Professional AI Red Team Reporting COASP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of an AI-specific attack vector that should be described in an AI red team report?

   • ASQL injection
   • BBuffer overflow
   • CCross-site scripting
   • DModel evasion
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When assessing the business impact of an AI model poisoning vulnerability, which factor is most relevant?

   • AThe training data file format
   • BThe color scheme of the model's user interface
   • CThe potential for incorrect decisions that could harm customers or revenue
   • DThe number of lines of code in the model's training script
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which section of an AI red team report is intended to provide a high-level overview of the engagement's purpose, scope, and key outcomes for readers who may not be technical?

   • ARecommendations
   • BMethodology
   • CExecutive summary
   • DFindings
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a red team engagement, you successfully performed a data poisoning attack on a financial institution's fraud-detection model by injecting malicious transactions into its training pipeline. You need to document this finding in the technical report so that the data science team can reproduce and remediate it. What should you include?

   • AA high-level summary of the poisoning attack and a recommendation to monitor training data, without exposing the specific injection method.
   • BThe raw training dataset with the injected samples highlighted, but no description of how the injection was performed.
   • CThe model's accuracy before and after the attack, along with a list of all endpoints that use the model, but no sample of the injected data.
   • DThe exact malicious transaction samples, the injection point in the pipeline, the model's performance drop, and the affected production assets.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   In your red team report, you identified a critical vulnerability in a production AI model that allows evasion attacks. The client has limited resources and needs to prioritize remediation. Which recommendation approach is most appropriate?

   • ARecommend only the most comprehensive solution, such as full adversarial retraining, regardless of cost.
   • BList all possible mitigations in alphabetical order without indicating priority.
   • CProvide a prioritized list of mitigations, starting with quick wins like input validation and monitoring, followed by longer-term measures like adversarial training.
   • DSuggest that the client immediately take the model offline until a complete fix is developed.
   Reveal Solution Discussion Select an answer first