Professional AI Red Team Reporting COASP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A red team report for a financial services company's AI-based loan approval system must be reviewed by external auditors who expect alignment with industry-recognized frameworks. Which action best ensures the report meets this expectation?

   • AInclude a disclaimer that the report is based on proprietary methodology and does not follow any external framework.
   • BMap each finding to relevant MITRE ATLAS techniques and OWASP AI Security guidance, and reference them in the report's methodology and findings sections.
   • CFocus exclusively on the business impact of each finding and omit technical framework references to make the report more readable.
   • DUse only the company's internal naming conventions for vulnerabilities and avoid referencing external frameworks to keep the report simple.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What should be included in the technical findings section of an AI red team report to support remediation?

   • AThe attack path, evidence, and affected assets for each vulnerability
   • BOnly the CVSS score of each vulnerability
   • CA summary of the engagement timeline and team members
   • DThe names of the red team members who discovered each issue
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an AI red team engagement, you successfully performed a model poisoning attack on a client's image classifier by injecting malicious samples into the training data pipeline. You need to document this finding for the technical team. What should be included in the technical findings section?

   • AThe full raw training dataset and all model weights used during the test.
   • BA step-by-step description of the attack path, the exact samples injected, the affected training dataset and model version, and evidence such as before/after accuracy metrics.
   • COnly the final accuracy drop observed, since that proves the attack was successful.
   • DA high-level summary that the model was poisoned and that retraining is recommended.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   In your red team report, you need to describe the implications of a model poisoning attack on a recommendation engine. Which statement best captures the AI-specific implications?

   • AThe attack only affects the model's accuracy on rare classes.
   • BThe attack could skew recommendations, leading to user dissatisfaction and potential revenue loss if malicious content is promoted.
   • CThe attack is easily detected by standard security monitoring tools.
   • DThe attack requires physical access to the server hosting the model.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   When writing an executive summary for an AI red team report, which approach is most appropriate for communicating risks to non-technical stakeholders?

   • AFocus on the business impact, such as potential financial loss or reputational damage, using plain language
   • BList every vulnerability with its CVSS score and attack vector
   • CDescribe the exact model architecture and training data used in the AI system
   • DUse technical jargon and detailed exploit code to demonstrate severity
   Reveal Solution Discussion Select an answer first