AI Incident Response and Forensics COASP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is developing an incident response playbook for AI incidents. They have limited resources and need to prioritize which AI-specific threats to cover. Which threat should be prioritized in the playbook?

   • AModel theft, because it is the most financially damaging
   • BModel poisoning, because it can compromise the integrity of the model and is difficult to detect
   • CData breaches, because they are a general IT issue
   • DAdversarial attacks, because they are the most common type of AI attack
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A European bank's AI-based anti-money laundering (AML) system has been compromised through a data poisoning attack, causing it to miss suspicious transactions. The bank has confirmed that personal data of customers was involved in the training data. The incident response team is preparing to notify regulators. Which action is MOST compliant with GDPR requirements?

   • ANotify the data protection officer (DPO) only, as they are responsible for regulatory communication.
   • BNotify the relevant supervisory authority within 72 hours of becoming aware of the incident, describing the nature of the personal data breach.
   • CNotify all customers whose data was used in the training dataset, regardless of whether they were affected by the compromised model.
   • DWait until the forensic investigation is complete to provide an accurate description of the breach.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After an AI incident, the incident response team needs to assess the impact on the model's confidentiality, integrity, and availability. Which activity is MOST relevant for assessing confidentiality impact?

   • AReview the incident response playbook to see if it was followed correctly
   • BCheck whether the model's accuracy has decreased significantly
   • CDetermine whether the attacker could extract sensitive information from the model's outputs or training data
   • DVerify that the model's version control history is intact
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization has completed the response to an AI incident involving a model that was manipulated to produce biased loan decisions. The incident response team is now writing the final report. Which element is MOST important to include in the lessons-learned section?

   • ASpecific recommendations for improving the AI incident response playbook based on gaps identified during the incident.
   • BA list of all team members involved in the response and their roles.
   • CA detailed timeline of the incident, including all actions taken by the response team.
   • DA summary of the technical findings, including the attack vector and affected model versions.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which type of AI-specific attack involves an attacker inserting a hidden trigger into a model during training so that the model behaves maliciously only when the trigger is present?

   • APrompt injection
   • BData exfiltration
   • CAdversarial perturbation
   • DModel poisoning
   Reveal Solution Discussion Select an answer first