Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational corporation provides an AI model API for predictive maintenance. The API uses OAuth 2.0 with scopes. The company has multiple business units, each with its own service accounts. A security audit reveals that some service accounts have the 'model:write' scope, which allows modifying models, but they only need 'model:read'. The audit also finds that the API does not enforce MFA for service accounts. An attacker compromises a service account with excessive permissions and modifies a model, causing incorrect predictions. Which combination of controls would best mitigate this risk?

   • ADisable the 'model:write' scope for all service accounts.
   • BImplement a SIEM to monitor service account activity.
   • CReview and reduce service account scopes to the minimum required, and enforce MFA for service accounts.
   • DRotate service account credentials monthly and use IP allowlisting.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large enterprise exposes an AI model API for predictive analytics. The API uses OAuth 2.0 with scopes. The enterprise has a complex organizational structure with multiple departments, each with its own service accounts. A security audit reveals that the API does not enforce MFA for service accounts, and some service accounts have excessive scopes. An attacker compromises a service account with excessive scopes and accesses sensitive data. The enterprise wants to improve security without disrupting the workflow of each department. Which approach would be most effective?

   • ADisable all service accounts that have not been used in the last 90 days.
   • BAllow each department to manage its own service accounts and scopes.
   • CImplement a SIEM to monitor service account activity and alert on anomalies.
   • DImplement a centralized identity and access management (IAM) policy that enforces least privilege and MFA for all service accounts.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A fintech company's AI model API for fraud detection uses OAuth 2.0 with authorization code flow. The API issues access tokens that expire in 1 hour and refresh tokens that expire in 30 days. The company wants to improve security without degrading user experience. A security audit finds that refresh tokens are not rotated and are not revoked when a user logs out. An attacker steals a refresh token and uses it to obtain new access tokens even after the user logs out. Which combination of controls would best mitigate this risk while maintaining usability?

   • AImplement refresh token rotation and revoke refresh tokens on logout.
   • BRequire the user to re-authenticate every time a refresh token is used.
   • CShorten the refresh token expiration to 1 day.
   • DUse a stronger encryption algorithm for the refresh token.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company uses a JWT-based authentication system for its AI model API. They want to implement token revocation but also want to keep the API stateless. Which approach is most appropriate?

   • AStore all tokens in a database and validate each request against it.
   • BUse a short token lifetime and a distributed denylist for revoked tokens.
   • CUse a long token lifetime and no denylist.
   • DUse a symmetric signing key and rotate it frequently.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which session management flaw allows an attacker to reuse a valid session token after a user logs out, because the server does not invalidate the token on the server side?

   • ASession fixation
   • BSession expiration not enforced
   • CInsecure cookie flags
   • DCross-site request forgery (CSRF)
   Reveal Solution Discussion Select an answer first