Drag and drop the REST API authentication method from the left to the description on the right.

Question

Explanation

This question tests knowledge of REST API authentication methods by requiring candidates to match each method name to its functional description. Common targets include Basic Auth, Bearer/Token, API Key, OAuth 2.0, Digest, HMAC, and mTLS.

Approach. Match each method to its mechanism: Basic Auth encodes username:password in Base64 and sends it in the Authorization header (no encryption - requires HTTPS). API Key passes a static secret via a header or query parameter to identify the caller. Bearer Token / JWT sends a signed token (often JSON Web Token) in the Authorization header; the server validates the signature without a database lookup. OAuth 2.0 is a delegation framework where a user grants a third-party app scoped access using short-lived access tokens obtained through an authorization server - credentials are never shared directly. Digest Auth hashes credentials with a server nonce so the password is never sent in cleartext. HMAC signs the entire request with a shared secret key, protecting against tampering and replay attacks. mTLS requires both client and server to present X.509 certificates, providing mutual identity verification at the transport layer.

Concept tested. REST API Authentication Methods - understanding the distinct mechanism, security properties, and use case of each method (Basic, API Key, Bearer/JWT, OAuth 2.0, Digest, HMAC, mTLS) as commonly tested on CompTIA Security+, CySA+, or similar certification exams.

Reference. CompTIA Security+ SY0-701 Domain 4 (Security Operations) - API security controls; IETF RFC 7235 (HTTP Authentication), RFC 6749 (OAuth 2.0), RFC 7519 (JWT)

No community discussion yet for this question.