Palo Alto Networks Certified Security Automation Engineer (PCSAE)IntegrationsHard
A security analyst is developing a custom integration that interacts with an internal security tool. This tool requires all API requests to be signed using a private key and a specific hashing algorithm (e.g., HMAC-SHA256). The private key is stored securely in the integration's configuration. What type of authentication mechanism is the integration primarily implementing?
- ABasic Authentication
- BSignature-based Authentication
- COAuth 2.0 Client Credentials
- DAPI Key Authentication
Show answer & explanationAnswer & explanation
Correct answer: B. Signature-based Authentication
Signature-based authentication involves generating a unique cryptographic signature for each request using a private key and a hashing algorithm. This signature is then sent with the request (often in a custom header) to verify the sender's identity and the request's integrity. This matches the scenario described, distinguishing it from simpler methods like API keys or more complex flows like OAuth.
Why the other options are wrong
- A. Basic Authentication uses a username and password (often Base64 encoded) and does not involve private keys or hashing algorithms for signing requests.
- C. OAuth 2.0 Client Credentials flow involves exchanging client ID/secret for an access token, which is then used for authorization, not direct request signing with a private key.
- D. API Key Authentication typically involves sending a static, pre-shared key with each request, without cryptographic signing per request.
Signature-based Authentication
An authentication method where each API request is cryptographically signed using a private key and a hashing algorithm to verify sender identity and message integrity.
- Uses a private key for signing.
- Involves a hashing algorithm (e.g., HMAC-SHA256).
- Signature is unique per request and verifies integrity.
- Often implemented with custom HTTP headers.
Memory trick: Signatures prove identity; keys are like simple passes.