Original Trifectapp practice · 5 original scenarios · About 15 minutes
AI trust-boundary practice: classify the evidence
Identify what crossed a trust boundary, choose the best-supported classification, and name a check that would show the control works. A bad answer is not automatically an attack, and one incident can involve several risks.
Choose the primary issue demonstrated by the stated facts. The OWASP 2025 risk names provide technical context for this V8 guide; they do not create additional CompTIA exam requirements. “Improper output handling” is also often called insecure output handling. These fictional cases do not run a model, execute code or access real records.
Case 1 · A retrieved note tries to take control
Evidence card
- An assistant is authorized only to summarize an externally supplied maintenance note.
- The note includes a sentence directing the assistant to abandon the summary and send internal account data to an outside recipient.
- No dataset is being updated. The independent tool-authorization check denies the requested send; no disclosure is observed.
Worked solution and technical references
Best choice: Indirect prompt injection. Untrusted retrieved content tries to become an instruction with authority over the assistant’s task. The failed send does not make the attempt harmless or prove disclosure occurred.
Verification or reasoning check: Keep document text separate from action authority. Test that the external note cannot expand permissions or authorize a send; inspect the denial record and confirm no data left.
Why the other choices fit less well
- Confirmed data exposure: The send was denied and no disclosure is observed. The attempted disclosure is a possible consequence; the initiating mechanism is indirect prompt injection.
- Data poisoning during training: The evidence concerns instructions in the current retrieved note. It does not describe modification of a training dataset.
- Ordinary factual error only: The note explicitly attempts to redirect the task and request an unauthorized action; this is more than an inaccurate statement.
Remember: Classify the attack mechanism separately from whether the attempted action succeeded.
Technical context: OWASP: Prompt Injection (2025). The scenario facts are original teaching inputs.
Case 2 · Tampering before the next fine-tune
Evidence card
- A contributor deliberately changes reviewed safe-response examples into unsafe examples in a fine-tuning dataset.
- The build process accepts the altered dataset. Evaluation of the new model shows it repeatedly recommending the altered unsafe behavior.
- There is an audit trail of dataset changes, rather than an instruction inserted into the current user conversation.
Worked solution and technical references
Best choice: Data poisoning. Deliberate dataset tampering crosses the boundary from untrusted changes into trusted learning material and influences the adapted model.
Verification or reasoning check: Preserve dataset and model versions, identify the unauthorized changes, rebuild from reviewed data, and compare behavior on held-out tests before reuse.
Why the other choices fit less well
- Prompt injection in the current conversation: There is no current conversation instruction carrying the attack. The observed tampering enters the fine-tuning data pipeline.
- Sensitive-data exposure only: The facts establish changed learning examples and resulting behavior, not disclosure of confidential records.
- Improper output handling only: No downstream component is executing or interpreting the generated response in this case. The compromised input is the fine-tuning dataset.
Remember: Dataset provenance, review and versioning address a different boundary from screening a live chat prompt.
Technical context: OWASP: Data and Model Poisoning (2025). The scenario facts are original teaching inputs.
Case 3 · A summary becomes executable page content
Evidence card
- A document assistant returns a summary containing script-bearing markup.
- The application inserts that generated string directly as active HTML into a reviewer’s page; the script executes in the browser.
- Investigators have not established how the model produced the markup. Focus on the proven application boundary, not an assumed initiating attack.
Worked solution and technical references
Best choice: Improper output handling. Generated text crossed into an executable browser context without appropriate handling. Treat the response as untrusted data and render it safely for the intended context.
Verification or reasoning check: Render plain summaries as text. If approved formatting is needed, apply a suitable HTML sanitizer and safe rendering rules; test that script-bearing output stays inert.
Why the other choices fit less well
- Confirmed training-data poisoning: No training-data changes are shown. The proven failure is the application’s handling of generated output.
- Confirmed prompt injection: Prompt injection could be one cause of malicious output, but the scenario does not establish it. The demonstrated downstream execution is improper output handling.
- A harmless hallucination only: The output was executed as browser code, so the issue extends beyond whether generated text is factually accurate.
Remember: A model response must not gain code-execution authority merely because an application received it.
Technical context: OWASP: Improper Output Handling (2025) · OWASP: Cross-Site Scripting Prevention. The scenario facts are original teaching inputs.
Case 4 · A correct answer reaches the wrong person
Evidence card
- An employee asks an internal assistant a routine question about a project.
- The retrieval service uses a shared privileged account without filtering records by the employee’s access rights.
- The assistant returns accurate confidential project notes that the employee is not permitted to read. No prompt override or dataset tampering is found.
Worked solution and technical references
Best choice: Sensitive-information exposure. The application crossed the requester’s access boundary and disclosed restricted notes. An ordinary question can expose a retrieval authorization defect.
Verification or reasoning check: Enforce the requester’s record-level permissions before retrieval and before release. Retest with permitted and unpermitted users, and handle the observed disclosure through the incident process.
Why the other choices fit less well
- Hallucination: The notes are accurate. Accuracy does not authorize the recipient to receive them.
- Data poisoning: The evidence shows unauthorized retrieval and disclosure, not corruption of training or supporting data.
- Prompt injection must have occurred: No instruction override is established. Broken access enforcement can expose data without prompt injection.
Remember: A correct answer can still be a security failure when it reaches an unauthorized person.
Technical context: OWASP: Sensitive Information Disclosure (2025). The scenario facts are original teaching inputs.
Case 5 · A convincing maintenance claim has no source
Evidence card
- An assistant states that a fictional appliance’s official manual requires a particular setting and names a manual section.
- The reviewer checks the actual manual and confirms that neither the setting nor the cited section exists.
- No tampered input or dataset is identified, no confidential data is returned, and the response is displayed as plain text without executing actions.
Worked solution and technical references
Best choice: Hallucination or unsupported generated claim. The observed issue is a credible-looking invented claim. Independent checking caught it; the available evidence does not establish an attack mechanism.
Verification or reasoning check: Record the incorrect claim, consult the genuine vendor documentation and test any eventual approved change in a safe environment. Ask for evidence, not just reassurance from the same assistant.
Why the other choices fit less well
- Data poisoning is confirmed: A false answer alone does not establish deliberate changes to data or model artifacts.
- Prompt injection is confirmed: No task-redirecting instruction is identified. Incorrect output alone is not evidence of prompt injection.
- Improper output handling is confirmed: The response remained plain text and no downstream execution occurred. The demonstrated issue is unsupported content, not an executable interpretation boundary.
Remember: Distinguish an unreliable result from evidence of an attack. Further investigation may change the classification.
Technical context: NIST AI 600-1: Generative AI Profile · OWASP: Misinformation (2025). The scenario facts are original teaching inputs.
Your offline pack
Read the evidence cards, complete the blank worksheet, then compare with the worked solutions. See instructions.
Activity v1.0 · November 7, 2026. Original teaching scenarios, not official CompTIA questions. Choices stay in the open page and clear on reload. This activity sends no answers and uses no persistent storage.