AI Incident Response and Forensics COASP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cybersecurity team is recovering from a model extraction attack where an attacker was able to replicate a proprietary model by querying it. The team has confirmed the attack and contained the incident. Which recovery action is MOST effective in preventing recurrence?

   • AIncrease the model's confidence threshold to reduce the information revealed in its outputs.
   • BDelete the model and create a new one from scratch using the same training data.
   • CImplement rate limiting and anomaly detection on the model's inference API to identify and block suspicious query patterns.
   • DRetrain the model with a different architecture to make it more difficult to replicate.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   After a complex AI incident, the incident response team is writing a report. The report must be useful for both technical staff and senior management. Which approach is MOST effective?

   • AFocus only on the business impact and omit technical details
   • BKeep the report brief and avoid including lessons learned
   • CInclude a technical appendix with detailed findings and an executive summary with high-level impact and recommendations
   • DWrite the report in highly technical language to ensure accuracy
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is investigating a model that was compromised through a backdoor attack. The model was trained on a dataset that included images with a specific watermark pattern. The team has identified the watermark as the trigger. During the analysis, they discover that the watermark also appears in the model's training data, but the data was sourced from multiple external providers. The team must determine the root cause. Which analysis approach is MOST effective?

   • AAnalyze the model's internal weights to identify which neurons respond to the watermark pattern.
   • BCompare the model's performance on clean images versus watermark images to quantify the impact of the trigger.
   • CRemove all images containing the watermark from the training dataset and retrain the model.
   • DTrace the provenance of the training data to identify which external provider supplied the watermark images and when they were added to the dataset.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational company's AI system has been breached, and the incident involves personal data of customers in multiple jurisdictions. The incident response team must handle legal and compliance obligations. Which approach is MOST appropriate?

   • AWait for law enforcement to provide guidance before notifying any authorities
   • BDelete all personal data involved in the incident to avoid notification obligations
   • CNotify only the jurisdiction with the most stringent requirements to save time
   • DIdentify all applicable data protection regulations and determine the notification requirements for each jurisdiction
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A cybersecurity team has completed the investigation of a model inversion attack that exposed sensitive training data. The team must now create an incident report for both technical staff and executive leadership. What is the MOST effective approach to structure the report?

   • AWrite a single detailed narrative that combines technical and business information in chronological order.
   • BInclude an executive summary with business impact, a technical section with forensic findings, and a lessons-learned section with actionable recommendations.
   • CProvide only the technical details of the attack vector and the affected model versions to avoid overwhelming non-technical readers.
   • DFocus exclusively on the timeline of events and the evidence collected, without including recommendations.
   Reveal Solution Discussion Select an answer first