Question 347 of 1,420
mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which three statements about REST API…
Which three statements about REST API authentication and security are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Token-based authentication typically uses the HTTP Authorization header to pass the token.
REST APIs often use token-based authentication (e.g., JSON Web Tokens) where the client includes a token in the HTTP Authorization header. HTTPS (TLS) is essential to encrypt the communication and protect credentials. API keys are a common method for identifying clients but are less secure than token-based methods if used alone. Basic authentication sends credentials in base64 encoding, which is not encrypted and should only be used over HTTPS. OAuth 2.0 is a framework that provides token-based authorization, often used for delegated access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Token-based authentication typically uses the HTTP Authorization header to pass the token.
Why this is correct
Correct because tokens are commonly sent in the Authorization header using the Bearer scheme.
- ✓
HTTPS is recommended for REST APIs to ensure data encryption in transit.
Why this is correct
Correct because HTTPS uses TLS to encrypt HTTP traffic, protecting sensitive data.
- ✗
API keys provide the same level of security as OAuth 2.0 tokens.
Why it's wrong here
API keys and OAuth 2.0 tokens offer distinct security models. API keys are typically static, long-lived credentials used for identifying a calling application or service, providing broad access based on their presence. OAuth 2.0 tokens, however, are dynamically issued, short-lived, and grant granular, scoped access on behalf of a resource owner, often after user consent, with an authorisation server (like Microsoft Entra ID) managing the authentication flow. While API keys are suitable for simple application identification or machine-to-machine communication, they lack the delegated authorisation, scope control, and token expiry mechanisms inherent to OAuth 2.0, which provide a significantly different security posture.
- ✗
Basic authentication over HTTP is secure because the credentials are base64-encoded.
Why it's wrong here
Incorrect because base64 encoding is not encryption; it can be easily decoded, so HTTP without TLS is insecure.
- ✓
OAuth 2.0 is an authorization framework that can be used for REST API access.
Why this is correct
Correct because OAuth 2.0 provides token-based authorization and is widely used for REST APIs.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 18, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.