Exam CISSP topic 1 question 252 discussion

D - Digest Authentication is the best option here as it does not require the password to be transmitted. Rather, the client takes the username and password and uses the MD5 hashing algorithm to create a hash, which is then sent to the SQL Server. The given answer, Form-based authentication is not particularly secure as the content of the user dialog box is sent as plain text, and the target server is not authenticated. This form of authentication can expose your user names and passwords unless all connections are over SSL.

D - Digest Authentication is the best option here as it does not require the password to be transmitted. Rather, the client takes the username and password and uses the MD5 hashing algorithm to create a hash, which is then sent to the SQL Server. The given answer, Form-based authentication is not particularly secure as the content of the user dialog box is sent as plain text, and the target server is not authenticated. This form of authentication can expose your user names and passwords unless all connections are over SSL.

D. Digest authentication Digest authentication is a type of authentication that provides a secure way for users to provide their credentials to a server. Digest authentication uses a one-way hash function to encrypt the user's password and a unique value, called a nonce, generated by the server to create a digest. The digest is then sent to the server, where it can be compared to the stored hash value to verify the user's identity. Because the password is never sent in clear text, it provides a higher level of protection against eavesdropping and replay attacks compared to other forms of authentication such as Basic authentication

In general Digest Authentication is preferred to Basic Authentication. HOWEVER if HTTPs is used Basic Authentication is often preferred (i.e. order of preference is; 1. Basic Authentication + TLS 2. Digest Authentication 3. Basic Authentication alone (worst option) )

If the precondition is http, not https, Digest Authentication is the best option

Forms based is sort of ok if the form itself is ssl/tls but not great otherwise. D for me.

should be A, the B,C,D are not relationship with the user credentials.

I choose D