CAIC Network Security & Protocols 3

Question 1

An AI inference API is exposed via an API gateway. Which rate-limiting strategy BEST prevents model extraction attacks through repeated queries?

Accepted Answer

Token bucket with per-API-key quotas and anomaly detection

Answer

Per-API-key token bucket limiting with anomaly detection catches extraction attempts even when attackers rotate IPs while staying within per-IP limits.

Question 2

Which network protocol vulnerability allows an attacker to intercept AI API calls on a shared network by broadcasting fake MAC address associations?

Accepted Answer

ARP poisoning

Answer

ARP poisoning floods the local network with fake ARP replies, associating the attacker's MAC with a legitimate IP to intercept traffic on the LAN.

Question 3

A zero-trust network architecture for AI workloads requires which core principle when a service requests access to a model endpoint?

Accepted Answer

Verify identity and authorization explicitly for every request

Answer

Zero trust mandates explicit verification of identity, device health, and authorization for every request regardless of network location.

Question 4

Which TLS configuration weakness allows a downgrade attack that could expose AI API traffic encrypted with weak ciphers?

Accepted Answer

Supporting TLS 1.0/1.1 alongside TLS 1.3

Answer

Keeping legacy TLS versions enabled allows attackers to force negotiation of weaker protocol versions with exploitable vulnerabilities like POODLE or BEAST.

Question 5

An AI company deploys a BGP-announced IP range for its inference endpoints. What attack could cause global traffic to be rerouted to an adversary's network?

Accepted Answer

BGP route hijacking

Answer

BGP route hijacking involves announcing more-specific or false routes that cause internet routers to send traffic intended for the victim to the attacker's infrastructure.

(CAIC) Certified AI Consultant Practice Test

(CAIC) Certified AI Consultant Practice Test

CAIC Network Security & Protocols 3