Scoping an AI Red Team Exercise and Threat Modeling COASP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following should be included in the scope documentation of an AI red team exercise?

   • AThe red team members' personal contact information
   • BThe detailed source code of the AI model
   • CThe list of exclusions, such as systems or data that must not be tested
   • DThe names of all employees in the organization
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which threat modeling framework is specifically designed to catalog adversarial tactics and techniques against machine learning systems?

   • AISO 27001
   • BMITRE ATLAS
   • CSTRIDE
   • DOWASP Top 10
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is applying MITRE ATLAS to an AI-powered chatbot that answers customer support questions. They want to systematically identify threats. Which approach best aligns with using a structured threat modeling framework?

   • AUse a generic network vulnerability scanner to identify open ports and known CVEs on the chatbot's infrastructure.
   • BFocus only on the model's accuracy metrics and test with random inputs to see if the chatbot gives wrong answers.
   • CAsk the development team to list all known bugs in the codebase and fix them before the exercise.
   • DEnumerate the chatbot's assets (training data, model, API, backend knowledge base) and map each to relevant ATLAS techniques such as prompt injection and model poisoning.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it important to align an AI red team exercise scope with the organization's compliance requirements?

   • ATo make the exercise more challenging for the red team
   • BTo ensure the exercise does not violate legal or regulatory obligations
   • CTo guarantee the exercise will find all vulnerabilities
   • DTo reduce the need for stakeholder communication
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A red team is scoping an exercise for an AI-powered autonomous vehicle perception system. The system uses a deep learning model to identify pedestrians and obstacles. The team has limited time and budget. Which scope is most appropriate for a first exercise?

   • AFocus on the model's image classification outputs using a simulation environment, and exclude physical vehicle testing.
   • BTest the entire vehicle's software stack, including all control systems, in the simulation.
   • CInclude full physical vehicle testing on public roads to assess real-world impact.
   • DFocus only on the sensor hardware, such as cameras and LiDAR, and exclude the model.
   Reveal Solution Discussion Select an answer first