In Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS), strict security policies mandate that the default administrator password must be changed immediately upon the first login. If an engineer attempts to access the NFVIS web portal or REST API before completing this initial password reset via the CLI (console or SSH), the system blocks access and returns a 401 Unauthorized HTTP error. The portal and API do not support the forced password change prompt natively, requiring the administrator to fulfill this prerequisite through a terminal session before web-based management is permitted.

B. Portal access (HTTPS) and API access are enabled by default on the management interface out-of-the-box; they do not require manual enablement via an SSH session.

C. A 401 Unauthorized error specifically denotes an authentication or credential failure. A stopped or frozen Tomcat service would typically result in a timeout or a 503/502 server error.

D. A browser certificate issue usually triggers an SSL/TLS security warning (e.g., NET::ERR_CERT_AUTHORITY_INVALID) in the browser, not a 401 Unauthorized HTTP status code from the API.

Cisco Systems. (2021). Cisco Enterprise Network Function Virtualization Infrastructure Software Configuration Guide, Release 4.x. Section: "Installing and Accessing Cisco Enterprise NFVIS" -> "Logging in to Cisco NFVIS". (Details the requirement to change the default admin password on first login to avoid API/Portal access denial).

Cisco Systems. (2020). Cisco Enterprise NFV Infrastructure Software (NFVIS) REST API Reference Guide. Section: "Authentication and Authorization". (Specifies that 401 Unauthorized responses occur when API requests are made using expired, invalid, or un-reset default credentials).