app spends time across components?
- A city network team builds a custom ops dashboard that pulls Meraki SSID state and DNA Center wireless health. Which ordered sequence matches the official construction steps?
- Municipal Wi-Fi staff will use a browser dashboard that shows Meraki location counts and Intersight inventory. Where must the Meraki API key and Intersight private key live?
- A civic status board needs DNA Center wireless health, Intersight inventory, Webex ChatOps events, and Meraki location observations. How should collection style be matched to each platform?
- City IT must demonstrate a constructed dashboard that presents data collected from official Cisco platform APIs. Which outcome satisfies that requirement?
- Operations wants one canvas that shows DNA Center wireless health and posts a Webex ChatOps alert when the wireless score drops. Which design stays inside the official 3.x construction?
Application Deployment and Security · 60 questions
- A municipal CI job fails during install with “Could not find a version that satisfies the requirement requests==2.31.0” while unit tests never start. What is the correct diagnosis?
- City automation CI reports that package A needs libX>=2 while package B pins libX<2, and the resolver aborts before tests run. What failed?
- After install succeeds, the city’s CI test job prints AssertionError and FAILED testssidtoggle, and the pipeline stays red so the image is not promoted. What is the accurate diagnosis?
- A civic pipeline log shows ModuleNotFoundError: No module named 'meraki' during the install/import phase, with no AssertionError lines. Which failure class does the log show?
- Requirements now list a new DNA Center client library, but CI restores last week’s cached site-packages, reports install success, then fails on import of the new module. Where should diagnosis start?
- A city CI pipeline shows install green, test red with FAILED assertions, then image-build and deploy skipped. An engineer opens the deploy log looking for a down Kubernetes API. What is the correct 4.1 read?
- The city’s prebuilt CD path already builds, pushes, and rolls container images into Kubernetes. How should a new Meraki webhook consumer integrate into that environment?
- During a municipal release, the CD must ship a new image tag for the DNA health API consumer without breaking callers that already use the stable ClusterIP name. What should change?
- The prebuilt CD only shifts traffic to pods that pass the environment’s existing readiness probe on port 8080. A new image listens only on 9000. What happens and what must the app meet?
- A developer must place a Webex ChatOps bot into the city’s already-running Docker and Kubernetes CD path. Which approach matches “integrate into a prebuilt CD environment”?
- The prebuilt Kubernetes path injects Meraki API credentials via Secret-mounted environment variables at deploy time. A teammate proposes baking the key into the image layers. Which choice follows the integration contract?
- On-call staff propose a runbook that SSHes to node-3 and pip installs the DNA dashboard wherever capacity appears. How should Docker and Kubernetes CD integration work instead?
- Which practice best describes the benefit of continuous testing in the city’s CI pipeline for a Meraki automation repo?
- Why does the municipal CI include a static-analysis job before Docker build and promote of the Webex ChatOps service?
- The city’s pipeline policy marks the build red when static analysis reports a high-severity finding so the artifact is not deployed. What benefit does that quality gate provide?
- What professional benefit do continuous testing and static analysis in CI primarily deliver for the civic automation team?
- Which statement correctly places static analysis for DEVCOR task 4.3 versus application security mitigations?
- City platform engineers containerize a Python DNA Center collector. What does using Docker for that application primarily establish?
- During a municipal Docker lab, the team builds and tags dna-collector:1.2, then starts a process from that tag. Which statement is correct?
- What must the Docker build include so the Meraki location consumer is a self-contained containerized application?
- A municipal CD pipeline promotes a civic API that talks to Meraki and DNA Center. Operators need reliable rollback to the last known-good build. Which image naming practice gives CD a stable release identity?
- Public-works developers containerize a Flask helper that queries Intersight inventory for a city NOC. Which practice correctly utilizes Docker for that process?
- A parks department needs a slim image for a Python tool that calls the Webex API. The Dockerfile already has a base image and a COPY of the app. Which single instruction best completes the default startup without authoring an entire recipe from scratch?
- A city automation service must use different DNA Center hostnames and feature flags in lab versus production. Which 12-factor approach keeps that deploy-specific config out of the repository?
- A containerized civic chatbot that posts to Webex must follow the 12-factor logging tenet. How should the process emit log events?
- A permitting portal uses PostgreSQL, a message queue, and a Meraki Dashboard API endpoint. Which design treats those as 12-factor backing services?
- A city scales out replicas of a ticket-intake API behind a load balancer. Which 12-factor process design supports stopping and replacing any instance safely?
- After a failed Webex notification deploy, an engineer SSHes into the live container and edits Python files to hotfix production. Which 12-factor rule did that break?
- A new hire’s laptop runs a UCS inventory script fine, but the CI container fails importing the same modules. Which 12-factor dependency practice prevents that class of failure?
- Operations asks the civic Firepower FDM helper team for an effective application logging strategy. Which emission pattern should the app adopt?
- A citizen portal UI calls a back-end that then invokes the Meraki API. On-call staff cannot join those hops when troubleshooting. Which logging-design choice fixes that?
- While debugging a Meraki integration, a developer enables a ‘log everything’ mode that prints Authorization headers and API keys. What makes that logging strategy unsafe?
- A DNA Center write fails during a scheduled civic sync, but on-call cannot tell what failed amid chatty logs. Which logging practice restores actionable signal?
- The platform team runs containers for a Webex ChatOps bot. Which logging assumption keeps day-2 debug from depending on SSH and tail?
- A parks inventory database stores citizen equipment locations, and a portal sends those records to staff browsers. Which privacy statement is accurate?
- A Meraki-assisted occupancy dashboard for libraries only needs site-level counts. Which storage privacy practice should the app follow?
- A municipal integration ships tenant inventory and limited PII to a partner webhook. The database volume is encrypted. Which transmission practice is still required?
- A ChatOps auditor bot stores Webex message bodies and location observations for troubleshooting. Which storage-privacy control limits long-term blast radius?
- During an outage, an engineer creates an unencrypted debug zip and database backup containing customer payloads from a civic AppDynamics-linked app. Why is that still a privacy concern?
- A developer commits a DNA Center token in a .env file, then deletes the line in a later commit. Which secret-storage approach is the relevant fix going forward?
- In production, a multi-replica civic API must read a Webex bot token at runtime. Which secret storage approach fits that scenario?
- A pipeline builds and pushes an image that deploys a Meraki reporter. Where should the registry password and deploy token live?
- On the city’s Kubernetes cluster, a Catalyst Center sync pod needs an API token. Which store is appropriate for that credential?
- Security mandates rotating the Intersight API secret every 90 days with minimal downtime. Which approach makes that rotation practical?
- Three teams need credentials for the same UCS tooling: a solo developer on a laptop, a shared CI runner, and multi-replica production. Which statement identifies the relevant secret approach?
- A city permitting API must present TLS credentials the ops team can rotate for that service alone. The shared ingress still uses a platform default certificate nobody on the app team can replace. Which configuration choice satisfies an application-specific SSL requirement?
- A municipal container build currently COPYs server.key into the image. Security review requires configuring TLS material at run time. Which change correctly configures the application certificate?
- Citizens call https://permits.city.example for a civic API, but the installed certificate lists only CN/SAN for dev.permits.city.example. Clients reject the handshake. What is wrong with the application certificate configuration?
- A parks reservation API still serves a certificate copied into place years ago and now past its notAfter date. Callers fail trust checks. Beyond the initial install, what must application-specific certificate configuration include?
- A developer is tasked with configuring an application-specific SSL certificate for a civic REST API. Which action stays in scope for that application HTTPS requirement?
- A city services portal echoes webhook and form text into HTML pages. Reviewers flag reflected cross-site scripting risk. Which mitigation correctly addresses XSS?
- A cookie-authenticated civic admin form accepts POST from the browser. Attackers could trick a logged-in clerk’s browser into submitting a cross-origin POST. Which mitigation specifically addresses CSRF?
- A utilities lookup API builds database queries by concatenating citizen-supplied IDs into SQL strings. Which change is the primary SQL injection mitigation?
- A security review lists three findings: reflected XSS in a status page, CSRF on an admin POST, and SQLi in a search endpoint. Which pairing correctly matches each threat to its primary mitigation?
- Developers added maximum-length checks on every form field for a permitting portal and declared XSS, CSRF, and SQLi handled. Why is that incomplete for OWASP threat mitigation?
- An exam-style lab asks which OWASP threat examples DEVCOR highlights for application mitigation strategies. Which set matches the official named trio?
- A civic integration sends tenant identifiers and access tokens to an API over the network. How do end-to-end encryption principles apply to that API hop?
- A reverse proxy terminates TLS for a city API and forwards requests to the application over HTTP on the internal segment. Which statement reflects end-to-end encryption principles for APIs?
- An integration team proposes “encrypting” API JSON by Base64-encoding bodies on HTTP without TLS. Which principle of API encryption does that miss beyond hiding bytes poorly?
- A blueprint asks how end-to-end encryption principles apply to APIs for a municipal microservice. Which focus stays in scope?
Infrastructure and Automation · 60 questions
- Operations wants continuous interface counters from IOS XE civic edge routers without walking MIBs on a timer. Which statement correctly describes model-driven telemetry versus classic polling?
- A network team enables a telemetry subscription toward a host that cannot decode the YANG model or encoding in use. Publications leave the router but nothing useful is stored. Which consumption consideration was missed?
- Cadence telemetry from dozens of civic routers produces timestamped counter samples. Which storage consideration fits model-driven telemetry consumption?
- An IOS XE edge router is configured with a telemetry subscription that names a collector receiver. Which statement describes that configured (dial-out) consumption topology?
- A collector opens a dynamic (dial-in) telemetry subscription to an IOS XE device. After the collector disconnects and the device reloads, no stream resumes until the collector returns. What consumption trait does this illustrate?
- Engineers must choose telemetry publication style for interface counters to graph and for interface admin-state that should wake a consumer only when it flips. Which consumption choice is appropriate?
- High-cadence subscriptions across a large civic router fleet begin filling the telemetry store within days. Which storage consideration should the team address?
- A developer enables a telemetry subscription that streams an entire operational YANG tree “in case we need it later,” though the app only graphs two interface counters. Which consumption consideration applies?
- A proposal claims civic IOS XE switches will “run Grafana themselves” for model-driven telemetry without a separate receiver or store. Which correction reflects proper MDT pipeline roles?
- Study notes list dial-in and dial-out transport names from IOS XE model-driven telemetry docs. For a DEVCOR-style item on telemetry consumption and storage, what should remain the scored focus?
- A municipal network team must push YANG-modeled configuration to a Catalyst switch running IOS XE without opening an interactive SSH session. Which approach correctly uses the official device-config API for this DEVCOR task?
- A city automation script PATCHes an IOS XE interface over RESTCONF. Which Accept/Content-Type media type matches the official YANG-data exchange?
- A parks IT developer must edit interface configuration on an IOS XE switch via RESTCONF. Which URI family is the correct datastore root for that edit?
- A municipal script must change only the description leaf on an existing IOS XE interface without replacing the whole interface resource. Which RESTCONF HTTP verb matches that intent?
- City hall needs GigabitEthernet1/0/10 given an IPv4 address and description through RESTCONF on IOS XE. What is the correct construction focus?
- A developer builds a RESTCONF URI for an IOS XE interface. The device exposes both IETF interfaces and Cisco-IOS-XE-native models. Which practice keeps the request valid?
- Operations wants GigabitEthernet1/0/5 administratively shut and a new description applied on an IOS XE switch via RESTCONF. Which statement is correct?
- A RESTCONF PATCH must update only Loopback100 on an IOS XE router. How should the target interface be identified?
- A library branch needs a static route added on an IOS XE edge router through RESTCONF. Which payload content matches the official static-route resource idea?
- Transit staff must remove a previously added static route on an IOS XE router using RESTCONF. Which action is correct?
- A DEVCOR practice item asks how to add one intended route on IOS XE with RESTCONF. Which answer stays in scope?
- A RESTCONF static-route create on IOS XE includes only 10.40.0.0/16 in the body and omits how packets leave. What is missing for a complete edit?
- City Wi-Fi segregation requires VLAN 40 created on an IOS XE access switch through the official RESTCONF API. Which construction is correct?
- When addressing a VLAN over RESTCONF on IOS XE, what role does the VLAN identifier play versus the display name?
- A DEVCOR item asks how to configure a VLAN object on IOS XE with RESTCONF. Which response stays on the scored idea?
- Blueprint task 5.2 names IOS XE for RESTCONF device configuration. A candidate proposes NX-OS or IOS XR REST as the correct target. Why is that wrong for this item?
- Municipal automation must construct an Ansible workflow that configures network parameters on IOS XE switches. Which artifact matches the intended playbook workflow?
- A playbook must set an interface description, ensure VLAN 20 exists, and add a static route on IOS XE. Which task approach best matches DEVCOR 5.3.a construction?
- A city Ansible play targets group accessswitches, but the repository has no inventory or dynamic source listing those hosts. What is wrong?
- The same Ansible play must configure VLAN ids and interface names for two library sites. Where should that site-specific data live for reuse?
- Operators rerun an Ansible play that should ensure one static route exists on each IOS XE edge. A task always appends the route CLI blindly. What problem does that create?
- Before applying VLAN and interface changes, the city NOC wants operators to preview what Ansible would change. Which approach fits the 5.3.a Ansible workflow?
- How does a typical Ansible-to-IOS-XE playbook workflow reach the switches in DEVCOR 5.3.a?
- A play creates an SVI-style interface that depends on VLAN 55. Which task ordering reflects a correctly constructed Ansible workflow?
- A fair DEVCOR 5.3.a practice item about Ansible network parameters should ask which kind of judgment?
- A municipal campus team must push IOS XE interface and VLAN changes with an agentless playbook that SSHes existing switches. Which tool matches official DEVCOR 5.3.a construction?
- Public-works networking wants IOS XE VLANs and static routes expressed as desired resources rather than an interactive SSH script. Which approach matches Terraform for DEVCOR 5.3.b?
- A city edge stack’s Terraform root lists VLAN and interface resources for IOS XE but never configures how Terraform authenticates to the device. What is missing from the constructed workflow?
- Before changing campus IOS XE routes with Terraform, change control wants a preview of creates, updates, and destroys. Which workflow order satisfies that review?
- After applying VLANs with Terraform, an engineer deletes the state file and runs apply again against the same HCL. What role does state play that this action risks breaking?
- A parks-and-rec access layer needs a new SVI VLAN and a static route declared in Terraform for IOS XE. Which construction matches the intended 5.3.b resources?
- Terraform already owns VLAN 40 on a library branch switch. Operations needs the VLAN renamed. What is the correct Terraform workflow change path?
- Blueprint task 5.3.b asks the team to construct a workflow that configures network parameters with the official v1.1 tool. Which tool is correct?
- The official DEVCOR lab runs Terraform from GitLab CI/CD against IOS XE. A question asks what the 5.3.b construction actually is. What is the right focus?
- A temporary guest VLAN resource must leave a civic center switch that Terraform owns. How should deprovisioning be done in the Terraform workflow?
- A fair DEVCOR item asks which Terraform piece solves a stated need for an IOS XE static route. What kind of answer should candidates expect?
- Requirements: agentless SSH to a large existing IOS XE estate and reuse of a mature play library. Which configuration-management choice best matches that technical constraint?
- Change advisory requires a human-readable plan file of creates/changes/destroys before any VLAN push, and the team will accept a short ramp on a new tool. Which pick best matches that business constraint?
- Transit ops already has hundreds of working Ansible plays and trained operators; leadership asks whether to rip-and-replace with Terraform next quarter for the same VLAN work. What does 5.4 emphasize?
- The stated requirement is: show the delta, then apply, and keep a state file of owned IOS XE objects. Which CM solution identification fits 5.4?
- Requirements: no agent on the device, reuse existing SSH reachability, and express changes as ordered tasks in plays. Which tool identification matches?
- When identifying a configuration-management solution on this DEVCOR v1.1 bank, how should Puppet be treated relative to Ansible and Terraform?
- A water-utility edge switch must run a small monitoring app on the network device itself. Which framework provides that on-box application hosting?
- Official DEVCOR 5.5 names which switch family as a platform that can host applications on the device (alongside other IOx-enabled devices)?
- Operators want a Linux environment on a Catalyst 9000 for scripts and tools without treating Python as an IOS process on the ASIC. What is Guest Shell?
- A new Catalyst 9000 app-hosting attempt fails because IOx services never started. What prerequisite do official hosting docs emphasize?
- IOx is enabled on a Catalyst 9000, but a networked Guest Shell app still has no reachability. What hosting interface concept is missing?
- From a supported IOS XE generation, the team wants a Docker-style app to run on the Catalyst through IOx. What is the 5.5 idea?
- A Catalyst 9000 has only bootflash available. Operators want to host several additional Docker apps beyond Guest Shell. What storage constraint applies?
- A city wants edge scripts and on-device automation to run local to each Catalyst 9000 rather than only in a central VM. What does DEVCOR 5.5 emphasize?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.