Free GOAA practice test: 30 questions with answers

A reproducible finding with exact input, observed output and business impact allows the owner to verify and fix the issue. Screenshots without explanation, unsupported claims and irrelevant tool lists do not support remediation.

Stopping, limiting exposure and reporting under the rules of engagement protects the data and the client. Copying or publishing personal data and ignoring it are unethical and may breach law or contract.

Scope and emergency contacts with escalation are essential for an authorized, safe exercise. Favourite prompts, template colours and lunch schedules are not rules of engagement.

Recording the exact version, configuration, inputs and outputs allows others to reproduce the result. Memory-based descriptions, untracked model changes and summaries alone prevent reproduction.

The bypass rate on adversarial prompts measures how often the guardrail fails. Response length, emoji counts and release dates do not measure guardrail effectiveness.

The component, conditions and recommended fix allow the owner to understand and remediate the issue. Personal preferences, coffee breaks and report file sizes do not support remediation.

Repetition with a success rate and comparison against benign controls separate reliable behaviour from randomness. Single results, ignoring versions and unrecorded prompt changes make findings unreliable.

Stopping use and notifying the client, and limiting handling to what is required under the data rules, protect the client's data. Unauthorized copies, public posting and sharing with other clients all breach obligations.

Hidden instructions that override the assistant's rules are prompt injection. SQL injection targets database queries, cross-site scripting targets browsers, and port scanning discovers open services.

Instructions hidden in retrieved content that the agent follows are indirect prompt injection. Credential stuffing, clickjacking and zone transfers are different attack types.

A finding that attacker-influenced input can trigger destructive tool actions without confirmation is a material risk with clear impact. Speed, description length and naming are not security findings.

The disclosure shows that data retrieval is not checked against the requester's authorization, which is an access control failure. Resolution, loading speed and logos are unrelated.

Least privilege with approval limits what an injected instruction can do, and validation before execution blocks harmful actions. Unrestricted tools, disabled logging and administrator credentials all increase impact.

A jailbreak tries to make the model ignore its safety or policy controls. Accuracy, size and speed are not the aim of a jailbreak.

An over-scoped token or one that reaches the model's context can be abused through injection. Name length, logos and console colours are not security weaknesses.

Data can leave through outputs, tool calls or rendered links such as image URLs. Printed copies, notebooks and locked tapes are not LLM exfiltration paths.

Model extraction reconstructs or imitates a model's behaviour from its outputs. Pass-the-hash is a credential attack, cache poisoning targets caches, and ransomware encrypts data.

Poisoned training samples that implant a trigger create a backdoor in the model. Denial of service, session hijacking and typosquatting are different attack classes.

Adversarial examples use small crafted perturbations to cause misclassification. Corrupted headers, default configurations and checksum collisions are different concepts.

Unverified model files can contain malicious code or tampered weights, so loading them is a supply-chain risk. Download speed, name length and file size do not create the same risk.

Membership inference tests check whether outputs reveal membership of specific records in the training set. Load testing, font rendering and zone transfers do not test this.

A documented method with a consistent budget and reported success rate makes robustness results comparable and meaningful. Changing methods, testing only easy inputs and single tests give biased or unreliable results.

Provenance review and statistical checks look for anomalous records and triggers. Assumptions, deleting data and duplicating records do not detect poisoning.

Passive reconnaissance within the rules of engagement gathers information without exploitation or disruption. Extracting weights, brute-forcing logins and denial-of-service traffic exceed authorized scope or cause harm.

Verbose errors reveal internal components and versions that help an attacker select known weaknesses. Transparency alone does not make the disclosure safe, and the other statements are inaccurate.

The OWASP Top 10 for LLM Applications lists common risks such as prompt injection and data leakage for LLM apps. PCI DSS, ISO 9001 and NIST SP 800-88 address other topics.

Exposed system prompts reveal logic and guardrails that attackers can study and bypass. Page speed, indexing and read-only status are not the immediate risk.

Reviewing documented schemas and asking about capabilities within scope maps the tools without harm. Malicious calls, deleting definitions and brute-forcing keys are exploitation or disruptive actions.

Published documentation, model cards and advisories are public, low-impact sources. Scanning internal networks, brute-forcing logins and exploitation go beyond legitimate reconnaissance.

Checking advisories and assessing applicability within scope is legitimate analysis. Exploiting immediately exceeds scope and risks harm, copying client data to a personal server is unauthorized, and ignoring the framework misses a real risk.