Question

A network automation engineer is writing a Python script that repeatedly polls a Cisco Catalyst Center REST API for device inventory data. During a security review, an auditor flags that the script sends the administrator username and password in a Base64-encoded HTTP header on every single request. The auditor asks the engineer to redesign the authentication so that long-lived credentials are not transmitted on each API call. Which approach best addresses this concern while following Catalyst Center's intended authentication model?

Accepted Answer

Authenticate once to the token endpoint using the credentials, then include the returned time-limited token in the X-Auth-Token header on subsequent requests

Answer

Continue using HTTP Basic authentication but encrypt the Base64 header with an additional AES key shared between the client and server

Answer

Disable HTTPS and use an IPsec tunnel so the Base64-encoded credentials are protected at the network layer instead

Answer

Embed the username and password as URL query parameters so they are logged separately from the HTTP headers