Cisco CCNP Enterprise 350-401 ENCOR REST API Security Practice Test

 

Topic 17 covers rest api security for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

An automation script sends administrator credentials to a controller API over plain HTTP on a management LAN. The LAN is private but shared with other systems. What is the primary security correction?

1. Change the TCP port but keep HTTP.
2. Use HTTPS/TLS and validate the API server identity.
3. Compress the request body.
4. Put the password in the URL query string.
5. Base64-encode the password twice and keep HTTP.

Correct Answer: B

 

Correct Answer

Answer B is correct because transport encryption and peer verification protect credentials from on-path observation/impersonation.

Incorrect Answers

Answer A is incorrect because an unusual port does not provide encryption. It does not satisfy the stem’s governing point: Sensitive API authentication should use authenticated TLS transport; a private network alone is not equivalent to confidentiality.

Answer C is incorrect because compression does not create confidentiality or authentication. It does not satisfy the stem’s governing point: Sensitive API authentication should use authenticated TLS transport; a private network alone is not equivalent to confidentiality.

Answer D is incorrect because URLs are frequently logged and plain HTTP still exposes the request.

Answer E is incorrect because encoding is reversible and does not provide transport confidentiality.

 

Question 2

A client uses HTTPS and encrypts the session, but it accepts any certificate without checking the presented server identity. Which security property is still missing?

1. IP routing.
2. Validate server identity.
3. Packet confidentiality.
4. Token expiration.
5. JSON syntax validation.

Correct Answer: B

 

Correct Answer

Answer B is correct because encryption without authenticating the peer can still protect a connection to the wrong endpoint.

Incorrect Answers

Answer A is incorrect because the client reached a TLS endpoint. It does not satisfy the stem’s governing point: TLS encryption and server identity validation are separate protections; clients must verify the intended peer.

Answer C is incorrect because TLS can still encrypt the established channel even if the client fails to validate identity.

Answer D is incorrect because expiry is separate from peer identity. It does not satisfy the stem’s governing point: TLS encryption and server identity validation are separate protections; clients must verify the intended peer.

Answer E is incorrect because certificate checks are transport trust, not payload syntax.

 

Question 3

A script connects to `api.example.net`, but the certificate is valid for `controller.example.net` and does not include `api.example.net` in an acceptable identity. The chain is otherwise trusted. What should the script do?

1. Add the API token to the query string to prove identity.
2. Disable DNS so hostname checks are unnecessary.
3. Change the JSON media type.
4. Ignore the mismatch because encryption still works.
5. Treat the hostname mismatch as a server-identity validation failure.

Correct Answer: E

 

Correct Answer

Answer E is correct because a trusted chain does not make a certificate valid for an unrelated hostname.

Incorrect Answers

Answer A is incorrect because a bearer token authenticates the caller and can be stolen by an impersonating endpoint.

Answer B is incorrect because the intended service identity still needs an authenticated binding.

Answer C is incorrect because payload format is unrelated to certificate identity. It does not satisfy the stem’s governing point: Certificate trust includes checking that the authenticated certificate identity matches the service name used by the client.

Answer D is incorrect because doing so weakens protection against impersonation. It does not satisfy the stem’s governing point: Certificate trust includes checking that the authenticated certificate identity matches the service name used by the client.

 

Question 4

A developer adds `verify=False` to a production Python API client to suppress a certificate error and commits it permanently. What is the main risk?

1. The token will automatically become read-only.
2. Every request will use HTTP instead of HTTPS.
3. An attacker-controlled TLS endpoint could receive the credentials.
4. JSON arrays will be decoded as strings.
5. The API will stop using encryption entirely.

Correct Answer: C

 

Correct Answer

Answer C is correct because disabling certificate validation removes the server-authentication protection that TLS clients rely on.

Incorrect Answers

Answer A is incorrect because certificate validation does not set token scope. It does not satisfy the stem’s governing point: Disabling certificate validation in production undermines server authentication and can expose API secrets to man-in-the-middle endpoints.

Answer B is incorrect because the URL can remain HTTPS while validation is disabled.

Answer D is incorrect because payload parsing is unrelated. It does not satisfy the stem’s governing point: Disabling certificate validation in production undermines server authentication and can expose API secrets to man-in-the-middle endpoints.

Answer E is incorrect because TLS may remain encrypted, but identity verification is weakened.

 

Question 5

An internal API server has a certificate signed by the company CA. The client fails validation because the company CA is not in its trust store. Policy forbids disabling verification. What is the correct remediation?

1. Trust the approved CA and verify hostnames.
2. Rename the token to `certificate`.
3. Use plain HTTP inside the office.
4. Move the access token into the URL.
5. Set `verify=False` only for this server forever.

Correct Answer: A

 

Correct Answer

Answer A is correct because adding the legitimate trust anchor fixes the trust path without bypassing validation.

Incorrect Answers

Answer B is incorrect because application header names do not build a PKI trust chain.

Answer C is incorrect because that removes transport protection. It does not satisfy the stem’s governing point: For an internal CA, establish the proper trust chain rather than disabling TLS verification.

Answer D is incorrect because token placement does not repair certificate trust. It does not satisfy the stem’s governing point: For an internal CA, establish the proper trust chain rather than disabling TLS verification.

Answer E is incorrect because that violates the stated policy and removes server authentication.

 

Question 6

A Catalyst Center client authenticates with its credentials, receives an access token, and then makes API calls. Which workflow is appropriate?

1. Send the username/password on every API call even when the token is valid.
2. Publish the token so multiple teams can share it.
3. Authenticate once, then present the returned token on later requests until renewal.
4. Use the token to log into SSH as a local password.
5. Convert the token into an SNMP community.

Correct Answer: C

 

Correct Answer

Answer C is correct because token-based APIs separate initial credential authentication from later token presentation.

Incorrect Answers

Answer A is incorrect because that unnecessarily repeats high-value credentials and ignores the documented token mechanism.

Answer B is incorrect because tokens are credentials and should not be broadly exposed.

Answer D is incorrect because API tokens are scoped to their API mechanism, not generic CLI login.

Answer E is incorrect because the mechanisms are unrelated. It does not satisfy the stem’s governing point: Token-based APIs commonly exchange credentials once for a limited-life token used on subsequent authorized calls.

 

Question 7

A script calls `https://controller/api/devices?access_token=SECRET123`. The web proxy logs full URLs. What is the security concern?

1. Keep tokens out of URLs; use authorization headers.
2. Tokens in URLs cannot be replayed.
3. HTTPS makes server/proxy logs unable to record the request URI.
4. Query strings are always encrypted at rest by every proxy.
5. The only issue is URL length.

Correct Answer: A

 

Correct Answer

Answer A is correct because bearer tokens in URLs have a high risk of being retained in logs and other metadata.

Incorrect Answers

Answer B is incorrect because a stolen bearer token may be reusable while valid.

Answer C is incorrect because the terminating proxy/server can still log the URI.

Answer D is incorrect because that is not guaranteed and is exactly why URI token transport is discouraged.

Answer E is incorrect because the decisive issue is credential exposure. It does not satisfy the stem’s governing point: Do not place bearer-like API tokens in URLs when headers are supported; URLs are commonly logged.

 

Question 8

Debug logging is enabled for an automation process. Logs now contain full `Authorization` and `X-Auth-Token` headers. What should be changed?

1. Redact secrets from logs and rotate credentials already exposed.
2. Move the same tokens into filenames.
3. Disable HTTPS so the log values match network captures.
4. Encode the token with Base64 before logging it.
5. Keep the secrets because debugging data is always private.

Correct Answer: A

 

Correct Answer

Answer A is correct because logs are often broadly accessible and long-lived; authentication secrets should not be written there.

Incorrect Answers

Answer B is incorrect because that creates another exposure path. It does not satisfy the stem’s governing point: Protect API credentials and tokens from diagnostic logging; exposure should trigger containment/rotation according to policy.

Answer C is incorrect because that worsens security. It does not satisfy the stem’s governing point: Protect API credentials and tokens from diagnostic logging; exposure should trigger containment/rotation according to policy.

Answer D is incorrect because encoding does not make the secret non-sensitive. It does not satisfy the stem’s governing point: Protect API credentials and tokens from diagnostic logging; exposure should trigger containment/rotation according to policy.

Answer E is incorrect because debug logs can be copied, archived and accessed by additional systems/users.

 

Question 9

An API token returns 401 after the platform-documented lifetime expires. The script still has valid service credentials. What is the correct response?

1. Change every API method to DELETE.
2. Put the expired token in the URL.
3. Re-authenticate and use the newly issued token.
4. Disable TLS because token expiration is a certificate problem.
5. Keep retrying the expired token indefinitely.

Correct Answer: C

 

Correct Answer

Answer C is correct because limited-life tokens are expected to require renewal/re-authentication. This directly matches the stem’s governing point: Handle documented token expiration by obtaining a new authorized token rather than weakening transport or retrying forever.

Incorrect Answers

Answer A is incorrect because HTTP method has nothing to do with credential renewal.

Answer B is incorrect because changing transport location does not renew it. It does not satisfy the stem’s governing point: Handle documented token expiration by obtaining a new authorized token rather than weakening transport or retrying forever.

Answer D is incorrect because expiry is an application credential lifecycle issue. It does not satisfy the stem’s governing point: Handle documented token expiration by obtaining a new authorized token rather than weakening transport or retrying forever.

Answer E is incorrect because expiry will not be fixed by identical retries.

 

Question 10

A developer says HTTP Basic credentials are safe on plain HTTP because `username:password` is Base64 encoded. What is the correction?

1. The only concern is JSON formatting.
2. Base64 is stronger than TLS because it changes the characters.
3. Plain HTTP becomes encrypted when an Authorization header is present.
4. Base64 is encoding; protect Basic credentials with TLS.
5. Basic authentication hashes the password automatically.

Correct Answer: D

 

Correct Answer

Answer D is correct because Base64 is readily reversible and does not provide confidentiality.

Incorrect Answers

Answer A is incorrect because credential confidentiality is the relevant issue. It does not satisfy the stem’s governing point: Do not mistake Base64 encoding for encryption; Basic authentication relies on TLS for transport confidentiality.

Answer B is incorrect because representation change is not cryptographic protection. It does not satisfy the stem’s governing point: Do not mistake Base64 encoding for encryption; Basic authentication relies on TLS for transport confidentiality.

Answer C is incorrect because HTTP headers do not enable TLS. It does not satisfy the stem’s governing point: Do not mistake Base64 encoding for encryption; Basic authentication relies on TLS for transport confidentiality.

Answer E is incorrect because the standard scheme transmits a Base64 representation, not a protective password hash.

 

Question 11

An API call presents a valid token and the platform identifies the caller, but a configuration endpoint returns 403 because the assigned role is read-only. What distinction is shown?

1. Authenticated, but not authorized.
2. The token must be expired.
3. TLS encryption failed.
4. The caller is anonymous because 403 means no identity.
5. The JSON is necessarily malformed.

Correct Answer: A

 

Correct Answer

Answer A is correct because identity validation and permission checks are separate. This directly matches the stem’s governing point: Authentication proves who the caller is; authorization determines whether that identity may perform a specific API action.

Incorrect Answers

Answer B is incorrect because an expired/invalid credential commonly produces 401 rather than the stated authorized identity with insufficient permission.

Answer C is incorrect because an application authorization decision was returned. It does not satisfy the stem’s governing point: Authentication proves who the caller is; authorization determines whether that identity may perform a specific API action.

Answer D is incorrect because the scenario states a valid token and identified user.

Answer E is incorrect because malformed requests use different error semantics. It does not satisfy the stem’s governing point: Authentication proves who the caller is; authorization determines whether that identity may perform a specific API action.

 

Question 12

A monitoring integration only needs to read device health. Which account design best follows least privilege?

1. Give the account configuration-write access in case it is needed someday.
2. Reuse a human administrator password in the script.
3. Use a shared super-admin token because it works for every endpoint.
4. Disable authentication for the health endpoint.
5. Use a dedicated identity with only the read permissions/scopes required for health retrieval.

Correct Answer: E

 

Correct Answer

Answer E is correct because least privilege limits the blast radius if the integration or token is compromised.

Incorrect Answers

Answer A is incorrect because unneeded future permissions violate least privilege. It does not satisfy the stem’s governing point: Grant API integrations only the permissions needed for their documented operational role.

Answer B is incorrect because dedicated automation identities are safer and more auditable.

Answer C is incorrect because excess privilege increases risk and weakens attribution. It does not satisfy the stem’s governing point: Grant API integrations only the permissions needed for their documented operational role.

Answer D is incorrect because sensitive management APIs should remain controlled. It does not satisfy the stem’s governing point: Grant API integrations only the permissions needed for their documented operational role.

 

Question 13

Ten automation jobs share one service account with full administrator rights even though nine are read-only and one deploys templates. What is the security weakness?

1. The shared account has excessive scope and expands both compromise impact and attribution ambiguity; split identities/roles by need.
2. Read-only jobs cannot use API tokens.
3. The account should be placed in URL query strings.
4. Template deployment requires every other job to be admin too.
5. Having more than one job automatically invalidates a token.

Correct Answer: A

 

Correct Answer

Answer A is correct because least privilege and separable identities reduce risk and improve auditability.

Incorrect Answers

Answer B is incorrect because they can use appropriately authorized tokens. It does not satisfy the stem’s governing point: Do not use one overprivileged shared service identity for unrelated jobs with different permission needs.

Answer C is incorrect because that would further expose credentials. It does not satisfy the stem’s governing point: Do not use one overprivileged shared service identity for unrelated jobs with different permission needs.

Answer D is incorrect because permissions need not be shared broadly. It does not satisfy the stem’s governing point: Do not use one overprivileged shared service identity for unrelated jobs with different permission needs.

Answer E is incorrect because token validity is platform-specific and not the core issue.

 

Question 14

A human administrator logs into a portal, while a backend automation service uses its own client/service identity. Why should security policy keep these identities conceptually separate?

1. Human accounts cannot ever call APIs.
2. Separate identities disable TLS.
3. They represent different actors and audit/privilege lifecycles; permissions and credentials can be managed without impersonating a human user.
4. Both identities must always share the same password.
5. Applications cannot authenticate to APIs.

Correct Answer: C

 

Correct Answer

Answer C is correct because separate identities improve least privilege, revocation and attribution.

Incorrect Answers

Answer A is incorrect because humans may call APIs, but the question is about distinct actors.

Answer B is incorrect because identity design is independent of transport encryption. It does not satisfy the stem’s governing point: Distinguish human and application/service identities so privileges, lifecycle and audit attribution match the actual actor.

Answer D is incorrect because that would defeat separation. It does not satisfy the stem’s governing point: Distinguish human and application/service identities so privileges, lifecycle and audit attribution match the actual actor.

Answer E is incorrect because service/application identities are common. It does not satisfy the stem’s governing point: Distinguish human and application/service identities so privileges, lifecycle and audit attribution match the actual actor.

 

Question 15

A backup automation role must read configurations and trigger approved backups but must not change network policy. Which control is most important?

1. Use a longer token so permissions matter less.
2. Share the network-admin token with the backup job.
3. Disable certificate validation to simplify backups.
4. Give full write access but document that the script should not use it.
5. Assign API permissions/scopes that allow only the required read/backup actions and deny unrelated configuration changes.

Correct Answer: E

 

Correct Answer

Answer E is correct because role authorization should match the documented operational responsibility.

Incorrect Answers

Answer A is incorrect because token lifetime does not replace authorization. It does not satisfy the stem’s governing point: Enforce an automation role with API authorization boundaries matched to its required actions.

Answer B is incorrect because that violates least privilege and attribution. It does not satisfy the stem’s governing point: Enforce an automation role with API authorization boundaries matched to its required actions.

Answer C is incorrect because that weakens transport trust. It does not satisfy the stem’s governing point: Enforce an automation role with API authorization boundaries matched to its required actions.

Answer D is incorrect because policy should enforce the boundary, not rely only on convention.

 

Question 16

A Python script is stored in a shared Git repository. It currently contains `USERNAME=”admin”` and `PASSWORD=”…”`. Which design is safer?

1. Obfuscate the password by reversing its characters in the source.
2. Rename the variables so reviewers cannot identify them.
3. Retrieve secrets at runtime from an approved secret manager/environment credential facility with access controls, leaving source code free of plaintext secrets.
4. Commit the token instead of the password.
5. Make the repository public so access is consistent.

Correct Answer: C

 

Correct Answer

Answer C is correct because separating secrets from source reduces repository leakage and supports rotation.

Incorrect Answers

Answer A is incorrect because simple obfuscation is reversible and still stores the secret.

Answer B is incorrect because security does not come from variable names. It does not satisfy the stem’s governing point: Store automation secrets outside source control in an access-controlled secret facility or equivalent runtime mechanism.

Answer D is incorrect because tokens are credentials too and should not be stored in source.

Answer E is incorrect because that increases exposure. It does not satisfy the stem’s governing point: Store automation secrets outside source control in an access-controlled secret facility or equivalent runtime mechanism.

 

Question 17

A bearer token appears in a public issue attachment. The token has not yet expired. What should the operator do first?

1. Wait for expiration because nobody may notice it.
2. Disable API logging permanently.
3. Base64-encode the same token and continue using it.
4. Revoke/invalidate the exposed token or associated credential as supported, remove the exposure, and issue a replacement through the approved process.
5. Change only the filename of the attachment.

Correct Answer: D

 

Correct Answer

Answer D is correct because once exposed, a bearer credential should be treated as compromised rather than trusted until natural expiry.

Incorrect Answers

Answer A is incorrect because continued validity leaves an avoidable replay window. It does not satisfy the stem’s governing point: Respond to exposed API credentials by invalidating/rotating them promptly and containing the disclosure.

Answer B is incorrect because logging policy does not revoke the leaked credential.

Answer C is incorrect because encoding does not change the compromised secret. It does not satisfy the stem’s governing point: Respond to exposed API credentials by invalidating/rotating them promptly and containing the disclosure.

Answer E is incorrect because that does not invalidate copies already obtained. It does not satisfy the stem’s governing point: Respond to exposed API credentials by invalidating/rotating them promptly and containing the disclosure.

 

Question 18

An attacker steals a valid bearer token from a client and sends it from another host before it expires. The API accepts tokens based only on possession and scope. What risk is illustrated?

1. Bearer-token replay: possession of the secret may be sufficient to use it until revocation/expiration, subject to its scope.
2. A certificate renewal event.
3. An STP loop.
4. A JSON syntax attack only.
5. A DNS caching benefit.

Correct Answer: A

 

Correct Answer

Answer A is correct because bearer credentials do not inherently prove the original client still possesses them exclusively.

Incorrect Answers

Answer B is incorrect because the stolen credential can be replayed independently of server cert renewal.

Answer C is incorrect because Layer 2 topology is unrelated. It does not satisfy the stem’s governing point: Bearer tokens must be protected from disclosure because a thief can often replay them while valid and in scope.

Answer D is incorrect because the token is valid; the risk is credential replay.

Answer E is incorrect because DNS is unrelated. It does not satisfy the stem’s governing point: Bearer tokens must be protected from disclosure because a thief can often replay them while valid and in scope.

 

Question 19

Every automation script uses the same `netadmin` identity. Audit logs show a dangerous policy change from that identity, but the team cannot determine which job performed it. What design improves attribution?

1. Use one even more privileged shared identity.
2. Disable audit logging because it did not identify the script.
3. Put the shared token in every URL so it appears in proxy logs.
4. Use distinct automation identities/tokens per service or responsibility, with least privilege and auditable ownership.
5. Change the API server hostname after each job.

Correct Answer: D

 

Correct Answer

Answer D is correct because separate identities make actions attributable and independently revocable.

Incorrect Answers

Answer A is incorrect because that increases the problem. It does not satisfy the stem’s governing point: Separate automation identities improve attribution, least privilege and credential lifecycle management.

Answer B is incorrect because removing evidence worsens accountability. It does not satisfy the stem’s governing point: Separate automation identities improve attribution, least privilege and credential lifecycle management.

Answer C is incorrect because that leaks the credential. It does not satisfy the stem’s governing point: Separate automation identities improve attribution, least privilege and credential lifecycle management.

Answer E is incorrect because hostname changes do not identify the calling application.

 

Question 20

An API client validates TLS correctly, but it blindly copies a user-supplied string into a JSON field that later becomes a device CLI template variable. Which statement is correct?

1. A longer token prevents malicious input.
2. TLS guarantees every received value is safe to execute.
3. Certificate validation automatically escapes CLI metacharacters.
4. Input validation makes HTTPS unnecessary.
5. Transport protection does not validate application input; the workflow still needs schema/input validation and safe handling at the downstream boundary.

Correct Answer: E

 

Correct Answer

Answer E is correct because TLS protects data in transit, not the semantic safety of user-controlled values.

Incorrect Answers

Answer A is incorrect because credential lifetime is unrelated to data validation. It does not satisfy the stem’s governing point: Transport security and input validation are separate controls; authenticated encrypted data can still contain unsafe or invalid values.

Answer B is incorrect because encryption/authentication do not establish input correctness. It does not satisfy the stem’s governing point: Transport security and input validation are separate controls; authenticated encrypted data can still contain unsafe or invalid values.

Answer C is incorrect because certificate checks do not transform payload content. It does not satisfy the stem’s governing point: Transport security and input validation are separate controls; authenticated encrypted data can still contain unsafe or invalid values.

Answer D is incorrect because both controls protect different risks. It does not satisfy the stem’s governing point: Transport security and input validation are separate controls; authenticated encrypted data can still contain unsafe or invalid values.