CCNA Network Services and Security Practice Question
An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?
⚠ Common exam trap
Remember that bearer tokens are part of the request, not the response, and should be in the Authorization header, not in query parameters or the request body.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the HTTP Authorization header
Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the HTTP Authorization header
Why this is correct
RFC 6750 specifies that a bearer token is transmitted in the HTTP Authorization request header using the Bearer authentication scheme (e.g., `Authorization: Bearer <token>`). This header is parsed by the resource server to validate the client's identity and permissions before processing the request. Because HTTP is the application-layer protocol used for REST APIs, this is the only correct placement for the token among the options listed.
- ✗
In the Ethernet trailer
Why it's wrong here
The Ethernet trailer contains the Frame Check Sequence (FCS), a CRC value used solely for error detection at Layer 2, not for carrying application data. Tokens such as bearer tokens are generated by authentication services and must be presented in the HTTP layer so that the web server can process them. Placing a token in the trailer would make it invisible to upper-layer protocols and would be stripped by the NIC long before the application could access it.
When this WOULD be correct
If the question asked where to include metadata for Ethernet frames in a network communication scenario, the Ethernet trailer could be referenced as it contains necessary information for data transmission, making it relevant in that specific context.
- ✗
In the DNS response section
Why it's wrong here
DNS responses carry resource records (like A, AAAA, or TXT) in the answer section, which serve to resolve domain names to IP addresses or other domain-related data. REST API authorization is an application-layer concern that occurs after the TCP connection is established and the HTTP request is sent, so it has no relationship to the DNS resolution process. A bearer token cannot be delivered via DNS because the DNS server does not forward arbitrary application data to the HTTP endpoint.
When this WOULD be correct
If the exam question were focused on a scenario where DNS was being used to authenticate a client to a server, and the question specified that the bearer token was being transmitted as part of a custom DNS protocol extension, then this option could be correct.
- ✗
In the TCP checksum field
Why it's wrong here
The TCP checksum field is a 16-bit value computed over the TCP header, pseudo-header, and payload to ensure data integrity during transport. It is recalculated at each hop and verified by the receiver, and any modification to it would cause the segment to be discarded as corrupt. Bearer tokens are not part of transport-layer metadata; they must be included in the HTTP request itself so that the application can authenticate the user, not buried in a checksum that is never exposed to the application layer.
When this WOULD be correct
In a hypothetical question where the focus is on TCP packet structure and error-checking mechanisms, a candidate might be asked about the purpose of the TCP checksum field. In that context, a correct answer could involve discussing how it ensures data integrity, potentially leading to confusion about where application data is placed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓In the HTTP Authorization headerCorrect answer▾
Why this is correct
RFC 6750 specifies that a bearer token is transmitted in the HTTP Authorization request header using the Bearer authentication scheme (e.g., `Authorization: Bearer <token>`). This header is parsed by the resource server to validate the client's identity and permissions before processing the request. Because HTTP is the application-layer protocol used for REST APIs, this is the only correct placement for the token among the options listed.
✗In the Ethernet trailerWrong answer — click to see why▾
Why this is wrong here
The Ethernet trailer contains a Frame Check Sequence (FCS) for error detection at Layer 2, not application-layer data like bearer tokens. Tokens are part of the HTTP application layer and are never placed in the Ethernet trailer.
★ When this WOULD be the correct answer
If the question asked where to include metadata for Ethernet frames in a network communication scenario, the Ethernet trailer could be referenced as it contains necessary information for data transmission, making it relevant in that specific context.
Why candidates choose this
Students might confuse the term 'trailer' with 'header' or think that security tokens could be embedded in lower-layer fields for encryption, but Ethernet trailers are purely for error checking and not for carrying application data.
✗In the DNS response sectionWrong answer — click to see why▾
Why this is wrong here
DNS responses contain resource records like A, AAAA, or CNAME, which map domain names to IP addresses. They have no role in carrying authentication tokens for REST API calls, as DNS is a separate protocol for name resolution.
★ When this WOULD be the correct answer
If the exam question were focused on a scenario where DNS was being used to authenticate a client to a server, and the question specified that the bearer token was being transmitted as part of a custom DNS protocol extension, then this option could be correct.
Why candidates choose this
A student might think that since DNS is used to resolve the controller's hostname, the token could be included in the DNS response. However, DNS is not involved in application-layer authentication and does not carry bearer tokens.
✗In the TCP checksum fieldWrong answer — click to see why▾
Why this is wrong here
The TCP checksum field is used for error detection of the TCP segment header and payload at the transport layer. It is computed by the sender and verified by the receiver; it does not carry any application data such as bearer tokens.
★ When this WOULD be the correct answer
In a hypothetical question where the focus is on TCP packet structure and error-checking mechanisms, a candidate might be asked about the purpose of the TCP checksum field. In that context, a correct answer could involve discussing how it ensures data integrity, potentially leading to confusion about where application data is placed.
Why candidates choose this
Students might confuse the checksum field with a field that could carry security information, or think that tokens could be embedded in transport-layer headers for encryption. However, TCP checksums are purely for integrity and not for authentication tokens.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
HTTP
HTTP stands for Hypertext Transfer Protocol, the set of rules web browsers and servers use to communicate and transfer web pages over the internet.
Key term
HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP that encrypts data between a web browser and a web server using SSL/TLS protocols.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.