3.10 Cisco DNAC Northbound APIs Use Cases CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is integrating DNAC with a SIEM. The SIEM needs to read device configuration and host information, but it must not be able to modify anything. The team has created a custom role 'SIEM-ReadOnly' that includes read permissions for device configuration and host inventory. However, when the SIEM tries to call the configuration API, it receives a 403 Forbidden error. What is the most likely cause?

   • AThe custom role does not include the necessary API endpoint permissions for configuration retrieval.
   • BThe SIEM is using the wrong token; it should use the 'Network Admin' token.
   • CThe configuration API requires a higher privilege level than the role provides.
   • DThe token has expired; the SIEM needs to re-authenticate.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An automation script triggers a network discovery in DNAC and then immediately tries to retrieve the device inventory. The script is getting an empty list even though the discovery status shows 'success'. What is the most likely reason?

   • AThe discovery was configured with the wrong IP range, so no devices were found.
   • BThe script is using the wrong API endpoint for inventory; it should use the topology API.
   • CThe service account does not have permission to view inventory, so the API returns an empty list.
   • DThe script is not waiting for the discovery to fully complete before querying inventory; the status may show success but the inventory is still being populated.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A network admin is using a DNAC Northbound API to push a configuration change to a device. The API call returns a 202 Accepted, but the configuration does not appear to take effect. The admin checks the device and sees the old configuration. What is the most likely issue?

   • AThe token expired before the configuration was applied.
   • BThe service account does not have permission to modify configuration, so the API silently ignored the request.
   • CThe configuration change was queued but failed to deploy due to a device connectivity issue or validation error.
   • DThe admin used the wrong API endpoint; they should use the device inventory API to push configuration.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is using DNAC APIs to track hosts that have been seen on the network. The analyst notices that some hosts are missing from the host inventory even though they are actively connected. What is the most likely reason?

   • AThe hosts are using IPv6 addresses, which are not supported by DNAC.
   • BThe analyst's service account does not have permission to see all hosts, so some are hidden.
   • CThe hosts are connected to devices that are not managed by DNAC or are in a segment that has not been discovered.
   • DThe analyst is using the wrong API; they should use the device inventory API to see hosts.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A developer is writing a script that uses DNAC Northbound APIs to fetch device configurations. The script runs every hour and uses a token obtained with a service account. The script sometimes fails with a 401 error, but after re-running it works. What is the most likely cause?

   • AThe script is using the wrong API endpoint for authentication.
   • BThe token has expired between runs, and the script is not refreshing it before making API calls.
   • CThe DNAC server is temporarily unavailable, causing authentication to fail.
   • DThe service account's password is changed periodically, and the script is not updated.
   Reveal Solution Discussion Select an answer first