AI0-001 AI Implementation and Operations Practice Question
A company deploys an AI model via a REST API that handles sensitive customer data. To secure the endpoint, the security team requires that only authenticated and authorized applications can invoke the API. Which mechanism should be implemented?
⚠ Common exam trap
CompTIA often tests the distinction between transport-layer security (TLS) and application-layer authentication, so candidates mistakenly choose TLS because it 'secures' the endpoint, but it does not verify who is calling the API.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API key or bearer token in the HTTP header
API keys or bearer tokens (e.g., OAuth 2.0 access tokens) are the standard mechanism for authenticating and authorizing client applications when invoking a REST API. These tokens are passed in the HTTP Authorization header, allowing the server to verify the client's identity and permissions before processing requests containing sensitive customer data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
API key or bearer token in the HTTP header
Why this is correct
An API key or bearer token in the HTTP header authenticates each calling application and enforces authorisation before the endpoint processes sensitive customer data. It satisfies the requirement that only authenticated and authorised applications can invoke the API.
- ✗
TLS encryption for the connection
Why it's wrong here
TLS encrypts data, but does not authenticate the client.
- ✗
Input sanitization to prevent injection
Why it's wrong here
Input sanitisation defends against injection attacks in processed payloads; it does not establish who is calling or whether they are permitted, so anonymous requests still reach the model. It suits hardening parsing and query handling, not enforcing authentication and authorisation.
- ✗
IP whitelisting
Why it's wrong here
IP whitelisting restricts by network origin, not by application identity, so any client on a permitted address can invoke the API and authorised apps on other networks are blocked. It fits locking down fixed, trusted network ranges rather than authenticating and authorising applications.
About these practice questions
This AI0-001 question is part of Courseiva's 962-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.