A security engineer is troubleshooting an API integration that suddenly started failing with HTTP 401 Unauthorized errors. The integration previously worked for months. The API uses custom token authentication. The engineer verifies that the token is not expired and the credentials are correct. What is the most likely cause of the failure?

The client's IP address changed

The API key was rotated by the administrator

The API server's clock has drifted, causing token validation to fail

The API now requires Basic authentication

A security analyst is reviewing API logs and notices that a partner's API key is being used from an unexpected geographic location. The API key is a static, long-lived credential. What is the most appropriate immediate action?

Revoke the API key and issue a new one to the partner

Switch the API to custom token authentication

Ignore the log entry as a false positive

Contact the partner and ask if they are traveling

What is a common management practice for API keys to reduce the risk of compromise?

Sharing the key among multiple users to simplify management

Storing the key in a public repository for easy access by the team

Embedding the key in client-side code so it is easily accessible

Rotating keys periodically and revoking them when no longer needed

A network administrator is configuring a legacy network device that only supports HTTP Basic authentication for its API. The administrator is aware of the security limitations. Which additional control is most effective at mitigating the risk of credential theft?

Disable the API and use CLI only

Restrict API access to a management VLAN

Implement a VPN or IPsec tunnel for API traffic

A developer is integrating a custom token-based API into a web application. The token is obtained by sending a username and password to an authentication endpoint. The developer needs to ensure the token is not exposed to client-side JavaScript. Where should the token be stored?

In the browser's sessionStorage

In an HttpOnly cookie set by the server

In a JavaScript global variable

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 4Objective 9

4.9 Interpret API Authentication Mechanisms: Basic, Custom Token, and API Keys 350-201 Practice Questions (Page 4)

Part of the Automation domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

20%of the exam

Questions 16–20

16expert · hard
A security engineer is troubleshooting an API integration that suddenly started failing with HTTP 401 Unauthorized errors. The integration previously worked for months. The API uses custom token authentication. The engineer verifies that the token is not expired and the credentials are correct. What is the most likely cause of the failure?
Select an answer first
17application · medium
A security analyst is reviewing API logs and notices that a partner's API key is being used from an unexpected geographic location. The API key is a static, long-lived credential. What is the most appropriate immediate action?
Select an answer first
18foundation · easy
What is a common management practice for API keys to reduce the risk of compromise?
Select an answer first
19application · medium
A network administrator is configuring a legacy network device that only supports HTTP Basic authentication for its API. The administrator is aware of the security limitations. Which additional control is most effective at mitigating the risk of credential theft?
Select an answer first
20application · medium
A developer is integrating a custom token-based API into a web application. The token is obtained by sending a username and password to an authentication endpoint. The developer needs to ensure the token is not exposed to client-side JavaScript. Where should the token be stored?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.