CCNA AI and Network Operations Practice Question
A script authenticates to a controller API and receives a token that it presents in later requests. Which two statements about that token-based workflow are correct?
⚠ Common exam trap
A common exam trap is assuming that the presence of a token changes the network management protocol from REST to SNMP or another protocol. This is incorrect because token-based authentication is a security mechanism layered on top of the existing API protocol and does not alter it. Another trap is believing that tokens must be stored in the router’s startup-config, which is false since tokens are ephemeral credentials managed by client applications, not static device configurations. Misunderstanding these points can lead to selecting incorrect answers about token workflows in automation scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token is often sent in an HTTP header in subsequent requests
After authentication, many APIs issue a token that the client includes in later HTTP requests. That token acts as proof that the client already authenticated successfully.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The token is often sent in an HTTP header in subsequent requests
Why this is correct
The token is typically included in the Authorization header of subsequent HTTP requests, often using the Bearer authentication scheme. This allows the controller API to validate the token and associate the request with the previously authenticated session without re-prompting for credentials. Stateless API servers rely on this per-request header transmission to maintain authentication context across multiple REST calls.
- ✓
The token proves identity for that authenticated session or request set
Why this is correct
The token serves as a cryptographic proof of identity, confirming that the client has successfully completed authentication and is entitled to exercise the permissions granted to that principal. It encodes or references the authenticated user or role, along with an expiration time and scope restrictions, so the API can authorize specific operations. This is what transforms an unauthenticated request into an authenticated session-equivalent for the duration of the token's validity.
- ✗
The token changes the API from REST to SNMP
Why it's wrong here
REST and SNMP are fundamentally different management protocols—REST uses HTTP over TCP with JSON or XML payloads, while SNMP uses UDP or TCP with a MIB-based structure and community strings or v3 security. An authentication token is merely a credential attached to the HTTP request; it has no ability to alter the underlying protocol or the API's behavior. The API remains RESTful; the token simply authenticates the caller, so it cannot change REST to SNMP.
When this WOULD be correct
If the question asked about a scenario where a network device's configuration is changed from using REST API to SNMP for management, then an option stating that the API changes from REST to SNMP could be correct, but that would involve reconfiguration, not a token.
- ✗
The token must be stored in the router startup-config
Why it's wrong here
Router startup-config is used to store persistent device settings like interface IP addresses, routing protocols, and administrative credentials for device access, not ephemeral API session tokens. Placing a controller API token there would be inappropriate, as it is not part of the router's operating configuration and would pose a security risk if left in plaintext in a config file. Applications and scripts manage tokens in memory or secure storage, never in the router's NVRAM-based configuration.
When this WOULD be correct
If the question asked about storing API credentials for device management (e.g., SNMP community strings or RADIUS keys) that must survive reboots, then storing them in startup-config would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The token is often sent in an HTTP header in subsequent requestsCorrect answer▾
Why this is correct
The token is typically included in the Authorization header of subsequent HTTP requests, often using the Bearer authentication scheme. This allows the controller API to validate the token and associate the request with the previously authenticated session without re-prompting for credentials. Stateless API servers rely on this per-request header transmission to maintain authentication context across multiple REST calls.
✗The token changes the API from REST to SNMPWrong answer — click to see why▾
Why this is wrong here
The token does not change the API protocol; REST and SNMP are fundamentally different protocols, and a token cannot convert one to the other.
★ When this WOULD be the correct answer
If the question asked about a scenario where a network device's configuration is changed from using REST API to SNMP for management, then an option stating that the API changes from REST to SNMP could be correct, but that would involve reconfiguration, not a token.
Why candidates choose this
Candidates may confuse token-based authentication with protocol conversion, or mistakenly think that tokens can alter API behavior.
✗The token must be stored in the router startup-configWrong answer — click to see why▾
Why this is wrong here
Tokens are ephemeral credentials stored in memory or client-side storage, not in router startup-config, which is used for device configuration persistence.
★ When this WOULD be the correct answer
If the question asked about storing API credentials for device management (e.g., SNMP community strings or RADIUS keys) that must survive reboots, then storing them in startup-config would be correct.
Why candidates choose this
Candidates may confuse token-based authentication with device configuration persistence, assuming tokens must be saved like passwords or keys in startup-config.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Management Approaches: Device, Cloud, Controller, Automation, and IaC
Key term
HTTP
HTTP stands for Hypertext Transfer Protocol, the set of rules web browsers and servers use to communicate and transfer web pages over the internet.
Key term
API
An API is a set of rules that allows software applications to communicate and exchange data with each other.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.