Quoting from documentation
challenge Allows free access to metadata, but any attempt at accessing actual data is met by a HTTP 401 code (which forces most clients to show an authentication dialog). The capabilities documents contain the full list of layers. DescribeFeatureType and DescribeCoverage operations work successfully. This mode works fine with clients such as uDig or Google Earth._
Sending a DescribeCoverage on a secured layer without proper privileges should work in challenge mode. However it doesn't since a coverageReader is used to access coverage
instead of using a coverageInfo object, resulting in access to actual data.