CAIC Network Security & Protocols 2 — Questions and Answers
Question 1: An AI system needs to securely transmit model inference requests between microservices. Which protocol provides mutual authentication and encryption at the transport layer?
- SSH tunneling
- mTLS (mutual TLS) (Correct answer)
- IPsec in transport mode
- SFTP
Correct answer: mTLS (mutual TLS)
mTLS requires both client and server to present certificates, providing mutual authentication and encrypted communication between microservices.
Question 2: Which attack vector exploits the way AI APIs handle oversized JSON payloads to cause denial-of-service conditions?
- SQL injection
- JSON bomb (billion laughs) (Correct answer)
- Cross-site scripting
- ARP poisoning
Correct answer: JSON bomb (billion laughs)
A JSON bomb uses deeply nested or recursive structures that expand exponentially during parsing, exhausting server memory and causing DoS.
Question 3: A Certified AI Consultant recommends network segmentation for an AI training cluster. What is the PRIMARY security benefit?
- Faster model training throughput
- Limiting lateral movement if a node is compromised (Correct answer)
- Reducing GPU memory fragmentation
- Simplifying DNS configuration
Correct answer: Limiting lateral movement if a node is compromised
Network segmentation contains breaches by preventing attackers who compromise one node from freely accessing other systems on the network.
Question 4: Which DNS security extension prevents cache poisoning attacks that could redirect AI API traffic to malicious servers?
- DNSSEC (Correct answer)
- DNS-over-HTTPS
- Split-horizon DNS
- Anycast DNS
Correct answer: DNSSEC
DNSSEC uses cryptographic signatures to validate DNS responses, preventing attackers from injecting forged DNS records.
Question 5: An AI platform uses WebSockets for real-time model streaming. Which security header is MOST important to prevent unauthorized cross-origin WebSocket connections?
- Content-Security-Policy
- Origin validation on the server side (Correct answer)
- X-Frame-Options
- Strict-Transport-Security
Correct answer: Origin validation on the server side
WebSocket upgrades bypass CORS, so servers must explicitly validate the Origin header to reject connections from unauthorized domains.
Question 6: What is the purpose of a network TAP (Test Access Point) in an AI security monitoring deployment?
- Blocking malicious traffic in real time
- Passively capturing traffic without affecting network performance (Correct answer)
- Encrypting data in transit
- Authenticating API clients
Correct answer: Passively capturing traffic without affecting network performance
A network TAP passively mirrors traffic to monitoring tools without introducing latency or single points of failure in the production path.
Question 7: Which protocol is preferred for secure, low-latency AI model telemetry transmission where UDP is acceptable and encryption is required?
- HTTPS/2
- DTLS (Datagram TLS) (Correct answer)
- SSH
- FTPS
Correct answer: DTLS (Datagram TLS)
DTLS provides TLS-equivalent security over UDP, making it suitable for latency-sensitive telemetry streams that can tolerate occasional packet loss.
CAIC Network Security & Protocols 2
An AI system needs to securely transmit model inference requests between microservices.
Which protocol provides mutual authentication and encryption at the transport layer?