AI0-001 AI Implementation and Operations Practice Question
A company deploys an AI model via a REST API that handles sensitive customer data. To secure the endpoint, the security team requires that only authenticated and authorized applications can invoke the API. Which mechanism should be implemented?
⚠ Common exam trap
CompTIA often tests the distinction between transport-layer security (TLS) and application-layer authentication, so candidates mistakenly choose TLS because it 'secures' the endpoint, but it does not verify who is calling the API.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API key or bearer token in the HTTP header
API keys or bearer tokens (e.g., OAuth 2.0 access tokens) are the standard mechanism for authenticating and authorizing client applications when invoking a REST API. These tokens are passed in the HTTP Authorization header, allowing the server to verify the client's identity and permissions before processing requests containing sensitive customer data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
API key or bearer token in the HTTP header
Why this is correct
API keys/tokens authenticate the caller and are standard for API security.
- ✗
TLS encryption for the connection
Why it's wrong here
TLS encrypts data, but does not authenticate the client.
- ✗
Input sanitization to prevent injection
Why it's wrong here
Input sanitization prevents code injection, not authentication.
- ✗
IP whitelisting
Why it's wrong here
IP whitelisting allows any request from a trusted IP, but does not authenticate individual applications.
About these practice questions
This AI0-001 question is part of Courseiva's 754-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.