AI Incident Response and Forensics COASP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is developing an incident response playbook for AI-specific threats. Which component is MOST important to include in the playbook?

   • AA list of all employees' contact information
   • BGeneral IT incident response procedures that apply to all systems
   • CSpecific procedures for detecting and containing model poisoning and adversarial attacks
   • DA detailed explanation of how AI models work
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst at a social media company notices that a content-moderation model is failing to flag hate speech that contains a specific rare emoji sequence. The model was recently updated with new training data. The analyst suspects a backdoor trigger embedded in the training data. Which technique would BEST confirm the presence of a backdoor trigger?

   • ACheck the model's accuracy on a standard benchmark dataset
   • BRun the model on a set of inputs that include the suspected trigger and observe if the model consistently misclassifies them
   • CInspect the model's weights for unusual patterns
   • DReview the model's training logs to see which data samples were used in the last update
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a primary source of digital evidence in an AI system forensic investigation?

   • AThe organization's marketing materials
   • BThe developers' personal emails
   • CThe model's hyperparameters
   • DThe training data and model artifacts
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A healthcare AI system that processes patient data has suffered a data breach. The incident response team is preparing to notify affected patients. Which legal or compliance consideration is MOST relevant to this notification?

   • AThe requirement to notify affected individuals within a specified timeframe under applicable data protection regulations
   • BThe need to preserve all evidence for potential litigation
   • CThe requirement to delete all patient data immediately after the breach
   • DThe obligation to notify law enforcement before notifying patients
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is investigating a model that has been producing incorrect outputs for a specific demographic group. They suspect data corruption in the training dataset. Which analysis technique would BEST help identify the root cause?

   • AReview the model's hyperparameters to see if they were misconfigured
   • BPerform a statistical analysis of the training data to identify anomalies or biases in the affected demographic group
   • CRetrain the model with a different algorithm to see if the issue persists
   • DCompare the model's outputs with a completely different model's outputs
   Reveal Solution Discussion Select an answer first