Certified Offensive AI Security Professional (C|OASP)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Attacking LLM Applications

   A chatbot can query a customer database. It follows instructions hidden in a web page it retrieved and reveals another customer's details. Which vulnerability does this describe?

   1. ATraining data leakage, which reveals content that the model memorised during training
   2. BModel denial of service, which exhausts compute with very long and repeated prompts
   3. CIndirect prompt injection, where retrieved untrusted content carries instructions
   4. DSupply-chain compromise, which tampers with a model file before it is deployed to users
   Show answer and explanationHide answer

   Correct answer: C

   The model obeyed instructions contained in untrusted retrieved content, which is indirect prompt injection, and the database access turned that into a data exposure. The other options concern resource exhaustion, memorisation and tampering with the supply chain, which do not match this chain of events.

2. Question 2Agent Security and Tool Use

   An AI agent can send emails and update records on its own. Which principle best reduces the risk of excessive agency?

   1. AGive the agent full administrator rights so that it never fails a task it has started
   2. BRun the agent only at weekends, when fewer people use the system and risks are lower
   3. CLet the agent choose its own permissions based on each request that it receives from users
   4. DGrant only the tools and permissions needed, and require approval for high-impact actions
   Show answer and explanationHide answer

   Correct answer: D

   Least privilege limits the damage an agent can do, and human approval for high-impact actions keeps a person in control of consequential steps. Broad rights, self-granted permissions and running at quiet times do not control what the agent can do.

3. Question 3Reporting, Ethics and Legal Scope

   A tester finds sensitive personal data during an AI assessment. Which principle should govern how the tester handles it?

   1. ACopy the data to a personal drive so that the findings can be checked again later
   2. BPost examples of the data publicly to show how serious the finding is for the client
   3. CShare the data with the model vendor so that it can fix the issue faster for everyone
   4. DMinimise access, avoid copies, and follow the agreed handling rules
   Show answer and explanationHide answer

   Correct answer: D

   Minimising access and avoiding copies protects the individuals concerned and limits the tester's own exposure, and the agreed rules define how evidence is handled and reported. Copying, publishing or sharing the data each create new harm.

4. Question 4Adversarial Attacks on AI Systems

   Which attack inserts manipulated samples into a model's training data so that the model learns a hidden behaviour?

   1. AMembership inference, which tests whether a particular record was in the training set
   2. BModel inversion, which reconstructs sensitive training records from the model's outputs
   3. CData poisoning, which corrupts the training data so the model learns a hidden behaviour
   4. DEvasion, which modifies inputs at inference time so that the model fails to detect them
   Show answer and explanationHide answer

   Correct answer: C

   Data poisoning changes what the model learns by tampering with its training data, often with a trigger that activates a hidden behaviour. Model inversion and membership inference are privacy attacks on outputs, and evasion changes inputs at inference time rather than training data.

5. Question 5Foundations of Offensive AI Security

   A tester is asked to assess an AI chatbot that a company runs for customers. Which item must be agreed before any testing begins?

   1. AThe model's parameter count, so that the test can be sized to its complexity
   2. BWritten authorisation and a defined scope agreed with the system owner
   3. CThe programming language used to build the chatbot's user interface
   4. DThe number of tokens each test prompt will use within the test budget
   Show answer and explanationHide answer

   Correct answer: B

   Written authorisation and a defined scope protect the tester and the client, and they set which systems and methods are allowed. Parameter counts, interface languages and token budgets may inform planning, but they do not authorise testing.