Quick Answer
The correct answer is the HTTP Authorization header, because bearer tokens are a standard component of OAuth 2.0 authentication and must be placed in the Authorization header using the format `Authorization: Bearer <token>`. This placement ensures the token is transmitted securely over HTTPS without being exposed in URLs or browser history, which can happen with query parameters. On the CCNA 200-301 v2 exam, this concept tests your understanding of REST API security when automating network tasks with controllers like Cisco DNA Center or SD-WAN vManage. A common trap is assuming the token can go in the request body or as a query string, but the RESTful convention and RFC 6750 mandate the Authorization header for bearer tokens. Remember the mnemonic: “Bearer belongs in the header, not the query or body—keep it out of the URL to stay secure.”
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?
In the HTTP Authorization header
That is the standard way bearer tokens are presented.
In the Ethernet trailer
Why wrong: Tokens are an application-layer concept, not a Layer 2 trailer field.
In the DNS response section
Why wrong: DNS is unrelated to REST API authorization.
In the TCP checksum field
Why wrong: Transport checksums do not carry application tokens.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
In the HTTP Authorization header
Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.
Key principle: Bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
In the HTTP Authorization header
In the Ethernet trailer
Why it's wrong here
Tokens are an application-layer concept, not a Layer 2 trailer field.
When this WOULD be correct
If the question asked where to include metadata for Ethernet frames in a network communication scenario, the Ethernet trailer could be referenced as it contains necessary information for data transmission, making it relevant in that specific context.
In the DNS response section
When this WOULD be correct
If the exam question were focused on a scenario where DNS was being used to authenticate a client to a server, and the question specified that the bearer token was being transmitted as part of a custom DNS protocol extension, then this option could be correct.
In the TCP checksum field
Why it's wrong here
Transport checksums do not carry application tokens.
When this WOULD be correct
In a hypothetical question where the focus is on TCP packet structure and error-checking mechanisms, a candidate might be asked about the purpose of the TCP checksum field. In that context, a correct answer could involve discussing how it ensures data integrity, potentially leading to confusion about where application data is placed.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
That is the standard way bearer tokens are presented.
Why this is wrong here
The Ethernet trailer contains a Frame Check Sequence (FCS) for error detection at Layer 2, not application-layer data like bearer tokens. Tokens are part of the HTTP application layer and are never placed in the Ethernet trailer.
★ When this WOULD be the correct answer
If the question asked where to include metadata for Ethernet frames in a network communication scenario, the Ethernet trailer could be referenced as it contains necessary information for data transmission, making it relevant in that specific context.
Why candidates choose this
Students might confuse the term 'trailer' with 'header' or think that security tokens could be embedded in lower-layer fields for encryption, but Ethernet trailers are purely for error checking and not for carrying application data.
Why this is wrong here
DNS responses contain resource records like A, AAAA, or CNAME, which map domain names to IP addresses. They have no role in carrying authentication tokens for REST API calls, as DNS is a separate protocol for name resolution.
★ When this WOULD be the correct answer
If the exam question were focused on a scenario where DNS was being used to authenticate a client to a server, and the question specified that the bearer token was being transmitted as part of a custom DNS protocol extension, then this option could be correct.
Why candidates choose this
A student might think that since DNS is used to resolve the controller's hostname, the token could be included in the DNS response. However, DNS is not involved in application-layer authentication and does not carry bearer tokens.
Why this is wrong here
The TCP checksum field is used for error detection of the TCP segment header and payload at the transport layer. It is computed by the sender and verified by the receiver; it does not carry any application data such as bearer tokens.
★ When this WOULD be the correct answer
In a hypothetical question where the focus is on TCP packet structure and error-checking mechanisms, a candidate might be asked about the purpose of the TCP checksum field. In that context, a correct answer could involve discussing how it ensures data integrity, potentially leading to confusion about where application data is placed.
Why candidates choose this
Students might confuse the checksum field with a field that could carry security information, or think that tokens could be embedded in transport-layer headers for encryption. However, TCP checksums are purely for integrity and not for authentication tokens.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Remember that bearer tokens are part of the request, not the response, and should be in the Authorization header, not in query parameters or the request body.
Detailed technical explanation
Bearer tokens are a form of access token used in REST API authentication to prove the identity of the client making the request. These tokens are typically generated by an authentication server and must be included in each API request to authorize access to protected resources. The HTTP Authorization header is the standardized method for transmitting bearer tokens, using the syntax 'Authorization: Bearer <token>'. This header is part of the HTTP protocol, which REST APIs use as their transport layer, making it the logical and secure place to include authentication credentials. The decision to place bearer tokens in the HTTP Authorization header follows the REST architectural style and HTTP standards. This approach separates authentication data from the message body and URL parameters, reducing the risk of token leakage through logs or caches. Cisco network automation scripts that interact with controller REST APIs must adhere to this standard to ensure successful authentication and authorization. Using HTTPS encrypts the entire HTTP message, including headers, protecting the bearer token from interception during transmission. A common exam trap is confusing bearer token placement with lower-layer protocol fields like Ethernet trailers or TCP checksum fields, which do not carry application-layer data. Another mistake is assuming DNS responses can carry authentication tokens, which they cannot since DNS is unrelated to REST API security. Practically, placing tokens outside the Authorization header leads to failed authentication and potential security risks. Understanding this distinction is critical for Cisco automation tasks and passing the CCNA exam questions on REST API security fundamentals.
Key takeaway
Bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Review bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — Bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS..
The correct answer is: In the HTTP Authorization header — Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.
Review bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS., then practise related 200-301 questions on the same topic to reinforce the concept.
Bearer tokens are included in the HTTP Authorization header to authenticate REST API requests securely over HTTPS.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.