350-401 Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The script is missing the X-XSRF-TOKEN header.

  Why it's wrong here

  The X-XSRF-TOKEN header is required for POST, PUT, and DELETE requests to prevent CSRF attacks, but not for GET requests. For a GET request, only the session cookie is needed. A missing X-XSRF-TOKEN would not cause a 401 on a GET; it might cause a 403 on a POST. Thus, this is not the cause.

• ✓

  The script has not obtained a valid session token via the /j_security_check endpoint.

  Why this is correct

  The vManage REST API requires authentication using a session token. The client must first POST credentials to /j_security_check to obtain a JSESSIONID cookie, which is then included in subsequent requests. Without this token, the server returns 401 Unauthorized. The script must authenticate before accessing /dataservice/device. This is the most likely cause of the error.

• ✗

  The script is using the wrong HTTP method; it should use POST instead of GET.

  Why it's wrong here

  The /dataservice/device endpoint supports GET to retrieve device information. Using POST would be incorrect and might result in a 405 Method Not Allowed, not a 401. The 401 clearly indicates an authentication failure, so the HTTP method is not the issue. The script must authenticate first.

• ✗

  The script is using HTTP instead of HTTPS.

  Why it's wrong here

  The vManage API requires HTTPS, but using HTTP would typically result in a connection error or a redirect, not a 401 Unauthorized. A 401 indicates an authentication issue. While HTTPS is mandatory, the error specifically points to missing or invalid credentials, not the protocol. Therefore, this is not the most likely cause.

Go deeper

Related to this question