When deploying a REST API-backed admin interface on Fogo Server, what security practice helps protect client credentials in transit?

When deploying a REST API-backed admin interface on Fogo Server, what security practice helps protect client credentials in transit?

• A. Use TLS/HTTPS for all API endpoints and validate server certificates; enforce strong ciphers and certificate rotation.
• B. Use HTTP and rely on VPN; disable certificate validation.
• C. Use TLS but accept any certificate; rotate keys monthly.
• D. Use FTP over TLS; ignore certificate validation.

Answer: (A)

Protecting credentials as they move between the admin interface and the server relies on securing the transport layer. Using TLS/HTTPS for every API endpoint ensures that the data, including login details or tokens, is encrypted in transit so eavesdroppers can’t read it. Verifying the server’s certificate is essential because it proves you’re connecting to the genuine Fogo Server endpoint and not an impersonator; this guards against man‑in‑the‑middle attacks that could intercept credentials. Enforcing strong cipher suites keeps the encryption robust against modern attack methods, and regularly rotating certificates and keys helps limit risk if a key is ever compromised or deprecated. Other approaches fall short because they either rely on less-secure channels (like HTTP) or undermine the trust model (disabling certificate validation or accepting any certificate). Using FTP for API interactions is not appropriate for a REST API, and ignoring certificate validation or pairing TLS with an insecure or untrusted setup leaves credentials exposed.

Protecting credentials as they move between the admin interface and the server relies on securing the transport layer. Using TLS/HTTPS for every API endpoint ensures that the data, including login details or tokens, is encrypted in transit so eavesdroppers can’t read it. Verifying the server’s certificate is essential because it proves you’re connecting to the genuine Fogo Server endpoint and not an impersonator; this guards against man‑in‑the‑middle attacks that could intercept credentials. Enforcing strong cipher suites keeps the encryption robust against modern attack methods, and regularly rotating certificates and keys helps limit risk if a key is ever compromised or deprecated.

Other approaches fall short because they either rely on less-secure channels (like HTTP) or undermine the trust model (disabling certificate validation or accepting any certificate). Using FTP for API interactions is not appropriate for a REST API, and ignoring certificate validation or pairing TLS with an insecure or untrusted setup leaves credentials exposed.