hardMultiple ChoiceObjective-mapped
200-901 Practice Question: A network automation engineer is tasked with…
A network automation engineer is tasked with creating a Python script to automatically back up the running configuration of all IOS XE devices in a data center using the Cisco IOS XE REST API. The engineer has credentials for each device and knows the IP addresses. The script uses the requests library and sends a GET request to https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native?content=config. The script runs successfully for some devices but fails with a 401 Unauthorized error for others. The engineer confirms the credentials are correct and the devices are reachable. The working devices are running IOS XE 16.9, while the failing ones are running IOS XE 16.6. The engineer checks the API documentation and finds that RESTCONF is enabled on all devices. However, the engineer notices that the failing devices require a different authentication method. What should the engineer do to fix the authentication for the IOS XE 16.6 devices?
⚠ Common exam trap
Cisco often tests the version-specific RESTCONF authentication differences, where candidates assume all IOS XE versions use the same authentication method (e.g., token-based), but older versions require Basic Auth and CSRF bypass.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the script to use HTTP Basic Authentication and disable CSRF check on the device.
IOS XE 16.6 requires HTTP Basic Authentication with the 'Authorization' header, and the RESTCONF API on these older versions also requires disabling the CSRF (Cross-Site Request Forgery) check. The engineer must modify the script to include the 'requests.auth.HTTPBasicAuth' and set the 'X-CSRF-Token' header to 'false' or disable CSRF on the device. This resolves the 401 error while still using RESTCONF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch from HTTPS to HTTP for the failing devices.
Why it's wrong here
HTTP is insecure and not the root cause; the authentication method is the issue.
- ✗
Use the NETCONF protocol instead of RESTCONF for all devices.
Why it's wrong here
While NETCONF is available, the requirement is to use REST API; switching protocols is a larger change.
- ✗
Change the URL to use the Cisco IOS XE CLI-based API instead of RESTCONF.
Why it's wrong here
The CLI API is separate; the issue is authentication with RESTCONF.
- ✓
Modify the script to use HTTP Basic Authentication and disable CSRF check on the device.
Why this is correct
Older IOS XE versions require basic authentication; disabling CSRF check may be necessary.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.