200-901 Software Development and Design Practice Question
An automation engineer is writing a Python script to interact with a REST API that requires authentication. The API returns a 403 Forbidden status. Which scenario best explains this response?
⚠ Common exam trap
Cisco often tests the distinction between 401 (Unauthorized) and 403 (Forbidden), where candidates mistakenly think any authentication failure results in 401, but 403 specifically applies when the server knows the identity but denies access due to insufficient permissions or a rejected token.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authentication token is invalid, and the request is not allowed.
A 403 Forbidden status code indicates that the server understood the request but refuses to authorize it. In the context of a REST API that requires authentication, a 403 is typically returned when the client is authenticated but lacks sufficient permissions to access the resource. It can also be returned for invalid or expired tokens when the server can identify the user and explicitly denies access without offering a challenge (unlike 401, which includes a WWW-Authenticate header to prompt for credentials). A missing token, however, results in a 401 Unauthorized, as the client has not provided any authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The request was malformed and the server cannot process it.
Why it's wrong here
That would typically result in a 400 Bad Request.
- ✗
The requested resource does not exist on the server.
Why it's wrong here
That would be a 404 Not Found.
- ✗
The server is temporarily unavailable due to maintenance.
Why it's wrong here
That would be a 503 Service Unavailable.
- ✓
The authentication token is invalid, and the request is not allowed.
Why this is correct
403 Forbidden indicates that the server recognized the credentials but they do not have the required permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.