200-901 Application Deployment and Security Practice Question
A developer is writing a Python script that must call a Cisco DNA Center REST API. The script must authenticate with a username and password over HTTPS and receive a token that is valid for subsequent API calls. The developer wants to avoid embedding the credentials in the script. Which approach should be used?
⚠ Common exam trap
The trap here is assuming that any HTTPS API must use a browser-based OAuth flow, when DNA Center issues tokens directly from a Basic-authenticated token endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Read the username and password from environment variables and POST them to the DNA Center authentication endpoint to obtain a token.
DNA Center issues a time-limited token when valid credentials are POSTed to its authentication endpoint. Supplying those credentials through environment variables keeps them out of source control and supports rotation across environments. The token is then supplied on subsequent requests, which is exactly the behavior the scenario requires without embedding secrets in the script.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Read the username and password from environment variables and POST them to the DNA Center authentication endpoint to obtain a token.
Why this is correct
DNA Center authentication uses a POST to the /dna/system/api/v1/auth/token endpoint with HTTP Basic authentication, returning a token used in the X-Auth-Token header. Reading credentials from environment variables keeps them out of source code and allows the same script to run in different environments without modification.
- ✗
Hardcode the credentials in a configuration file and commit the file to the Git repository so the script can read it at runtime.
Why it's wrong here
Committing credentials to a repository exposes them to anyone with repository access and to history even after deletion. This violates the requirement to avoid embedding credentials and creates a long-lived secret leak. Configuration files can be used for non-sensitive settings, but secrets must not be stored in version control.
- ✗
Use an OAuth 2.0 authorization code flow with a browser-based redirect to obtain an access token for the DNA Center API.
Why it's wrong here
DNA Center does not use a browser-based OAuth 2.0 authorization code flow for the standard token endpoint described in this scenario. Its authentication endpoint accepts Basic credentials and returns a token directly, so implementing a redirect-based flow would add complexity and fail against the actual API.
- ✗
Send the username and password as query parameters on every API call instead of obtaining a token first.
Why it's wrong here
Passing credentials as query parameters exposes them in logs, proxies, and browser history, and DNA Center expects authentication via the token endpoint or Basic authentication, not repeated query parameters. This approach also forces re-authentication on every call and does not produce the token the scenario requires.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.