CCNP Automation Practice Question
A network automation team is using the Cisco SD-WAN vManage REST API to monitor the status of WAN Edge devices. The team writes a Python script that authenticates using basic authentication and then sends a GET request to /dataservice/device. The script receives a 401 Unauthorized error even though the credentials are correct. The team verifies that the user account has the 'admin' role. What is the most likely cause of the authentication failure?
⚠ Common exam trap
The trap here is assuming that the vManage API supports basic authentication like many REST APIs, when it actually requires a session cookie obtained via a specific login endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The vManage API requires the use of a session token obtained via /j_security_check instead of basic authentication.
The Cisco SD-WAN vManage REST API uses session-based authentication. Clients must first POST to /j_security_check with credentials to obtain a JSESSIONID cookie, which is then included in subsequent requests. Basic authentication is not supported, leading to a 401 error even with valid credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The vManage API requires the use of a session token obtained via /j_security_check instead of basic authentication.
Why this is correct
The Cisco SD-WAN vManage REST API does not support basic authentication for most endpoints. Instead, clients must authenticate by sending a POST request to /j_security_check with username and password, which returns a JSESSIONID cookie. Subsequent requests must include this cookie. Using basic authentication results in a 401 error even with valid credentials.
- ✗
The vManage API requires TLS client certificate authentication for all API calls.
Why it's wrong here
While vManage supports certificate-based authentication for some features, it is not mandatory for API access. The default authentication method is session-based using /j_security_check. The 401 error is due to the use of basic authentication, not the absence of a client certificate.
- ✗
The script must include the header 'Content-Type: application/json' in the GET request to authenticate.
Why it's wrong here
The Content-Type header specifies the format of the request body and is not used for authentication. A GET request typically has no body. The 401 error indicates an authentication failure, not a content negotiation issue. Adding this header would not resolve the problem.
- ✗
The user account must be assigned the 'api' role in addition to the 'admin' role to access the REST API.
Why it's wrong here
Cisco SD-WAN vManage does not have a separate 'api' role. The 'admin' role has full access to the API. The 401 error is not due to role assignment but rather the authentication method. The API expects a session cookie, not basic authentication headers.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.