AI Incident Response and Forensics COASP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main goal of the recovery phase in AI incident response?

   • ATo restore the AI system to a secure and functional state
   • BTo collect evidence for legal proceedings
   • CTo identify the root cause of the incident
   • DTo contain the incident to prevent further damage
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm detects that its fraud-detection model has been producing anomalous outputs for the past 72 hours. The incident response team is about to begin forensic collection. The model is deployed in a containerized environment with GPU acceleration, and the training data resides in an object storage bucket with versioning enabled. Which action should the team take FIRST to preserve evidence while minimizing disruption to ongoing operations?

   • AReview the container logs to identify the exact timestamp when the anomalous behavior began.
   • BCreate a snapshot of the container filesystem and GPU memory, then capture the model artifact and its associated metadata from the registry.
   • CCopy the training dataset from the object storage bucket to a separate forensic workstation for analysis.
   • DImmediately shut down the container and disconnect the object storage bucket from the network to prevent any further modification.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following best describes the primary purpose of the preparation phase in AI incident response?

   • ATo restore AI systems to a secure state after an incident
   • BTo contain and eradicate malicious elements from AI systems
   • CTo identify and prioritize AI-related incidents as they occur
   • DTo establish policies, tools, and trained personnel for effective incident handling
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's spam filter model has been compromised through a data poisoning attack, causing it to classify legitimate emails as spam. The incident response team has confirmed the attack and is in the eradication phase. Which action is MOST appropriate for removing the malicious elements?

   • AApply a filter to the model's output to reclassify legitimate emails as non-spam.
   • BDeploy the model to a sandbox environment for further analysis without removing the poisoned data.
   • CIdentify and remove the poisoned samples from the training dataset, then retrain the model on the cleaned data.
   • DIncrease the model's spam threshold to reduce the number of false positives.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key consideration when handling AI incident data that may be subject to legal holds?

   • AAnonymizing all data immediately
   • BPreserving all relevant evidence in its original form
   • CEncrypting all data to prevent access
   • DDeleting data after 30 days
   Reveal Solution Discussion Select an answer first