CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A developer implements an API endpoint that accepts Basic Authentication. The credentials are 'admin:password' encoded as Base64. An analyst asks why Base64 is not encryption. What is the correct explanation?
- A.Base64 is a form of encryption using a public key
- B.Base64 encoding is secure because it changes the character encoding
- C.Base64 uses AES-128 encryption with a fixed key
- D.Base64 is an encoding scheme (not encryption) that represents binary data in ASCII text format. It has no key and is trivially reversible by anyone: 'admin:password' → 'YWRtaW46cGFzc3dvcmQ=' → 'admin:password'. Encryption requires a key and produces ciphertext that cannot be reversed without the key. Basic Auth credentials encoded in Base64 are effectively plaintext without TLS
Why D is correct
This is a foundational security concept confusion. Encoding transforms data format (Base64, URL encoding, hex) - it is reversible, keyless, and provides zero security. Encryption transforms data using a key to produce ciphertext that cannot be reversed without the key. Hashing produces a fixed-size one-way digest. Basic Authentication uses Base64 encoding purely for transmission compatibility (HTTP headers must be ASCII), not for security. Without HTTPS, Basic Auth credentials are effectively cleartext.
Know someone studying for Web App Fundamentals? Send them this one.