Using APIs

350-901 · 60 questions

• A city worker process calls a silent Firepower FDM controller and waits forever, pinning the worker while other municipal jobs starve. What should the REST consumer set to avoid that hang?
• The parks inventory client raises a local socket read deadline before any HTTP status line arrives from Meraki. How does that event differ from receiving an HTTP 408 response body?
• A GET of UCS inventory for the city's data-center audit dies on a read timeout. Which consumer behavior is the robust next step for that idempotent read?
• The city's DNA Center consumer receives HTTP 429 with a Retry-After value of 30 seconds. What is the robust client action before the next attempt?
• A transit-agency integration catches HTTP 429 from the Meraki Dashboard API and immediately reissues the identical request in a tight loop. Why is that control flow wrong?
• Several city workers all wait exactly 2, then 4, then 8 seconds after timeouts to the same controller and stampede together when the window opens. Which pattern reduces that synchronized retry storm?
• A city FDM object-create POST times out; the client cannot tell whether the firewall object was created. Which approach is the robust default for that non-idempotent write?
• A library Wi-Fi automation job sets a 3-second timeout but retries a down DNA Center host without any attempt limit, hanging for many minutes. What belongs in robust timeout handling?
• The municipal Intersight consumer receives HTTP 503 with a Retry-After header during a maintenance blip. Which 2.1 branch should the client take inside its retry budget?
• A city Webex ChatOps integration receives remaining-call and reset-time metadata from the API before it has earned a 429. What should a robust consumer do with that signal?
• Five parallel workers in the city's UCS inventory poller each retry as if they alone owned the entire API rate ceiling and still trip 429. What robust pattern should they use?
• After N consecutive timeouts to the same FDM host, the city automation keeps issuing immediate new attempts and burning its timeout budget. What robust timeout handling should it apply next?
• Creating a network object through the city's FDM API returns HTTP 400 (or 422) because the payload is malformed. What is the correct consumer control flow?
• A Meraki SSID enable call returns HTTP 403 for the city's service account. How should the consumer treat that response compared with a 429?
• A batch job retrieving wireless health for city branch IDs receives HTTP 404 for one identifier. What is the correct control flow for that resource hop?
• A city’s asset-tagging service POSTs a new switch hostname to a Cisco inventory API and receives HTTP 409 Conflict because that name already exists. How should the consumer handle the response?
• A parks-department dashboard calls a Cisco API with a Bearer token, receives HTTP 401, then retries after a token refresh that the authorization server also rejects. What is the correct control-flow choice?
• A water-utility script sends PATCH to a Cisco platform endpoint and receives HTTP 405 Method Not Allowed. What should the consumer do next?
• A city IT integration catches an unrecoverable 4xx from a Cisco API inside a helper and returns an empty “success” object so callers keep running. What is the correct design instead?
• A municipal change-ticket worker receives HTTP 422 Unprocessable Entity from a Cisco configuration API. How should the consumer map that result?
• A library-network tool updates fifty Meraki device names in one batch; one identifier returns an unrecoverable 4xx name conflict. What is the correct control flow?
• A transit-agency client receives HTTP 403 Forbidden on one Cisco API call and HTTP 429 Too Many Requests on another. How should unrecoverable-error control flow treat them?
• A facilities inventory poller GETs a Cisco resource and receives HTTP 410 Gone. What should the consumer do with that identifier?
• A slow Cisco API call finally returns HTTP 403 Forbidden after several seconds. Which consumer action is correct?
• A city NOC client successfully GETs a Cisco site list with Cache-Control: max-age=300. What is the cache-aware optimization for the next two minutes?
• An OAuth token response and a privileged Cisco inventory body both arrive with Cache-Control: no-store. What must the consumer do?
• A municipal automation client still holds a Cisco API representation and its ETag. How should the next GET be constructed to optimize bandwidth?
• After a conditional GET, a Cisco API returns HTTP 304 Not Modified with an empty body. What should the consumer do?
• A Cisco API provides Last-Modified on a GET response but no ETag. How should the consumer optimize the next GET?
• A response from a Cisco health API includes Cache-Control: no-cache. What does that directive mean for the consumer’s stored copy?
• A per-operator Cisco API response is marked Cache-Control: private. Which reuse policy is correct?
• A cached Cisco controller inventory has exceeded its freshness lifetime and was stored with must-revalidate. What must the consumer do before serving it?
• After a successful PUT to a Cisco resource, a follow-up GET returns 200 with a different ETag than the client had cached. What should happen to the old stored body?
• A city script caches a rarely changing Cisco catalog GET, then performs a PATCH on one of those resources. What is the correct cache behavior afterward?
• A Cisco API response includes Expires and Age headers alongside usable Cache-Control. How should a consumer use Expires and Age?
• A developer proposes skipping the OAuth token request because a fresh cached Cisco device list is still within max-age. Which statement is correct?
• A public-works app consumes a Cisco REST API that paginates with a Link header including rel="next". How should the client construct follow-on requests?
• A school-district integration reads a Cisco API that uses limit and offset query parameters. After receiving the first full page, how is the next request constructed?
• A Cisco list API returns a nextPageToken cursor instead of numeric offsets. How should the consumer request the following page?
• An offset/limit Cisco API does not return Link relations or page tokens. The latest response contains fewer items than the requested limit. What should the consumer conclude?
• A city utilities dashboard pages Meraki device inventory for every district pump house. The API returns items and a next link but never a grand total. The developer’s loop waits until a count field appears before fetching more pages. What should the consumer do instead?
• A municipal 311 intake tool walks DNA Center client pages and builds one list for the night’s report. Inside the loop the code does results = page.items on every iteration. What construction mistake does that introduce?
• A parks department sync pulls Webex space memberships where the response only exposes a next URL—no last page index. A developer fires pages 1 through 50 in parallel to “go faster.” What is the correct construction approach?
• A water-utility script pages Intersight server inventory filtered to chassis tagged “lift-station.” On page two the code drops the tag filter and calls a different collection URL that still has a next link. What must the next-page request preserve?
• A transit-ops dashboard asks the Meraki API for limit=100 client records but the server returns 40 and a next pointer. The offset math still adds 100 for the following request. What should drive the next-request step?
• A city open-data portal queries UCS blade inventory with a filter for “cooling-tower” tags. The first page returns HTTP 200 with an empty items array. How should the pagination control flow treat that result?
• While paging Firepower FDM network objects for a municipal firewall audit, the consumer receives HTTP 429 mid-walk. After honoring Retry-After, what should it do with the pagination cursor?
• A harbor-ops app pages AppDynamics metric snapshots using offset += 1 after each 50-item page instead of advancing by the page size the API contract uses. What is the likely construction result?
• A civic permitting portal will use the OAuth2 three-legged authorization code grant so residents approve access to their profile API. What is the first hop the constructed flow must perform?
• After a library-cardholder consents, the municipal app’s redirect URI receives an authorization code. A junior developer places that code in Authorization: Bearer on the first resource GET. Why is that wrong?
• A confidential client for a city GIS portal holds an authorization code after resident consent. Which step correctly obtains the access token?
• The municipal fleet API has returned an access token to the city’s maintenance app after a successful code grant. How should subsequent protected resource calls be authorized?
• An exam-style review for the city’s identity team asks for the official happy-path order of the OAuth2 authorization code grant. Which sequence is correct?
• A wastewater SCADA integration can call a machine-only API with client credentials, but the resident portal must let each homeowner approve data sharing. Why does official DEVCOR task 2.5 require the authorization-code (three-legged) path for that portal?
• A proposed redesign of the city’s permitting SSO returns an access token in the front-channel redirect fragment (implicit-style) and skips the code-for-token exchange. Relative to the official authorization-code happy path, what is wrong?
• During OAuth setup for a parks reservation app, a developer changes the authorize redirect to an ad-hoc localhost URL that was never registered with the authorization server. What grant rule does that violate?
• A school-district parent portal starts an authorization-code grant but omits the state parameter. Which protection is missing from that grant step?
• Where should a confidential municipal client use its client secret during the authorization-code grant?
• After a successful token exchange, a developer caches the authorization code to “renew” access later when the access token expires. What happens if that code is replayed at the token endpoint?
• The city’s confidential client receives an optional refresh token after a successful authorization-code grant. How does refresh relate to the official three-legged sequence?