Professional AI Red Team Reporting COASP Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   A red team report for a hospital's AI-based patient monitoring system identified a model poisoning vulnerability that could cause the system to miss critical alerts. The hospital has a limited budget and must prioritize remediation. The system is subject to FDA regulations, and the hospital's legal team is concerned about liability. Which recommendation should the report prioritize?

   • ARetrain the model with a larger dataset that includes more diverse patient data to make it more robust to poisoning.
   • BDisable the AI-based monitoring system and rely solely on manual monitoring by nurses until the vulnerability is fixed.
   • CImmediately replace the monitoring system with a new one from a different vendor that is not based on machine learning.
   • DImplement continuous monitoring of the model's performance and an alerting mechanism for anomalies, while documenting the risk in a risk register for regulatory review.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is it beneficial to align an AI red team report with frameworks such as MITRE ATLAS?

   • ATo automatically fix the vulnerabilities found during the assessment
   • BTo ensure the report uses a recognized taxonomy and is accepted by the professional community
   • CTo make the report longer and more comprehensive
   • DTo replace the need for a technical findings section
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   In an AI red team report, what does the risk and impact assessment primarily aim to communicate?

   • AThe technical difficulty of each attack
   • BThe number of vulnerabilities found in each system component
   • CThe cost of the red team engagement
   • DThe likelihood and business impact of each identified vulnerability
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A red team report for a bank's AI-based credit scoring system must be submitted to the board of directors. The board is concerned about regulatory compliance and wants to know how the findings relate to industry standards. What should the report include to address this concern?

   • AA statement that the red team used a proprietary methodology that is superior to industry standards, so no external framework references are needed.
   • BA list of all vulnerabilities with their CVSS scores, but no explanation of how they relate to AI-specific risks or standards.
   • CA section that maps each finding to relevant MITRE ATLAS techniques and OWASP AI Security controls, and explains how remediation aligns with these frameworks.
   • DA summary of the findings in business terms only, with no mention of technical frameworks, to keep the report accessible to non-technical board members.
   Reveal Solution Discussion Select an answer first