CCNP Practice Question: A Python script uses the requests library to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The script uses a hardcoded token, which is a security risk.

  Why it's wrong here

  Hardcoded credentials or API tokens are indeed a security weakness because anyone with access to the script source can extract and reuse the token, and rotating it requires editing code. However, in this particular script the token is present and functional, so the script will operate; the more immediate and catastrophic flaw is that SSL verification is disabled, allowing an attacker to intercept the token and the entire session. Thus, although hardcoded tokens are a valid concern, the question specifically targets the most severe vulnerability shown.

• ✓

  The script disables SSL certificate verification, making it vulnerable to man-in-the-middle attacks.

  Why this is correct

  Disabling SSL certificate verification with verify=False means the client accepts any certificate presented, including a forged one from a man-in-the-middle. This allows an attacker to intercept, decrypt, and modify traffic between the script and the DNA Center API, exposing credentials and data. In production, certificates should be validated against a trusted CA or internal enterprise CA. This is the most direct and exploitable security flaw in the script as written.

• ✗

  The script does not handle HTTP errors, which could expose sensitive information.

  Why it's wrong here

  While adding try/except or checking status codes is good practice, the absence of error handling does not directly make the script vulnerable to an attacker; it may cause crashes or unclear diagnostics, but it does not expose data to interception on the wire. The question asks for a security risk, and an SSL verification failure is the more concrete and severe vulnerability. Unhandled HTTP errors typically only affect the script's own output, not an attacker's ability to compromise the session.

• ✗

  The script uses an incorrect URL; the path should be /dna/intent/api/v1/network-device.

  Why it's wrong here

  The URL path /dna/intent/api/v1/network-device is actually the correct endpoint for retrieving network devices in the Catalyst Center (DNA Center) REST API. The script's issue is not a typo or wrong path but the disabled transport security; even if the path were wrong, that would cause a functional failure rather than a security vulnerability. Therefore this option misidentifies the actual problem in the script.