GIAC GAIPT: GIAC AI Penetration Tester

Last checked October 22, 2026 against the official GIAC exam page.

1. Question 1Defence and Mitigation

   Which input control reduces the risk of prompt injection from user-supplied content?

   1. ASeparating system instructions from untrusted content, and treating the untrusted text as data
   2. BConcatenating the user's text directly into the system prompt, so the model sees a single instruction
   3. CAllowing the user to write the system prompt, so that the user can customise the assistant freely
   4. DRemoving every character that is not a letter, so that instructions cannot contain any punctuation
   Show answer and explanationHide answer

   Correct answer: A

   Separating instructions from untrusted content, and treating that content as data, limits injected instructions. Concatenation, user-written system prompts and letter-only filtering each leave the risk in place.

2. Question 2Model and Data Attacks

   Which attack uses many queries to a model API to approximate its behaviour, producing a copy that the attacker can use without paying for access?

   1. AModel extraction, which trains a surrogate model from the responses of the target API
   2. BDenial of service, which exhausts the capacity of the API so that legitimate users cannot be served
   3. CCross-site scripting, which runs script in the browser of the user who views the model's output
   4. DSQL injection, which inserts commands into database queries that the application builds from input
   Show answer and explanationHide answer

   Correct answer: A

   Model extraction trains a surrogate from responses, which is the attack described. Denial of service, XSS and SQL injection are different attack classes.

3. Question 3Prompt Injection and Jailbreaks

   Which attack places instructions in user-supplied content, such as a web page the model summarises, so that the model follows the attacker's instructions instead of the developer's?

   1. AMembership inference, which determines whether a given record was part of the model's training data
   2. BModel inversion, which reconstructs training examples from the outputs of the model over many queries
   3. CIndirect prompt injection, where malicious instructions are embedded in content the model retrieves or reads
   4. DTraining data poisoning, which corrupts the dataset used to train the model before it is deployed
   Show answer and explanationHide answer

   Correct answer: C

   Indirect prompt injection hides instructions in content the model reads, such as retrieved pages or documents. Model inversion, membership inference and data poisoning are different attacks on training or outputs.

4. Question 4Scoping and Reconnaissance

   Before testing an LLM-backed chatbot, a tester must agree the rules of engagement. Which item is most important to define first?

   1. AThe number of employees who will receive the final report after the engagement has been completed
   2. BThe brand colours used in the chatbot's interface, so that the test report matches the company style
   3. CThe scope and permitted techniques, including whether prompt injection and data-extraction tests are in bounds
   4. DThe programming language used to write the chatbot's front-end code, which decides the test tools
   Show answer and explanationHide answer

   Correct answer: C

   The scope and permitted techniques, including which AI-specific attacks are authorised, must be agreed before testing so that the work stays within authority. Colours, report recipients and front-end languages do not define the authority to test.

5. Question 5Reporting and Ethics

   During an AI penetration test, the tester finds personal data in the model's responses. What should the tester do?

   1. ACopy all of the personal data into the tester's own notes, so that the client can be shown the full scale
   2. BStop, record the minimum needed to evidence the issue, and follow the agreed data-handling and escalation process
   3. CPublish the personal data on the tester's blog, to show the scale of the issue to the public and media
   4. DContinue extracting personal data until the tester has a complete copy of every record for the report
   Show answer and explanationHide answer

   Correct answer: B

   The tester should stop, record only the minimum evidence, and follow the agreed handling and escalation process. Copying, publishing and extracting full records each breach data protection duties.