AI Reconnaissance and Attack Surface Mapping COASP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of AI reconnaissance in the context of offensive security?

   • ATo identify and map the components of an AI system that could be targeted by an attack
   • BTo directly exploit vulnerabilities in the AI model's inference logic
   • CTo ensure the AI system complies with data protection regulations
   • DTo monitor the AI system's performance and detect anomalies in real time
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What type of information can be gathered from publicly available documentation of an AI system?

   • AThe internal database schema of the training data
   • BThe exact weights of the trained model
   • CThe model's private API keys and authentication tokens
   • DThe model's architecture and expected input formats
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the context of AI attack surface mapping, what does 'reconnaissance' typically involve?

   • ASending crafted inputs to the AI model to cause misclassification
   • BDeploying a honeypot to attract attackers
   • CCollecting information about the AI system's architecture, data, and deployment environment
   • DPatching known vulnerabilities in the AI system
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A client wants you to map the external attack surface of their AI chatbot service. You have been given permission to perform active enumeration. Which combination of actions would most effectively discover hidden API endpoints and understand the service's functionality?

   • ARun a port scan on the entire public IP range and attempt to connect to every open port with a web browser.
   • BCrawl the public web application, parse JavaScript files for API routes, and fuzz common endpoint patterns with a wordlist.
   • CSearch for the client's API documentation on public code repositories and paste sites.
   • DSend a large number of chat messages to the bot and analyze the responses for error messages that reveal internal paths.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You are testing a sentiment analysis API. You want to infer the model's decision boundary without causing service disruption. Which input strategy is most effective for mapping the boundary while minimizing the number of requests?

   • ASend the same input multiple times to check for output variability.
   • BGenerate inputs that are semantically similar but with slight lexical variations, and observe how the sentiment score changes.
   • CSend a single input with extreme sentiment and record the output confidence.
   • DSend random strings of characters to see if the API returns an error.
   Reveal Solution Discussion Select an answer first