Professional AI Red Team Reporting COASP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which practice is most appropriate when including evidence in an AI red team report?

   • AOmitting all evidence to keep the report short
   • BIncluding full screenshots of internal dashboards with real user data
   • CUsing only verbal descriptions without any supporting artifacts
   • DRedacting sensitive information and providing a clear description of the evidence
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the key characteristic of actionable recommendations in an AI red team report?

   • AThey are generic and apply to any AI system
   • BThey provide specific, prioritized steps that the organization can take to mitigate the risk
   • CThey only list the vulnerabilities without suggesting fixes
   • DThey are written only for technical staff and ignore business constraints
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are writing the executive summary for a red team report on a large e-commerce platform's AI-based recommendation system. The system was found vulnerable to a data poisoning attack that could manipulate product rankings. The client's legal team is concerned about regulatory compliance, and the marketing team is worried about brand reputation. The executive summary must be concise and non-technical. Which approach best balances these concerns?

   • AEmphasize that the attack is unlikely to be exploited and that no immediate action is needed.
   • BRecommend that the company immediately shut down the recommendation system until a full investigation is complete.
   • CState that the attack could manipulate product rankings, potentially misleading customers and affecting sales, and note that the issue may have regulatory implications under consumer protection laws.
   • DFocus solely on the technical details of the poisoning attack, including the exact injection method and model layers affected.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In an AI red team report, what is the purpose of describing AI-specific attack vectors such as model poisoning and evasion?

   • ATo compare the AI system with traditional software vulnerabilities
   • BTo demonstrate the red team's familiarity with AI terminology
   • CTo explain how these attacks could affect the AI system and its business context
   • DTo provide a general overview of all possible cyber attacks
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   You are documenting a complex AI red team finding involving a combination of model evasion and prompt injection in a voice assistant. The finding is reproducible but requires a specific sequence of steps. The client's engineering team needs to understand the attack path to fix it, but the report must not expose sensitive user data. What is the best way to document this finding?

   • AInclude the full conversation logs from the voice assistant, including any user data captured during the test.
   • BDescribe the attack in high-level terms without specific steps, to avoid giving attackers a roadmap.
   • CProvide a video of the attack, including the audio of the voice assistant's responses.
   • DProvide a step-by-step attack path with sanitized examples, including the exact prompts and perturbations used, and the model's responses, without any real user data.
   Reveal Solution Discussion Select an answer first