SecAI+ Access Controls AI Model Endpoints

1. API keys should be stored where for maximum security?

In plain text configuration files

In environment variables or secrets management systems

In client-side JavaScript

In public repositories

2. Certificate pinning is primarily used to prevent which attack?

Brute force attacks

Man-in-the-middle attacks

Denial-of-service attacks

SQL injection attacks

3. Audit logging for AI model endpoints should capture which information?

Only successful access attempts

User identity, timestamp, action, and outcome

Only failed authentication attempts

Network packet headers only

4. In the context of AI endpoints, what is model versioning used for?

Tracking access control changes

Managing different model releases and rollback capabilities

Encrypting model parameters

Monitoring user behavior

5. What does the principle of least privilege mandate?

Grant all users full system access

Users receive minimum permissions needed for tasks

Eliminate all access restrictions

Administrators control all access decisions

6. API gateway firewalls primarily protect against which threats?

Physical server theft

Unauthorized API calls and malicious payloads

Employee social engineering

Hardware failures

7. Which access control model is most suitable for dynamic, context-aware decisions?

Discretionary Access Control (DAC)

Mandatory Access Control (MAC)

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

8. Scope in OAuth 2.0 is used to define what?

User password requirements

Permissions and resource access limits

Network bandwidth allocation

Database query restrictions

9. Which protocol is most commonly used for secure API communication?

HTTP

HTTPS

FTP

SMTP

10. What is the primary advantage of implementing service-to-service authentication?

Reduces network bandwidth

Verifies identity of communicating services

Improves query response time

Simplifies database architecture

11. Which authentication method combines something you know, something you have, and something you are?

Single-factor authentication

Multi-factor authentication

Biometric authentication

Token-based authentication

12. Which mechanism prevents an authenticated user from being impersonated in subsequent requests?

Session fixation protection

CSRF token validation

Nonce-based verification

IP whitelisting

13. TLS/SSL certificates are primarily used to secure which layer of communication?

Application layer

Transport layer

Data link layer

Physical layer

14. What is the primary benefit of implementing attribute-based access control (ABAC)?

Faster processing times

Granular, policy-driven access decisions

Reduced network latency

Simplified user management

15. In zero-trust architecture, which principle is NOT assumed?

Never trust, always verify

All users are trustworthy by default

Verify every access request

Assume breach mentality

16. API rate limiting serves primarily to prevent which type of attack?

SQL injection

Cross-site scripting

Denial-of-service attacks

Man-in-the-middle attacks

17. What does JWT stand for in the context of API security?

Java Web Token

JSON Web Token

JavaScript Web Transport

Java Web Transport

18. Which token type is typically short-lived and used to access protected resources?

Refresh token

Access token

Session token

API key

19. OAuth 2.0 is primarily used for what security function?

Data encryption

Authorization delegation

Network routing

Intrusion detection

20. What is the primary purpose of role-based access control (RBAC) in AI model endpoints?

To encrypt data in transit

To assign permissions based on user roles

To monitor network traffic

To compress API responses

SecAI+ Access Controls for AI Model Endpoints Quiz