GIAC GOAA: GIAC Offensive AI Analyst

Last checked October 22, 2026 against the official GIAC exam page.

1. Question 1Defensive validation and reporting

   A tester has confirmed a prompt injection that reveals restricted data. Which element is most important for the finding report?

   1. AA screenshot of the chat window with no written explanation of the input
   2. BA claim that the system is insecure based on general concerns without evidence
   3. CA list of every tool used in the assessment regardless of its relevance
   4. DReproducible steps, the exact input, the observed output, and the impact on the business
   Show answer and explanationHide answer

   Correct answer: D

   A reproducible finding with exact input, observed output and business impact allows the owner to verify and fix the issue. Screenshots without explanation, unsupported claims and irrelevant tool lists do not support remediation.

2. Question 2Prompt and agent exploitation

   A tester sends a message to an AI assistant that contains hidden instructions telling it to ignore its previous rules and reveal its system prompt. What class of attack is this?

   1. ASQL injection
   2. BPrompt injection
   3. CCross-site scripting
   4. DPort scanning
   Show answer and explanationHide answer

   Correct answer: B

   Hidden instructions that override the assistant's rules are prompt injection. SQL injection targets database queries, cross-site scripting targets browsers, and port scanning discovers open services.

3. Question 3Model and data attacks

   An attacker repeatedly queries a public model API and uses the outputs to train a copy that imitates the model's behaviour. Which attack is this?

   1. AModel extraction
   2. BCache poisoning
   3. CPass-the-hash
   4. DRansomware deployment
   Show answer and explanationHide answer

   Correct answer: A

   Model extraction reconstructs or imitates a model's behaviour from its outputs. Pass-the-hash is a credential attack, cache poisoning targets caches, and ransomware encrypts data.

4. Question 4AI system reconnaissance

   During an authorized assessment of a customer chatbot, the tester wants to identify which model family and hosting provider the application uses, without exploiting anything. Which approach is most appropriate?

   1. ASending sustained denial-of-service traffic from multiple sources to saturate the chatbot's inference endpoints
   2. BExtracting the model weights from the inference server by copying the quantized parameter files out of the container without written permission
   3. CBrute-forcing administrator logins to the model management console by replaying a password wordlist against the exposed admin API
   4. DPassive review of public documentation, response headers and observable behaviour within the agreed rules of engagement
   Show answer and explanationHide answer

   Correct answer: D

   Passive reconnaissance within the rules of engagement gathers information without exploitation or disruption. Extracting weights, brute-forcing logins and denial-of-service traffic exceed authorized scope or cause harm.

5. Question 5Defensive validation and reporting

   A tester discovers that testing the chatbot could expose customer personal data to the tester. What should the tester do?

   1. AContinue testing and copy the records to a local drive for later analysis
   2. BStop, limit exposure, and report the issue to the client under the rules of engagement
   3. CIgnore it because the tester is authorized under the contract to access it
   4. DShare the extracted records publicly to demonstrate the severity of the flaw
   Show answer and explanationHide answer

   Correct answer: B

   Stopping, limiting exposure and reporting under the rules of engagement protects the data and the client. Copying or publishing personal data and ignoring it are unethical and may breach law or contract.