Home / networking / CCNA Automation (200-901 CCNAAUTO, formerly DevNet Associate) / Cheat Sheet
CCNA Automation (200-901 CCNAAUTO, formerly DevNet Associate)

CCNA Automation Cheat Sheet

CCNA Automation Tests Reading Code, Payloads and API Responses — Not CLI Configuration

200-901 was renamed from DevNet Associate (DEVASC) to CCNA Automation on 3 February 2026 with the same exam number. It suits network engineers learning to code: read every snippet line by line instead of guessing from names.

Check Your Readiness →
Among the harder certs
Avg: Not published by Cisco
Pass: 750 / 1000
Most candidates understand CCNA Automation (200-901 CCNAAUTO, formerly DevNet Associate) concepts — and still fail. This exam tests how you apply knowledge under pressure.

200-901 CCNAAUTO v1.1 Domain Map

Expect artefacts on screen: curl calls, Python requests code, playbooks, YANG trees, diffs and raw HTTP responses, often in fill-in-the-blank or drag-and-drop form. Cisco publishes 120 minutes but no question count. One bracket, header or state value usually decides the answer.

  1. 01
    Understanding and Using APIs (20%) — REST methods, status codes, headers, auth types, webhooks, pagination, Python requests
  2. 02
    Infrastructure and Automation (20%) — controller vs. device, Ansible, Terraform, NSO, pyATS, CML, YANG trees, diffs, sequence diagrams
  3. 03
    Software Development and Design (15%) — JSON/XML/YAML parsing, TDD, agile vs. waterfall vs. lean, MVC vs. Observer, Git
  4. 04
    Cisco Platforms and Development (15%) — Meraki, Catalyst Center, ACI, SD-WAN, Webex, CUCM AXL/UDS, NETCONF vs. RESTCONF
  5. 05
    Application Deployment and Security (15%) — VMs vs. containers, Dockerfiles, CI/CD, unittest, OWASP threats, secrets, Bash
  6. 06
    Network Fundamentals (15%) — VLANs, gateways, planes, DHCP/DNS/NAT/SNMP/NTP, port numbers, connectivity diagnosis

Wrong instinct vs correct approach

A webhook receiver at 192.168.1.50 behind home NAT never gets events from a cloud service
✕ Wrong instinct

The webhook payload format or URL path is wrong

✓ Correct approach

The service pushes HTTP POSTs from the internet, and a private address behind NAT has no inbound mapping. Expose a public URL through port forwarding or a tunnel; webhooks are never polled by the client.

A script must list one site's clients via a Meraki-style API but only knows the organisation name
✕ Wrong instinct

Call the clients endpoint directly with the site name

✓ Correct approach

Follow the hierarchy: GET organisations to find the org ID, GET that org's networks to find the network ID, then GET /networks/{networkId}/clients?timespan=86400 with the API key header.

A controller API returns 202 with a taskId after a configuration request
✕ Wrong instinct

The change is complete, so read the result immediately

✓ Correct approach

202 Accepted means asynchronous processing. Poll the task resource using the taskId until it reports success or failure. On Catalyst Center, keep sending the X-Auth-Token obtained from the auth token endpoint.

An API call works in the browser on the corporate network but the Python script times out
✕ Wrong instinct

The API server is down or rate limiting

✓ Correct approach

The browser uses the corporate proxy and the script does not, so direct traffic is blocked. Configure the proxy for the script. Timeouts suggest a blocked port or route; refused connections mean nothing is listening.

Know these cold

  • ▸ PUT replaces and is idempotent; PATCH updates part; POST creates and is not idempotent
  • ▸ 201 created, 202 accepted for later, 204 success with no body to parse
  • ▸ json.loads parses a string; json.load reads an open file object
  • ▸ xmltodict turns XML attributes into keys prefixed with @
  • ▸ TDD order is red, green, refactor; the failing test comes first
  • ▸ git commit records only staged changes locally; nothing reaches the remote until push
  • ▸ Unified diff — inus lines removed, plus lines added; hunk header @@ -old +new @@
  • ▸ YANG tree rw nodes are configurable; ro nodes are operational state only
  • ▸ Terraform is declarative with state and plan; Ansible is agentless and keeps no state file
  • ▸ Ports — SH 22, Telnet 23, HTTPS 443, NETCONF 830, SNMP UDP 161 and traps 162

Can you answer these without checking your notes?

In this scenario: "A webhook receiver at 192.168.1.50 behind home NAT never gets events from a cloud service" — what should you do first?
The service pushes HTTP POSTs from the internet, and a private address behind NAT has no inbound mapping. Expose a public URL through port forwarding or a tunnel; webhooks are never polled by the client.
In this scenario: "A script must list one site's clients via a Meraki-style API but only knows the organisation name" — what should you do first?
Follow the hierarchy: GET organisations to find the org ID, GET that org's networks to find the network ID, then GET /networks/{networkId}/clients?timespan=86400 with the API key header.
In this scenario: "A controller API returns 202 with a taskId after a configuration request" — what should you do first?
202 Accepted means asynchronous processing. Poll the task resource using the taskId until it reports success or failure. On Catalyst Center, keep sending the X-Auth-Token obtained from the auth token endpoint.

Common Exam Mistakes — What candidates get wrong

Applying a credentials fix to a 403, or a permissions fix to a 401

401 means the caller is not authenticated; check the token or key. 403 means it is authenticated but not allowed, so a new key for the same account changes nothing. 429 means back off and honour Retry-After.

Sending a Python dict with data= and getting 415 Unsupported Media Type

requests' json= argument serialises the dict and sets Content-Type: application/json; data= does neither for JSON. Content-Type describes what you send, Accept what you want back. Never combine json.dumps with json=.

Mixing up NETCONF and RESTCONF transport, port and encoding

NETCONF runs XML RPCs over SSH on TCP 830 with candidate datastores and commit. RESTCONF uses HTTPS on 443 with application/yang-data+json or +xml. A JSON-over-HTTPS requirement always points to RESTCONF.

Assuming state: started restarts a service on every Ansible run

Modules are idempotent: started only starts a stopped service, and a handler fires only when a notifying task reports changed. On an unchanged second run, nothing is installed, templated or restarted.

Believing EXPOSE in a Dockerfile makes the port reachable from the host

EXPOSE only documents the port. Publish it with docker run -p 8080:8080, host port first. RUN executes at image build time; CMD or ENTRYPOINT defines what starts with the container, and only the last CMD counts.

Resources to help you pass CCNA Automation (200-901) on your first attempt

CCNA Automation rewards reading code and API responses precisely. Check how accurately you read.