200-901 CCNAAUTO Cheat Sheet: Key Facts

The short version

This sheet is for the last days before 200-901 CCNAAUTO. It lists the exam facts, then the ideas that questions keep returning to in each of the six domains, the term pairs people mix up, and rules of thumb for reading scenarios. It is a review aid in our own words. It does not cover everything on the exam, so check Cisco’s exam topics for the full list.

Exam facts at a glance

Item	Detail
Exam	200-901 CCNAAUTO, Automating Networks Using Cisco Platforms, topics v1.1
Time	120 minutes
Questions and passing score	Not published by Cisco
Retake after a fail	Five calendar days
Validity	Three years

Domain weightings: Software Development and Design 15%, APIs 20%, Cisco Platforms 15%, Application Deployment and Security 15%, Infrastructure and Automation 20%, Network Fundamentals 15%.

Domain 1: Software development and design

Key concepts

Data formats: JSON uses braces and quoted keys, XML uses tags, YAML uses indentation and no braces.
Git flow: clone, branch, add, commit, push, merge. `fetch` downloads changes without merging, `pull` fetches and merges.
Testing: a unit test checks one small piece, an integration test checks parts working together.
Design ideas: MVC, observer, version control, and why short functions are easier to test.

Confusing pairs

`git fetch` is for looking, `git pull` is for taking in.
A list keeps order and allows duplicates. A dictionary maps keys to values. A set keeps unique items.
Waterfall plans everything first, agile works in short cycles.

Decision rules

If the scenario says “check what changed before merging”, think fetch and diff.
If it asks for key-value data in a script, think dictionary.

Domain 2: Understanding and using APIs

Key concepts

REST verbs: GET reads, POST creates, PUT replaces, PATCH changes part, DELETE removes.
Status codes: 2xx success, 3xx redirect, 4xx client error, 5xx server error.
Authentication: basic, token (bearer), API key, OAuth. Rate limits and pagination appear in many scenarios.
Webhooks push events to your URL. Polling asks repeatedly.

Confusing pairs

401 means “who are you?” (not authenticated). 403 means “I know you, but no” (not allowed).
PUT replaces the whole resource. PATCH changes only the fields you send.
200 returns content, 201 says created, 204 says success with no body.
Synchronous waits for the answer. Asynchronous returns at once and you check later.

Decision rules

If a request returns 415, think wrong content type header. If 404, think wrong path or ID.
If the receiver must prove who sent a webhook, think shared secret or signature.

Domain 3: Cisco platforms and development

Key concepts

Know the job of each platform: Meraki (cloud-managed networks), Catalyst Center (controller for enterprise campus), ACI (data center fabric), Catalyst SD-WAN, NSO (multivendor service orchestration), Webex (messaging and meetings APIs).
Most platform APIs follow the same pattern: get a token, send it in a header, read the JSON.

Confusing pairs

Controller-level management configures many devices through one system. Device-level management goes box by box.
Intent-based APIs describe the desired outcome. CLI scripts describe steps.

Decision rules

If the scenario talks about one dashboard in the cloud for branches, think Meraki.
If it talks about a data center policy model, think ACI.

Domain 4: Application deployment and security

Key concepts

Docker: an image is a template, a container is a running instance. `EXPOSE` documents a port, publishing it happens at run time.
CI/CD: continuous integration builds and tests on each commit, continuous delivery or deployment pushes to an environment.
Environments: development, test, staging, production.
Security: never store secrets in a repository, validate input, use encryption in transit, apply the least privilege rule.
Attacks: XSS injects script into pages, SQL injection injects queries, CSRF tricks a logged-in user.

Confusing pairs

A VM includes a guest operating system, a container shares the host kernel.
Public, private, hybrid and multicloud are different ideas. Hybrid mixes private and public, multicloud uses several public providers.
Encoding is not encryption.

Decision rules

If a pipeline must stop early on a problem, think fail fast.
If a secret appears in code, the answer moves it to a vault or environment variable.

Domain 5: Infrastructure and automation

Key concepts

Ansible is agentless, uses YAML playbooks and an inventory, and aims for idempotent tasks (running twice gives the same result).
NETCONF uses XML over SSH, RESTCONF uses HTTP with JSON or XML, and YANG models describe the data.
Terraform-style tools describe desired state. Scripts describe steps.
Reading a unified diff: lines starting with `-` were removed and `+` were added.
Bash basics: `$?` holds the last exit status, 0 means success.

Confusing pairs

`get` returns running state and configuration, `get-config` returns configuration only.
Declarative says what the end state is. Imperative says how to get there.
Push models send changes from a server. Pull models have the device fetch them.

Decision rules

If a batch of changes must be all or nothing, think transactions and validation before commit.
If the question stresses safe re-runs, think idempotence.

Domain 6: Network fundamentals

Key concepts

Layers: switching works at layer 2, routing at layer 3. A VLAN splits a layer 2 network.
Addressing: a /24 has 256 addresses, 254 usable hosts. A default gateway leads off the subnet.
Services: DHCP hands out addresses, DNS resolves names, NAT translates addresses.
Ports: SSH 22, HTTP 80, HTTPS 443, NETCONF over SSH 830.
Monitoring: SNMP traps are sent without confirmation, informs are acknowledged.
Load balancers spread traffic, firewalls filter it.

Confusing pairs

TCP is reliable and ordered, UDP is fast but makes no delivery promise.
A switch forwards by MAC address, a router by IP address.

Common traps

Picking the answer that is true in general but does not fit the scenario’s one key detail.
Skipping the “select two” instruction.
Mixing up the order of a JSON path, for example missing a level such as `response`.
Reading `PUT` and `PATCH` as the same thing.
Spending five minutes on one code sample.

Last-day checklist

[ ] Rehearse the status code groups and the ones above.
[ ] Re-read your own notes on the confusing pairs, not new material.
[ ] Run one short timed set and review only the misses.
[ ] Check your booking, ID and the current delivery rules. See the exam day guide.
[ ] Sleep. A tired mind misreads code.

More guides for CCNAAUTO-200-901

Next step

Use the domains explained page for depth on any weak area, and the sample questions for a quick check. When you want timed practice, the 200-901 practice exams report results per domain. The exam overview links everything together.

Try these practice exams