Integrating LLMs with Offensive Operations GCIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common use of LLMs in offensive operations for payload generation?

   • AEncrypting communication channels between attacker and victim.
   • BGenerating convincing phishing emails that mimic legitimate communication.
   • CAnalyzing network traffic to identify vulnerabilities.
   • DOptimizing network bandwidth for data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst discovers that an internal LLM-based chatbot, connected to a customer database, has been tricked into revealing customer PII by a user who injected a prompt that overrode the system's instructions. Which defensive countermeasure would most directly prevent this type of attack?

   • ARestrict the chatbot's database access to only the minimum data needed for its function and apply strict output filtering to prevent PII from being returned.
   • BDisable the chatbot's ability to access the internet to prevent external prompt injection.
   • CAdd a second LLM to review all responses and flag any that contain PII.
   • DImplement input sanitization to strip out any text that looks like a prompt or instruction.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A red-team operator is building a tool that uses an LLM to automate initial reconnaissance. The tool will query public APIs, summarize findings, and then generate follow-up queries. The operator wants to minimize the risk of the LLM being manipulated by malicious data encountered during recon. Which approach best reduces this risk?

   • AParse and sanitize all external data before it is included in prompts, and treat LLM outputs as untrusted.
   • BUse a separate, isolated LLM instance for each target and discard the conversation after each run.
   • CUse a fine-tuned LLM that has been trained only on reconnaissance reports.
   • DDisable the LLM's ability to call external APIs during reconnaissance.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key method to detect offensive use of LLMs in an organization?

   • AUsing a firewall to block LLM traffic.
   • BDisabling all LLM services in the organization.
   • CBlocking all external access to the internet.
   • DMonitoring and logging all interactions with LLM APIs for suspicious patterns.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How can an attacker exploit LLM hallucinations to mislead defenders?

   • ABy generating false information that appears credible, causing defenders to chase non-existent threats.
   • BBy causing the LLM to crash, disrupting services.
   • CBy using the LLM to brute-force passwords.
   • DBy making the LLM generate malware that is undetectable.
   Reveal Solution Discussion Select an answer first