3.10 Cisco DNAC Northbound APIs Use Cases CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network automation engineer at a large enterprise needs to write a script that periodically pulls the latest device inventory from Cisco DNA Center. The script runs under a service account that has been granted only the 'Inventory Viewer' role. The engineer wants to ensure the script authenticates securely and only performs actions the account is permitted to do. Which approach should the engineer use?

   • AUse the service account's username and password directly in every inventory API request without obtaining a token.
   • BUse the service account's credentials to obtain a token, then use that token to request a higher-privilege token from the /dna/intent/api/v1/token endpoint.
   • CUse the service account's username and password to call the /dna/system/api/v1/auth/token endpoint, obtain a token, and then use that token for inventory GET requests.
   • DGenerate a permanent API key from the DNAC UI and use it in the Authorization header for all inventory requests.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization has a compliance requirement that only certain users can modify device configurations via DNAC APIs. They want to ensure that a service account used by a monitoring tool cannot make any changes. What should the organization do?

   • AHave the monitoring tool use the 'Super Admin' role but with a short token timeout.
   • BDo not give the monitoring tool a token; instead, use a shared admin token.
   • CAssign the monitoring service account a custom role that only has read permissions for device configuration.
   • DUse the same 'Network Admin' account for monitoring but restrict the IP address of the API calls.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network engineer is writing a script to automate the initial setup of a new site. The script needs to discover all devices in the site's IP range and then retrieve the topology of the discovered network. The engineer has a service account with the 'Discovery Admin' role. What is the correct sequence of API calls?

   • ACall the discovery API without a token, then use the topology API.
   • BUse the device inventory API to trigger discovery and then get topology.
   • CObtain a token, trigger discovery, poll for completion, then call the topology API to get the network topology.
   • DObtain a token, call the topology API first, then trigger discovery.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network operations team wants to use DNAC APIs to get a list of all devices that are currently unhealthy. They have a service account with the 'Health Viewer' role. What should they do?

   • AObtain a token, then call the health API to get health scores for all devices and filter for unhealthy ones.
   • BObtain a token, then call the host inventory API to get device health.
   • CObtain a token, then call the topology API to see which devices are red.
   • DObtain a token, then call the device inventory API and look for a health field.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise has multiple DNAC clusters, each managed by different teams. A central automation platform needs to pull inventory from all clusters. The platform uses a single service account that has been replicated across all clusters with the same role. However, the platform is getting 401 Unauthorized errors on some clusters. What is the most likely cause?

   • AThe service account's password is different on some clusters, causing token generation to fail.
   • BThe service account is locked out on some clusters due to too many failed login attempts.
   • CThe token endpoint is rate-limited on some clusters, causing intermittent failures.
   • DThe service account's role does not exist on some clusters, so the token is generated but has no permissions.
   Reveal Solution Discussion Select an answer first