Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which control is most effective in preventing authentication bypass due to JWT algorithm confusion?

   • AEncrypting all API traffic with TLS
   • BUsing longer API keys
   • CEnforcing a strict whitelist of allowed JWT signing algorithms on the server
   • DRotating API keys monthly
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An AI model API uses session tokens that are generated using a predictable algorithm. An attacker can predict the next token and hijack a session. Which mitigation is most effective?

   • AUse the user's IP address in the token.
   • BUse a cryptographically secure random number generator for session tokens.
   • CUse a shorter session timeout.
   • DUse a longer session token.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How can an attacker exploit a misconfigured role in an AI model API to escalate privileges?

   • ABy performing a timing attack to guess the admin password
   • BBy using a low-privilege account to call an administrative endpoint that does not enforce role checks
   • CBy sending a specially crafted prompt to the AI model to reveal hidden system instructions
   • DBy using a stolen API key from a different user
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An AI model API uses session cookies that do not have the Secure and HttpOnly flags set. Which attack is this most likely to enable?

   • APrivilege escalation via role parameter.
   • BSQL injection.
   • CDenial of service.
   • DSession hijacking via cross-site scripting (XSS) or network sniffing.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A developer stores a JWT in localStorage for an AI model API web client. An XSS vulnerability is found. What is the most likely impact?

   • AThe attacker can steal the JWT and replay it to access the API.
   • BThe attacker can only cause a denial of service.
   • CThe attacker can only perform CSRF attacks.
   • DThe attacker can modify the JWT payload.
   Reveal Solution Discussion Select an answer first