hardMultiple ChoiceObjective-mapped
200-901 Practice Question: A company has a microservices application…
A company has a microservices application deployed on Kubernetes. There are three services: frontend, backend, and database. The frontend is exposed via an Ingress. The API gateway is used for authentication. Recently, after updating the backend service, users are experiencing 401 Unauthorized errors when accessing endpoints that previously worked. The authentication mechanism uses JWT tokens issued by an external identity provider. The JWT tokens are validated by the API gateway. The backend service itself does not validate tokens; it relies on the gateway to forward user identity via headers. The development team checked the logs and found that the backend is receiving requests with the correct JWT from the gateway but still returning 401. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that JWT validation must happen at the backend, but here the trap is that the backend was never supposed to validate tokens, and a code change introducing such validation causes the 401 errors, not a problem with the gateway or Ingress.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The backend service code now attempts to validate the JWT itself and fails.
The scenario states that the backend service relies on the gateway to forward user identity via headers and does not validate JWT tokens itself. If the new backend version now attempts to validate the JWT, it would likely fail because the backend lacks the necessary signing key or validation logic, causing 401 errors even though the gateway correctly forwards the token. This matches option D, as the change in backend behavior introduces a new validation step that was not present before.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Ingress controller is stripping the Authorization header before forwarding to the backend.
Why it's wrong here
Logs show backend receives the correct JWT, so header is present.
- ✗
The API gateway's JWT signing key has changed and the backend is using the old key.
Why it's wrong here
If the key changed, the gateway would fail to validate tokens, not the backend.
- ✗
The new backend version uses a different HTTP method for the affected endpoints.
Why it's wrong here
Method mismatch would cause 405 or similar, not 401.
- ✓
The backend service code now attempts to validate the JWT itself and fails.
Why this is correct
Likely the update added token validation code that is not properly configured.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.