Bypassing Defensive Controls GOAA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security researcher is testing an AI-based malware detector that uses a deep neural network. The researcher has white-box access to the model and wants to generate adversarial examples that are robust to the detector's defensive preprocessing, such as input clipping. Which attack technique is most appropriate?

   • AUse a transfer attack from a surrogate model, which is robust to preprocessing by design.
   • BUse an iterative attack like PGD that accounts for the preprocessing by incorporating it into the optimization process.
   • CUse a query-based attack, which is unnecessary with white-box access.
   • DUse a one-shot attack like FGSM, which is fast but may not survive preprocessing.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company uses an AI-powered email filter that blocks phishing emails by analyzing text and URLs. A penetration tester wants to bypass this filter to deliver a phishing email to employees. The tester has no access to the model's internals but can send test emails and observe whether they are blocked. Which technique is most effective for this black-box scenario?

   • AUse a query-based method that iteratively modifies the email content based on the filter's feedback to find a variant that is not blocked.
   • BApply a large random perturbation to the email text in one attempt, hoping it will confuse the classifier.
   • CObtain the model's training data and retrain a local copy to exactly replicate the filter, then use white-box attacks.
   • DSend the email from a compromised internal account to bypass the filter's external sender checks.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A red team is conducting an exercise against an AI-based endpoint detection and response (EDR) system. The team has white-box access to the model but is constrained by a limited time window. They need to generate adversarial examples that are effective against the EDR. Which approach best balances effectiveness and time efficiency?

   • AUse an iterative attack like PGD, which is more effective but requires more computational time.
   • BUse a fast gradient-based attack like FGSM to generate adversarial examples quickly, accepting potentially lower success rates.
   • CUse a transfer attack from a surrogate model to save time, but it may be less effective.
   • DUse a query-based attack to avoid relying on gradients, even though it is slower.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A red team is testing a physical access control system that uses a deep learning model to recognize faces. The system is deployed at a high-security facility with both a visible-light camera and an infrared camera. The team has access to a photo of an authorized employee. They want to test whether the system can be bypassed using an adversarial perturbation that works across both camera modalities. The team has white-box access to the visible-light model but only black-box access to the infrared model. Which approach is most likely to succeed?

   • ACraft an adversarial perturbation using the visible-light model and test it against the infrared model, iterating based on the infrared model's responses.
   • BUse a universal adversarial perturbation that is known to fool all face recognition models.
   • CUse a perturbation optimized only for the visible-light model and assume it will transfer to the infrared model.
   • DPhysically cover the infrared camera to force the system to rely only on visible light.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security researcher is testing an AI-based image classifier that is used to detect inappropriate content on a social media platform. The researcher wants to create images that bypass the classifier while still appearing normal to human viewers. Which technique is most appropriate?

   • ACompress the image to reduce its file size.
   • BAdd imperceptible perturbations to the image that cause the classifier to misclassify it.
   • CChange the image format from JPEG to PNG.
   • DCrop the image to remove the inappropriate content.
   Reveal Solution Discussion Select an answer first