Cisco 350-901 DEVCOR/AUTOCOR cheat sheet

Twelve-Factor App: codebase, dependencies, config, backing services, build/release/run, processes, port binding, concurrency, disposability, dev/prod parity, logs, admin processes - config lives in environment variables, never hard-coded.

Git data model: a commit is an immutable snapshot referencing a tree and parent commit(s); branches are movable pointers, so rebasing rewrites hashes while merging creates a new commit with two parents.

Semantic Versioning MAJOR.MINOR.PATCH: MAJOR breaks backward compatibility, MINOR adds backward-compatible features, PATCH is backward-compatible fixes; 0.y.z API is unstable.

Design patterns: Factory centralizes object creation, Singleton enforces one instance, Observer decouples event producers from subscribers, Strategy swaps interchangeable algorithms behind one interface.

Test pyramid: many fast unit tests, fewer integration tests, fewest end-to-end/UI tests; contract tests protect consumer-provider API compatibility.

Idempotency is required for safe retries: GET, PUT, and DELETE are idempotent, POST is not, and PATCH may or may not be - retried POSTs need idempotency keys.

Code review and CI gates: lint, static analysis, unit tests, and secret scanning run before merge; trunk-based development keeps branches short-lived to reduce merge conflicts.

Microservices trade-offs: independent deployability and scaling versus distributed-system complexity (network latency, partial failure, eventual consistency, data duplication).

HTTP status families: 2xx success (200 OK, 201 Created, 202 Accepted, 204 No Content), 3xx redirect, 4xx client error (400, 401 unauthenticated, 403 forbidden, 404, 409 conflict, 422, 429 rate limited), 5xx server error.

REST constraints: client-server, statelessness, cacheability, uniform interface, layered system, optional code-on-demand; statelessness means each request carries all needed context.

Pagination and filtering: use limit/offset or cursor tokens, return total counts and next links; cursor pagination stays stable under concurrent inserts where offset pagination does not.

OAuth 2.0 flows: authorization code with PKCE for user-facing apps, client credentials for machine-to-machine; access tokens go in the Authorization header as Bearer, never in URLs.

Rate limiting responses use 429 plus Retry-After; clients must implement exponential backoff with jitter and honor idempotency keys when retrying writes.

Webhooks: verify signatures (for example HMAC over the raw body), respond 2xx quickly, and process asynchronously; treat deliveries as at-least-once so handlers must be idempotent.

Caching headers: Cache-Control max-age, ETag with If-None-Match producing 304, Last-Modified with If-Modified-Since; conditional requests save bandwidth.

API versioning strategies: URI path (/v1), custom media type, or query parameter; breaking changes require a new version with a deprecation timeline and sunset headers.

Cisco DNA Center (Catalyst Center) Intent API: base path /dna/intent/api/v1, authenticated by X-Auth-Token obtained from POST /dna/system/api/v1/auth/token using HTTP Basic credentials; tokens expire and must be refreshed.

DNA Center key resources: sites and topology, network devices (/network-device), clients (/client-health), templates (Template Programmer), compliance, and Command Runner for show commands.

Cisco Meraki dashboard API: base https://api.meraki.com/api/v1, header X-Cisco-Meraki-API-Key, organization-scoped paths, and Link headers for pagination; rate limit returns 429.

Cisco Intersight: REST API with signed requests (HMAC with key ID and secret) or OAuth bearer tokens; manages UCS and Intersight-managed infrastructure via /api/v1 resource endpoints.

Cisco Webex APIs: https://webexapis.com/v1, Bearer OAuth token, resources for people, rooms, memberships, messages, and webhooks that POST event payloads to a registered target URL.

Cisco ACI: APIC REST API over HTTPS returning JSON or XML; object model uses classes such as fvTenant and fvBD, queried with query-target-filter; authentication via a login token cookie.

NETCONF/YANG: NETCONF runs over SSH using XML RPC operations (get-config, edit-config, commit); YANG models define the data tree, and RESTCONF maps it to HTTP with JSON encoding.

Cisco SD-WAN (vManage) API: /dataservice paths with X-XSRF-TOKEN header after a j_security_check login; resources cover devices, templates, policies, and alarms.

Cisco NX-OS/NX-API and IOS XE guestshell allow on-box automation; streaming telemetry (model-driven) pushes operational data instead of polling SNMP.

Containers versus VMs: containers share the host kernel and isolate via namespaces and cgroups, so images are small and start fast but are less isolated than hypervisor-based VMs.

Kubernetes objects: Pod (smallest deployable unit), Deployment (replica management and rolling updates), Service (stable virtual IP/load balancing), ConfigMap/Secret (configuration), Ingress (HTTP routing).

CI/CD pipeline stages: source commit, build artifact, automated tests, security scanning, artifact registry push, staged deployment, and rollback strategy (blue-green or canary).

OAuth 2.0 versus OpenID Connect: OAuth 2.0 delegates authorization via access tokens; OIDC adds an ID token (JWT) for authentication and a UserInfo endpoint.

JWT structure is header.payload.signature, Base64URL-encoded; the signature must be verified and claims exp, iss, and aud validated - the payload is readable, not encrypted.

OWASP API risks include broken object-level authorization (BOLA), broken authentication, excessive data exposure, and unrestricted resource consumption; enforce authorization per object, not per endpoint.

Secret management: never commit secrets to Git; use vaults or environment injection, rotate credentials, and prefer short-lived tokens or workload identity over static keys.

Infrastructure as code security: scan IaC templates for misconfiguration, pin image tags and dependency versions, and sign artifacts (for example with cosign/Sigstore) to enforce supply-chain integrity.

Ansible: agentless over SSH, YAML playbooks, idempotent modules, inventory defines hosts; idempotency means repeated runs converge to the same state without duplicate changes.

Terraform: declarative HCL, providers per platform, state file tracks managed resources; plan shows the diff, apply executes it, and state locking prevents concurrent modification.

Terraform workflow rules: remote state with locking (for example S3 plus DynamoDB), never edit state manually, use modules for reuse, and taint/replace resources that cannot be updated in place.

Puppet and Chef are agent-based configuration management using declarative manifests/recipes and a catalog or run-list; both converge nodes to a desired state on a schedule.

Python automation: requests for HTTP APIs, json for parsing, netmiko/napalm/paramiko for device CLI or multi-vendor abstraction, and ncclient for NETCONF sessions.

Model-driven programmability: YANG models with RESTCONF/NETCONF replace screen-scraping CLI; gNMI/gRPC streaming telemetry provides high-frequency structured data.

CI/CD for infrastructure: pipeline runs lint, plan, policy checks (OPA/Sentinel), approval gate, then apply; drift detection compares live state against declared state.

GitOps: Git is the single source of truth, an agent (for example Argo CD or Flux) reconciles cluster state to the repository, and rollback is a revert commit.