200-901 Software Development and Design Practice Question
A network automation script uses the requests library to retrieve device information from a REST API. The API requires authentication via a bearer token. Which code example correctly sets the Authorization header?
⚠ Common exam trap
Cisco often tests the distinction between the 'Bearer' scheme and other authentication methods, and the trap here is that candidates confuse the auth parameter (which only supports Basic/Digest) with the need to manually set the Authorization header for bearer tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
headers = {'Authorization': 'Bearer ' + token}\nresponse = requests.get(url, headers=headers)
It constructs the Authorization header using the 'Bearer' scheme, which is the standard method for passing OAuth 2.0 bearer tokens in HTTP requests. The requests library requires the header to be explicitly set as a dictionary, and the token must be prefixed with 'Bearer ' to comply with RFC 6750.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
headers = {'Authorization': 'Token ' + token}\nresponse = requests.get(url, headers=headers)
Why it's wrong here
The scheme word 'Token' does not match the bearer authentication scheme the API requires, so the server rejects the header. It is tempting because it still places the credential in the Authorization header, which suits APIs that explicitly document a custom Token scheme rather than OAuth 2.0 bearer tokens.
- ✗
response = requests.get(url, headers={'Authorization': token})
Why it's wrong here
Omitting the 'Bearer ' scheme prefix means the header value is not a valid bearer credential, so authentication fails. It is tempting because it does populate the Authorization header with the token, which suits APIs that accept a raw key in a custom header name rather than the standard bearer format.
- ✓
headers = {'Authorization': 'Bearer ' + token}\nresponse = requests.get(url, headers=headers)
Why this is correct
The Authorization header must carry the literal scheme 'Bearer' followed by a space and the token value. Concatenating 'Bearer ' with the token and passing the dictionary via the headers parameter sets this correctly for the authenticated GET request.
- ✗
response = requests.get(url, auth=('Bearer', token))
Why it's wrong here
Passing auth=('Bearer', token) triggers HTTP Basic authentication, base64-encoding the pair into a Basic header rather than sending a bearer token. It is tempting because requests' auth parameter handles credentials cleanly, but bearer tokens belong in a headers dictionary as {'Authorization': 'Bearer <token>'}.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.