7. Utilize Common API Authentication Mechanisms: Basic, Custom Token, and API Keys 200-901 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A developer is writing a script to interact with a REST API that uses custom token authentication. The token endpoint requires the client to send a client ID and client secret in the request body. The developer wants to keep the client secret secure. What is the best practice for handling the client secret?

   • AStore the client secret in an environment variable or a secrets manager and read it at runtime.
   • BInclude the client secret in the URL as a query parameter.
   • CUse Basic authentication to send the client secret instead of putting it in the body.
   • DHard-code the client secret in the script because it is needed for every token request.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a custom token authentication scheme, how does a client typically obtain a token?

   • AThe client includes its credentials in every request and the server converts them to a token.
   • BThe client requests a token from a DNS server.
   • CThe client sends its credentials to an authentication endpoint and receives a token in response.
   • DThe client generates the token locally using a random number generator.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer is integrating a third-party SaaS API that issues a custom token after a one-time login with a client ID and client secret. The API documentation states that the token expires after 30 minutes. The developer's application runs a batch job every hour. What is the most appropriate way to handle authentication for each batch run?

   • ARequest a new token at the start of each batch job and include it in the Authorization header.
   • BRequest a token once and reuse it indefinitely.
   • CSend the client ID and client secret in every API request instead of using a token.
   • DUse an API key that is generated once and never expires.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A network team is building an automation platform that will be used by both internal engineers and external partners. Internal engineers use Active Directory credentials and need to be able to log in to a web portal. External partners' applications need to access the API without user interaction. The security team requires that internal credentials are never sent to the API and that partner access can be revoked per partner. Which authentication strategy should the team implement?

   • AUse API keys for internal engineers and Basic authentication for external partners.
   • BUse HTTP Basic authentication for both internal engineers and external partners.
   • CUse a custom token for internal engineers and API keys for external partners.
   • DUse the same API key for all external partners to simplify management.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network operations team wants to allow a third-party monitoring tool to read interface statistics from their Cisco Meraki dashboard API. The tool only needs read-only access and will be used by a small, trusted group. Which authentication mechanism is the most appropriate choice?

   • AGenerate an API key with read-only permissions and include it in the request header.
   • BImplement a custom token that expires every 5 minutes.
   • CUse HTTP Basic Authentication with the dashboard administrator's username and password.
   • DEmbed the API key in the URL of each request.
   Reveal Solution Discussion Select an answer first