CCNA AI and Network Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Tokens are often sent in an HTTP header such as Authorization

  Why this is correct

  REST APIs commonly transmit tokens in an Authorization header following the Bearer scheme, such as Authorization: Bearer <token>. This keeps the credential out of the URL, query string, and request body, where it might be logged by proxies or web servers, and aligns with HTTP's standard challenge-response authentication framework.

• ✗

  Tokens are always permanent and never expire

  Why it's wrong here

  Token lifetimes are typically bounded to limit the damage of token theft; access tokens often expire within minutes or hours, and refresh tokens may also be rotated or revoked. A permanent, non-expiring token would remain valid indefinitely after a breach, so production systems enforce time-based expiration, issuer constraints, and revocation mechanisms rather than “always permanent” behavior.

  When this WOULD be correct

  In a scenario where the exam question specifically states that the API being discussed uses permanent tokens for authentication, such as in a legacy system or a specific implementation that does not require expiration for security, this option would be correct.

• ✓

  Tokens can be used instead of resending credentials on every request

  Why this is correct

  Tokens are opaque or structured bearer credentials (e.g., JWT) that let a client authenticate by proving possession of the token rather than repeatedly transmitting username/password. Because the server can verify the token's signature or lookup its session, credentials are not exposed on every API call, reducing replay and credential-leak risk.

• ✗

  Tokens require Telnet to be enabled on the device

  Why it's wrong here

  Token authentication operates entirely at the HTTP/HTTPS application layer and has no dependency on Telnet, which is an unencrypted legacy protocol for remote terminal access. Devices do not need Telnet enabled for REST APIs to issue or validate tokens; any such requirement would conflict with modern secure API design that assumes TCP/HTTP connectivity.

  When this WOULD be correct

  If the exam question specified a scenario involving legacy systems where Telnet is used for device management, and the context required enabling Telnet for token authentication, then this option could be correct.

• ✗

  A token changes JSON into XML automatically

  Why it's wrong here

  Authentication and data format are orthogonal concerns: tokens prove identity, while JSON-to-XML conversion is a representation/transformation issue handled by content negotiation, middleware, or parser utilities. A token's payload carries claims or a session identifier, not an instruction to change the response's media type, so the API returns the format requested via Accept headers regardless of authentication.

  When this WOULD be correct

  If the exam question asked about a system that automatically converts data formats upon receiving an API token, or if it specified a feature of a specific API that performs such conversions, then this option could be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”