A security audit reveals that a network device's API logs show the Authorization header in plain text. The device supports both Basic authentication and API keys. The audit recommends that credentials not appear in logs. What is the best way to address this?

Use Basic authentication but change the log level to only log successful requests.

Continue using Basic authentication but ensure the logs are encrypted at rest.

Switch to API keys and configure the device to redact the Authorization header in logs.

Use a custom token that is shorter and less sensitive.

A network administrator is using a third-party tool to monitor the Cisco Meraki dashboard. The tool requires an API key to access the dashboard API. The administrator wants to limit the tool's access to read-only operations. Which of the following is the most appropriate way to configure the API key?

Generate a custom token for the tool.

Use HTTP Basic Authentication with the administrator's credentials.

Use the administrator's personal API key.

Create a dedicated API key with read-only permissions and provide it to the tool.

A network automation engineer is writing a script that must interact with an on-premises Cisco DNA Center instance. The security team has mandated that credentials must not be transmitted in plaintext and that the script must not store the password in the source code. The engineer plans to use HTTP Basic Authentication. Which approach satisfies the security team's requirement?

Use HTTPS and read the username and password from environment variables at runtime.

Use HTTP and embed the base64-encoded credentials in the script.

Use HTTPS and hardcode the credentials in the script.

Use HTTP and send the credentials in the URL query string.

A company is developing a public API that will be used by many external developers. The API must support rate limiting per developer and the ability to disable a developer's access quickly. The developers will use simple scripts and do not want to manage complex authentication flows. Which authentication mechanism is the most suitable?

Use HTTP Basic Authentication with a shared account.

Use OAuth 2.0 with client credentials.

Use custom tokens that expire every hour.

Issue each developer a unique API key that is sent in a header.

CiscoCertified Network Associate Automation (CCNA Automation)

Domain 2Objective 7

7. Utilize Common API Authentication Mechanisms: Basic, Custom Token, and API Keys 200-901 Practice Questions (Page 2)

Part of the 2.0 Understanding and Using APIs domain, which accounts for 20% of the 200-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

4concepts

20%of the exam

Questions 6–10

6expert · hard
A security audit reveals that a network device's API logs show the Authorization header in plain text. The device supports both Basic authentication and API keys. The audit recommends that credentials not appear in logs. What is the best way to address this?
Select an answer first
7application · medium
A network administrator is using a third-party tool to monitor the Cisco Meraki dashboard. The tool requires an API key to access the dashboard API. The administrator wants to limit the tool's access to read-only operations. Which of the following is the most appropriate way to configure the API key?
Select an answer first
8application · medium
A network automation engineer is writing a script that must interact with an on-premises Cisco DNA Center instance. The security team has mandated that credentials must not be transmitted in plaintext and that the script must not store the password in the source code. The engineer plans to use HTTP Basic Authentication. Which approach satisfies the security team's requirement?
Select an answer first
9expert · hard
A company is developing a public API that will be used by many external developers. The API must support rate limiting per developer and the ability to disable a developer's access quickly. The developers will use simple scripts and do not want to manage complex authentication flows. Which authentication mechanism is the most suitable?
Select an answer first
10foundation · easy
Which authentication mechanism is most suitable for a third-party application that needs to access a public API on behalf of a user without exposing the user's password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-901” is a trademark of its owner, used for identification only.

7. Utilize Common API Authentication Mechanisms: Basic, Custom Token, and API Keys 200-901 Practice Questions (Page 2)

Questions 6–10

A security audit reveals that a network device's API logs show the Authorization header in plain text. The device supports both Basic authentication and API keys. The audit recommends that credentials not appear in logs. What is the best way to address this?

Which authentication mechanism is most suitable for a third-party application that needs to access a public API on behalf of a user without exposing the user's password?

Keep studying — 2.0 Understanding and Using APIs