CCNP Automation Practice Question
A network engineer is using a Python script to retrieve the operational status of all interfaces on a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state but receives an HTTP 401 Unauthorized response. The engineer can successfully ping the device and has verified that the RESTCONF feature is enabled with 'restconf' in global configuration. Which action will resolve the issue?
⚠ Common exam trap
The trap here is assuming that a 401 error is caused by a transport or feature configuration issue rather than missing or incorrect authentication credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a local username with privilege level 15 and ensure the script includes valid Basic Authentication credentials.
The 401 Unauthorized response indicates that the HTTP request lacks valid authentication credentials. RESTCONF on Cisco IOS XE uses HTTP Basic Authentication by default when no AAA is configured. The engineer must create a local user with appropriate privileges and include the credentials in the request. Enabling HTTPS or adjusting ACLs does not address authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a local username with privilege level 15 and ensure the script includes valid Basic Authentication credentials.
Why this is correct
RESTCONF on Cisco IOS XE requires HTTP authentication. A 401 Unauthorized indicates missing or invalid credentials. Creating a local user with sufficient privilege and including the credentials in the Authorization header (Basic Auth) allows the request to be authenticated. This is the standard method for RESTCONF access when no AAA server is configured.
- ✗
Configure an ACL to permit TCP port 830 on the device to allow RESTCONF traffic.
Why it's wrong here
RESTCONF uses HTTPS (TCP 443), not port 830. Port 830 is used by NETCONF over SSH. Opening port 830 would not affect RESTCONF authentication. The 401 error indicates the request reached the server but lacked valid credentials, so firewall rules are not the issue.
- ✗
Enable the 'ip http secure-server' command to allow HTTPS access to the RESTCONF API.
Why it's wrong here
While HTTPS is required for RESTCONF, the scenario states the script is already using https:// and the device is reachable. The error is 401 Unauthorized, not a connection failure. Enabling the secure server would not address authentication; it would only ensure the transport is encrypted, which is already implied.
- ✗
Add the 'restconf' command under the interface configuration mode for the management interface.
Why it's wrong here
The 'restconf' command is enabled globally, not per interface. Interface configuration does not control RESTCONF access. The 401 error is an authentication failure, not a feature enablement issue. Enabling RESTCONF on an interface is not a valid Cisco IOS XE command and would not resolve the problem.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.