API Reconnaissance and Model Fingerprinting COASP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security researcher is testing an AI-based image recognition API for adversarial robustness. The API returns a confidence score and has a rate limit. The researcher wants to generate adversarial images that are misclassified by the API while also determining if the model is a convolutional neural network (CNN) or a vision transformer (ViT). Which approach is most efficient?

   • AFirst, fingerprint the model architecture using a small set of images that are known to produce different outputs for CNNs and ViTs, then use architecture-specific adversarial attacks.
   • BGenerate adversarial images using a generic attack method and then analyze the misclassifications to infer the architecture.
   • CUse a large batch of adversarial images and observe the confidence scores to infer the architecture.
   • DTrain a surrogate model on the API's responses and use it to generate adversarial images.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You are testing an AI API that uses API keys for authentication. You have a valid key but it only allows access to the 'predict' endpoint. You want to test if you can access the 'admin' endpoint. Which approach is most effective?

   • ATry to guess the admin API key by brute-forcing.
   • BCheck the API documentation for the admin endpoint's authentication requirements.
   • CSend a request to the admin endpoint with your valid API key and observe the response.
   • DUse a different HTTP method (e.g., POST instead of GET) on the admin endpoint.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is performing API reconnaissance on a web application that uses a single-page application (SPA). The analyst wants to discover all API endpoints, including those that are not directly visible in the network traffic. Which technique is most effective?

   • AAnalyze the JavaScript bundles of the SPA to extract API endpoint strings and route definitions.
   • BUse a web crawler to follow all links and forms on the SPA to discover endpoints.
   • CIntercept traffic from a mobile app version of the same service, if available.
   • DPerform a dictionary attack on common API paths using a wordlist.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When testing an API's authentication mechanism, which of the following is a common vulnerability to check for?

   • AIncorrect CORS configuration
   • BMissing rate limiting on login endpoints
   • CVerbose error messages
   • DUnencrypted HTTP traffic
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of analyzing API parameters during security testing?

   • ATo identify injection points and logic flaws
   • BTo discover the API's rate limit
   • CTo determine the API's response time
   • DTo map the API's network architecture
   Reveal Solution Discussion Select an answer first