Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An AI model API for a mobile app uses OAuth 2.0 with refresh tokens. A security review finds that refresh tokens are long-lived and never revoked when a user changes their password. An attacker who steals a refresh token can maintain access indefinitely. Which control should be implemented to mitigate this risk?

   • ARevoke refresh tokens when a user changes their password.
   • BStore refresh tokens in local storage on the mobile device.
   • CUse a stronger encryption algorithm for the refresh token.
   • DShorten the access token expiration to 5 minutes.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An AI model API uses JWT tokens for authentication. A security analyst discovers that the tokens are not stored securely on the client side and can be easily extracted from the browser's local storage. An attacker steals a token and replays it to access the API. Which mitigation would be most effective in preventing token theft from the client?

   • AAdd a user-agent claim to the JWT.
   • BStore tokens in HTTP-only cookies instead of local storage.
   • CUse a stronger signing algorithm for the JWT.
   • DShorten the token expiration time to 5 minutes.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A machine learning platform issues JWT tokens to client applications for accessing its model inference API. A security analyst notices that the tokens are valid for 24 hours and are not bound to a specific client. An attacker who steals a token from one client can replay it from another system. Which mitigation would be most effective in preventing token replay?

   • ARequire the token to be sent in the Authorization header instead of the query string.
   • BShorten the token expiration time to 5 minutes.
   • CInclude a client-specific claim (e.g., client ID) in the JWT and validate it on each request.
   • DUse a longer, more complex secret to sign the JWT.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which scenario best illustrates a weakness in multi-factor authentication (MFA) that could compromise an AI model API?

   • AAn attacker exploits a prompt injection to make the model reveal its system prompt
   • BAn attacker intercepts the API key in transit
   • CAn attacker guesses the user's password using a brute-force attack
   • DAn attacker uses a phishing page to capture both the user's password and the one-time MFA code in real time
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which set of controls is most appropriate to mitigate weak credential exploitation in AI model API access?

   • AImplementing a content delivery network (CDN) for the API
   • BEncrypting API keys at rest and in transit
   • CEnforcing strong password policies, disabling default accounts, and implementing account lockout after failed attempts
   • DUsing a Web Application Firewall (WAF) and rate limiting
   Reveal Solution Discussion Select an answer first