200-901 Infrastructure and Automation Practice Question
An organization wants to automate the deployment of wireless configurations across multiple Meraki networks using the Meraki Dashboard API. What authentication method should the developer use in the API requests?
⚠ Common exam trap
Cisco often tests the misconception that all REST APIs use OAuth2 or Basic Auth, but the Meraki API specifically uses a custom header-based API key, which candidates may overlook in favor of more common authentication methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include an API key in the X-Cisco-Meraki-API-Key header
The Meraki Dashboard API uses a simple API key for authentication, not OAuth2 or JWT. The key must be included in the `X-Cisco-Meraki-API-Key` header of every request. This is the only supported method for authenticating with the Meraki API, as documented by Cisco Meraki.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provide username and password in the Authorization header with Basic auth
Why it's wrong here
Basic auth with username and password is not the Meraki Dashboard API's supported mechanism for automated requests; the API expects a per-user API key sent in the X-Cisco-Meraki-API-Key header. It is tempting because Basic auth is a familiar HTTP standard, but it is not how Meraki authenticates dashboard API calls.
- ✗
Use OAuth2 client credentials grant and pass a bearer token
Why it's wrong here
Meraki Dashboard API requests are authenticated with a per-user API key in the X-Cisco-Meraki-API-Key header, not an OAuth2 bearer token. It is tempting because OAuth2 client credentials is a standard machine-to-machine pattern, but Meraki's dashboard does not issue tokens through that grant.
- ✓
Include an API key in the X-Cisco-Meraki-API-Key header
Why this is correct
The Meraki Dashboard API authenticates requests by placing an API key in the X-Cisco-Meraki-API-Key header, which the developer must include on every call. This header-based key satisfies the requirement to automate wireless configuration deployment across multiple networks.
- ✗
Generate a JSON Web Token (JWT) signed with a shared secret
Why it's wrong here
The Meraki Dashboard API does not accept self-signed JWTs with a shared secret; it authenticates requests using a per-user API key in the X-Cisco-Meraki-API-Key header. It is tempting because JWTs are common for stateless API auth elsewhere, but Meraki's dashboard does not implement that scheme.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.