OWASP LLM and ML Top 10 (2025) Mapping to AI Threat and Governance COASP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An offensive AI team is planning a red-team exercise for a system that uses an LLM to generate responses and a separate ML model to detect spam. The team has a limited budget and must choose between testing the LLM for prompt injection or testing the ML model for adversarial examples. Which factor should most influence the decision?

   • AThe LLM is easier to test than the ML model.
   • BThe ML model is more critical to the system's security than the LLM.
   • CThe likelihood that the LLM is vulnerable to prompt injection is higher than the likelihood that the ML model is vulnerable to adversarial examples.
   • DThe ML model's training data is publicly available, making it more susceptible to data poisoning.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An offensive AI team is planning a red-team exercise for a system that uses an LLM to generate customer support responses and a separate ML model to detect fraudulent transactions. The team wants to test the most critical OWASP LLM and ML Top 10 risks. Which testing scenario is most appropriate?

   • AAttempt to inject malicious prompts into the LLM to make it provide fraudulent transaction instructions, and test the fraud detector with adversarial examples.
   • BReview the training data for both models to identify any biases.
   • CTest the system's authentication and authorization mechanisms.
   • DTest the system's ability to handle a large volume of requests to ensure availability.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An offensive AI security team is planning an assessment of a document-summarization service that uses an LLM and a separate image-classification model. The team has limited time and must prioritize testing based on the OWASP LLM and ML Top 10. The service accepts untrusted user documents and the image model is used to filter inappropriate content. Which testing strategy best aligns with the OWASP frameworks and the service's attack surface?

   • AFocus exclusively on data poisoning of the image classifier's training data.
   • BPrioritize testing for sensitive information disclosure by feeding the LLM documents with confidential data.
   • CTest for model theft by querying the LLM and image classifier with crafted inputs.
   • DTest for prompt injection and insecure output handling on the LLM, and adversarial examples on the image classifier.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A compliance team is mapping OWASP ML Top 10 risks to regulatory requirements. Which risk is most relevant to ensuring that a model does not inadvertently reveal personal data about individuals in its training set?

   • AML02: Data Poisoning
   • BML07: Adversarial Perturbation
   • CML06: Membership Inference
   • DML08: Model Theft
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An offensive AI tester is planning a test to see if a machine learning model can be made to misclassify inputs by adding small perturbations. Which OWASP ML Top 10 risk should the tester use as a reference?

   • AML02: Data Poisoning
   • BML07: Adversarial Perturbation
   • CML05: Model Inversion
   • DML06: Membership Inference
   Reveal Solution Discussion Select an answer first