AI Threat and Vulnerability Management AAISM Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is prioritizing vulnerabilities for an AI system that is used for medical diagnosis. The team has identified the following vulnerabilities: (1) a model inversion attack that could expose patient data, (2) a data poisoning vulnerability in the training pipeline, and (3) a prompt injection vulnerability in the system's natural language interface. The system is subject to HIPAA and must maintain high accuracy. Which vulnerability should be prioritized?

   • AThe prompt injection vulnerability, because it could allow an attacker to manipulate the system's responses.
   • BThe model inversion vulnerability, because it directly exposes protected health information (PHI) and violates HIPAA.
   • CThe data poisoning vulnerability, because it could compromise the accuracy of diagnoses.
   • DAll three should be prioritized equally, as they are all critical.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of a supply chain risk specific to AI systems?

   • AA compromised pre-trained model obtained from a third-party repository
   • BA user querying the model to extract training data
   • CA denial-of-service attack on the model's API endpoint
   • DAn attacker crafting an adversarial example to fool the model at inference
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is categorizing threats to an AI system that uses a public cloud-based machine learning service. The analyst is concerned about an attacker who could steal the model by querying it repeatedly. Which threat category does this attack belong to?

   • ABackdoor insertion, which is a type of attack that embeds a trigger in the model.
   • BModel inversion, which is a type of attack that reconstructs training data.
   • CData poisoning, which is a type of attack that corrupts the training data.
   • DModel extraction, which is a type of adversarial attack targeting the confidentiality of the model.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which regulatory requirement might affect how AI vulnerabilities are managed?

   • ATraffic laws
   • BData protection regulations such as GDPR
   • CBuilding safety codes
   • DFood labeling regulations
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has implemented a vulnerability management lifecycle for its AI systems. The security team has identified a vulnerability in a model's inference API that allows an attacker to cause a denial of service. The team has patched the API and wants to verify that the vulnerability is resolved. Which action is most appropriate for verification?

   • ARe-run the vulnerability scan and attempt to exploit the vulnerability in a test environment.
   • BClose the vulnerability ticket and move on to the next one.
   • CReview the patch notes and assume the vulnerability is fixed.
   • DMonitor the API for a month to see if any attacks occur.
   Reveal Solution Discussion Select an answer first