350-901 practice questions 301–310

1. Question 301 · 385 in bank

   Select 2

   An application uses OAuth to get access to several API resources on behalf of an end user. What are two valid parameters to send to the authorization server as part of the first step of an authorization code grant flow? (Choose two.)

   • AURI to which the authorization server will send the user-agent back when access is granted or denied
   • Blist of the API resources that the application is requesting to access
   • Csecret that was generated by the authorization server when the application registered as an OAuth integration
   • Dlist of scopes that correspond to the API resources to which the application is requesting to access
   • Ename of the application under which the application registered as an OAuth integration

   Show answer

   Answer: AD

   Explanation

   "A" and "D" Explanation: The authorization code is a temporary code that the client will exchange for an access token. The code itself is obtained from the authorization server where the user gets a chance to see what the information the client is requesting, and approve or deny the request. The following parameters are used to make the authorization request. You should build a query string with the below parameters, appending that to the application’s authorization endpoint obtained from its documentation. • client_id o The client_id is the identifier for your app. You will have received a client_id when first registering your app with the service. • redirect_uri (optional) o The redirect_uri may be optional depending on the API, but is highly recommended. This is the URL to which you want the user to be redirected after the authorization is complete. This must match the redirect URL that you have previously registered with the service. • scope (optional) o Include one or more scope values (space-separated) to request additional levels of access. The values will depend on the particular service.

   Source: Adapted from community discussion — blezzzo

   Next question

2. Question 302 · 385 in bank

   DRAG DROP -

   

   Refer to the exhibit above and click on the tab in the top left corner to view a diagram that describes the typical flow of requests involved when a webhook is created for a booking service. Drag and drop the requests from the left onto the item numbers on the right that match the missing sections in the sequence diagram to design the complete flow of requests involved as a booking is updated from a web application. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The correct answer is: 1. Web Application 2. POST (to build the webhook) 3. 204 4. Webhook Listener 5. for each listener 6. PATCH (to update the webhook information about the booking)

   Source: Adapted from community discussion — designated

   

   Next question

3. Question 303 · 385 in bank

   DRAG DROP -

   

   Refer to the exhibit above and click on the resource tabs in the top left corner to view resources to help with this question. Python code that uses the UCS Python SDK is instantiating a service profile named `devcore-server-01` from service profile template `devcore_template`, then associating the service profile instance to blade 3 in chassis 7. Drag and drop the code snippets from the left onto the item numbers on the right that match the missing sections in the Python exhibit. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. UCSHandle (user interface point for any UCS) 2. login (initiates connection to the server referenced by the UCSHandle) 3. LsServer (Service Profile / Template / Capabilities) 4. SP_FROM_TEMPLATE (template created by LsServer) 5. add_mo (add a managed object to the UCSHandle commit buffer) 6. commit (commits the buffer to the server) 7. logout (disconnect from the server referenced by the UCShandle) https://ciscoucs.github.io/ucsmsdk_docs/

   Source: Adapted from community discussion — designated

   

   Next question

4. Question 304 · 385 in bank

   DRAG DROP -

   

   Refer to the exhibit above and click on the Meraki Resources tab in the top left corner to view Meraki documentation to help with this question. Drag and drop the parts of the Python code from the left onto the item numbers on the right that match the missing sections in the exhibit to enable an SSID. Not all code parts are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The correct answer is: networks -> item1 network_id -> item2 ssids -> item3 Click-through splash page -> item4 psk -> item5 192.168.0.1/32 -> item6 5 GHz band only -> item7 Reference Meraki API Doc: https://developer.cisco.com/meraki/api-v1/#!update-network-wireless-ssid

   Source: Adapted from community discussion — arturogonzalezgzz

   References

   • cisco.com documentation

   

   Next question

5. Question 305 · 385 in bank

   DRAG DROP - Drag and drop the expressions from below onto the code to implement error handling. Not all options are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Duplicated #42 - The body of if is executed only if this evaluates to create the route or if the status is equal to 201 if = status == 201 (HTTP 201 is CREATED) = correct - So, if the route is I52not be created, the body of else is executed else: = correct Note: if-else statement evaluates the Boolean expression. If the condition is TRUE then, the code present in the “ if “ block will be executed otherwise the code of the “else“ block will be executed Wrong if response == 601 = there is no 6xx HTTP code elif is used to include multiple conditional (and it is not this case) when is used to run a block of code whenever, during the execution of the program, a condition is met or related to an event (and it is not this case)

   Source: Adapted from community discussion — designated

   

   Next question

6. Question 306 · 385 in bank

   

   Refer to the exhibit. An application's REST API GET call is tested to the inventory database. Which missing code must be included to limit the number of values that are returned from the query to 20?

   • A?inventory=20
   • Binventory?limit=20
   • Climit=?20
   • Dinventory=limit?20

   Show answer

   Answer: B

   Explanation

   The correct answer is B inventory?limit=20 path = inventory query = ? offset or limit = limit equal = = query number = 20

   Source: Adapted from community discussion — designated

   Next question

7. Question 307 · 385 in bank

   How should a web application be designed to work on a platform where up to 1000 requests per second can be served?

   • AUse algorithms like random early detection to deny excessive requests.
   • BSet a per-user limit (for example, 5 requests/minute/user) and deny the requests from the users who have reached the limit.
   • COnly 1000 user connections are allowed; further connections are denied so that all connected users can be served.
   • DAll requests are saved and processed one by one so that all users can be served eventually.

   Show answer

   Answer: B

   Explanation

   I would have to disagree with everyone saying B. B won't work if there is 2000 users registerd and then have rate-limit on 2req/sec for each user. That would mean a cap on 1000 and the rest of the request wouldn't be serverd. That's why we have RabbitMQ, which is placing the Request in a que which workers handles when there is time. D is the right answer for this.

   Source: Adapted from community discussion — goodguy123

   Next question

8. Question 308 · 385 in bank

   Which security approach should be used for developing a REST API?

   • AAdd an API key to each URL string.
   • BUse custom security relevant HTTP response codes.
   • CUtilize CORS headers.
   • DUtilize TLS for end-to-end encryption.

   Show answer

   Answer: D

   Explanation

   Correct D Source: Cisco DEVCOR 350-901 Study Guide API traffic requires secure treatment as well because it may carry access credentials or sensitive data. Unsecured API calls may result in security breaches that may have serious business consequences, such as losing the right to operate due to lack of compliance, reputation loss due to security breaches, or escalating cloud costs dues to malicious use of resources billable in a pay-as-you-go model. To protect north-south API traffic, the following options are available: -Traditional TLS or Mutual TLS (MTLS) authentication and encryption -TLS or IPSec from the client to an API gateway or NGFW -Cloud-based VPN service -Dedicated cloud connections To protect the east-west API traffic, the following options are available: -TLS or MTLS between services, like for north-south traffic -Service mesh segmentation service -Dedicated container firewall

   Source: Adapted from community discussion — ferock

   Next question

9. Question 309 · 385 in bank

   

   Refer to the exhibit. The application follows a containerized microservices architecture that has one container per microservice. The microservices communicate with each other by using REST APIs. The double-headed arrows in the diagram display chains of synchronous HTTP calls needed for a single user request. Which action ensures the resilience of the application in the scope of a single user request?

   • AImplement retries with exponential backoff during HTTP API calls.
   • BSet up multiple instances of each microservice in active/active mode by using the Orchestrator.
   • CRedesign the application to be separated into these three layers: Presentation, API, and Data.
   • DCreate two virtual machines that each host an instance of the application and set up a cluster.

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Resilience is the ability to provide and maintain an acceptable level of service in the face of unexpected faults and challenges to a normal operation. In summary, resilience tries to live through the failure with error handling and error correction, while high availability’s goal is to detect and work around the failure by replacing a broken component. Key: Retries: Used to repeat the same operation a few times in the hope of working around a temporary network or systems problem. There are a few things to consider with retries: if the problem is resource utilization, retries can add more stress, so it’s a good idea to use exponential backoff or a circuit breaker. Also, sometimes requests may actually go through, so calls should be idempotent (for example, “delete X” rather than “delete the last item”).

   Source: Adapted from community discussion — designated

   Next question

10. Question 310 · 385 in bank

    DRAG DROP - Drag and drop the steps on the left into the order on the right for an end-user to access an OAuth2 protected resource using the 'Authorization Code Grant' flow. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    I think this is correct (assuming you are logging into Spotify but using your Facebook account for authz): 1 End user initiates authentication with OAuth client (spotify) 2 OAuth client communicates with authz server (facebook) to display login UI 3 End user authenticates with the authz server (fb) 4 OAuth client receives an authz code (from fb) 5 OAuth client requests access token from authz server (fb) 6 OAuth client receives access token from authz server (from fb) 7 OAuth client requests a resource on the resource server (plays spotify playlist)

    Source: Adapted from community discussion — python_tamer

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-901 practice, question 301. 385 questions available.