A city parking portal’s browser UI must show DNA Center wireless health and Meraki SSID status. Where should the integration store platform API tokens and issue those privileged controller calls?
Select an answer to reveal the explanation.
Short Explanation
Think of the browser as the storefront window and the server as the vault. Layout and click state live in the window; DNA Center or Meraki keys stay in the vault. Putting platform secrets in front-end JavaScript is a distributed-app design failure, not a convenience.
Full Explanation
Privileged Cisco platform work belongs on a trusted server-side tier. DNA Center and Meraki tokens, controller hostnames, and any call that can mutate or reveal inventory must never ship to the clerk's browser. The parking portal's front end should request layout-ready status from that back-end, keep only presentation and local UX state, and treat platform credentials as vault material. That split is core distributed-application design for 350-901: the browser is an untrusted client, not an API gateway.
Putting tokens in front-end JavaScript fails because every clerk workstation becomes a credential holder; DevTools, XSS, or a compromised kiosk can harvest DNA Center and Meraki secrets and call the controllers outside municipal policy. Shipping secrets in a public CDN config fails for the same reason at larger scale—the file is world-readable to anyone who downloads the mobile shell. Storing secrets in localStorage fails because storage is readable by any script on the origin, survives across sessions on shared clerk workstations, and still leaves the browser as the privileged caller.
Exam caveat: a BFF or API facade that proxies status is still correct even when the UI is a SPA; SPA architecture does not authorize client-side platform tokens. OAuth for the clerk's portal login is separate from storing controller API keys.
Operational check: confirm the browser network tab never shows Meraki or DNA Center Authorization headers or token query parameters, and that token rotation is performed only on the server tier.