Free Cisco 350-401 Practice Exam with Questions & Answers | Set: 5

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

The correct answer is B. TLS or SSL for communication.

In basic API authentication, credentials (such as username and password) are often transmitted using Base64 encoding, which is not encrypted. This makes them vulnerable to sniffer (packet capture) attacks if sent over an unencrypted channel.

TLS (Transport Layer Security) and its predecessor SSL provide encryption of the communication channel.

This ensures that even if packets are captured, the credentials remain confidential and unreadable.

Cisco documentation emphasizes that APIs (RESTCONF, HTTP-based APIs) should use HTTPS (HTTP over TLS) to secure credentials in transit.

A. VPN connection between client and server While a VPN encrypts traffic, it is not specifically required for API authentication security. The standard and expected method is TLS/HTTPS.

C. AAA services to authenticate the API AAA controls who can access, but it does not encrypt credentials in transit.

D. next-generation firewall A firewall provides traffic filtering and threat protection but does not directly secure credential transmission in basic API authentication.

Basic Authentication = NOT secure by itself

Always pair it with HTTPS (TLS encryption)

Rule to remember:

If credentials travel over the network → encrypt with TLS

1 and 3 – Configuration

4 and 5 – Orchestration