Using AI for Web Exploitation GOAA Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A security operations team is automating a web exploitation workflow that must run continuously and adapt to changes in the target application. The workflow uses AI to discover vulnerabilities and generate exploits. The team is concerned about the AI model degrading over time as the application changes. What is the best way to maintain the effectiveness of the workflow?

   • AUse a larger AI model that is less likely to degrade.
   • BManually update the AI model's prompts every time the application changes.
   • CFreeze the AI model after initial training to ensure consistent results.
   • DImplement a feedback loop where the AI model is periodically retrained on new vulnerability data and the workflow's success/failure results.
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   How can AI techniques be used to evade a web application firewall (WAF)?

   • ABy using only encrypted traffic to hide payloads
   • BBy sending payloads at a higher volume to overwhelm the WAF
   • CBy disabling the WAF through a separate vulnerability
   • DBy generating payloads that mimic normal traffic patterns
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After an AI-driven attack against a web application, a tester reviews the output and notices that the AI reported a successful SQL injection, but the extracted data appears to be a default error message rather than database content. What should the tester conclude?

   • AThe AI likely produced a false positive; the payload may have triggered an error but not actually executed a query.
   • BThe application is using a honeypot that returns fake data.
   • CThe injection succeeded and the database returned an error message as part of the data.
   • DThe AI tool is broken and should be discarded.
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   An AI-driven exploitation tool reports a critical remote code execution vulnerability in a web application. The report includes a screenshot of a command output and a confidence score of 95%. However, the tester notices that the screenshot shows a generic error page and the command output is not from the target system. What should the tester do?

   • ATreat the finding as a false positive and manually verify the vulnerability by reproducing the exploit in a controlled environment.
   • BRe-run the AI tool multiple times until it produces a screenshot that matches the target.
   • CAccept the AI's high confidence score and include the finding in the report as critical.
   • DIgnore the finding entirely because AI tools are unreliable.
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   What is the main benefit of orchestrating AI-powered tools in an automated exploitation workflow?

   • AIt allows the entire exploitation process to run without any human involvement
   • BIt coordinates multiple tools to perform steps like scanning, payload generation, and exploitation in a sequence
   • CIt eliminates the need for vulnerability discovery before exploitation
   • DIt guarantees that all exploitation attempts will succeed
   Reveal Solution Discussion Select an answer first