3.10 Cisco DNAC Northbound APIs Use Cases CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An organization has a policy that only the 'Network Admin' role can trigger network discoveries. However, a junior engineer needs to be able to view the results of discoveries without triggering new ones. The junior engineer has been assigned the 'Network Viewer' role, which includes read access to device inventory. When the junior engineer tries to view discovery results, they get a 403 error. What is the most likely reason?

   • AThe junior engineer is using the wrong API endpoint; they should use the topology API.
   • BThe junior engineer is trying to trigger a discovery, which is not allowed by the policy.
   • CThe token has expired, causing a 403 error instead of 401.
   • DThe 'Network Viewer' role does not include permission to view discovery results; it only has device inventory read access.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations team wants to use DNAC Northbound APIs to retrieve device health information. The team's service account has been assigned the 'Network Administrator' role, which allows full read/write access to network devices. However, the team only needs to read health data and wants to minimize the risk of accidental changes. What should the team do?

   • ACreate a new service account with a custom role that only has read permissions for device health, and use that account's token for the API calls.
   • BUse the existing 'Network Administrator' account to call the health API endpoints, as it has the necessary read permissions.
   • CUse the 'Network Administrator' account to obtain a token, then modify the token's claims to remove write permissions.
   • DRequest a one-time token from DNAC that grants read-only access to health data for a limited time.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A network team is using DNAC APIs to automate the onboarding of new branch offices. The script triggers a discovery, waits for it to complete, then retrieves the device inventory and host inventory. The script works for most branches, but for one branch, the host inventory is empty even though the device inventory shows the switches. What is the most likely reason?

   • AThe discovery for that branch was triggered with a different IP range, so hosts were not discovered.
   • BThe host inventory API is not supported for that branch's device model.
   • CThe script is querying the host inventory before the discovery is fully complete.
   • DThe switches in that branch are not configured with the necessary SNMP credentials for DNAC to collect host information.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An enterprise has just deployed Cisco DNA Center and wants to automatically discover all network devices in a new branch office. The automation team plans to use the Northbound API to trigger discovery. They need to ensure that the discovery process is initiated and that they can later retrieve the list of discovered devices. What should they do?

   • ACall the discovery API to start a new discovery, then poll the discovery status API until it completes, and finally call the device inventory API to get the discovered devices.
   • BUse the topology API to trigger discovery and then use the same API to get the device list.
   • CCall the discovery API once and assume it completes synchronously; the response will include the full device list.
   • DCall the device inventory API directly; it automatically triggers discovery if no devices are found.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network admin needs to write a script that fetches the configuration of a specific switch from DNAC and then pushes a new configuration to it. The admin has a service account with the 'Network Admin' role. The script must authenticate and then perform both operations. Which sequence of API calls should the script make?

   • AObtain a token, then directly use the configuration API to push the new configuration without fetching the device ID.
   • BUse the device API to get the device ID, then obtain a token, and then push the configuration.
   • CObtain a token, use the topology API to find the device, then use the same topology API to push the configuration.
   • DObtain a token, use the device API to get the device ID, then use the configuration API to retrieve and update the configuration.
   Reveal Solution Discussion Select an answer first