Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Cisco Certified DevNet Associate (DEVASC) · Cisco
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
It is B Since the application receives a webhook over HTTPS without a secret, there is a risk that the credentials in the webhook information could be transmitted over the network without encryption. Using HTTPS is a secure way to transmit data, but without a secret or proper authentication, there is a risk of unauthorized access. Enabling transport layer encryption (such as HTTPS) and ensuring proper authentication mechanisms for webhooks are essential to prevent the exposure of sensitive information during transmission.
HTTPS is encrypted transport, the credentials are no more at risk than any other traffic over HTTPS. The fact that the webhook info is in cleartext and debugging is going to log said webhook info...that means your log is going to contain the credentials in cleartext. So you should turn off webhook logging during debug. C.
From my point of view C is the correct answer because B says something about during transport which is HTTPS and which is encprypted -> So no security issue because you cannot decript it. And when using webhooks debug, an atacker can exploit this vulnerability and obtain the credentials. So the problem is that this debug should not be present in a production app constructed in this way. For more details about webhooks debugging: https://hookdeck.com/webhooks/guides/troubleshooting-debugging-webhooks-tutorial#conclusion