JWT Definition in REST API Security Explained
Describe characteristics of REST-based APIs (authentication types, CRUD, HTTP verbs, and data encoding)
Answer
Correct answer: C — a JWT is an encoded, not encrypted, JSON token used to securely exchange claims between two parties in a REST API.
Which definition describes JWT in regard to REST API security?
Community Insight
The question tests whether you know a JWT is encoded rather than encrypted and that its canonical purpose is securely transferring claims between parties, not authentication alone — the trap is picking 'authentication' because JWTs are so often used in login flows.
A JSON Web Token (JWT) is a compact, URL-safe, encoded (not encrypted) JSON token defined by RFC 7519 that carries signed claims between two parties. For the CCNA 200-301 REST API security question, the matching definition is the encoded JSON token used to securely exchange information.
Option D is the most commonly selected wrong answer: learners associate JWTs with login tokens and pick 'used for authentication.' That is a real use case, but it is narrower than the standard definition, and both C and D correctly say 'encoded,' so authentication vs. secure exchange of information is the deciding distinction.
Community Discussion (19 comments)
Tompoo
👍 1
Selected: C
JWT (JSON Web Token) is a compact, URL-safe way to securely transmit information between parties as a JSON object.
hyousf85
👍 1
Selected: C
chat gpt
Mimon
👍 1
Selected: C
https://jwt.io/introduction#:~:text=Information%20Exchange%3A%20JSON%20Web%20Tokens%20are%20a%20good%20way%20of%20securely%20transmitting%20information%20between%20parties.
zbeugene7
👍 1
Forgot that some people at the aforementioned company let's say don't have perfect English. If the manual states: " When a user authenticates with a REST API, the server generates a JWT token that contains user information, such as the user ID and access privileges. " that means it's not used for authentication , means token is THE RESULT of authentication and it means it's used for authorization
zbeugene7
👍 1
For secure information exchange other tools are used: encryption, message integrity, and of course indirectly the JWT
Elmir42
👍 1
Option C could also be considered correct because JWTs are indeed used to securely exchange information, but in the specific context of REST API security, D is the most accurate answer.
IgorLVG
👍 1
Selected: C
C is the best solution
Starlord2535
👍 1
JWT, or JSON Web Token, is an encoded JSON token that is used to securely exchange information. It is a compact and self-contained way for securely transmitting information between parties as a JSON object. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA. They are commonly used for authentication and authorization in REST API security 2 3 . Therefore, the correct definition of JWT in regard to REST API security is: C. an encoded JSON token that is used to securely exchange information Option D is not the best choice because while JWTs can be used for authentication, they are not limited to that purpose. JWTs are designed to be a compact, self-contained way of securely transmitting information between parties as a JSON object. This makes them suitable for a wide range of use cases, including authentication, authorization, and information exchange. Therefore, it is more accurate to describe JWTs as an encoded JSON token that is used to securely exchange information, rather than exclusively for authentication.
PassRon
👍 2
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.
dropspablo
👍 1
JWT, which stands for JSON Web Token, is a technique defined in RFC 7519 for remote authentication between two parties. It is one of the most used ways to authenticate users in RESTful APIs. What is JSON Web Token? JWT (JSON Web Token) is an industry standard RCT 7519 method for performing two-party authentication via a signed token that authenticates a web request. This token is a Base64 code that stores JSON objects with the data that allow authentication of the request. https://www.devmedia.com.br/como-o-jwt-funciona/40265
dropspablo
👍 1
I believe answer D, because "This token is a Base64 code that stores JSON objects with the data that allow authentication of the request."
espandrews
👍 3
C and D are correct. -this ciscodump is a wonderful journey
espandrews
👍 1
this is what my AI friend says on this matter: Both statements are correct. JWTs are used to securely transmit information between parties as a JSON object . This information can include authentication and authorization data, allowing the recipient to verify the identity of the sender and determine what resources they have access to . So while JWTs can be used for securely exchanging information, they are primarily used for authentication and authorization purposes.
Ciscoman021
👍 5
Selected: D
JWT (JSON Web Token) is an encoded JSON token that is commonly used in REST API security for authentication and authorization. Therefore, the correct answer is D - "an encoded JSON token that is used for authentication".
Zortex
👍 4
D. an encoded JSON token that is used for authentication JSON Web Tokens (JWT) is an open standard for securely transmitting information between parties as a JSON object. In the context of REST API security, JWT is typically used for authentication purposes. It is a compact, URL-safe means of representing claims to be transferred between two parties. When a user authenticates with a REST API, the server generates a JWT token that contains user information, such as the user ID and access privileges. The token is then sent to the client, typically in the form of an HTTP header, and is included in subsequent requests to the API. The server then validates the token to ensure that it was issued by a trusted authority and that it has not been tampered with. If the token is valid, the server grants access to the requested resources. If the token is invalid or has expired, the server denies access to the resources. Therefore, the correct definition of JWT in regard to REST API security is that it is an encoded JSON token that is used for authentication.
danny43213
👍 2
JSON Web Token (JWT) is an open standard ( RFC 7519 ) that defines a compact and self-contained way for securely transmitting information between parties as a JSON
oatmealturkey
👍 4
I still think the answer is D. JWT provides authentication, but technically it does not in itself provide security to the information that is being exchanged, because without HTTPS (TLS), the information can still be intercepted and the JWT can be stolen. But please correct me if I'm wrong!
splashy
👍 2
Selected: D
https://www.rfc-editor.org/rfc/rfc7519#ref-JWS https://en.wikipedia.org/wiki/JSON_Web_Token#Use https://medium.com/emblatech/secure-your-spring-restful-apis-with-jwt-a-real-world-example-bfdd2679db5f
splashy
👍 3
And a week later... It's encoded It exchanges more info then just authentication https://jwt.io/introduction/ It's probably C :)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
RFC 7519 defines a JSON Web Token as a compact, URL-safe representation of claims transferred between two parties, with the claims encoded as a JSON object and typically digitally signed with JWS. That matches option C: an encoded JSON token used to securely exchange information. JWTs routinely carry far more than an authentication identity — subject, issuer, audience, expiry, roles and custom claims — so 'exchange information' is the accurate, general definition. On the CCNA this wording tracks the official IETF phrasing, which is why C is the expected answer.Why the Other Options Are Wrong
Options A and B fail immediately because a standard JWT is encoded, not encrypted: the payload is only Base64URL-encoded and signed, so anyone holding the token can read the claims unless JWE encryption is deliberately applied. Option D is only partially right — JWTs are frequently used to prove identity after a login — but it both narrows the definition and, unlike C, fails to capture the claim-transfer purpose the standard describes. Since A and B share the same fatal 'encrypted' error and D is the narrower distractor, C is the only complete and defensible definition.Community Comment Notes
Commenters are split: Ciscoman021 argued for D, stating JWT is 'an encoded JSON token that is commonly used in REST API security for authentication and authorization,' while splashy pushed back with 'It's encoded. It exchanges more info then just authentication' and cited the jwt.io introduction, later switching to D as well. espandrews pointed out that 'C and D are correct,' which highlights the ambiguity — but in a single-choice exam the broader RFC 7519 wording wins. oatmealturkey added a valuable caveat that a JWT 'does not in itself provide security to the information' without HTTPS/TLS, since a token can be intercepted and replayed.Official Reference
Exam Strategy
On definition questions, eliminate options that contradict the standard's exact terminology — a JWT is encoded and signed, not encrypted. Then choose the option that matches the broadest official wording rather than one narrow real-world use case.
Frequently Asked Questions
Why isn't 'encoded JSON token used for authentication' the right definition of a JWT?
It is a common use, but it is narrower than the RFC 7519 definition. JWTs carry any claims — roles, expiry, issuer — so 'securely exchange information' is the accurate general description.
Are JWTs encrypted, as options A and B claim?
No. A standard JWT payload is Base64URL-encoded and digitally signed (JWS), so it can be read by anyone holding it. Encryption only occurs if the JWE structure is deliberately used.
Related Analysis
Practice All 200-301 Questions
Access 220 questions with complete answers and detailed explanations.
View Full 200-301 Practice Test →