101 · Question #709
A user fails to provide credentials when requesting a web resource that requires authentication. Which HTTP response code does the server send?
The correct answer is C. HTTP 401. HTTP 401 Unauthorized is the correct response when a client fails to supply authentication credentials for a protected resource. Other codes in this list serve entirely different purposes.
Question
A user fails to provide credentials when requesting a web resource that requires authentication. Which HTTP response code does the server send?
Options
- AHTTP 200
- BHTTP 302
- CHTTP 401
- DHTTP 502
How the community answered
(50 responses)- A4% (2)
- C94% (47)
- D2% (1)
Why each option
HTTP 401 Unauthorized is the correct response when a client fails to supply authentication credentials for a protected resource. Other codes in this list serve entirely different purposes.
HTTP 200 OK indicates the request succeeded and the server is returning the requested content - the opposite of an authentication failure.
HTTP 302 Found is a redirection response used to temporarily point the client to a different URL, not to signal missing authentication.
HTTP 401 Unauthorized is defined in RFC 7235 as the response a server must send when a request lacks valid authentication credentials for a protected resource. It signals that the client must authenticate itself to get the requested response, and typically includes a WWW-Authenticate header indicating the authentication scheme required.
HTTP 502 Bad Gateway indicates a server acting as a proxy received an invalid response from an upstream server - a server-side network error unrelated to client authentication.
Concept tested: HTTP authentication response codes
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/401
Topics
Community Discussion
5
Lena V.Jun 26, 2026HTTP 401 Unauthorized is the correct answer. The server sends this when a request hits a protected resource and authentication credentials are either missing or not provided at all. It is the server saying "I do not know who you are, so prove it before I hand over this resource." The 401 is specifically about missing or absent authentication, which is exactly the scenario here. The other options are wrong because 200 means success, 302 is a redirect, and 502 means bad gateway, which is a server-to-server communication error.
Mei-Ling H.Jun 26, 2026I kept reading "fails to provide" as a redirect scenario, but 401 means the server is literally asking for credentials it never got.
Toby R.Jun 26, 2026Got this one almost exactly on my exam, the scenario said something like "a user tries to access a protected page without logging in, what code does the server return" and the answer is C, HTTP 401 Unauthorized. I was glad I drilled this one beforehand because 302 was sitting there trying to trick you into thinking redirect, but 302 is for actually sending the client somewhere else, not telling them their creds are missing.
Carlos M.Jun 26, 2026C is right, 401 Unauthorized is what the server throws back when credentials are missing or not provided at all (as opposed to 403, which is when you have credentials but still lack permission). Quick thing to nail down though: do you know what the difference is between 401 and 407, since both deal with auth but one is specific to proxy authentication?
Lena V.Jun 29, 2026407 is the same handshake as 401 but the challenge comes from a proxy server instead of the origin, so the client must resend credentials via Proxy-Authorization rather than Authorization.