Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   A company deploys an AI model API for internal use. The API uses a default API key that was included in the documentation. The key is 'admin123'. An employee discovers the key and uses it to access the API, which is not authorized for their role. What is the most effective immediate action to prevent further unauthorized use?

   • ARotate the API key and enforce a strong key generation policy.
   • BAdd logging to track API key usage.
   • CDisable the API until a new key is distributed.
   • DChange the API endpoint URL to a less predictable path.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   How does a replay attack compromise an AI model API's authentication?

   • ABy guessing the API key through brute force
   • BBy modifying the token's payload to change the user role
   • CBy intercepting a valid token and reusing it to make unauthorized requests
   • DBy causing the server to generate a new token for the attacker
   Reveal Solution Discussion Select an answer first
3. 48application · medium

   A company's AI model API supports MFA for interactive logins but not for API key-based access. An attacker steals a valid API key. Which control would best mitigate this?

   • AUse a longer API key.
   • BImplement short-lived tokens that are exchanged for the API key.
   • CRotate the API key monthly.
   • DAdd MFA to the API key itself.
   Reveal Solution Discussion Select an answer first