Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A data science team uses an AI model API that issues API keys with a 'model:write' scope to all users. A junior analyst only needs to run inference, but the key also allows modifying the model. Which action should the team take to prevent privilege escalation?

   • AIssue keys with the least privilege scope required for each role.
   • BRotate the keys weekly.
   • CAdd a second key for model modification and keep the original for inference.
   • DUse the same key for all team members to simplify management.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large enterprise exposes an AI model API for document classification. The API uses OAuth 2.0 with the client credentials grant. The API gateway validates the JWT signature using a public key from a well-known URL. A security researcher finds that the gateway does not validate the 'aud' (audience) claim. An attacker creates a client application with a different audience and obtains a token for that client. The attacker then uses that token to access the document classification API. The gateway accepts the token because it only checks the signature. Which combination of controls would best mitigate this vulnerability?

   • AImplement IP allowlisting for the API gateway.
   • BValidate the 'aud' claim on the API gateway and ensure that the token's audience matches the API's identifier.
   • CRotate the signing keys and require a stronger algorithm.
   • DSwitch to API keys instead of OAuth tokens.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is reviewing the authentication configuration of an AI model API that uses JWT tokens. The analyst discovers that the API accepts tokens signed with the 'none' algorithm. An attacker crafts a token with 'alg': 'none' and an arbitrary user ID, gaining access as an admin. Which configuration change should be made to prevent this attack?

   • AUse a symmetric signing key instead of an asymmetric key.
   • BAdd more claims to the JWT payload.
   • CIncrease the token expiration time to 24 hours.
   • DConfigure the API to reject tokens that use the 'none' algorithm.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A data science team deploys an internal AI model API for sentiment analysis. The API uses basic authentication with a shared account. The team stores the credentials in a plaintext configuration file on a shared network drive. An intern discovers the file and uses the credentials to access the API, incurring significant compute costs. Which combination of controls would best prevent this from recurring?

   • AImplement IP allowlisting so the API only accepts requests from the office network.
   • BChange the shared password monthly and restrict access to the network drive.
   • CUse individual API keys for each team member and store them in a secrets manager.
   • DDisable basic authentication and require a client certificate for all API access.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company provides an AI model API for natural language processing. The API uses OAuth 2.0 with password grant for client authentication. A security audit reveals that the API does not enforce multi-factor authentication (MFA) for user accounts. An attacker obtains a user's password through a phishing campaign and accesses the API, incurring costs and potentially exfiltrating data. Which control would most directly mitigate this risk?

   • ADisable the password grant and require client credentials grant.
   • BEnforce MFA for all user accounts that access the API.
   • CUse longer, more complex passwords for all users.
   • DImplement rate limiting on the login endpoint.
   Reveal Solution Discussion Select an answer first