350-201 Question 270
Single answerA company is developing a custom application that interfaces with a Cisco Secure Firewall Management Center (FMC) API. The developers must ensure secure authentication for the API by using a mechanism that avoids exposing sensitive credentials in every API request. Which authentication mechanism should the developers implement?
- A
Basic authentication
- B
OAuth token-based authentication
- C
API key in query parameters
- D
Custom token passed in HTTP headers
Show answer and explanation
Correct answer: B
Explanation
OAuth token-based authentication provides a secure way to interact with APIs by using tokens instead of transmitting sensitive credentials in every request. This method ensures that credentials are only used during the initial authentication process, and tokens can be configured to expire, further enhancing security. It is widely regarded as the best practice for securing API communications.
- A. Incorrect.
Basic authentication transmits credentials (username and password) in every API request, making it less secure unless combined with encryption such as HTTPS. It is not the most secure option for production environments.
- B. Correct.
OAuth token-based authentication is a secure mechanism that avoids exposing credentials in every API request. Instead, a token is used after an initial authentication process, reducing the risk of credential exposure.
- C. Incorrect.
Using an API key in query parameters is not recommended because query parameters can be logged or exposed in URLs, making this method less secure.
- D. Incorrect.
Custom tokens passed in HTTP headers could be secure, but they often rely on custom implementation, which may introduce vulnerabilities if not done properly. OAuth tokens are a standard, secure approach.