Integrating LLMs with Offensive Operations GCIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An incident responder is investigating a suspected data breach. During the investigation, they find a log entry that appears to be from an attacker's LLM tool, but the entry contains contradictory information that does not match other evidence. What is the most likely explanation?

   • AThe log entry is a result of a system error and should be ignored.
   • BThe attacker intentionally used an LLM to generate false log entries to mislead the investigation.
   • CThe log entry is from a different attack and is unrelated to the current investigation.
   • DThe log entry is a false positive from the SIEM and can be safely disregarded.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is deploying an LLM-based assistant that can access internal ticketing and HR systems. The security team wants to reduce the risk of prompt injection leading to unauthorized data access. Which control is most effective?

   • ADisable the LLM's ability to access the internet to prevent external attacks.
   • BTrain the LLM to recognize and ignore any input that contains the word 'ignore previous instructions'.
   • CUse a more powerful LLM that is less susceptible to prompt injection.
   • DImplement a strict allowlist of commands the LLM can execute, and require human approval for any action that modifies data or accesses sensitive fields.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations team is evaluating how attackers might use LLMs to enhance their phishing operations. They want to understand the most significant advantage LLMs provide over traditional phishing kits. What is that advantage?

   • ALLMs can directly deliver phishing emails without the need for email servers.
   • BLLMs can generate highly personalized and context-aware phishing content at scale, reducing the effort required to craft convincing emails.
   • CLLMs can bypass multi-factor authentication by generating one-time passwords.
   • DLLMs can automatically exploit vulnerabilities in web browsers.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a defensive countermeasure against prompt injection attacks on LLMs?

   • AImplementing input validation and sanitization to filter out malicious prompt patterns.
   • BDisabling the LLM's ability to generate text.
   • CIncreasing the LLM's temperature setting to make outputs more random.
   • DUsing a larger LLM model to improve its understanding of prompts.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is testing an LLM-powered web chat interface that answers questions from public data. The analyst wants to determine if the chat can be manipulated to reveal information it should not. Which test would be most effective?

   • ACheck the chat's response time to see if it is slower when handling sensitive topics.
   • BAttempt to inject a prompt that instructs the chat to ignore its system prompt and respond as if it were a different, less restricted AI.
   • CAsk the chat a series of increasingly specific questions about the data it was trained on.
   • DSend a large volume of requests to see if the chat crashes or becomes unavailable.
   Reveal Solution Discussion Select an answer first