CISSP Question #128: Real Exam Question with Answer & Explanation

Question

Which of the following methods provides the MOST protection for user credentials?

Options

• AForms-based authentication
• BDigest authentication
• CBasic authentication
• DSelf-registration

Explanation

This question tests knowledge of web authentication methods and their relative security levels for protecting user credentials in transit.

Common mistakes.

• A. Forms-based authentication transmits credentials in plaintext via HTTP POST unless TLS/SSL is explicitly implemented, meaning the protection level depends entirely on the underlying transport security rather than the authentication method itself.
• C. Basic authentication encodes credentials using Base64 rather than encrypting or hashing them, making it trivially easy to decode intercepted credentials since Base64 is not a security mechanism.
• D. Self-registration is a user account creation process, not an authentication method, and provides no inherent protection for credentials during the login process.

Concept tested. Comparing web authentication methods and credential security

Reference. https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/digestauthentication

No community discussion yet for this question.