Exam 350-401 topic 1 question 980 discussion

API Keys is the correct answer because here we are asked about stateless authentication and authorization , 0Auth and cookie-based is stateful authentication . SSL/TLS are encryption mechanisms . B)API Keys we have them in the Header you would see something similar Auth=( "user" : "password")

OAuth is the only option available that does authorization. The answer is A.

OAuth 2.0 -> tokens for stateless authentication and authorization. API keys -> only for authentication.

API keys are a simple way to authenticate requests to an API, but they are not typically used for authorization and do not provide the same level of security as OAuth 2 tokens. They also do not inherently provide stateless authentication. Ans is A

A is correct

Answer A https://doubleoctopus.com/security-wiki/network-architecture/stateless-authentication/

A is right

Reference: https://frontegg.com/guides/api-authentication-api-authorization OAth2 tokens: OAuth 2.0 involves several roles, including the resource owner, the client, the authorization server, and the resource server. API keys: API key-based authentication involves sending an API key along with a request. An API key is a unique identifier that is issued by the API provider to authorized users or applications, and is used to identify and track API usage. Since stateless does not requiere a server I think the correct one is B.

A- OAuth 2 is a (stateful+ stateless) and can be used for (authentication+ authorization) B- API keys is a (stateless) and can be used for (authentication) C- SSL/TLS certificate encryption is a (stateful) and can be used for (authentication) D- cookie-based session authentication is a (stateful) and can be used for (authentication) means A is a correct answer

I think A is the right answer. from chatgpt OAuth 2 tokens. OAuth 2 is commonly used for stateless authentication and authorization in REST API calls. It allows clients to obtain access tokens from an authorization server, which they can then use to authenticate and authorize their requests to protected resources. These access tokens are typically sent along with API requests to prove the client's identity and permissions.