200-901 Infrastructure and Automation Practice Question
A developer is writing a Python script that calls the Cisco DNA Center Intent API to create a new network device. The script must send a JSON body and authenticate with a token. Which TWO HTTP request components are required for this API call to succeed? (Choose two.)
⚠ Common exam trap
The trap here is believing that Basic credentials or a session cookie can substitute for the X-Auth-Token header once authentication has already occurred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
X-Auth-Token header containing the authentication token
Creating a device through the DNA Center Intent API requires a JSON body, so Content-Type must be application/json, and the call must be authenticated with the token in the X-Auth-Token header. Compression headers and browser-style cookies or Basic credentials do not satisfy these two mandatory requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cookie: JSESSIONID from a prior login
Why it's wrong here
DNA Center's REST API is stateless and does not rely on browser session cookies such as JSESSIONID. Including a cookie does not authenticate the request, and the controller still expects the X-Auth-Token header, so this option does not help the script create the device.
- ✓
X-Auth-Token header containing the authentication token
Why this is correct
Every Intent API call after authentication must include the token returned by the token endpoint in the X-Auth-Token header. Omitting it causes a 401 Unauthorized response. This header is the controller's required mechanism for proving that the caller has already authenticated successfully.
- ✗
Authorization: Basic with the username and password
Why it's wrong here
Basic credentials are used only against the authentication endpoint to obtain a token. Sending Basic credentials on the device-creation call is not the documented pattern and does not replace the required X-Auth-Token header, so it will not satisfy the authentication requirement for this operation.
- ✓
Content-Type: application/json
Why this is correct
DNA Center expects the request body to be JSON, so the Content-Type header must declare application/json. Without it, the controller may reject the payload or fail to parse it, returning a 400-level error. This header tells the API how to interpret the serialized device object in the body.
- ✗
Accept-Encoding: gzip
Why it's wrong here
Accept-Encoding: gzip asks the server to compress the response. It is an optional performance header, not a requirement for creating a device. The API call succeeds without it, so it is not one of the required components the developer must include.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.