The correct action is to upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3. This resolves the unauthorized error because APIC firmware version 5.2(1) enforces TLS 1.3 by default, and older versions of the requests library (pre-2.25.0) lack support for this protocol, causing the TLS handshake to fail and return an 'Unauthorized' error even with valid credentials. On the Cisco DCCOR / CCNP Data Center Core 350-601 exam, this scenario tests your understanding of how APIC firmware upgrades can silently enforce stricter security protocols, breaking automation scripts that rely on outdated libraries—a common trap where candidates mistakenly suspect account lockouts or credential issues. Remember the memory tip: "TLS 1.3 demands requests 2.25 or newer"—if your script fails after an APIC upgrade, always check the library version before troubleshooting credentials.
350-601 Automation Practice Question
This 350-601 practice question tests your understanding of automation. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.
Option B is correct because APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Change the authentication method in the script from password-based to certificate-based authentication.
Why it's wrong here
The error is not related to the authentication method; it's a TLS issue.
✓
Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.
Why this is correct
Upgrading the library ensures TLS 1.3 compatibility, preserving security.
Related concept
Read the scenario before looking for a memorised answer.
✗
Regenerate the API key for the service account and update the script with the new key.
Why it's wrong here
The credentials are correct, so the API key is not the issue.
✗
Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.
Why it's wrong here
While this would work, it reduces security and is not the recommended approach.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume the 'Unauthorized' error is due to invalid credentials or authentication method, when in fact it is caused by a TLS protocol version mismatch between the client library and the upgraded APIC.
Detailed technical explanation
How to think about this question
Cisco APIC firmware 5.2(1) enables TLS 1.3 by default, which uses a different handshake (e.g., 0-RTT, fewer round trips) than TLS 1.2. The Python requests library relies on the underlying urllib3 and OpenSSL; versions before 2.25.0 (released November 2020) did not include support for TLS 1.3, causing the APIC to reject the connection with an 'Unauthorized' error because the TLS negotiation fails before any HTTP authentication occurs. This is a common issue when upgrading network controllers that enforce newer TLS standards.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-601 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Automation — This question tests Automation — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3. — Option B is correct because APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.