引导式测验 · 硬 等级

自动渗透测试中的人工智能测验

检查 AI 笔测试代理如何根据观察到的系统状态进行计划、解释工具输出和链式结果，同时尊重授权范围。

相关引导路径自动化渗透测试中的人工智能
问题 1 的 8

NIST 的技术指南在安全测试和评估过程中包含哪些阶段？

预览每个问题8 问题

当您参加测验时，就会出现答案和解释。

  1. NIST 的技术指南在安全测试和评估过程中包含哪些阶段？
    • Planning, discovery, attack, and reporting
    • Model pretraining, fine-tuning, deployment, and monitoring
    • Data labeling, medical diagnosis, treatment, and follow-up
    • Design, advertising, checkout, and customer support
  2. 基于法学硕士的渗透测试代理通常使用“规划器”做什么？
    • 安排员工休假
    • 对目标和系统状态进行推理以决定下一步的攻击步骤
    • 设计公司标志
    • 发送营销电子邮件
  3. NIST 目标漏洞验证技术的目标是什么？
    • Guarantee that an attacker will exploit every vulnerability
    • Replace the need to define test scope
    • Corroborate that a suspected vulnerability exists in the target environment
    • Automatically assign legal liability for a weakness
  4. 哪个序列与 MITRE ATT&CK 中的三个企业战术相匹配？
    • Classification, Regression, then Clustering
    • Planning, Discovery, then Reporting
    • Encryption, Compression, then Backup
    • Initial Access, Privilege Escalation, then Lateral Movement
  5. 人工智能在渗透测试中的主要风险是什么？
    • 相同的技术可以降低恶意攻击者和代理的障碍，可能会导致意外中断
    • 它使计算机运行得更快
    • 它只在纸上起作用
    • 它消除了对密码的需要
  6. What did the cited LLM penetration-testing benchmark evaluate?
    • Whether autonomous testing eliminates the need for authorization
    • How language models and a PentestGPT system performed on benchmark penetration-testing tasks
    • Whether every vulnerability can be exploited from noisy tool output
    • Whether AI testing is more common than annual manual testing
  7. In the guide’s attack-graph description, what do the nodes and edges represent?
    • Nodes are users, and edges are their email messages
    • Nodes are model layers, and edges are attention heads
    • Nodes are system states, and edges are exploits that can move between states
    • Nodes are vulnerabilities, and edges are severity labels
  8. Why does an AI pen-testing agent need human authorization and a defined scope?
    • Authorization makes scan results automatically accurate
    • Scope is needed only to improve language-model fluency
    • A defined scope guarantees every vulnerability is exploitable
    • Its offensive actions can disrupt systems, and testing must stay within approved targets