AI and Machine Learning Fundamentals from an Offensive Security Perspective COASP Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In the context of machine learning, what is the primary difference between supervised and unsupervised learning?

   • ASupervised learning trains on unlabeled data and predicts labels, while unsupervised learning trains on labeled data and predicts values.
   • BSupervised learning requires a neural network, while unsupervised learning uses only decision trees.
   • CSupervised learning uses labeled data to train models, while unsupervised learning finds patterns in unlabeled data.
   • DSupervised learning is used for regression only, while unsupervised learning is used for classification only.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is examining a machine learning system that labels network traffic as normal or anomalous. The system was trained on a dataset that includes both labeled examples of normal traffic and unlabeled examples of mixed traffic. Which type of learning does this scenario best describe?

   • AReinforcement learning
   • BSupervised learning
   • CUnsupervised learning
   • DSemi-supervised learning
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A penetration tester is performing an assessment of an AI system and has completed the reconnaissance phase. The tester has identified that the model is a decision tree and that the training data is stored in a publicly accessible S3 bucket. According to the hacking methodology, which action should the tester take next?

   • AMove to post-exploitation without exploiting the bucket
   • BReport the vulnerability without exploiting it
   • CExploit the publicly accessible S3 bucket to access the training data
   • DPerform further reconnaissance on the model's API
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A machine learning engineer is deploying a model that classifies malware. The engineer is aware that attackers could craft malware samples that evade the model. The engineer has access to the model's architecture and parameters. Which attack is the engineer most likely to defend against by using adversarial training?

   • AModel extraction attacks — where attackers query the model to steal its functionality.
   • BMembership inference attacks — where attackers infer if a sample is in the training set.
   • CEvasion attacks — where attackers perturb malware samples to be classified as benign.
   • DPoisoning attacks — where attackers inject malicious samples into the training set.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization uses a machine learning model to approve loan applications. A malicious actor wants to cause the model to approve loans for applicants who should be rejected. The actor has access to the model's training data pipeline. Which attack would be most effective for this goal?

   • ACrafting adversarial examples for individual applications
   • BPoisoning the training data with fraudulent approved examples
   • CExtracting the model to find its weaknesses
   • DPerforming a denial-of-service attack on the model
   Reveal Solution Discussion Select an answer first