API Reconnaissance and Model Fingerprinting COASP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of an adversarial input for an image classification API?

   • AA high-resolution version of the original image
   • BAn image with subtle perturbations invisible to the human eye
   • CA completely black image
   • DAn image with a large watermark
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a primary method for extracting a model's functionality?

   • AIntercepting network traffic to read model weights
   • BUsing SQL injection to dump the model database
   • CExploiting a buffer overflow in the API server
   • DSending a large number of queries and recording the outputs
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of generating adversarial inputs for an API-hosted model?

   • ATo authenticate to the API
   • BTo measure the API's response time
   • CTo increase the model's accuracy
   • DTo test the model's robustness and identify misclassifications
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are testing an AI-powered image classification API. The API uses an API key in the Authorization header. You notice that the same API key works for both low-privilege and admin operations. You also observe that the API returns different error messages for invalid API keys versus missing API keys. What is the most effective way to test for authorization bypass?

   • ATry to access admin endpoints with the low-privilege API key and observe if the API enforces role-based access control.
   • BUse the API key to generate adversarial inputs and test the model's classification accuracy.
   • CSend requests with a modified API key to see if the error message reveals the expected key format.
   • DCheck if the API has rate limiting by sending many requests with the same key.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is performing API reconnaissance on a mobile app that communicates with a backend server. The analyst has captured the network traffic and found an API endpoint that returns a list of products. The analyst wants to discover additional endpoints that are not used by the app. Which technique is most effective?

   • AUse a web crawler to scan the backend server for common API paths.
   • BIntercept traffic from the mobile app while using different features to discover new endpoints.
   • CPerform a DNS enumeration to find subdomains that may host additional API endpoints.
   • DDecompile the mobile app and search for API endpoint strings in the code.
   Reveal Solution Discussion Select an answer first