AI Incident Response and Forensics COASP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is investigating a model that has been misclassifying images with a specific watermark. The analyst suspects that the watermark is a backdoor trigger. Which analysis technique would BEST confirm this hypothesis?

   • AReview the model's training data for any images with the watermark
   • BExamine the model's architecture to see if it has any unusual layers
   • CCheck the model's accuracy on a standard image dataset
   • DTest the model with images that have the watermark and images without it, and compare the classification results
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A healthcare organization discovers that a large language model used for clinical decision support has been generating inappropriate treatment recommendations for patients with a specific rare condition. Forensic analysis reveals that the model was fine-tuned on a dataset that included maliciously injected examples. The organization must determine the origin of the attack and assess the impact. The model was trained in a multi-tenant cloud environment, and the training pipeline logs show access from an internal IP range. Which approach BEST balances the need for attribution with regulatory compliance?

   • ACorrelate the training pipeline logs with identity provider authentication records to trace which internal user or service account initiated the fine-tuning job.
   • BRequest the cloud provider's physical server logs to determine if the training data was accessed from outside the organization.
   • CAnalyze the injected examples to identify the attacker's intent and then delete the fine-tuned model to prevent further harm.
   • DImmediately notify all affected patients and regulatory authorities before completing the forensic analysis.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational bank's AI-powered credit scoring model has been found to be biased against a specific demographic group due to a data poisoning attack. The attack originated from a compromised third-party data vendor. The bank operates in the EU and the US. During the incident response, the bank's legal team must determine regulatory reporting obligations. Which consideration is MOST critical when deciding whether to notify regulators?

   • ANotify the third-party vendor immediately and require them to report the incident to their own regulators.
   • BWait for the forensic investigation to be 100% complete before notifying any regulatory authority.
   • CDetermine whether the biased model outputs resulted in adverse actions against individuals, which would trigger specific notification requirements under data protection and fair lending laws.
   • DNotify all customers whose data was used in the training dataset, regardless of whether they were affected by the biased outputs.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst notices that a computer-vision model used for autonomous vehicle navigation is misclassifying stop signs as speed limit signs when a small white sticker is placed in the bottom-right corner. The model performs normally on clean images. The team suspects an intentional attack. What is the MOST appropriate immediate triage action?

   • ADelete the training data that contains images with stickers to prevent the model from learning this pattern.
   • BRetrain the model with additional clean images of stop signs to improve its robustness against the sticker pattern.
   • CQuarantine the affected model version and analyze the sticker pattern to determine if it matches a known adversarial trigger.
   • DIncrease the confidence threshold for the model's classification output to reduce false positives.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a key component of a comprehensive AI incident report?

   • AA list of all employees' personal information
   • BA copy of the entire training dataset
   • CA marketing analysis of the incident
   • DA detailed timeline of events and actions taken
   Reveal Solution Discussion Select an answer first