Prompt Injection Attacks COASP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization runs an LLM chatbot that can access customer records. Security wants to detect prompt injection attempts. Which monitoring approach is most effective for identifying indirect injection via retrieved documents?

   • ALog all user inputs and flag those containing 'ignore previous instructions'.
   • BAudit the vector database for changes.
   • CMonitor the model's output for unexpected requests to access sensitive data or unusual tool calls.
   • DTrack the number of tokens processed per request.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare chatbot provides medical information based on a knowledge base. An attacker injects false information into a public health article that the chatbot retrieves. What is the most serious potential impact?

   • AThe chatbot's response time increases due to the injected content.
   • BThe knowledge base is permanently corrupted.
   • CUsers receive incorrect medical advice that could lead to harm.
   • DThe chatbot's system prompt is exposed to the attacker.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of output filtering as a defense against prompt injection?

   • AUsing a system prompt that instructs the model to ignore any instructions that ask it to reveal secrets.
   • BRestricting the model's access to a database to read-only operations.
   • CScanning the model's response for sensitive patterns like API keys before displaying it to the user.
   • DSanitizing user input by removing special characters before sending it to the model.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A developer is building an LLM application that can access a database. To reduce the risk of prompt injection, the developer wants to ensure the model can only perform read-only queries and cannot modify data. Which mitigation strategy does this best describe?

   • AInput validation
   • BPrompt engineering
   • COutput filtering
   • DLeast privilege
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is deploying an LLM-powered email assistant that can read emails, summarize them, and draft replies. The security team is concerned about prompt injection via email content. They have the following constraints: (1) the assistant must be able to read all incoming emails to function; (2) it must be able to draft replies, but sending emails requires human approval; (3) the team wants to minimize the risk of the assistant leaking sensitive email content. Which combination of defenses best meets these constraints?

   • AUse a stronger LLM model that is less susceptible to prompt injection.
   • BDisable the assistant's ability to draft replies and only allow it to summarize.
   • CBlock all emails that contain the word 'ignore'.
   • DSanitize email content before it is included in the prompt, and enforce least privilege so the assistant cannot send emails directly.
   Reveal Solution Discussion Select an answer first