mediumMultiple ChoiceObjective-mapped
200-901 Practice Question: A developer is building a REST API for a Cisco…
A developer is building a REST API for a Cisco DNA Center application. The API must allow external partners to retrieve network device inventory. Which security mechanism should be implemented to ensure that only authorized partners can access the API while maintaining the ability to revoke access for a specific partner without affecting others?
⚠ Common exam trap
Cisco often tests the distinction between authentication (verifying identity) and authorization (granting permissions), and the trap here is that candidates may over-engineer the solution by choosing OAuth 2.0 when a simpler API key mechanism fully satisfies the requirement for per-partner revocation without unnecessary complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use unique API keys per partner
Unique API keys per partner provide a simple, scalable mechanism to authenticate and authorize individual partners. Each key can be independently revoked without affecting other partners' access, directly meeting the requirement for granular access control. API keys are a common choice for server-to-server integrations where a lightweight, token-based authentication is sufficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use unique API keys per partner
Why this is correct
API keys are simple to manage and can be revoked individually without impacting other partners.
- ✗
Whitelist partner IP addresses in the API gateway firewall
Why it's wrong here
IP whitelisting is inflexible and does not authenticate the application, only the network address.
- ✗
Require HTTP basic authentication with a shared username and password
Why it's wrong here
Basic auth with shared credentials cannot be revoked per partner; changing the password affects all.
- ✗
Implement OAuth 2.0 with client credentials grant
Why it's wrong here
OAuth 2.0 with the client credentials grant authenticates the client application itself, not an individual user or partner, so it cannot distinguish one partner from another for targeted revocation; revoking a client credential would block all partners using that client ID. It is tempting because client credentials are designed for server-to-server machine-to-machine communication without user interaction, which matches the API’s non-human access pattern, but the requirement for per-partner revocation demands a grant type that issues tokens tied to a specific resource owner, such as the authorization code grant with individual partner accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.