Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An attacker intercepts a JWT used to access a generative AI API and replays it within its validity window. Which mitigation would be most effective to prevent this replay?

   • AUse short-lived JWTs and implement a token revocation list.
   • BUse a stronger signing algorithm like RS256.
   • CEncrypt the JWT payload with a symmetric key.
   • DUse a longer JWT expiration to reduce the need for re-authentication.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's AI model API uses OAuth 2.0 with scopes for authorization. A developer creates a new service account and assigns it the 'model:delete' scope by mistake, while it only needs 'model:read'. An attacker compromises the service account and deletes production models. What is the best way to prevent this in the future?

   • ADisable the 'model:delete' scope for all service accounts.
   • BUse a shared service account for all model operations.
   • CRequire multi-factor authentication for all service accounts.
   • DImplement a review process for scope assignments and audit them regularly.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial firm's AI model API allows access with just a username and password. A phishing attack compromises several user passwords. Which additional control would most effectively reduce the impact of this credential compromise?

   • ARequire multi-factor authentication for all API users.
   • BRestrict API access to office IP addresses.
   • CUse longer passwords.
   • DMonitor login logs for anomalies.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which misconfiguration in an AI model API's role-based access control (RBAC) can lead to privilege escalation?

   • ARegularly rotating API keys
   • BEnabling multi-factor authentication for all users
   • CAssigning the 'admin' role to a service account that only needs to make inference calls
   • DUsing strong, unique passwords for all accounts
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An AI model API has two roles: 'viewer' and 'admin'. A viewer user discovers they can call an admin-only endpoint by adding a specific HTTP header. Which issue is this?

   • AThe server relies on a client-supplied header for authorization.
   • BThe server uses a weak JWT signing algorithm.
   • CThe server has a session timeout that is too long.
   • DThe server does not validate the API key format.
   Reveal Solution Discussion Select an answer first