7. Utilize Common API Authentication Mechanisms: Basic, Custom Token, and API Keys 200-901 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary security limitation of HTTP Basic Authentication?

   • AIt requires the server to store passwords in plain text.
   • BIt does not support the use of HTTPS.
   • CIt transmits credentials in a form that can be easily decoded if intercepted.
   • DIt uses a weak hashing algorithm that can be easily cracked.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A network automation team is building a solution that must authenticate to two APIs: a legacy on-premises device that only supports HTTP Basic Authentication, and a cloud-based service that issues short-lived custom tokens. The solution runs in a shared environment where multiple users have access to the same server. The security policy requires that credentials be protected at rest and that the solution work without user interaction. Which approach best satisfies these requirements?

   • AStore the Basic Auth credentials and the client secret in a secrets manager, and have the solution retrieve them at runtime and obtain a token for the cloud API.
   • BUse the same API key for both APIs.
   • CRequire a user to enter the credentials interactively each time the script runs.
   • DHardcode the Basic Auth credentials and the client secret in the script.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A developer is writing a script to automate Cisco Webex Teams messaging. The script must authenticate to the Webex API. The developer has a personal access token. Which of the following is the correct way to include the token in an API request?

   • AAdd the token in the request body as a JSON field.
   • BAdd a cookie named 'auth' with the token value.
   • CAdd a query parameter named 'token' with the token value.
   • DAdd an Authorization header with the value 'Bearer <token>'.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security auditor is reviewing an API that uses HTTP Basic Authentication over HTTPS. The auditor notes that the API also supports API keys for some endpoints. The auditor recommends moving to a token-based system. Which of the following is the strongest justification for the recommendation?

   • ATokens are always encrypted, while Basic Auth credentials are not.
   • BTokens can be scoped to specific permissions and revoked independently without changing the user's password.
   • CAPI keys are more secure than tokens.
   • DBasic Authentication cannot be used over HTTPS.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is designing an API for internal automation tools. The API will be accessed by multiple services, each with different permission levels. The security team requires that credentials be revocable per service and that the API not store plaintext passwords. Which authentication mechanism is the best fit?

   • AIssue a unique API key to each service and store only a hash of the key.
   • BUse a single custom token for all services.
   • CUse client certificates for each service.
   • DUse HTTP Basic Authentication with a shared username and password.
   Reveal Solution Discussion Select an answer first