A red team found that an AI-powered resume screening tool can be evaded by adding a specific phrase to a resume, causing the tool to rank a less-qualified candidate higher. The company uses this tool to shortlist candidates for manual review. How should the red team articulate the business impact of this vulnerability in the report?

The vulnerability could cause the tool to rank all candidates equally, eliminating the usefulness of the screening process entirely.

The vulnerability could lead to the immediate hiring of unqualified candidates, resulting in direct financial loss and legal liability.

The vulnerability is a technical issue with the model's ranking algorithm and has no direct business impact because the tool is not a final decision-maker.

The vulnerability could allow unqualified candidates to advance, increasing the risk of poor hiring decisions and potential bias, though final decisions still require human review.

You are assessing the risk of a model inversion attack on a recommendation system that uses user purchase history. The attack could allow an attacker to infer sensitive user preferences. What is the most appropriate risk statement for the report?

The attack could lead to unauthorized disclosure of user preferences, resulting in privacy violations and potential reputational damage.

The attack may cause the recommendation system to produce inaccurate recommendations.

The attack will likely go unnoticed by the system's monitoring tools.

The attack is technically complex and requires significant computational resources.

You need to include evidence of a successful model evasion attack in your report. The evidence includes the adversarial images used. What is the best way to present this evidence?

Describe the attack in text only, without any images.

Include all adversarial images generated during the test, even if they are hundreds.

Include a few representative adversarial images with a description of the perturbation method and the model's misclassification.

Provide a link to an external repository containing the images, without any description.

What is the primary purpose of the executive summary in an AI red team report?

To provide a detailed technical analysis of each vulnerability

To list all the tools and commands used during the assessment

To provide step-by-step remediation instructions for each finding

To communicate key risks and impacts to non-technical stakeholders in a concise manner

EC-CouncilCertified Offensive AI Security Professional

Domain 7Objective 4

Professional AI Red Team Reporting COASP Practice Questions (Page 3)

Part of the Security Testing, Hardening, and Incident Response domain, which makes up ~16% of our current practice bank.

49questions here

10free pages

8concepts

Questions 11–15

11application · medium
A red team found that an AI-powered resume screening tool can be evaded by adding a specific phrase to a resume, causing the tool to rank a less-qualified candidate higher. The company uses this tool to shortlist candidates for manual review. How should the red team articulate the business impact of this vulnerability in the report?
Select an answer first
12application · medium
You are assessing the risk of a model inversion attack on a recommendation system that uses user purchase history. The attack could allow an attacker to infer sensitive user preferences. What is the most appropriate risk statement for the report?
Select an answer first
13application · medium
You need to include evidence of a successful model evasion attack in your report. The evidence includes the adversarial images used. What is the best way to present this evidence?
Select an answer first
14foundation · easy
What is the primary purpose of the executive summary in an AI red team report?
Select an answer first
15foundation · easy
In a professional AI red team report, which section should describe the step-by-step process used to test the AI system, including tools, techniques, and procedures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to COASP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “COASP” is a trademark of its owner, used for identification only.

Professional AI Red Team Reporting COASP Practice Questions (Page 3)

Questions 11–15

You are assessing the risk of a model inversion attack on a recommendation system that uses user purchase history. The attack could allow an attacker to infer sensitive user preferences. What is the most appropriate risk statement for the report?

You need to include evidence of a successful model evasion attack in your report. The evidence includes the adversarial images used. What is the best way to present this evidence?

What is the primary purpose of the executive summary in an AI red team report?

In a professional AI red team report, which section should describe the step-by-step process used to test the AI system, including tools, techniques, and procedures?

Keep studying — Security Testing, Hardening, and Incident Response