Agent Hijacking COASP Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which logging practice is most useful for detecting a hijacked agent?

   • ALogging only successful user authentications
   • BLogging only system uptime and resource usage
   • CLogging only the agent's final responses to users
   • DLogging all tool calls and their parameters
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team is investigating an AI agent that was hijacked. The agent was supposed to summarize internal reports and send them to a specific distribution list. The investigation reveals that the agent sent a summary containing confidential information to an external email address. The agent's logs show that the email content contained a prompt injection. Which attack vector is most likely responsible?

   • APrompt injection combined with malicious tool use
   • BDenial of service
   • CModel extraction
   • DData poisoning
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An AI agent that handles customer refunds is hijacked and processes thousands of fraudulent refunds. What is the most significant impact on data integrity?

   • AThe refund records in the database are now inaccurate and unreliable
   • BThe agent's model weights are altered
   • CThe network bandwidth is exhausted
   • DThe agent's training data is permanently corrupted
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A retail company's AI agent manages inventory and has access to the supplier database. The agent is hijacked to order excessive stock from a specific supplier, causing a financial loss. The incident response team has contained the agent and investigated the logs. They have identified the injection vector. What is the NEXT step in the incident response process?

   • AImmediately resume normal operations without any changes
   • BDelete all logs to prevent the attacker from covering their tracks
   • CNotify all suppliers that their data may have been compromised
   • DRecover the agent by restoring it from a clean backup and applying the identified mitigation to prevent recurrence
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A hospital's AI agent schedules surgeries and has access to the operating-room calendar. An attacker hijacks the agent to schedule a surgery for a non-existent patient, causing a real patient's surgery to be cancelled. The hospital's incident response team must assess the impact. Which of the following is the MOST critical impact to prioritize?

   • AFinancial loss is the most critical impact because the hospital loses revenue from the cancelled surgery
   • BPatient safety is the most critical impact because the cancelled surgery could lead to a deterioration in the real patient's condition
   • CReputational damage is the most critical impact because the hospital will lose trust
   • DData integrity is the most critical impact because the surgery calendar now has a false record
   Reveal Solution Discussion Select an answer first