API token management in Jenkins - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Jenkins CLI: List API Tokens for a User

You run the following Jenkins CLI command to list API tokens for user 'alice'. What is the expected output?

Jenkins

java -jar jenkins-cli.jar -s http://jenkins.example.com/ who-am-i --username alice --password secret

A

Authenticated as alice
User ID: alice
API Tokens:
- token1
- token2

B

Authenticated as alice
No API tokens found

C Error: Missing command 'list-api-tokens'

D Authentication failed: Invalid credentials

💡 Hint

The command 'who-am-i' shows user identity, not API tokens.

The 'who-am-i' command only confirms authentication and user identity. It does not list API tokens. If credentials are wrong, authentication fails.

🧠 Conceptual

intermediate

Purpose of Jenkins API Tokens

What is the main purpose of using API tokens in Jenkins instead of user passwords?

A To enable secure authentication for scripts and tools without exposing user passwords

B To allow users to reset their passwords automatically

C To encrypt all Jenkins data at rest

D To provide multi-factor authentication for Jenkins login

💡 Hint

Think about automation and security.

API tokens let scripts and external tools authenticate securely without using the user's actual password, reducing risk if the token is compromised.

❓ Troubleshoot

advanced

Troubleshooting Jenkins API Token Revocation

After revoking an API token for user 'bob', his automation scripts still authenticate successfully. What is the most likely reason?

A The token was regenerated with the same value

B The token was not actually revoked due to a UI caching issue

C The scripts are using a cached session cookie instead of the token

D Jenkins does not support token revocation

💡 Hint

Consider how authentication sessions work.

Jenkins sessions may remain active after token revocation, so scripts using cached session cookies can still authenticate until the session expires or is invalidated.

🔀 Workflow

advanced

Securely Creating and Using Jenkins API Tokens

Which sequence correctly describes the secure workflow to create and use a Jenkins API token for automation?

A 3,1,2,4

B 2,1,3,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Follow the logical order of accessing UI and generating tokens.

You must first log in, then go to your user profile to generate the token, then use it in scripts.

✅ Best Practice

expert

Best Practice for Managing Jenkins API Tokens in CI/CD Pipelines

What is the best practice for managing Jenkins API tokens securely in CI/CD pipeline configurations?

A Store the API token in Jenkins Credentials plugin and reference it securely in the pipeline

B Use the user's password instead of API tokens to avoid token expiration issues

C Share the API token via email with all team members for backup

D Hardcode the API token directly in the pipeline script for easy access

💡 Hint

Think about secure storage and access control.

Using Jenkins Credentials plugin keeps tokens encrypted and access controlled, avoiding exposure in scripts or logs.