CCNP Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The script is missing the X-XSRF-TOKEN header.

  Why it's wrong here

  The X-XSRF-TOKEN header is required for POST, PUT, and DELETE requests to prevent CSRF attacks, but not for GET requests. For a GET request, only the session cookie is needed. A missing X-XSRF-TOKEN would not cause a 401 on a GET; it might cause a 403 on a POST. Thus, this is not the cause.

• ✓

  The script has not obtained a valid session token via the /j_security_check endpoint.

  Why this is correct

  The vManage REST API requires authentication using a session token. The client must first POST credentials to /j_security_check to obtain a JSESSIONID cookie, which is then included in subsequent requests. Without this token, the server returns 401 Unauthorized. The script must authenticate before accessing /dataservice/device. This is the most likely cause of the error.

• ✗

  The script is using the wrong HTTP method; it should use POST instead of GET.

  Why it's wrong here

  The /dataservice/device endpoint supports GET to retrieve device information. Using POST would be incorrect and might result in a 405 Method Not Allowed, not a 401. The 401 clearly indicates an authentication failure, so the HTTP method is not the issue. The script must authenticate first.

• ✗

  The script is using HTTP instead of HTTPS.

  Why it's wrong here

  The vManage API requires HTTPS, but using HTTP would typically result in a connection error or a redirect, not a 401 Unauthorized. A 401 indicates an authentication issue. While HTTPS is mandatory, the error specifically points to missing or invalid credentials, not the protocol. Therefore, this is not the most likely cause.