Quiz lié à un guide · Difficile Niveau

Quiz sur la sécurité de l'IA

Teste la modélisation des menaces, les attaques du cycle de vie, l'autorisation, les limites des outils, la validation des résultats, les tests ciblés et les risques résiduels.

Chemins de guidage associésSécurité de l'IA
Question 1 de 8

A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?

Prévisualisez chaque question8 des questions

Les réponses et les explications apparaissent au fur et à mesure que vous répondez au quiz.

  1. A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
    • All AI applications have identical trust boundaries
    • Their assets, permissions, adversaries, and possible consequences differ
    • Write access makes the internal agent automatically safe
    • Public systems cannot expose private data
  2. What does a prompt saying “follow security rules” replace?
    • Account isolation
    • Secret management
    • Nothing; authorization and permission limits still need enforcement in code
    • Output validation
  3. Which example is a training-stage threat?
    • An attacker changes one inference-time image
    • A user guesses a password
    • A database rejects a valid query
    • Poisoned training material that changes learned behavior
  4. A model writes a database query from a user request. What safeguard applies before execution?
    • Validate and safely handle the generated output at the software boundary
    • Assume the model understands database permissions
    • Use the output as a command without inspection
    • Rely only on a prompt asking for safe SQL
  5. Why restrict a tool to only the permissions it needs?
    • It prevents every adversarial input
    • A model error then cannot silently expose broader capability
    • It eliminates security testing
    • It guarantees confidentiality of all logs
  6. What must a successful refusal test not be confused with?
    • Evidence that one test case passed
    • One observed model behavior
    • Proof that the whole system is secure across different paths and modalities
    • A useful regression example
  7. How should security testing be conducted?
    • By probing unrelated external systems
    • Only after a breach
    • Without documenting scope or ownership
    • On representative failure paths in an authorized environment
  8. What should security telemetry balance?
    • Enough diagnostic value with minimized collection of sensitive content
    • Maximum prompt retention regardless of purpose
    • No event data at all
    • Full response logging for every user indefinitely