A company is deploying an AI model for credit scoring. They are concerned about both evasion attacks (manipulating inputs to get a better score) and data poisoning (attackers injecting fake data into the training set). Which of the following are appropriate defensive strategies? Select all that apply.

Regularly auditing the training data for anomalies.

Adversarial training with perturbed credit applications.

Robust aggregation techniques during training to reduce the impact of poisoned data.

Using a more complex model to better fit the data.

Input validation to reject applications with unusual patterns.

A security team is defending a spam filter against adversarial emails. They have a high volume of incoming emails and need a defense that does not significantly increase latency. Which defensive strategy is most appropriate?

Input sanitization with lightweight checks

Adversarial training with a large dataset

Which statement best describes the role of perturbations in adversarial example generation?

Perturbations are labels changed to confuse the training process.

Perturbations are changes to the model's architecture to improve robustness.

Perturbations are modifications to the input data that are typically small and designed to mislead the model.

Perturbations are random noise added to the model's weights during training.

A company is deploying an AI model for autonomous vehicle perception. They must balance safety (avoiding misclassification of obstacles) with performance (real-time inference). Which threat-modeling approach best addresses this trade-off?

Prioritize evasion attacks and implement adversarial training with a focus on physical-world perturbations

Focus on data poisoning and implement differential privacy

Implement multiple input sanitization layers

Ignore adversarial attacks and focus on model accuracy

A red team is testing a malware detection model. They have white-box access and want to craft an adversarial example that is evasive but also preserves the malware's functionality. Which technique is most appropriate?

Gradient-based perturbation with a functionality constraint

EC-CouncilCertified Offensive AI Security Professional

Domain 4Objective 1

Adversarial Machine Learning Techniques COASP Practice Questions (Page 3)

Part of the Adversarial Machine Learning and Model Privacy Attacks domain, which makes up ~13% of our current practice bank.

38questions here

8free pages

3concepts

Questions 11–15

11expert · hard · select all that apply
A company is deploying an AI model for credit scoring. They are concerned about both evasion attacks (manipulating inputs to get a better score) and data poisoning (attackers injecting fake data into the training set). Which of the following are appropriate defensive strategies? Select all that apply.
Select an answer first
12expert · hard
A security team is defending a spam filter against adversarial emails. They have a high volume of incoming emails and need a defense that does not significantly increase latency. Which defensive strategy is most appropriate?
Select an answer first
13foundation · easy
Which statement best describes the role of perturbations in adversarial example generation?
Select an answer first
14expert · hard
A company is deploying an AI model for autonomous vehicle perception. They must balance safety (avoiding misclassification of obstacles) with performance (real-time inference). Which threat-modeling approach best addresses this trade-off?
Select an answer first
15expert · hard
A red team is testing a malware detection model. They have white-box access and want to craft an adversarial example that is evasive but also preserves the malware's functionality. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to COASP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “COASP” is a trademark of its owner, used for identification only.