AI Incident Response and Forensics COASP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A social media company's content moderation model is found to be allowing hate speech to pass through undetected. The incident response team is activated and must determine the scope of the incident. Which action is MOST appropriate during the identification phase of the incident response lifecycle?

   • ACollect and analyze inference logs to determine the timeframe and volume of undetected hate speech.
   • BNotify law enforcement about the hate speech that was not detected.
   • CDisable the content moderation model until the cause of the failure is identified.
   • DImmediately retrain the model with a more diverse dataset to improve its detection capabilities.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is creating an incident response playbook for AI-specific threats. The playbook must include procedures for detecting and responding to model poisoning attacks. Which procedure is MOST important to include in the detection phase of the playbook?

   • AProvide instructions for isolating the model from the network to prevent further damage.
   • BDefine baseline model performance metrics and establish thresholds for detecting anomalous behavior that may indicate poisoning.
   • CList the contact information for the model development team and data science leads.
   • DInclude a list of all model versions and their deployment dates for reference during the investigation.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization is developing an incident response playbook specifically for AI-related incidents. The playbook must address the unique aspects of AI systems, such as model poisoning and adversarial attacks. Which element is MOST important to include in the playbook?

   • AA generic incident response checklist that applies to all types of security incidents, including network and endpoint attacks.
   • BA predefined procedure for isolating and preserving model artifacts, training data, and inference logs during the containment phase.
   • CA template for documenting the incident timeline and the names of the response team members.
   • DA list of contacts for the organization's legal team and public relations department.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which action is an example of containing a compromised AI model during incident response?

   • ADeleting the model from production
   • BIsolating the model's serving environment from the network
   • CRetraining the model with clean data
   • DDocumenting the incident in a report
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After a model poisoning incident, the incident response team needs to determine the origin of the attack and assess the impact on the model's confidentiality, integrity, and availability. Which activity is MOST critical for attribution?

   • ACheck the model's version history to see when it was last updated
   • BReview the incident response playbook to ensure all steps were followed
   • CAnalyze the model's training data provenance and the access logs of the training pipeline
   • DEvaluate the model's performance on a test dataset to measure the impact
   Reveal Solution Discussion Select an answer first