Integrating LLMs with Offensive Operations GCIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An incident responder is analyzing a phishing email that was generated by an LLM. The email contains a link to a credential-harvesting page. The responder wants to identify the LLM's involvement and gather evidence. Which action is most effective?

   • ASubmit the email text to a public LLM detector tool and rely on its verdict.
   • BCheck the email headers for the X-Mailer field to identify the sending client.
   • CPreserve the email as evidence and document the analysis steps, including any LLM-detection tools used.
   • DLook for linguistic patterns or unusual phrasing that are common in LLM-generated text.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following tasks is best suited for an LLM during the reconnaissance phase?

   • AParsing a company's annual report to extract key employee names and email addresses.
   • BCracking password hashes obtained from a compromised system.
   • CPerforming a TCP SYN scan to identify open ports.
   • DIntercepting and decrypting TLS traffic.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is deploying an LLM-based email assistant that drafts responses to customer inquiries. The assistant has access to customer account data. The security team is concerned about prompt injection via incoming emails. They need to implement a defense that is both effective and does not significantly degrade the assistant's performance. Which control is best?

   • ADisable the assistant's access to customer data and only allow it to draft generic responses.
   • BBlock all incoming emails that contain the word 'ignore'.
   • CUse a separate LLM to review the assistant's responses and flag any that contain sensitive data or instructions, and require human approval for those responses.
   • DUse a more powerful LLM that is less susceptible to prompt injection.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is developing an LLM-based chatbot to answer employee questions about IT policies. The chatbot has access to a database of internal documents. The team is concerned about indirect prompt injection, where an attacker embeds malicious instructions in a document that the chatbot retrieves. Which defense is most effective?

   • AImplement a separate classifier that detects and blocks responses that contain instructions or commands, and restrict the chatbot's access to only the documents it needs.
   • BUse a larger LLM that is less likely to follow embedded instructions.
   • CDisable the chatbot's ability to access the database and only use pre-approved responses.
   • DSanitize all documents by removing any text that looks like an instruction.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an LLM integration point that could be exploited in offensive operations?

   • AThe LLM's tokenizer vocabulary.
   • BA REST API that allows external applications to send prompts to the LLM.
   • CThe LLM's training dataset.
   • DThe LLM's internal neural network weights.
   Reveal Solution Discussion Select an answer first