In the STRIDE threat model, which threat category describes an attacker presenting forged credentials to access the AI service?

• A. Data leakage
• B. Denial of Service
• C. Spoofing
• D. Access control failure

Answer: (C)

Spoofing is about impersonation. When an attacker presents forged or stolen credentials to access an AI service, they are pretending to be a legitimate user or entity. That impersonation is the core idea of spoofing: gaining access by convincing the system it’s dealing with someone it trusts. Data leakage would involve exposing information, Denial of Service targets availability, and an access control failure would be about weak enforcement of who can do what; but the act of using forged credentials to access the service is precisely spoofing—authentication bypass through impersonation.