Free Certified Offensive AI Security Professional (C|OASP) practice test: 30 questions with answers

The model obeyed instructions contained in untrusted retrieved content, which is indirect prompt injection, and the database access turned that into a data exposure. The other options concern resource exhaustion, memorisation and tampering with the supply chain, which do not match this chain of events.

Restricting the data the model can reach and filtering results by the user's role reduces what can be exposed, whatever the prompt says. Higher temperature does not hide data, and placing all customer data in the prompt makes the exposure larger.

If the application renders model output as HTML or script without encoding, an attacker who controls part of the output can inject code into other users' pages. Layout problems, caching and fixed lengths are not the security concern.

Jailbreak resistance comes from layers: input and output filtering, monitoring and adversarial testing before release, so one bypass does not defeat the system. A single prompt is easy to override, and disabling logs or lengthening outputs make attacks harder to detect or no safer.

Least privilege limits the damage an agent can do, and human approval for high-impact actions keeps a person in control of consequential steps. Broad rights, self-granted permissions and running at quiet times do not control what the agent can do.

Allow-listed tools limit which actions are possible, scoped credentials limit what each action can reach, and logs make misuse visible. A shared unlimited key, disabled logging and unrestricted internet calls each widen the damage a manipulated agent can cause.

A step or cost budget stops runaway behaviour, and human checkpoints keep consequential actions under control. No limit invites runaway actions, a one-step limit makes the agent useless, and a self-set limit relies on the agent judging its own risk.

Scoped credentials for each tool and regular review with revocation are core least-privilege practices for agents. Broad credentials, combined read and write rights and permissions that are never reviewed each increase the damage a manipulated agent can cause.

Minimising access and avoiding copies protects the individuals concerned and limits the tester's own exposure, and the agreed rules define how evidence is handled and reported. Copying, publishing or sharing the data each create new harm.

A useful finding names the affected component, explains the impact, gives the conditions needed to reproduce it and suggests a fix. A screenshot without reproduction, a single model name or a general claim does not let the client act on the finding.

Written permission from the owner, covering the systems and the methods, is the basis for lawful testing. Telling the developer, public availability and selling results do not give the tester authority to test.

A rules of engagement or statement of work defines the scope of AI components and endpoints in bounds and the rules for handling sensitive data. Favourite prompts, laptop configuration and vendor release forecasts are not part of the engagement terms.

Data poisoning changes what the model learns by tampering with its training data, often with a trigger that activates a hidden behaviour. Model inversion and membership inference are privacy attacks on outputs, and evasion changes inputs at inference time rather than training data.

An adversarial evasion example perturbs an input so that the model misclassifies it while a person sees little change. Data poisoning alters training, model extraction copies the model, and prompt injection targets language models through text instructions.

Membership inference estimates whether a given record was in the training data, which is a privacy risk for the individual. Prompt leakage exposes instructions, model theft copies the model, and backdoor insertion plants a trigger during training.

Model extraction trains a substitute model from the outputs of the target, which can copy its behaviour and expose intellectual property. The other techniques target training membership, training integrity or system prompts rather than copying the model.

Written authorisation and a defined scope protect the tester and the client, and they set which systems and methods are allowed. Parameter counts, interface languages and token budgets may inform planning, but they do not authorise testing.

The OWASP Top 10 for LLM Applications is the community list that names the principal risks in LLM-based systems, such as prompt injection and sensitive data disclosure. The web application list does not cover model-specific risks, and the CIS Controls and NIST catalogue are broader security references.

The NIST AI Risk Management Framework is organised around Govern, Map, Measure and Manage, and it is widely used to structure AI risk work. ISO 27001, PCI DSS and SOC 2 are valuable security standards but do not use these functions for AI risk.

The rules of engagement set the permitted targets, the testing windows, the escalation contacts and when to stop. Tool preference, training cost and marketing claims are not rules that govern how the test is run.

A model receives instructions and data as one stream of text, so it cannot always tell which part should be obeyed. That is the root of prompt injection. The other options describe storage, execution or authentication that language models do not perform by default.

The system prompt sets the standing role, rules and constraints the model should follow. It is not a credential store, a training corpus or an audit log, although it is a sensitive asset that attackers may try to extract.

A vector store holds embeddings of document chunks and returns the passages closest to a query, which are then added to the prompt. Model weights, chat logs and prompt encryption are handled elsewhere in the system.

Tools let the agent act on systems and data, so a manipulated decision has real consequences beyond the text it writes. Speed, memory use and logging are not the reason agents widen the attack surface, and agents can and should be logged.

Generated output can be wrong, unsafe or out of scope, so the tester must review it, validate it and keep its use within the agreed boundaries. Running it untested on production, trusting it blindly or publishing it all break the engagement rules.

AI-generated attack ideas can look convincing while being wrong, unsafe or outside the authorised scope, so a human must check them. The speed, value and legal arguments in the other options are not the reason for keeping a person in the loop.

Generated test cases must be checked against the agreed scope before running, because the model may suggest actions that are out of bounds. Running them against production, presenting unchecked results, or publishing the list each bypass the required review.

The model family, its tools and its data sources determine where untrusted content can enter and what actions the system can take, which shapes the test plan. Facility details, styling and salaries do not change how the application can be attacked.

An architecture and supply-chain review identifies components, data flows and third-party dependencies, which shows where attacks can enter. Password cracking, port scanning and phishing simulations are different activities that do not map the design of an AI system.

Motivation and the assets an attacker wants define the goal of the threat profile, and they guide which attack paths matter most. Server versions, training counts and frontend languages are technical or organisational details rather than the attacker's objective.