Which two statements describe the authentication method used with Cisco Intersight REST API Requests? (Choose two.)

Question

Options

• AThe REST API request contains a base64-encoded signature of the message content and headers.
• BThe REST API request message body is encoded as a SHA384 hash and then signed with the API Key ID.
• CThe Cisco Intersight Web service verifies the signature of incoming request with the RSA public key for the API Key ID.
• DThe incoming REST API request is challenged by the Cisco Intersight Web service with a request for the RSA private key.
• EThe message body is encoded as a SHA256 hash if the message body is not empty and then signed with the API Key ID.

• A
  84% (47)
• B
  4% (2)
• D
  4% (2)
• E
  9% (5)

Explanation

Cisco Intersight uses HTTP Signature-based authentication, where the client signs request headers (and optionally the body digest) using their RSA private key, and the resulting signature is base64-encoded and included in the request - making A correct. On the server side, Intersight looks up the RSA public key tied to the API Key ID sent in the request and uses it to verify that signature - making C correct.

Why the distractors are wrong:

• B is wrong on the hash algorithm - Intersight uses SHA256 for body digests, not SHA384. Also, "signed with the API Key ID" is misleading; the ID is just an identifier, not the signing mechanism.
• D is wrong because the server never requests or receives the RSA private key - that would defeat the purpose of asymmetric cryptography. The private key stays with the client always.
• E gets the hash algorithm right (SHA256) but falls into the same trap as B by saying the body is "signed with the API Key ID" - the actual signing uses the RSA private key; the Key ID only tells Intersight which public key to use for verification.

Memory tip: Think of it like sealing a letter - you sign it with your private key (only you can sign), Intersight opens and verifies it with your public key (anyone registered can verify), and the whole sealed envelope is base64-encoded for transport. The "Key ID" is just your name on the envelope.

No community discussion yet for this question.