350-401 · Question #711
350-401 Question #711: Real Exam Question with Answer & Explanation
The correct answer is A: separation of privilege. REST Security Design Principle Explained Separation of privilege is a core REST security design principle, meaning that access to resources should require multiple conditions or credentials to be met, ensuring no single point of failure grants full system access. This aligns with
Question
What is one main REST security design principle?
Options
- Aseparation of privilege
- Bpassword hashing
- Cconfidential algorithms
- DOAuth
Explanation
REST Security Design Principle Explained
Separation of privilege is a core REST security design principle, meaning that access to resources should require multiple conditions or credentials to be met, ensuring no single point of failure grants full system access. This aligns with REST's stateless, resource-based architecture where each resource should have distinct, minimal access rights assigned only to those who need them.
Why the distractors are wrong:
- Password hashing (B) is a general cryptographic practice, not a REST-specific design principle - it's an implementation technique used across many systems
- Confidential algorithms (C) actually contradicts good security practice (Kerckhoffs's principle says algorithms should be public, only keys kept secret)
- OAuth (D) is an authorization framework/protocol commonly used with REST APIs, but it is not itself a REST security design principle
💡 Memory Tip: Think of REST security principles using the acronym "SALT" - Separate privileges, Authenticate properly, Limit exposure, and Trust minimally. "Separation of privilege" mirrors the real-world idea of needing both a key and a PIN to access a safe - no single credential rules all.
Topics
Community Discussion
No community discussion yet for this question.