Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary security impact of not enforcing multi-factor authentication (MFA) on an AI model API's administrative accounts?

   • AIt prevents the use of API keys for machine-to-machine communication
   • BIt allows attackers to bypass rate limiting
   • CIt increases the risk that a stolen password alone is sufficient to gain full administrative access
   • DIt makes the API slower due to additional authentication steps
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which common weakness in AI model API deployments allows attackers to gain unauthorized access by trying a list of commonly used passwords against an administrative account?

   • AInsecure API key storage
   • BWeak or default credentials
   • CLack of encryption in transit
   • DMissing rate limiting
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large enterprise exposes a multi-tenant AI model API. They currently use long-lived JWTs with broad scopes. A security review recommends reducing the risk of token theft and privilege escalation. The team must balance security with user experience (minimal re-authentication). Which approach best meets both?

   • AKeep long-lived JWTs but add more scopes.
   • BUse short-lived tokens but without refresh tokens.
   • CUse a single long-lived JWT for all users to simplify.
   • DUse short-lived access tokens with refresh tokens and implement scoped access tokens.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which authentication bypass technique involves an attacker modifying the 'kid' (key ID) parameter in a JWT to point to a file path or URL that the server uses to fetch the verification key?

   • ASession fixation
   • BJWT key injection attack
   • CCredential stuffing
   • DMan-in-the-middle (MITM) attack
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security engineer at a healthcare startup discovers that an AI model API endpoint, used for medical image analysis, is accepting requests without any authentication when the 'X-API-Key' header is omitted. The API gateway logs show that the endpoint is publicly accessible. The engineer needs to fix this immediately while maintaining the current API key-based authentication for legitimate clients. What should the engineer do first?

   • AConfigure the API gateway to require a valid API key for the endpoint and reject requests without it.
   • BDisable the endpoint until a full security audit is completed.
   • CRotate all API keys and distribute new ones to legitimate clients.
   • DAdd a rate-limiting rule to the endpoint to reduce abuse.
   Reveal Solution Discussion Select an answer first