200-901 Network Fundamentals Practice Question
A network engineer is using a REST API to retrieve a list of network devices from a controller. The API requires authentication using a token. Which HTTP header should be used to include the token in the request?
⚠ Common exam trap
Many candidates confuse the Authorization header with other headers like Content-Type, which specify data format rather than credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
For token-based authentication in REST APIs, the token is sent in the Authorization header, typically using the Bearer scheme. This header is designed to carry credentials and is processed by the server to validate the client's identity. Other headers like Content-Type and Accept serve different purposes and do not authenticate the request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization
Why this is correct
The Authorization header is used to carry credentials for authenticating the client with the server. For token-based authentication, the token is typically included as 'Bearer <token>'. This is the standard way to send authentication information in HTTP requests, and it is expected by most REST APIs.
- ✗
Accept
Why it's wrong here
The Accept header tells the server what media types the client can handle in the response, such as application/json. It is used for content negotiation, not authentication. Including a token in Accept would not authenticate the request and would likely be ignored.
- ✗
Content-Type
Why it's wrong here
The Content-Type header indicates the media type of the request body, such as application/json. It does not carry authentication credentials. While it is important for specifying the format of data sent, it is not used for token authentication.
- ✗
User-Agent
Why it's wrong here
The User-Agent header identifies the client software making the request, such as a browser or script. It is used for analytics and compatibility, not for authentication. Sending a token in User-Agent would not be recognized as valid authentication by the server.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.