AI Incident Response and Forensics COASP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A fraud-detection model at a bank suddenly misclassifies a large batch of legitimate transactions as fraudulent. The security team suspects a data-poisoning attack but is unsure whether the model was retrained on poisoned data or an attacker manipulated the input pipeline. The incident response lead needs to determine the scope of the incident and preserve evidence for potential legal action. Which action should the team take FIRST?

   • AShut down the entire AI infrastructure to prevent further fraudulent classifications
   • BIsolate the model's serving environment and snapshot the current model artifacts, training data, and logs
   • CNotify the bank's customers about the misclassification incident immediately
   • DImmediately retrain the model on a clean dataset to restore normal classification behavior
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a critical step when collecting digital evidence from an AI system during forensic investigation?

   • APreserving the integrity of model artifacts and logs using cryptographic hashes
   • BRestoring the system from backup before collecting evidence
   • CRunning the model in production to observe its behavior
   • DDeleting logs to prevent data leakage
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During an AI incident, a security team discovers that a model has been compromised by a backdoor that triggers on specific inputs. The team needs to contain the incident while minimizing disruption to business operations. Which containment strategy BEST achieves this?

   • ADisable all access to the model for all users until the incident is resolved
   • BRoute traffic containing the suspected trigger pattern to a sandboxed environment for further analysis
   • CShut down the entire model-serving infrastructure immediately
   • DDelete the model and retrain it from scratch without further analysis
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Why is it important to include 'lessons learned' in an AI incident report?

   • ATo justify the cost of the incident to shareholders
   • BTo assign blame to specific individuals
   • CTo satisfy marketing requirements
   • DTo improve future incident response processes and prevent recurrence
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's voice recognition model has been attacked using adversarial audio samples, causing it to misinterpret voice commands. The incident response team has confirmed the attack and is now assessing the impact. Which factor is MOST important to evaluate when determining the impact on model confidentiality?

   • AThe cost of retraining the model with additional adversarial samples.
   • BWhether the adversarial samples caused the model to reveal sensitive information from its training data.
   • CThe number of incorrect voice commands the model processed during the attack.
   • DThe duration of time the model was exposed to the adversarial samples.
   Reveal Solution Discussion Select an answer first