Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which security control is specifically designed to prevent token replay attacks in AI model APIs?

   • AStoring tokens in HttpOnly cookies
   • BUsing short-lived tokens with a nonce or timestamp validation
   • CUsing a long expiration time for tokens
   • DEncrypting the token in transit with TLS
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A startup provides an AI model API for image recognition. The API uses API keys for authentication. The startup's customer support team has access to a shared API key that is stored in a shared document. A former employee, who still has access to the document, uses the key to access the API and incurs charges. The startup wants to prevent this from happening again without disrupting current customers. Which combination of controls would be most effective?

   • AAdd a rate limit to the API key.
   • BImplement IP allowlisting for the API key.
   • CChange the shared API key and share the new key only with current employees.
   • DIssue individual API keys for each employee and revoke the shared key, then store keys in a secrets manager.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization exposes an AI model API for image classification. The API uses OAuth 2.0 with scopes. A developer accidentally assigns the 'admin' scope to a service account that only needs to call the 'classify' endpoint. An attacker compromises the service account and gains full administrative access to the API, including the ability to delete models. What is the most effective control to prevent this type of privilege escalation?

   • AAdd an IP allowlist for the service account's API access.
   • BRotate the service account's credentials every 30 days.
   • CImplement the principle of least privilege by granting only the required scopes to each service account.
   • DUse a shared API key for all service accounts to simplify management.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   How can attackers exploit default credentials in an AI model API's management console to cause harm?

   • ABy sending a specially crafted HTTP request to the API endpoint to trigger a buffer overflow
   • BBy using the default admin credentials to access the console and modify model configurations or exfiltrate training data
   • CBy performing a denial-of-service attack to overwhelm the API
   • DBy intercepting network traffic to capture API keys
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security engineer is reviewing an AI model API that uses OAuth 2.0 with the client credentials grant. The API trusts the 'aud' claim in the JWT but does not validate it. An attacker obtains a JWT from a different client application. What is the most likely impact?

   • AThe attacker can forge a new JWT with a different signing key.
   • BThe attacker can use the JWT to access this API because the audience is not validated.
   • CThe attacker can only access the other client's resources.
   • DThe attacker can escalate to admin by modifying the 'role' claim.
   Reveal Solution Discussion Select an answer first