hardMultiple SelectObjective-mapped
200-901 Practice Question: A developer needs to authenticate to the Cisco…
A developer needs to authenticate to the Cisco SD-WAN vManage API. Which two steps are required to obtain a session token?
⚠ Common exam trap
Cisco often tests the distinction between the initial credential submission endpoint (/j_security_check) and the token retrieval endpoint (/dataservice/client/token), leading candidates to mistakenly think a single POST to /authenticate is sufficient or that OAuth2 is used.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
POST j_username and j_password to the /j_security_check endpoint.
The Cisco SD-WAN vManage API uses a form-based authentication mechanism where credentials (j_username and j_password) are submitted via a POST request to the /j_security_check endpoint. This endpoint validates the credentials and, upon success, returns a JSESSIONID cookie that serves as the session token for subsequent API calls. Option B is correct because after obtaining the JSESSIONID, a GET request to /dataservice/client/token is required to retrieve an XSRF token, which must be included in the header of all subsequent requests to prevent cross-site request forgery attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
POST j_username and j_password to the /j_security_check endpoint.
Why this is correct
First step for JSESSIONID.
- ✓
GET the /dataservice/client/token endpoint.
Why this is correct
Second step to get X-XSRF-TOKEN.
- ✗
Provide an API key in the HTTP header.
Why it's wrong here
Not used in vManage.
- ✗
POST credentials to the /authenticate endpoint.
Why it's wrong here
No such endpoint.
- ✗
Use OAuth2 client credentials grant.
Why it's wrong here
Not natively supported.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.