Authentication Weaknesses in AI Model APIs COASP Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company's AI model API for natural language processing uses JWT tokens for authentication. The tokens are signed with a symmetric key that is shared between the API and the authentication server. A security audit finds that the signing key is stored in the source code repository. An attacker gains access to the repository and steals the signing key. The attacker forges a token with admin privileges and accesses the API. Which combination of controls would best mitigate this risk?

   • AAdd a claim to the JWT that includes the user's IP address.
   • BSwitch to API keys instead of JWT tokens.
   • CRotate the signing key immediately, store it in a secrets manager, and use asymmetric signing (RS256) instead of symmetric (HS256).
   • DUse a longer symmetric key and change it annually.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A hospital deploys an AI diagnostic assistant API. The API uses a default admin account with a well-known password. The security team is planning a remediation. Which control is most effective to prevent exploitation of this weak credential?

   • ARotate the default password monthly.
   • BRestrict the API to internal IP addresses.
   • CEnforce a strong password policy and disable the default account.
   • DAdd a WAF in front of the API.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which authentication mechanism is commonly used in AI model APIs to identify the calling application by a unique identifier and secret pair, often sent in an HTTP header?

   • AAPI keys
   • BJSON Web Tokens (JWT)
   • CMutual TLS (mTLS)
   • DOAuth 2.0 authorization code flow
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A startup offers an AI model API for real-time translation. The API uses API keys for authentication. The startup's CTO wants to add an additional layer of security without disrupting existing clients. Which control would provide the most immediate improvement in authentication security?

   • ARotate all API keys immediately.
   • BAdd a rate limit per API key.
   • CSwitch to OAuth 2.0 with JWT tokens.
   • DImplement IP allowlisting for API key usage.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A small company uses a third-party AI model API. The admin console is protected only by a default password that was never changed. An attacker uses this to access the console and exfiltrate the API key. Which combination of controls would have most effectively prevented this?

   • AUse a longer default password.
   • BRestrict admin console access to a VPN.
   • CMonitor admin console logs.
   • DChange the default password and enforce MFA for admin accounts.
   Reveal Solution Discussion Select an answer first