nerdexam
CompTIA

CAS-002 · Question #823

A bank is in the process of developing a new mobile application. The mobile client renders content and communicates back to the company servers via REST/JSON calls. The bank wants to ensure that the…

The correct answer is D. Authentication assertion should be stored securely on the client. Stateless REST communication requires the client to carry all authentication state with each request, since the server does not maintain session context.

Technical Integration of Enterprise Components

Question

A bank is in the process of developing a new mobile application. The mobile client renders content and communicates back to the company servers via REST/JSON calls. The bank wants to ensure that the communication is stateless between the mobile application and the web services gateway. Which of the following controls MUST be implemented to enable stateless communication?

Options

  • AGenerate a one-time key as part of the device registration process.
  • BRequire SSL between the mobile application and the web services gateway.
  • CThe jsession cookie should be stored securely after authentication.
  • DAuthentication assertion should be stored securely on the client.

How the community answered

(40 responses)
  • A
    3% (1)
  • B
    10% (4)
  • C
    3% (1)
  • D
    85% (34)

Why each option

Stateless REST communication requires the client to carry all authentication state with each request, since the server does not maintain session context.

AGenerate a one-time key as part of the device registration process.

A one-time registration key establishes device identity but does not provide a mechanism for the client to carry authentication state across subsequent stateless requests.

BRequire SSL between the mobile application and the web services gateway.

SSL/TLS secures the transport channel by providing encryption and integrity, but it does not address whether the communication model is stateful or stateless.

CThe jsession cookie should be stored securely after authentication.

Storing a jsession cookie implies server-side session management, which is a stateful mechanism and directly contradicts the requirement for stateless communication.

DAuthentication assertion should be stored securely on the client.Correct

In a stateless architecture, the server holds no session information, so the client must present an authentication assertion (such as a JWT or SAML token) with every request. Storing this assertion securely on the client device and including it in each API call allows the web services gateway to validate requests without maintaining server-side session state. This is the foundational mechanism that enables stateless RESTful communication.

Concept tested: Client-side authentication tokens for stateless REST APIs

Source: https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html

Topics

#REST API security#stateless authentication#mobile security#token-based auth

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice