CertArea
All GIAC exams

Free GAIPS practice test: 30 questions with answers

30 original questions for GIAC AI Platform Security, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

GAIPS exam guide: topics, cost and format

All 30 GAIPS questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Securing the AI platform (4 questions)

  1. Question 1

    A team downloads a pretrained model from a public hub and loads it into production. Which control reduces the risk of a tampered model?

    1. ALoad it directly into the production inference service because the hub is a trusted source
    2. BVerify the model's source, checksum or signature, and scan the artifact before use
    3. CRename the file to a trusted name such as model.safetensors and then copy it to the server
    4. DRun it with administrator rights inside the production cluster so that it can reach the network
    Show answer and explanation
    Correct answer: B

    Verifying provenance, checksums or signatures, and scanning artifacts detects tampering before deployment. Trusting the hub, renaming, and admin rights do not reduce the risk.

  2. Question 2

    Model files in a serialization format can execute code when they are loaded. Which practice reduces this risk?

    1. ADisable file validation on incoming model artifacts so uploads from partner teams load without delay
    2. BLoad a pickle file downloaded from an unverified forum thread directly into the serving process
    3. CRun model loading as root on the production host to avoid permission errors
    4. DLoad models only from trusted sources in safer formats, and sandbox the loading process
    Show answer and explanation
    Correct answer: D

    Unsafe serialization formats can execute code on load, so trusted sources, safer formats, and sandboxing reduce the risk. Loading from anywhere, root execution, and disabled validation increase it.

  3. Question 3

    A company hosts a model endpoint for internal use. Which control limits abuse, such as scraping the model at high volume?

    1. ANo logging of inbound API requests by client
    2. BAuthentication, per-client rate limits, and quotas
    3. CA shared key posted on a public forum by staff
    4. DA public endpoint with no authentication gate
    Show answer and explanation
    Correct answer: B

    Authentication with per-client limits and quotas restrict abuse and extraction attempts. Public endpoints, posted keys, and no logging make abuse easier and harder to detect.

  4. Question 4

    Which practice protects the secrets used by an AI platform, such as API keys for model providers?

    1. AStore them in a secrets manager and inject them at runtime with rotation
    2. BShare them in a team chat channel so new engineers can copy them
    3. CHard-code them in the application source tree for the staging build
    4. DPut them in a public configuration file committed to the repo
    Show answer and explanation
    Correct answer: A

    A secrets manager with runtime injection and rotation keeps keys out of code and limits exposure. Hard-coding, public files, and chat sharing expose them.

LLM application threats (4 questions)

  1. Question 5

    An attacker embeds hidden instructions in a web page that a retrieval-augmented assistant reads, instructing the model to send user data to an external address. Which vulnerability class does this describe?

    1. ACross-site request forgery on a login form
    2. BBuffer overflow in the GPU driver
    3. CIndirect prompt injection
    4. DSQL injection in the warehouse
    Show answer and explanation
    Correct answer: C

    Indirect prompt injection places instructions in content the model later ingests, such as a retrieved web page. SQL injection, CSRF, and buffer overflows target different layers and are not the mechanism described.

  2. Question 6

    Which OWASP LLM risk category covers manipulation of training or fine-tuning data to change model behaviour?

    1. AData and model poisoning
    2. BSensitive information disclosure only
    3. CInsecure output handling only
    4. DModel denial of service only
    Show answer and explanation
    Correct answer: A

    Data and model poisoning covers tampering with training or fine-tuning data to influence model behaviour. The other categories address different risks such as output handling or availability.

  3. Question 7

    A chatbot passes model output directly into a shell command, and an attacker crafts a prompt that produces a destructive command. Which OWASP LLM risk applies?

    1. AInsecure output handling
    2. BModel theft
    3. CTraining data poisoning
    4. DVector weight leakage only
    Show answer and explanation
    Correct answer: A

    Insecure output handling occurs when model output is used without validation in downstream systems, enabling injection. The other risks do not describe passing unvalidated output to commands.

  4. Question 8

    An attacker repeatedly queries a model with carefully chosen inputs to reconstruct a close copy of its behaviour. Which threat is this?

    1. ALog rotation
    2. BDenial of service through rate limits
    3. CModel extraction
    4. DPrompt caching
    Show answer and explanation
    Correct answer: C

    Model extraction reconstructs a model's behaviour through query access. Rate-limit denial, prompt caching, and log rotation are not extraction techniques.

Governance and assurance (4 questions)

  1. Question 9

    An organization must demonstrate that its AI system follows a documented security standard. Which artifact best supports this?

    1. AA marketing brochure describing the platform's security features for buyers this year
    2. BA verbal assurance from a developer who states the control was reviewed in a team meeting
    3. CA control mapping showing how each requirement is implemented and evidenced
    4. DA screenshot of a dashboard chart exported from the monitoring tool showing alert counts
    Show answer and explanation
    Correct answer: C

    A control mapping links each requirement to implementation and evidence, which supports assurance. Brochures, verbal assurances, and screenshots lack that traceability.

  2. Question 10

    Before an AI feature is released to customers, which activity provides the most useful assurance about its security?

    1. AChecking the logo, colour scheme, and footer text against the approved brand guidelines before launch
    2. BCounting the lines of code and the number of functions in each module
    3. CAdversarial testing of the feature, including prompt injection and data leakage scenarios
    4. DReading the marketing copy and the press release for tone and brand consistency before launch with the legal team
    Show answer and explanation
    Correct answer: C

    Adversarial testing targets the specific AI risks such as injection and leakage. Marketing copy, logos, and line counts do not test security.

  3. Question 11

    Which two statements about AI risk assessment are correct? (Choose two.)

    1. AAssessments should identify both technical and business impacts
    2. BAssessments are only needed once, at the start of the project
    3. CAssessments should be revisited when the model or its data changes
    4. DAssessments cannot consider third-party models
    5. EAssessments replace the need for controls
    Show answer and explanation
    Correct answer: A, C

    Risk assessments should cover technical and business impacts and be revisited when models or data change. They must consider third-party components, and they guide controls rather than replacing them.

  4. Question 12

    An auditor asks how an AI system's training data was approved. Which evidence best answers this?

    1. AA dashboard chart showing model accuracy trends across successive training runs
    2. BA verbal statement from the lead engineer during the sprint review meeting
    3. CA screenshot of the shared data folder showing file names and upload dates
    4. DData governance records with approvals, sources, and licence terms
    Show answer and explanation
    Correct answer: D

    Governance records with approvals, sources, and licence terms provide traceable evidence. Verbal statements, accuracy charts, and screenshots do not show approval.

Detection and monitoring (4 questions)

  1. Question 13

    A monitoring system must spot a sudden rise in requests from one client that tries many similar prompts. Which signal is most useful?

    1. AThe office air temperature in the main building lobby
    2. BRequest volume and similarity patterns per client over time
    3. CThe model's published release notes and changelog
    4. DThe number of registered users in the directory
    Show answer and explanation
    Correct answer: B

    Volume and similarity per client reveal scraping or extraction attempts. Release notes, directory counts, and office temperature do not indicate abuse.

  2. Question 14

    A security operations team wants alerts when an AI agent makes a tool call that it has never made before. Which detection approach fits?

    1. ABaseline normal tool-call patterns and alert on new or unusual sequences
    2. BSkip alerting on agent tool-call activity so analysts stay focused
    3. CReview and alert on agent tool-call patterns once a fiscal year
    4. DRaise an alert for each tool invocation with no history check
    Show answer and explanation
    Correct answer: A

    Baselines with alerts on new or unusual sequences detect unexpected agent behaviour without flooding analysts. Alerting on everything, no alerts, and annual alerts are impractical or ineffective.

  3. Question 15

    Which log source is most valuable for investigating how an attacker used an AI platform to access a data store?

    1. AThe model's public marketing page describing its features, pricing tiers, and general capabilities
    2. BThe office guest Wi-Fi password, which facilities staff rotate monthly and share with visitors today
    3. CA printed copy of the acceptable use policy kept in the facilities binder and reviewed yearly
    4. DAudit logs of data store access tied to the calling identity and the model request
    Show answer and explanation
    Correct answer: D

    Audit logs tied to identity and model requests show the access path. Marketing pages, printed policies, and Wi-Fi passwords do not record platform access.

  4. Question 16

    A monitoring team sees many failed guardrail events from one account. Which first action is most appropriate?

    1. ADelete the account's audit and guardrail logs promptly to free storage space before the review begins
    2. BDisable guardrails globally across model endpoints until the investigation closes
    3. CIgnore the events because the guardrail already blocked them and moved on
    4. DInvestigate the account's activity and consider temporary restrictions while reviewing
    Show answer and explanation
    Correct answer: D

    Investigating and temporarily restricting while reviewing addresses possible misuse proportionately. Ignoring blocked events, deleting logs, and disabling guardrails weaken protection.

Adversarial testing and red teaming (4 questions)

  1. Question 17

    A red team wants to find out whether a chatbot can be tricked into revealing its system prompt. Which test approach is most appropriate?

    1. ALimit testing to the chatbot's greeting and onboarding text shown at start of a session
    2. BReview the source code and configuration files alone, and skip live interaction testing
    3. CAsk the chatbot once, politely and in a single message, to reveal its system prompt
    4. DCraft prompts that attempt to override instructions and check whether protected content is returned
    Show answer and explanation
    Correct answer: D

    Adversarial prompts that attempt to override instructions test the actual weakness. A single polite request, greeting tests, and code review alone do not exercise the behaviour under attack.

  2. Question 18

    A red team finds that a model refuses harmful requests in English but complies when the same requests are written in another language. What does this indicate?

    1. AThe safety behaviour does not generalise across languages and needs testing in each supported language
    2. BTranslating a prompt into another language has no effect on the model's behaviour
    3. CThe model is perfectly safe in the supported languages because its English safety tests passed
    4. DThe English refusal proves the other languages are safe because the same refusal training was applied to every language
    Show answer and explanation
    Correct answer: A

    Safety behaviour can fail to generalise across languages, so each supported language needs testing. Assuming equal safety or inferring it from English results is unsupported.

  3. Question 19

    A tester sends a series of messages that gradually lead a chatbot to produce restricted content, with each step looking harmless. What technique is being used?

    1. ACertificate pinning bypass against the TLS client
    2. BA UDP volumetric denial-of-service flood
    3. CMulti-turn manipulation or gradual escalation
    4. DPort scanning across the model hosts
    Show answer and explanation
    Correct answer: C

    Multi-turn manipulation builds toward restricted output step by step. Port scanning, floods, and certificate bypass are different attack categories.

  4. Question 20

    Which metric is useful for tracking how often a guardrail blocks benign requests, as well as harmful ones?

    1. AThe current number of GPUs in the cluster
    2. BThe colour of each reply text
    3. CThe model's exported file size
    4. DFalse positive rate of the guardrail
    Show answer and explanation
    Correct answer: D

    The false positive rate shows how often benign requests are blocked, which affects usability. GPU counts, file sizes, and response colours do not measure guardrail accuracy.

Securing RAG and retrieval pipelines (4 questions)

  1. Question 21

    A RAG application ingests documents from a shared drive. An attacker places a poisoned document in the drive that alters the model's answers. Which control reduces this risk?

    1. ARemove the source controls and skip checks to speed up the nightly indexing job run
    2. BIndex everything automatically from every writable location on the shared drive, even unreviewed edits by staff
    3. CTrust documents without checks because they are stored in the company drive and were uploaded by staff
    4. DRestrict write access to the source, review new documents, and track provenance before indexing
    Show answer and explanation
    Correct answer: D

    Restricting writes, reviewing new content, and tracking provenance stop poisoned documents from being indexed. Automatic indexing from writable locations, removed controls, and blind trust enable the attack.

  2. Question 22

    A vector database stores embeddings of confidential documents. Which control protects these embeddings?

    1. AApply the same access controls and encryption to the vector store as to the source documents
    2. BLeave the vector store unauthenticated because embeddings are just numbers
    3. CStore embeddings in a public cloud bucket that is readable by anonymous web users
    4. DPublish the embeddings on a research portal so collaborators can download them
    Show answer and explanation
    Correct answer: A

    Embeddings can encode sensitive information, so they need the same protection as the source. Treating them as harmless numbers, publishing, and public buckets expose the data.

  3. Question 23

    A team discovers that deleted documents still appear in the assistant's answers. What is the most likely cause?

    1. AThe model memorised the deleted documents during its original training run
    2. BThe index was not updated to remove the deleted source content
    3. CThe user's browser cached an old copy of the answer
    4. DThe sampling temperature is set too high, so the model rewords answers
    Show answer and explanation
    Correct answer: B

    Deleted content persists in an index until removed, so the index sync is the likely cause. Training memory is possible but the index is the direct data path, and temperature and browser caches do not retain source content.

  4. Question 24

    A retrieval step returns a passage that contains an instruction to the model to ignore its rules. What should the application do?

    1. ATreat the passage as data, strip or flag embedded instructions, and keep the system instructions separate
    2. BFollow the instruction because it came from a trusted internal document that was approved by the knowledge base owner
    3. CSummarise the embedded instruction for the user and present it as a helpful next step in the reply so users can follow it
    4. DDisable retrieval for the session and let the model answer from its parametric memory
    Show answer and explanation
    Correct answer: A

    Treating retrieved text as data and flagging or stripping embedded instructions prevents injection. Following it, summarising it as an instruction, and disabling retrieval entirely do not follow the secure design.

Securing the model supply chain (3 questions)

  1. Question 25

    A team uses a third-party fine-tuned model with an unknown training history. Which assessment is most important before production use?

    1. AEvaluate the model for backdoors and unexpected behaviours with targeted tests
    2. BCheck its model card's colour scheme, font choices, and README formatting before deployment
    3. CUse it in production without evaluation to save engineering time and avoid a delay
    4. DAssume it is safe because its download count and stars are high
    Show answer and explanation
    Correct answer: A

    Targeted tests for backdoors and unexpected behaviour address the unknown history. Popularity, colour schemes, and skipping evaluation do not provide assurance.

  2. Question 26

    An AI application depends on dozens of open-source libraries. Which practice reduces the risk of a compromised dependency?

    1. AIgnore security advisories for the libraries because application code has already been tested
    2. BInstall the newest release of each package automatically without review
    3. CRemove the lock file so each build resolves the latest package versions
    4. DMaintain a software bill of materials and scan dependencies for known vulnerabilities
    Show answer and explanation
    Correct answer: D

    An SBOM and dependency scanning show what is in use and what is vulnerable. Automatic unreviewed updates, removed lock files, and ignored advisories increase risk.

  3. Question 27

    A third-party model provider changes its model version without notice, and outputs shift. Which control helps the platform team detect and respond?

    1. AAccept every new version automatically when the vendor publishes it to production
    2. BPin model versions and run regression tests before accepting a new version
    3. CStop calling external model APIs from production workloads and move to self-hosted models
    4. DIgnore output changes and leave the dashboards and alerting thresholds as configured
    Show answer and explanation
    Correct answer: B

    Pinning versions and running regression tests before adoption detect and manage changes. Automatic acceptance and ignoring changes expose the platform to unexpected behaviour.

Securing AI agents and tools (3 questions)

  1. Question 28

    An agent can call a payments tool. Which design limits the damage of a manipulated call?

    1. AConstrain the tool with spending limits, allowlisted recipients, and human approval above a threshold
    2. BLet the agent choose recipients freely from the saved contact list and the vendor directory
    3. CDisable audit logging of payment calls and suppress alerts for the payments tool nightly
    4. DGive the tool unlimited spending authority and let it self-approve transfers to new payees
    Show answer and explanation
    Correct answer: A

    Spending limits, allowlisted recipients, and approval thresholds constrain manipulated calls. Unlimited authority, free recipient choice, and disabled logging increase the damage and hide it.

  2. Question 29

    An agent must act with the permissions of the user who asked for the task, not with the agent's own broader permissions. Which pattern achieves this?

    1. ADelegated authorization that passes the user's scoped identity to the tool
    2. BGiving the agent a shared domain administrator account for jobs
    3. CStoring the user's plaintext password in the agent config files
    4. DRunning the agent as root on each production server cluster
    Show answer and explanation
    Correct answer: A

    Delegated authorization uses the user's scoped identity, which prevents privilege escalation. Shared admin accounts, root execution, and stored passwords grant broader or unsafe access.

  3. Question 30

    Which practice helps detect that an agent is being used to perform actions outside its intended purpose?

    1. ADisable tool call monitoring for agents to reduce latency and improve speed
    2. BTrust the agent's own report of its actions in each summary it writes to reviewers
    3. CMonitor tool calls and alert on unusual sequences, volumes, or targets
    4. DReview agent logs once a year during the annual compliance audit cycle by staff
    Show answer and explanation
    Correct answer: C

    Monitoring tool calls for unusual patterns detects misuse. Disabling monitoring, trusting self-reports, and yearly reviews do not detect misuse in time.

Want more GAIPS questions?

The full bank has 100 questions with answers and explanations, as a PDF, an online practice exam, or both.

Full question bank · 100 questions
$89$124

Both formats together. The best value.

Instant access after payment, with 90 days of updates. Checkout is on our store, AIExamCerts.