7. Utilize Common API Authentication Mechanisms: Basic, Custom Token, and API Keys 200-901 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When making an API request with a custom token, where is the token typically included?

   • AIn the HTTP method name.
   • BIn a custom HTTP header, such as Authorization or X-Auth-Token.
   • CIn the request body as a JSON field.
   • DIn the URL as a query parameter.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An engineer is comparing authentication methods for a new automation script that will run nightly. The script needs to authenticate to a network controller. The controller supports Basic authentication, API keys, and custom tokens. The engineer wants the script to run unattended without storing a password in plain text and wants to be able to revoke access without changing the service account password. Which method should the engineer choose?

   • AHTTP Basic authentication with the service account password stored in the script
   • BAPI key stored in a secrets vault
   • CCustom token that is hard-coded in the script
   • DHTTP Basic authentication with the password stored in an environment variable
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization is building a public-facing API that will be consumed by external partners. The API must support per-partner access control, the ability to revoke a partner's access without affecting others, and must not expose long-lived secrets to the partner's end users. Which authentication mechanism best meets these requirements?

   • AIssue a single custom token that all partners share.
   • BUse HTTP Basic Authentication with a shared service account for all partners.
   • CIssue each partner a unique API key that is sent in a header and can be revoked individually.
   • DRequire each partner to use the organization's internal SSO credentials.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization is migrating from a legacy system that uses HTTP Basic authentication to a new API that supports API keys. The migration must be completed without downtime, and the team wants to avoid storing passwords in scripts. The legacy system and new API will run in parallel for a month. What is the best approach to manage authentication during the migration?

   • AUpdate all scripts to use API keys immediately and disable Basic authentication on the legacy system.
   • BKeep using Basic authentication for all scripts and do not migrate to API keys.
   • CUse a custom token that works for both systems.
   • DMaintain both authentication methods during the transition, migrate scripts to API keys, and then disable Basic authentication after the migration is complete.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How is an API key typically included in an API request?

   • AIn the request body as a JSON field.
   • BAs a cookie.
   • CIn a custom HTTP header, such as X-API-Key.
   • DAs a query parameter in the URL.
   Reveal Solution Discussion Select an answer first