DevNet Associate common mistakes
DevNet Associate · Understand the traps and how to avoid them.
Reads a short Python snippet and picks an answer from pattern recognition instead of tracking each variable's value line by line, so questions about mutable default arguments, list aliasing, or in-place methods like sort() versus sorted() come out wrong.
The exam shows 5–15 line snippets where the bug is a subtle state change; candidates who 'skim for the shape' of the code reuse a memorized answer from a similar-looking example.
What to do instead
On scratch paper, rewrite the snippet and after every line write the current value of each variable and whether two names point to the same object. Drill 15–20 snippets on list/dict/string methods, default arguments, shallow copies, and try/except flow until you can predict output before running it.
Treats git pull as identical to git fetch, and cannot say what happens to local commits during a merge versus a rebase in a team-workflow scenario.
Most candidates use a handful of git commands by muscle memory and never learned what the remote-tracking branch is, so scenario questions about diverged branches break down.
What to do instead
Draw the commit graph before answering. Internalize: fetch only updates remote-tracking refs; pull = fetch + merge; merge creates a merge commit and preserves history; rebase replays commits onto a new base and rewrites hashes; a fast-forward is possible only when there is no divergence.
Classifies HTTP status codes by memorized labels only, so the candidate cannot decide whether a client should retry, fix the request, or re-authenticate.
Status codes are usually studied as a list of names rather than as decision rules, and the exam asks what the client code should do next.
What to do instead
Build a table with the action attached: 200/201/204 success paths; 301/304 caching and redirects; 400 malformed request; 401 missing or bad credentials; 403 authenticated but not permitted; 404 wrong resource; 409 conflict; 429 rate limited, retry with Retry-After and backoff; 500/502/503/504 server-side, retry with backoff. Learn that 4xx means do not retry unchanged.
Confuses authentication with authorization and picks an API key for a scenario that requires acting on behalf of a specific user with limited permissions.
Both concepts are described with the word 'access', and candidates map 'has a key' to 'is allowed to do this'.
What to do instead
Write one-sentence definitions and keep them in front of you: authentication proves identity, authorization decides permissions. Then map the mechanisms: basic auth (credentials per request), API key (identifies the calling app, not a user), bearer token, and OAuth 2.0 (delegated access with scopes, 'on behalf of a user'). Any scenario mentioning user consent or limited scope points to OAuth.
Cannot match a Cisco platform to its API family or endpoint style, for example choosing DNA Center for a Meraki wireless task or NSO for an ACI fabric change.
Cisco product names and their APIs blur together, and candidates learn them as a vocabulary list instead of by the job each platform does.
What to do instead
Build a matrix with one row per platform: Meraki Dashboard API (REST, organization/network scoped), DNA Center (intent REST under /dna/intent/api/v1), ACI/APIC (REST with class-based MIT queries), Intersight (REST), Webex (REST), NSO (JSON-RPC, NETCONF), SD-WAN vManage (REST), Finesse and UCCX (REST), IOS XE (NETCONF, RESTCONF, SNMP, CLI). Add one sentence per row on what the platform manages, not just what protocol it speaks.
Says base64 protects a credential, or uses the words hashing and encryption interchangeably when asked how to store passwords or verify message integrity.
All three operations produce unreadable-looking output, so candidates group them as 'security'.
What to do instead
Separate them by reversibility and key: encoding (base64) is reversible with no key and provides no security; hashing is one-way (SHA-256 for integrity, bcrypt or similar with a salt for passwords); encryption is reversible with a key (TLS in transit, AES at rest). Then answer storage questions with secret managers and environment variables, and never committing credentials to git.
Describes containers as lightweight virtual machines and cannot explain individual Dockerfile lines, such as the difference between CMD and ENTRYPOINT or what EXPOSE and VOLUME actually do.
Containers get learned from diagrams rather than from reading a file, so instruction-level questions collapse into vague statements about isolation.
What to do instead
Learn the four nouns: image, container, registry, volume. Read a six-line Dockerfile and say aloud what each instruction produces. Key facts: CMD gives a default command that can be overridden, ENTRYPOINT sets the fixed executable, EXPOSE documents a port and does not publish it, VOLUME declares persistent storage, and each RUN/COPY adds a layer. Containers share the host kernel; VMs run their own.
Merges YANG, NETCONF, and RESTCONF into one concept, so the candidate cannot say which is the data model, which is the transport, and which encoding each uses.
Three layers get studied at once and are remembered as a single acronym cluster.
What to do instead
Keep three separate columns. Data model: YANG. Protocol/transport: NETCONF over SSH, RESTCONF over HTTPS. Encoding: NETCONF uses XML, RESTCONF uses JSON or XML. Then map RESTCONF verbs to NETCONF operations (GET to , POST to create, PUT/PATCH to merge or replace, DELETE to ) and note that both are model-driven, unlike screen-scraping CLI.
Answers infrastructure-as-code and pipeline questions as if Ansible and Terraform were interchangeable imperative scripts, and cannot place unit versus integration tests in a CI/CD flow.
Both tools are filed under 'automation' without distinguishing state, idempotency, or where they run in a pipeline.
What to do instead
Learn the contrast: Terraform is declarative with a state file and plan/apply preview; Ansible is procedural task lists using idempotent modules against an inventory. For pipelines, know the stage order (build, test, deploy), that unit tests are fast and isolated while integration tests exercise real dependencies, and that a failing stage must stop the pipeline.
Skips subnet and forwarding reasoning, so the candidate cannot tell whether two addresses are on the same subnet, what the default gateway is for, or which OSI layer a device operates at.
Network fundamentals feel unrelated to writing code, so candidates under-prepare and then guess on the questions that require a quick calculation.
What to do instead
Practice /24 to /30 subnet math until mask, network, broadcast, and host range are quick. Then connect layers: MAC and ARP at layer 2, IP and routing at layer 3, TCP/UDP ports at layer 4, DNS for name resolution, VLANs for segmenting one switch. For each scenario, ask which address the host compares and whether the destination is local or off-subnet.