Free GAIPT practice test: 30 questions with answers

Separating instructions from untrusted content, and treating that content as data, limits injected instructions. Concatenation, user-written system prompts and letter-only filtering each leave the risk in place.

Restricting tools and permissions, with human approval for sensitive actions, limits what the agent can do. Giving every tool, disabling logs and self-granted permissions each increase excessive agency.

Logging and monitoring prompts and tool calls, with alerts on unusual patterns, detects injection attempts. Disabling logs, memory-only prompts and unmonitored acceptance each remove detection.

Verifying provenance and integrity and pinning versions limit supply-chain risk. Unverified plugins, unknown download sites and unreviewed self-updates each increase it.

Enforcing access rights at retrieval and logging retrieved documents with anomaly review limit exposure and detect misuse. Shared unrestricted indexes, keys in prompts and ignoring classification each expose data.

Model extraction trains a surrogate from responses, which is the attack described. Denial of service, XSS and SQL injection are different attack classes.

Data poisoning corrupts training data so that a trigger causes misbehaviour. Prompt injection is an inference-time attack, model inversion reconstructs data, and evasion targets runtime inputs.

Limiting output detail and frequency and testing for memorisation reduce the leakage of training records. Full probability outputs, unlimited anonymous queries and plain-text records all increase leakage.

Membership inference determines whether a record was in the training data. Prompt injection, CSRF and port scanning are different attacks.

Rate limits, authentication and pattern monitoring make extraction harder and detectable, and limiting output detail reduces what an extractor learns. Full logits, unlimited anonymous access and public weights all aid extraction.

Indirect prompt injection hides instructions in content the model reads, such as retrieved pages or documents. Model inversion, membership inference and data poisoning are different attacks on training or outputs.

Role-play and override attempts test whether instructions can be bypassed. Summaries, latency and token counts do not test instruction adherence.

Least-privilege tool permissions and approval for high-impact actions limit what an injected instruction can achieve. Unlimited APIs, removed logging and admin credentials each increase the damage.

A reproducible proof of concept showing the affected data or action, with steps and inputs, demonstrates real impact. Unsupported claims, unfiltered prompt lists and marketing text do not demonstrate impact.

A dedicated test environment with recorded attempts is safe and reproducible, and testing simple cases matters because basic defences should block them. Live production attacks, premature public sharing and ignoring refusals are not sound practice.

The scope and permitted techniques, including which AI-specific attacks are authorised, must be agreed before testing so that the work stays within authority. Colours, report recipients and front-end languages do not define the authority to test.

Passive review of documentation, client code and error messages reveals model and provider hints without attacking. Mass malicious prompting, credential guessing and flooding are active attacks outside passive reconnaissance.

Stack traces exposing internal details are information disclosure, which helps an attacker. They are not denial of service or CSRF, and detailed errors are not safe in production.

MITRE ATLAS catalogues adversary tactics and techniques against AI systems. ATT&CK for enterprise, ISO 27001 and PCI DSS do not address AI-specific adversary techniques.

The OWASP Top 10 for LLM Applications lists the critical risks to LLM applications. The web Top 10, the NIST key management publication and a vendor feature list do not catalogue LLM-specific risks.

The tester should stop, record only the minimum evidence, and follow the agreed handling and escalation process. Copying, publishing and extracting full records each breach data protection duties.

Testing must stay within authorisation and avoid harm to the people the system serves. Unrestricted breaking, accuracy-only testing and testing real customer decisions in production each breach ethical or contractual boundaries.

A good finding gives severity with impact, reproduction steps, evidence and remediation. A glossary of jargon, personal opinions and model weights do not make a finding actionable.

Scope and authorisation define what was tested and findings with evidence, impact and remediation make the report useful. Salaries, social accounts and presentation colours are not report content.

Critical findings should be notified promptly through the agreed process so the client can act. Holding, publicising and further exploitation each cause harm or breach the engagement.

Unencoded model output rendered as script is insecure output handling, which leads to XSS in the consuming application. The other options describe different risks.

Unreviewed generated queries give the agent excessive agency, allowing destructive or unauthorised actions. Hallucination, token overflow and embedding drift are real issues but not the most serious here.

Allowlists and human approval constrain generated commands before execution. Immediate execution, removed validation and unrestricted system choice each make the risk worse.

Policy-based output filtering and escaping before rendering or passing output on both reduce harm. Raw output, disabled filters and skipping review of confident outputs each leave users exposed.

Using unvalidated model output to build file paths is insecure output handling leading to path traversal. The other options describe different attacks.