Quiz połączony z przewodnikiem · Średni Poziom

Piaskownice wykonywania kodu dla agentów Quiz

Testuje, w jaki sposób piaskownice agentów izolują kod napisany przez model: kontenery a maszyny microVM i gVisor, limity ruchu wychodzącego z sieci i ograniczenia zasobów, takie jak limity czasu.

Powiązane ścieżki prowadzącePiaskownice do wykonywania kodu dla agentów
Pytanie 1 z 8

Why is code written by an AI agent treated as untrusted by default?

Podgląd każdego pytania8 pytania

Odpowiedzi i wyjaśnienia pojawiają się w miarę rozwiązywania quizu.

  1. Why is code written by an AI agent treated as untrusted by default?
    • Because models cannot write working code
    • Because it can be buggy, wasteful or shaped by prompt injection
    • Because interpreted languages are always insecure
    • Because operating systems block AI-generated code
  2. What is the main security weakness of standard containers compared with microVMs?
    • They cannot limit memory
    • They take minutes to start
    • They share the host's kernel
    • They cannot run Python
  3. What does gVisor add to reduce risk from untrusted code?
    • A user-space kernel that intercepts system calls
    • A hardware security chip
    • A faster file system
    • An antivirus scanner for Python packages
  4. Firecracker microVMs were originally built by AWS to power which kind of services?
    • Video streaming
    • Email delivery
    • Search indexing
    • Lambda and Fargate
  5. Why is restricting outbound network access often considered the most important sandbox control when prompt injection is possible?
    • It makes code run faster
    • It prevents code from sending data or secrets to outside servers
    • It stops the model from generating code
    • It lowers memory usage
  6. Which control specifically defends against a fork bomb?
    • A read-only file system
    • A network allowlist
    • A cap on the number of processes via cgroups
    • Removing environment variables
  7. What is the recommended way to give sandboxed code access to a credential it genuinely needs?
    • Put the API key in an environment variable
    • Hard-code it into the prompt
    • Store it in the scratch directory
    • Route access through a narrow proxy or tool call instead of exposing the secret
  8. Which statement reflects the guide's warning about a common misconception?
    • A sandbox limits damage from code but does not make the agent's answers correct or its granted tools harmless
    • Sandboxes make agents completely safe
    • Sandboxes are only needed for compiled languages
    • WebAssembly sandboxes cannot run Python