200-901 Infrastructure and Automation Practice Question
An engineer is writing a Python script using the Cisco DevNet sandbox to configure OSPF on a CSR1000v via RESTCONF. What authentication method is typically used for RESTCONF requests?
⚠ Common exam trap
Cisco often tests the distinction between RESTCONF and NETCONF authentication, where candidates might mistakenly think RESTCONF uses SSH keys or no authentication, but RESTCONF always requires HTTPS-based authentication, typically Basic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Basic authentication over HTTPS
RESTCONF typically uses Basic authentication over HTTPS (RFC 7235) because it is a lightweight, stateless mechanism that sends a base64-encoded username:password pair in the Authorization header. In the Cisco DevNet sandbox CSR1000v environment, this is the standard method for authenticating RESTCONF requests, as the sandbox provides a username and password for access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No authentication
Why it's wrong here
RESTCONF runs over HTTPS and requires credentials; unauthenticated requests to a CSR1000v return 401. The sandbox still enforces AAA. No authentication applies only to deliberately open lab endpoints or initial discovery of the RESTCONF root, not configuration pushes.
- ✗
OAuth2
Why it's wrong here
IOS XE RESTCONF uses HTTP Basic authentication against the local or AAA user database; OAuth2 requires an authorisation server issuing bearer tokens, which the CSR1000v does not provide natively. OAuth2 is correct for controller-based APIs such as Cisco DNA Center, not device-level RESTCONF.
- ✗
API token only
Why it's wrong here
RESTCONF on IOS XE authenticates each request with HTTP Basic credentials (username and password), not a bearer token; there is no token-issuing endpoint. API tokens fit platforms such as Meraki or DNA Center, where a token is issued and presented in a header.
- ✓
Basic authentication over HTTPS
Why this is correct
RESTCONF requests to the CSR1000v sandbox carry an HTTP Basic authentication header containing base64-encoded username and password, transported inside the TLS tunnel that HTTPS provides. No OAuth token exchange or certificate-based mutual authentication is required.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 975-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.