200-901 CCNAAUTO Domains Explained

The short version

The exam has six domains. APIs and Infrastructure and Automation are worth 20% each. Software Development and Design, Cisco Platforms and Development, Application Deployment and Security, and Network Fundamentals are worth 15% each. This page follows the v1.1 exam topics published by Cisco, and puts them in plain words.

Domain 1: Software Development and Design (15%)

What it covers. Comparing XML, JSON and YAML; parsing them into Python structures; test-driven development; agile, lean and waterfall; why to split code into functions, classes and modules; the MVC and Observer design patterns; and Git (clone, add, commit, push, pull, branch, merge, conflicts, diff).

In practice. You will read a small JSON or YAML document and say what a Python script gets from it. You will recognize which Git command downloads changes without merging them.

Typical traps.

JSON needs double quotes and has no comments. A snippet with single quotes or trailing commas is invalid.
`git pull` is a fetch plus a merge. `git fetch` alone changes nothing in your branch.
TDD means write a failing test first, then the smallest code to pass it.

Practice. Parse each format in Python. Create a branch, cause a merge conflict on purpose, and resolve it.

Domain 2: Understanding and Using APIs (20%)

What it covers. Building REST requests from documentation, webhooks, API constraints such as rate limits and pagination, HTTP response codes, response parts, authentication (basic, custom token, API key), API styles (REST, RPC, synchronous, asynchronous) and Python scripts using the requests library.

In practice. A script gets an unexpected code and you must say why. A call needs a header, or a body is missing a field.

Typical traps.

401 is about who you are, 403 is about what you may do.
PUT replaces the whole object, PATCH changes part of it.
Basic authentication is only encoded, not encrypted, so it needs HTTPS.
Webhooks are pushed to you; polling is you asking repeatedly.

Practice. Call a public REST API with requests, print the status code, headers and body, and break the request in several ways to see each error.

Domain 3: Cisco Platforms and Development (15%)

What it covers. Using a Cisco SDK from documentation; what Meraki, Catalyst Center, ACI, Catalyst SD-WAN and NSO do; UCS Manager and Intersight; Webex and Unified Communications Manager (including the AXL and UDS interfaces); security platforms such as XDR, Firepower, Secure Connect, Secure Endpoint, ISE and Secure Malware Analytics; device-level APIs on IOS XE and NX-OS; DevNet resources; and YANG, RESTCONF and NETCONF. It also lists tasks such as getting a device list from a controller or managing Webex spaces and messages.

In practice. Given a scenario, you pick the platform or API that fits, or you complete a call against documentation.

Typical traps.

Product names change. Use the names in the current exam topics, not those from old study material.
Controller APIs and device APIs are different tools for different scales.
Authentication flows differ per platform: some use a token endpoint first.

Practice. Use the DevNet Sandbox to list devices on at least two platforms, and send a Webex message from a script.

Domain 4: Application Deployment and Security (15%)

What it covers. Edge computing; private, public, hybrid cloud and edge; virtual machines, bare metal and containers; CI/CD components; Python unit tests; Dockerfiles and Docker images; secret protection, encryption in storage and transit; firewalls, DNS, load balancers and reverse proxies; OWASP threats such as XSS, SQL injection and CSRF; bash basics; and DevOps principles.

In practice. You read a Dockerfile and say what it builds, or you spot where a secret is exposed.

Typical traps.

`EXPOSE` documents a port; it does not publish one.
Variables set in a shell must be exported to reach a child process.
Hard-coded credentials are almost always the wrong answer.

Practice. Write a Dockerfile for a small Python app, run it, and publish a port. Add a unit test and run it in a simple pipeline.

Domain 5: Infrastructure and Automation (20%)

What it covers. Model-driven programmability, controller-level versus device-level management, network simulation and test tools such as Cisco Modeling Labs and pyATS, CI/CD for infrastructure, infrastructure as code, Ansible, Terraform and NSO, and reading scripts, playbooks, NETCONF and RESTCONF output, YANG models, unified diffs and sequence diagrams. Code review is included too.

In practice. You read a short Ansible playbook and say what changes on the servers. You read a unified diff and say which line was replaced.

Typical traps.

In a unified diff, `-` lines are removed and `+` lines are added. Lines starting with a space are unchanged.
YANG `config false` nodes are state, not configuration.
`get-config` returns configuration only; `get` returns state too.
Idempotency: a good playbook can be run twice with the same result.

Practice. Write a playbook with two tasks. Query a device with RESTCONF in a sandbox and read the YANG tree.

Domain 6: Network Fundamentals (15%)

What it covers. MAC addresses and VLANs; IP addresses, routes, masks and gateways; switches, routers, firewalls and load balancers; reading topology diagrams; management, data and control planes; DHCP, DNS, NAT, SNMP and NTP; common port numbers; diagnosing connectivity problems such as a blocked port, a NAT problem, a proxy or a VPN; and the effect of latency or loss on applications.

In practice. A script cannot reach a service, and you work out which layer is at fault.

Typical traps.

SNMP traps and informs are sent by the device; polls come from the manager.
A 169.254.x.x address means DHCP failed.
Know default ports: SSH 22, Telnet 23, HTTP 80, HTTPS 443, NETCONF over SSH 830.

Practice. Do subnetting by hand daily for a week. Draw a small network and trace a packet.

How to use this page

Rank the domains by your own confidence. Spend your time on low confidence first, and on the 20% domains when two are close. Then check yourself with the sample questions.