AI Incident Response and Forensics COASP Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which of the following is a common method for detecting data corruption in a training dataset during incident analysis?

   • AEncrypting the dataset with a new key
   • BStatistical analysis of data distributions and outlier detection
   • CCompiling the dataset into a binary executable
   • DDeleting the dataset to prevent further damage
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security operations center receives an alert about unusual model behavior in a recommendation system. The alert indicates that the model is recommending products that are not in the user's interest. The team needs to triage the incident. Which step should be taken FIRST?

   • AIgnore the alert if the model's overall accuracy is still high
   • BDetermine whether the behavior is caused by an adversarial attack, data poisoning, or a benign model update
   • CRetrain the model with the latest data to fix the behavior
   • DImmediately shut down the recommendation system to prevent further damage
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   When analyzing a model to determine if it contains a backdoor, which technique is most directly used?

   • AReviewing the model's API documentation
   • BChecking the model's license agreement
   • CReverse engineering the model to inspect its internal weights and activations
   • DMeasuring the model's inference latency
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A manufacturing company's predictive maintenance model was compromised through a data poisoning attack. The incident has been contained, and the team is now in the recovery phase. The original training data has been verified as clean, but the model weights are suspect. What is the MOST effective recovery action?

   • AIncrease the frequency of model retraining to reduce the impact of future poisoning attacks.
   • BApply a patch to the model's output layer to correct the misclassifications caused by the poisoning.
   • CRetrain the model from scratch using the verified clean dataset and validate its performance against a holdout test set.
   • DRestore the model from the most recent backup without verifying the backup's integrity.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   During triage of AI-related incidents, which factor is most important for prioritizing a reported anomaly in model outputs?

   • AThe number of lines of code in the model's training script
   • BThe age of the training dataset
   • CThe potential impact on business operations and data integrity
   • DThe programming language used to implement the model
   Reveal Solution Discussion Select an answer first