Courseiva
← 200-901
Full test
hardMultiple Choice

200-901 Practice Question: Refer to the exhibit

Exhibit

from flask import Flask, request, jsonify
import jwt

app = Flask(__name__)
app.config['SECRET_KEY'] = 'my-secret'

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username')
    password = request.json.get('password')
    # Verify username/password (omitted)
    token = jwt.encode({'user': username}, app.config['SECRET_KEY'], algorithm='HS256')
    return jsonify({'token': token})

@app.route('/protected', methods=['GET'])
def protected():
    token = request.headers.get('Authorization')
    if not token:
        return jsonify({'msg': 'Missing token'}), 401
    try:
        # token format: "Bearer <token>"
        token = token.split()[1]
        data = jwt.decode(token, app.config['SECRET_KEY'], algorithms=['HS256'])
        return jsonify({'msg': 'Access granted', 'user': data['user']})
    except:
        return jsonify({'msg': 'Invalid token'}), 401

Refer to the exhibit. A security audit reveals that the authentication mechanism is vulnerable. Which attack is most likely possible?

⚠ Common exam trap

Cisco often tests the distinction between attacks that target the authentication mechanism itself (like token forgery) versus attacks that exploit input handling (XSS, SQLi) or transport security (MITM), leading candidates to pick a wrong option because they focus on a general security flaw (e.g., missing HTTPS) rather than the specific vulnerability implied by the token's weak secret.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Token forgery if the secret key is weak.

The exhibit shows a JSON Web Token (JWT) being used for authentication. If the secret key used to sign the JWT is weak or easily guessable, an attacker can forge a valid token by brute-forcing the secret and then crafting a token with arbitrary claims (e.g., elevated privileges). This is a classic token forgery attack, not a cross-site scripting or injection attack, because the vulnerability lies in the signing mechanism, not in input handling or transport security.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Cross-site scripting (XSS) via the token.

    Why it's wrong here

    XSS executes injected script in a victim's browser; it does not defeat an authentication mechanism itself. The exhibit's flaw concerns how credentials or tokens are validated, not output encoding. XSS would be the answer where user input is reflected into HTML without escaping.

  • ✓

    Token forgery if the secret key is weak.

    Why this is correct

    Weak HMAC signing keys let attackers brute-force the secret offline, then mint validly signed JSON Web Tokens that Microsoft Entra ID accepts as genuine. This satisfies the audit's vulnerability finding: the authentication mechanism trusts token signatures, so a compromised key permits arbitrary identity claims without any credential theft.

  • ✗

    Man-in-the-middle attack due to missing HTTPS.

    Why it's wrong here

    Missing HTTPS permits interception, but the stem attributes the vulnerability to the authentication mechanism, not transport encryption. The exhibit's credential or token handling is the flaw. Man-in-the-middle is the answer when traffic traverses plaintext HTTP and an attacker can intercept or alter it.

  • ✗

    SQL injection through the login endpoint.

    Why it's wrong here

    SQL injection exploits unsanitised database queries, not the authentication logic shown in the exhibit. The audit flags how identity is verified, not query construction. SQL injection would be correct where login input is concatenated directly into a database query without parameterisation.

About these practice questions

One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.