mediumMultiple Choice
200-901 Practice Question: When making API calls to Cisco DNA Center, a…
When making API calls to Cisco DNA Center, a developer receives a 401 Unauthorized error. The token was obtained using the token API endpoint. What is the most likely reason?
⚠ Common exam trap
Cisco often tests the distinction between authentication errors (401) and other HTTP errors (400, 404, 406) to see if candidates understand that a valid but expired token still returns 401, not a different status code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token has expired
A 401 Unauthorized error when using a token obtained from the token API endpoint most commonly indicates that the token has expired. Cisco DNA Center tokens have a configurable Time-To-Live (TTL), typically defaulting to 1 hour, after which the token becomes invalid and must be refreshed via the /dna/system/api/v1/auth/token endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The request body contains invalid JSON
Why it's wrong here
Malformed JSON produces a 400 Bad Request, since the API rejects the payload during parsing before authentication is evaluated. A 401 specifically means the credential itself was rejected. Invalid JSON is worth checking when debugging 400-class errors on POST or PUT calls, but it cannot explain an authentication failure.
- ✓
The token has expired
Why this is correct
Cisco DNA Center tokens are time-limited; the token API returns a bearer token with a fixed expiry, typically one hour. Once that lifetime elapses, subsequent calls carrying the stale token are rejected with 401 Unauthorized, so the developer must request a fresh token.
- ✗
The API base URL is incorrect
Why it's wrong here
An incorrect base URL yields connection failures or 404 Not Found, because the request never reaches the authentication layer that issues 401 responses. The 401 proves the endpoint was reached and the token rejected. Verifying the base URL is the right step when calls fail with DNS or 404 errors instead.
- ✗
The HTTP header for Accept is missing
Why it's wrong here
A missing Accept header causes 406 Not Acceptable or content-negotiation failures, not 401, because authentication is evaluated independently of response-format preferences. The token was already rejected. Setting Accept correctly matters when the server returns 406 or an unexpected content type despite valid credentials.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.