300-445 Question 161
Select 2You are tasked with testing the authentication methods of a web application that handles sensitive data. The web application requires secure user authentication and supports single sign-on (SSO). The development team has implemented OAuth 2.0 and SAML. Which two authentication methods are most appropriate to test in this scenario?
- A
Basic authentication
- B
Digest authentication
- C
OAuth 2.0
- D
SAML
- E
Bearer tokens
Show answer and explanation
Correct answers: C, D
Explanation
OAuth 2.0 and SAML are the most appropriate methods to test in this scenario because they are modern, secure, and specifically designed to handle authentication for applications requiring SSO and secure data handling. OAuth 2.0 allows token-based authentication and delegated access, while SAML facilitates SSO, making them ideal for the application's needs.
- A. Incorrect.
Basic authentication is not secure for sensitive data as it transmits credentials (username and password) in Base64 format, which can be intercepted if not used over HTTPS.
- B. Incorrect.
Digest authentication is more secure than basic authentication but is considered outdated and not commonly used for modern applications requiring advanced security features.
- C. Correct.
OAuth 2.0 is a widely used mechanism for secure authentication and authorization, especially in applications requiring delegation and token-based access. It is suitable for the scenario described.
- D. Correct.
SAML (Security Assertion Markup Language) is a protocol designed to facilitate secure SSO (Single Sign-On) and is commonly used in enterprise environments for secure authentication.
- E. Incorrect.
Bearer tokens are a mechanism used within OAuth 2.0, but they are not an independent authentication method. They are part of the OAuth framework and are not directly tested as separate methods.