Worked solutions
Compare your reasoning with the evidence, not just the answer letter. These are original learning scenarios, not official exam questions.
Case 1 · A retrieved note tries to take control
Best choice: Indirect prompt injection. Untrusted retrieved content tries to become an instruction with authority over the assistant’s task. The failed send does not make the attempt harmless or prove disclosure occurred.
Verification or reasoning check: Keep document text separate from action authority. Test that the external note cannot expand permissions or authorize a send; inspect the denial record and confirm no data left.
Why the other choices fit less well
- Confirmed data exposure: The send was denied and no disclosure is observed. The attempted disclosure is a possible consequence; the initiating mechanism is indirect prompt injection.
- Data poisoning during training: The evidence concerns instructions in the current retrieved note. It does not describe modification of a training dataset.
- Ordinary factual error only: The note explicitly attempts to redirect the task and request an unauthorized action; this is more than an inaccurate statement.
Remember: Classify the attack mechanism separately from whether the attempted action succeeded.
Technical context: OWASP: Prompt Injection (2025). The scenario facts are original teaching inputs.
Case 2 · Tampering before the next fine-tune
Best choice: Data poisoning. Deliberate dataset tampering crosses the boundary from untrusted changes into trusted learning material and influences the adapted model.
Verification or reasoning check: Preserve dataset and model versions, identify the unauthorized changes, rebuild from reviewed data, and compare behavior on held-out tests before reuse.
Why the other choices fit less well
- Prompt injection in the current conversation: There is no current conversation instruction carrying the attack. The observed tampering enters the fine-tuning data pipeline.
- Sensitive-data exposure only: The facts establish changed learning examples and resulting behavior, not disclosure of confidential records.
- Improper output handling only: No downstream component is executing or interpreting the generated response in this case. The compromised input is the fine-tuning dataset.
Remember: Dataset provenance, review and versioning address a different boundary from screening a live chat prompt.
Technical context: OWASP: Data and Model Poisoning (2025). The scenario facts are original teaching inputs.
Case 3 · A summary becomes executable page content
Best choice: Improper output handling. Generated text crossed into an executable browser context without appropriate handling. Treat the response as untrusted data and render it safely for the intended context.
Verification or reasoning check: Render plain summaries as text. If approved formatting is needed, apply a suitable HTML sanitizer and safe rendering rules; test that script-bearing output stays inert.
Why the other choices fit less well
- Confirmed training-data poisoning: No training-data changes are shown. The proven failure is the application’s handling of generated output.
- Confirmed prompt injection: Prompt injection could be one cause of malicious output, but the scenario does not establish it. The demonstrated downstream execution is improper output handling.
- A harmless hallucination only: The output was executed as browser code, so the issue extends beyond whether generated text is factually accurate.
Remember: A model response must not gain code-execution authority merely because an application received it.
Technical context: OWASP: Improper Output Handling (2025) · OWASP: Cross-Site Scripting Prevention. The scenario facts are original teaching inputs.
Case 4 · A correct answer reaches the wrong person
Best choice: Sensitive-information exposure. The application crossed the requester’s access boundary and disclosed restricted notes. An ordinary question can expose a retrieval authorization defect.
Verification or reasoning check: Enforce the requester’s record-level permissions before retrieval and before release. Retest with permitted and unpermitted users, and handle the observed disclosure through the incident process.
Why the other choices fit less well
- Hallucination: The notes are accurate. Accuracy does not authorize the recipient to receive them.
- Data poisoning: The evidence shows unauthorized retrieval and disclosure, not corruption of training or supporting data.
- Prompt injection must have occurred: No instruction override is established. Broken access enforcement can expose data without prompt injection.
Remember: A correct answer can still be a security failure when it reaches an unauthorized person.
Technical context: OWASP: Sensitive Information Disclosure (2025). The scenario facts are original teaching inputs.
Case 5 · A convincing maintenance claim has no source
Best choice: Hallucination or unsupported generated claim. The observed issue is a credible-looking invented claim. Independent checking caught it; the available evidence does not establish an attack mechanism.
Verification or reasoning check: Record the incorrect claim, consult the genuine vendor documentation and test any eventual approved change in a safe environment. Ask for evidence, not just reassurance from the same assistant.
Why the other choices fit less well
- Data poisoning is confirmed: A false answer alone does not establish deliberate changes to data or model artifacts.
- Prompt injection is confirmed: No task-redirecting instruction is identified. Incorrect output alone is not evidence of prompt injection.
- Improper output handling is confirmed: The response remained plain text and no downstream execution occurred. The demonstrated issue is unsupported content, not an executable interpretation boundary.
Remember: Distinguish an unreliable result from evidence of an attack. Further investigation may change the classification.
Technical context: NIST AI 600-1: Generative AI Profile · OWASP: Misinformation (2025). The scenario facts are original teaching inputs.