7. Utilize Common API Authentication Mechanisms: Basic, Custom Token, and API Keys 200-901 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A network engineer is troubleshooting a script that intermittently fails with 401 errors. The script uses a custom token that is obtained at startup. The script also makes calls to a second API that uses Basic authentication. The engineer notices that the 401 errors occur only after the script has been running for more than 30 minutes. What is the most likely cause?

   • AThe API key used for the second API is rate-limited.
   • BThe Basic authentication header is being overwritten by the custom token header.
   • CThe custom token has expired, and the script is not refreshing it.
   • DThe Basic authentication credentials are being rejected because the password contains special characters.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A developer is building an application that uses a third-party API. The API requires a custom token that is obtained by sending a client ID and client secret to a token endpoint. The token expires after 1 hour. The application makes frequent API calls throughout the day. Which of the following is the most efficient and secure approach?

   • AUse the client ID and client secret directly in every API call.
   • BObtain a new token for every API call.
   • CUse an API key instead of a custom token.
   • DObtain a token at application startup and cache it until it expires, then request a new one.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A developer is implementing token-based authentication for a new API. The API will be used by mobile clients and server-to-server integrations. The security team requires that tokens be revocable and that the API can identify the client type. Which token design best meets these requirements?

   • AIssue a single long-lived token to all clients.
   • BIssue a unique token per client that includes metadata about the client type and can be revoked individually.
   • CIssue tokens that never expire to avoid disruption.
   • DUse the client's IP address as the token.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A developer is building an application that needs to authenticate to multiple Cisco APIs. Some APIs support custom tokens, some support API keys, and one legacy API only supports Basic authentication. The application must minimize the number of credentials stored and support automated rotation. Which approach best meets these requirements?

   • AStore each API's credentials separately and rotate them manually.
   • BUse Basic authentication for all APIs because it is the most compatible.
   • CUse a secrets management service to store the different credentials and automate rotation where supported.
   • DUse a single API key for all APIs.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network engineer is writing a script to back up configuration from a Cisco IOS-XE device using the RESTCONF API. The device is configured to use HTTP Basic Authentication. The engineer wants to ensure the credentials are not exposed in the script's output or logs. Which of the following is the most effective way to achieve this?

   • AUse the credentials in the URL of the RESTCONF request.
   • BRead the username and password from environment variables and avoid printing the Authorization header.
   • CUse a custom token instead of Basic Authentication.
   • DBase64-encode the credentials and print them for debugging.
   Reveal Solution Discussion Select an answer first