200-901 Infrastructure and Automation Practice Question
A large enterprise uses Cisco DNA Center to manage over 500 network devices across multiple sites. The network operations team wants to automate the validation of device compliance with a baseline configuration. They have a Python script that uses the Cisco DNA Center REST API to retrieve the device configuration and compare it against a golden configuration stored in a local file. Recently, the script started failing with a 401 HTTP response code when trying to authenticate. The team confirmed the username and password are correct and that the DNA Center server is reachable. The script uses the /api/system/v1/auth/token endpoint to obtain a token. Which of the following is the most likely cause of the 401 error?
⚠ Common exam trap
Cisco often tests the distinction between authentication (401) and authorization (403) errors, and the trap here is that candidates might blame the endpoint version or HTTP method when the real issue is token lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authentication token has expired and the script is not refreshing it.
The 401 HTTP response code indicates an authentication failure. Since the username and password are confirmed correct and the server is reachable, the most likely cause is that the script obtained a token earlier but is now using an expired token without refreshing it. Cisco DNA Center tokens have a configurable timeout (default 1 hour), and the script must re-authenticate or refresh the token before it expires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The API endpoint requires a different HTTP method (e.g., POST vs GET).
Why it's wrong here
A wrong HTTP method yields 405 Method Not Allowed, not 401, which specifically signals failed authentication. Method selection would be the answer if the stem reported 405 or 404 responses instead of an authentication failure.
- ✗
The script is using an incorrect API version path (e.g., /v2 instead of /v1).
Why it's wrong here
An incorrect API version path returns 404 Not Found, since the router cannot match the URI; authentication is never evaluated. Version-path errors would explain a 404, whereas the stem's 401 points to credential or token rejection.
- ✗
CORS (Cross-Origin Resource Sharing) is blocking the request.
Why it's wrong here
CORS is a browser-enforced policy governing cross-origin fetch requests; a server-side Python script using requests is not subject to it, so it cannot produce a 401. CORS configuration would matter for a JavaScript client calling DNA Center from a different web origin.
- ✓
The authentication token has expired and the script is not refreshing it.
Why this is correct
The token obtained from /api/system/v1/auth/token is time-limited, so a long-running script that caches it will eventually present an expired credential and receive 401. Refreshing the token before each API call, or handling the expiry response, satisfies the requirement for continuous authentication against Cisco DNA Center.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.