mediumMultiple Choice
200-901 Practice Question: In a Cisco DNA Center environment, an application…
In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?
⚠ Common exam trap
Cisco often tests the distinction between the authentication method used to obtain a token (Basic Auth) versus the method used to authorize subsequent API calls (Bearer token), leading candidates to mistakenly select Basic Authentication for all requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests
Cisco DNA Center uses token-based authentication. The correct flow is to first send a POST request to the /dna/system/api/v1/auth/token endpoint with a valid username and password (typically using Basic Authentication over HTTPS). The response contains a JSON Web Token (JWT) that must be included in the X-Auth-Token header of all subsequent API requests. This token has a configurable expiry (default 60 minutes) and must be refreshed before it expires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OAuth 2.0 client credentials grant with client ID and secret
Why it's wrong here
Cisco DNA Center's REST API does not accept OAuth 2.0 client credentials; it authenticates with HTTP Basic credentials to obtain a token, or uses token-based X-Auth-Token headers. It is tempting because OAuth 2.0 client credentials is the standard machine-to-machine grant, and would be correct for APIs designed around OAuth, such as many cloud services.
- ✓
Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests
Why this is correct
Cisco DNA Center requires token-based authentication: credentials are Base64-encoded and POSTed to /dna/system/api/v1/auth/token, which returns a time-limited token. Subsequent REST calls must include this token in the X-Auth-Token header, satisfying the stem's requirement to retrieve the device list securely without resending credentials per request.
- ✗
Basic authentication with username and password in the header
Why it's wrong here
Basic authentication with username and password in the header is not the required method; DNA Center expects credentials posted to the authentication endpoint to obtain a token, which is then sent as X-Auth-Token. It is tempting because Basic auth is simple and widely supported, and would be correct for many REST APIs that accept credentials directly per request.
- ✗
API key passed in a query parameter
Why it's wrong here
DNA Center does not authenticate REST calls with an API key in a query parameter; it issues a time-limited token via its authentication API, returned in the X-Auth-Token header. It is tempting because API keys are common for public REST services, and would be correct for platforms such as Meraki or various cloud APIs.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.