The correct answer is B. TLS or SSL for communication.
In basic API authentication, credentials (such as username and password) are often transmitted using Base64 encoding, which is not encrypted. This makes them vulnerable to sniffer (packet capture) attacks if sent over an unencrypted channel.
* TLS (Transport Layer Security) and its predecessor SSL provide encryption of the communication channel.
* This ensures that even if packets are captured, the credentials remain confidential and unreadable.
* Cisco documentation emphasizes that APIs (RESTCONF, HTTP-based APIs) should use HTTPS (HTTP over TLS) to secure credentials in transit.
* A. VPN connection between client and server While a VPN encrypts traffic, it is not specifically required for API authentication security. The standard and expected method is TLS/HTTPS.
* C. AAA services to authenticate the API AAA controls who can access, but it does not encrypt credentials in transit.
* D. next-generation firewall A firewall provides traffic filtering and threat protection but does not directly secure credential transmission in basic API authentication.
* Basic Authentication = NOT secure by itself
* Always pair it with HTTPS (TLS encryption)
Rule to remember:
If credentials travel over the network # encrypt with TLS