COASP practice questions
EC-Council · 312-52 · 200 questions
Original practice questions for the EC-Council Certified Offensive AI Security Professional (COASP) exam (exam code 312-52), covering foundations of offensive AI security, AI reconnaissance and threat profiling, AI system exploitation techniques, AI model and lifecycle attacks, and governance with defensive engineering. Content is framed for authorized civic and municipal AI red-team / purple-team testing and defensive validation. Content is original practice material aligned to the official exam blueprint and is not a brain-dump of actual exam questions.
This course contains the use of artificial intelligence.
About the 312-52 exam
- Time allowed
- 6 hours
- Questions
- 70
- Passing score
- 70-80%
- Format
- 70 multiple-choice and performance-based questions in a 6-hour proctored exam delivered through the ECC Exam Portal
Schedule this exam The certification this earns
Exam details published by the vendor, checked 18 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
Foundations of Offensive AI Security · 22 questions
- A city CISO reviews a new 311 LLM assistant that answers resident requests and can open service tickets. How does this change the municipal attack surface compared with the prior static FAQ pages?
- A public-health chatbot pilot can answer symptom FAQs, retrieve clinic guidance, and call a scheduling plugin. Which description best captures the layered AI threats the city SOC should inventory?
- County permitting adds an AI “suggest documents” widget on the portal. The SOC wants an authorized offensive AI engagement. What should the scope definition emphasize first?
- A transit authority compares attacks on a rider-alert LLM with classic SQL injection on the same website. What distinction should the offensive AI lead emphasize?
- An emergency-management AI drafting tool loads third-party plugins for weather and GIS lookups. What risk should the municipal risk team flag first?
- City council staff ask how to frame a civic AI red-team charter using industry AI security references. Which approach best aligns municipal risk talks with common offensive AI frameworks?
- A water utility MLOps team asks how DoD-style AI ethical principles should shape authorized offensive testing of a plant-operations assistant. What is the soundest application?
- An assessor office wants assurance-case thinking before promoting a valuation-assistant LLM to public staff. What does that approach primarily require?
- A library director asks how switching from a self-hosted library chatbot to a vendor-hosted LLM changes the offensive testing plan. What is the key implication?
- A city AI working group is purple-teaming a permitting copilot. How should mission requirements shape offensive AI test objectives?
- A 311 agent uses RAG over knowledge articles. Which statement best explains why embeddings and retrieval are security-relevant architecture pieces?
- A public-health triage bot will be fine-tuned on clinic notes. How does fine-tuning most clearly change the municipal AI attack surface?
- A permitting assistant truncates long policy text mid-answer when the context window fills. Why is this an operational and security concern for offensive AI foundations?
- A fire/EMS dispatch assistant invokes tools for CAD lookups, while a parks FAQ bot only returns text. What architectural distinction should the diagram emphasize?
- A county clerk LLM pipeline runs moderation and logging stages before returning a reply. Why do those inference-pipeline stages matter to offensive and defensive testing?
- A housing authority bot stores short-term conversational memory across caseworker sessions. What foundational risk does this create?
- An open-data portal LLM wraps a vendor API. What should the attack-surface inventory include as LLM internals?
- A parks recreation chatbot plans multi-step facility bookings through tool invocation. Which foundational offensive AI concern applies most directly?
- A municipal FAQ model’s dataset curation workflow lacks integrity checks before training. What foundational assurance gap does this create?
- A city SOC defines knowledge and skills for staff who will red-team the 311 LLM versus classic web apps. Which foundational addition is most necessary for the AI track?
- A transit agency compares a self-hosted LLM on a city GPU cluster with a SaaS rider assistant. How should foundational recon approaches differ?
- An ethics board asks how assurance metrics help decide whether a permitting AI is trustworthy enough for public use. What is the best foundational answer?
AI Reconnaissance and Threat Profiling · 44 questions
- A city SOC must inventory vendor-hosted AI endpoints used by departments using only authorized public OSINT. Which activity best fits that recon objective?
- During an authorized purple-team, testers fingerprint the permitting API’s model version from response headers and behavioral cues. What is the primary security purpose of that step?
- An analyst probes a 311 bot with benign capability questions to map supported tools without attempting exploitation. What recon goal does this technique serve?
- During an authorized purple-team of a public-health AI assistant, testers observe that carefully worded capability probes cause the model to echo fragments of its hidden system instructions. How should the civic red team treat that observation?
- County IT is reconnoitering the clerk's document-summarizer agent under an MoU. Beyond model fingerprinting, which reconnaissance objective best maps the agent's integration attack surface?
- A transit authority purple team is building a threat map for a rider-facing LLM that drafts service alerts. What linkage should the map emphasize for leadership?
- While mapping a municipal open-data RAG portal, the SOC discovers architecture notes, vendor names, and corpus descriptions in public documentation. What is the most appropriate recon use of that material?
- During citywide AI asset discovery, the SOC finds departmental chatbots that never appeared in the central inventory. What recon finding does this primarily represent?
- Authorized endpoint enumeration of an assessor-office valuation assistant reveals undocumented debug query parameters that alter verbosity and return internal metadata. How should the team classify this?
- A water-utility chatbot shares authentication boundaries with its vector-store indexes. What should AI reconnaissance include that classic app inventories often miss?
- An emergency-operations status page publicly discloses the model family used by the city's crisis assistant. What should threat intelligence do with that indicator?
- Library chatbot recon shows the public chat endpoint is tightly rate-limited while an adjacent admin summarization endpoint is far less constrained. What should the mapping note emphasize?
- A grant-funded municipal AI pilot must undergo authorized recon. The CISO asks how data-policy obligations should affect the engagement. What is the best practice?
- Housing-authority threat profiling references a prior industry pattern where internal FAQ text leaked through prompt abuse. How should that history be used in the civic profile?
- Permitting leadership wants recon findings ranked for remediation. Which prioritization approach best fits civic AI reconnaissance?
- The city SOC facilitates a workshop to threat-map the 311 LLM, its RAG corpus, and ticketing integrations. What is the primary output of that exercise?
- An analyst is choosing techniques to inventory a county agency's AI assistants. How should AI-appropriate enumeration differ from classic network port scanning alone?
- A county CISO asks which reconnaissance activities stay inside the rules of engagement for a production 311 bot. Which approach is most appropriate?
- Fingerprinting shows the elections FAQ bot shares a model stack with another city's vendor deployment. What risk insight should municipal threat profiling take from that?
- Public-health recon finds that long guidance replies truncate mid-sentence when context limits are hit, cutting off isolation steps. How should this be documented?
- During authorized transit purple-team tests, error messages reveal internal plugin names used by the rider assistant. What recon value do those messages provide?
- City recon discovers three undocumented departmental LLM wrappers. What is the correct follow-through?
- Building a threat profile for a county clerk summarization AI, which scenario belongs in the profile alongside external abuse classes?
- The SOC must sequence AI reconnaissance across many municipal bots. Which prioritization best reflects offensive AI security judgment?
- An authorized test shows a 311 bot's ticket-priority wording can be steered by untrusted user text that the model treats as instructions. What risk class does this illustrate?
- A public-health assistant test floods prior turns with lengthy content until safety-oriented instructions are no longer reflected in later replies. What pattern is being identified?
- During a permitting red-team, an uploaded notes file contains text that tries to override policy instructions when the copilot summarizes the document. What issue should testers report?
- A purple team needs to report how injection could lead to a tool call and then a ticket update on a civic agent. How should they document it for leadership?
- During an authorized test of a city library chatbot, what is the purple team evaluating when it runs jailbreak-class prompts against age-restricted content filters?
- In authorized testing, a county clerk bot discloses internal routing hints when asked to repeat its rules. Which risk class does that finding primarily represent?
- A transit authority's rider-alert LLM can be steered into misinformation-class outputs about service status during authorized testing. What risk should the assessment highlight?
- A housing-authority caseworker assistant concatenates untrusted resident email text directly into the model context. What injection-enabling flaw should the red team flag?
- An emergency-management chatbot assessment includes advanced prompt-chaining scenarios. What should those authorized tests primarily map?
- After prompt-injection findings on a municipal assistant, how should the city map them into the AI risk register for governance?
- A city SOC writes an operational-risk note that successful injection against the 311 bot could spam field crews. What skill does that note demonstrate?
- Compliance asks how authorized prompt-exploitation tests on a resident-facing bot should intersect with PII handling rules. What is the appropriate design stance?
- When mission-mapping prompt-test priority across city bots, which systems should rank highest?
- A water-utility RAG assistant answers with an attacker-controlled snippet from a poisoned knowledge page during an authorized exercise. What abuse class does this illustrate?
- An assessor AI ignores conflicting tax-code snippets when the context is stuffed with noise during testing. What does that finding primarily demonstrate?
- During authorized testing, a Fire/EMS assistant's tool calls appear influenced by injected natural-language 'parameters' in the chat. Which risk class should be recorded?
- City red-team leads must brief leadership on a prompt-attack chain against a municipal assistant. What communication approach fits COASP-aligned civic practice?
- A parks booking agent gradually loses system constraints after a long multi-turn conversation in an authorized test. What failure mode is demonstrated?
- An elections FAQ bot is tested to see whether civic neutrality instructions survive adversarial prompting. What is the assessment primarily evaluating?
- A purple team comparing paths into a permitting assistant needs to distinguish injection types. Which contrast is correct?
AI System Exploitation Techniques · 62 questions
- A 311 LLM emits unsanitized HTML into the resident portal. What AppSec concern should the offensive AI assessment emphasize?
- Public-health bot output is pasted into an internal admin tool and raises an XSS-class concern during review. What does this illustrate?
- A permitting assistant suggests a URL that a backend tool might fetch. Which risk category should the purple team document?
- A clerk summarizer returns text that could be dangerous if a macros-enabled workflow executed it. How should the assessment treat that finding?
- In a test environment, a housing agent retains fragments of prior resident SSN-like data across sessions. What security finding is that?
- A transit bot memory-poisoning test plants false 'station closed' facts for later retrieval in an authorized exercise. What offensive test class is being exercised?
- A city SOC builds a framework that scores LLM output-handling failures by resident-service impact. What capability does that represent?
- The CISO must quantify and communicate AI output risk from civic bots to the mayor's office. Which approach best fits?
- An emergency chatbot assessment probes rare-event scenarios to find gaps in evacuation guidance coverage. What T&E practice is that?
- City IR standards are updated to catch anomalous patterns in 311 LLM transcripts. What does that change primarily support?
- A library chatbot returns citation links that leave the city's allowed domains. What should the assessment emphasize?
- A water-utility advisory bot must never emit text that looks like control-system commands. What boundary is the purple team verifying?
- A county AI risk register tracks 'improper output handling' apart from classic XSS tickets. Why separate those entries?
- During a test, an assessor bot's logs show memory reads of another caseworker's private notes. What failure is indicated?
- A public-works LLM emits markdown that the portal renders as active content. What risk class should be logged?
- Blue team playbooks trigger when civic LLM outputs unexpectedly mention internal hostnames. What capability is that?
- In an authorized test, a 311 agent with ticket-write tools is steered to escalate unrelated cases. What technique class is demonstrated?
- A permitting agent can file fee waivers without any human approval. What risk does the assessment highlight?
- A public-health agent's tools can look up EHR records broader than the chat use case needs. What finding is that?
- In a multi-agent city-hall exercise, a compromised planner agent misroutes work to peer agents. What risk is under test?
- Testing shows a housing agent's required human approval step can be skipped via tool-parameter tricks. What weakness is exposed?
- A transit maintenance agent chains tools to open work orders outside intended service zones. What should the purple team report?
- A clerk-agent review finds no allow-lists on document-destruction tools. What assessment activity produced that gap?
- An emergency-dispatch assistant's assurance case fails because tool side effects lack supporting evidence. What practice is missing?
- A parks booking agent's UX hides confirmation and enables accidental high-impact cancellations. What risk dimension is highlighted?
- A county agent can invoke payment APIs; purple team probes those calls for least-privilege gaps. What is being tested?
- A library research agent forwards raw tool output to residents without mediation. What unsafe pattern is that?
- In testing, a water leak-report agent changes priority fields after natural-language coaxing. What abuse class is shown?
- A city agent graph shows a low-trust FAQ bot can invoke a high-trust finance agent. What should reviewers map first?
- An assessor agent lacks checkpoint or rollback after a partial multi-tool failure. What integrity concern is that?
- A fire-inspection agent accepts unauthenticated suggestions from a peer model during handoff. What trust issue is that?
- SOC gap analysis finds agent logs omit tool-argument audit trails needed for forensics. What deficiency is reported?
- A city chatbot marketplace lists a plugin whose name nearly matches the official permitting helper. What ecosystem risk is that?
- A public-health LLM stack remains pinned to an old vulnerable SDK. What supply-chain concern should the assessment raise?
- A purple-team exercise finds a malicious plugin silently overrides the clerk portal's benign summarizer. What ecosystem attack class is that?
- A transit AI weather plugin is granted broad outbound network access far beyond forecast lookups. What integration risk should the assessment emphasize?
- Housing authority engineers discover a compromised package in the AI wrapper service's dependency tree. What supply-chain finding is that?
- An open-data RAG portal loads a community embedding model with no provenance or integrity checks. What supply-chain gap should testers call out?
- After an AI supply-chain tabletop, the county begins inventorying AI components with SBOM and MBOM practices. What control objective is that?
- An emergency-management AI SaaS vendor changes subprocessors without notifying the city. What third-party risk should the assessment flag?
- A permitting cloud AI integration runs in shared tenancy with unclear isolation guarantees. What cloud AI concern should reviewers raise?
- Library clerks install an unofficial 'productivity' LLM browser extension on workstations that handle patron records. What supply risk is that?
- Water-utility MLOps pulls a pretrained model from an unverified registry mirror. What supply-chain exposure is that?
- A city AI ecosystem map shows unclear ownership between plugin allow-listing and agent deployment. What control gap should leaders close?
- An elections FAQ bot package is republished under a lookalike organization name in the package index. What ecosystem risk is that?
- A public-works agent tool SDK auto-updates overnight and bypasses the city's pinned security review. What supply-chain control failure is that?
- Assessor staff find a malicious prompt template circulating on the internal wiki for valuation assistants. How should the assessment treat it?
- A new 311 vendor plugin requests filesystem scopes unnecessary for chat replies. What review step should precede enablement?
- County developers notice an internal AI helper package name that also exists on a public registry. What supply-chain pattern is that?
- A transit model card claims auditability but omits training-data licensing details. What supply-chain gap should reviewers note?
- A health-department team proposes pulling a fine-tuning dataset from an anonymous torrent mirror 'for convenience.' What should the assessment conclude?
- The city's cloud landing zone uses the same identity for AI inference jobs and training jobs. What integration control is missing?
- Purple-team findings show clerk-agent plugins are installed without cryptographic signing. What integrity control should they recommend?
- Municipal GitOps deploys AI agent configuration from a forked repository containing unknown external commits. What supply-chain hardening is needed?
- A CVE in an open-source RAG framework affects the parks recreation chatbot. What operational supply-chain practice should the city define?
- An on-prem municipal LLM gateway vendor embeds outbound telemetry without disclosure in the contract. What supply and privacy risk is that?
- Ecosystem mapping shows multiple departments buying overlapping critical AI plugins from different vendors. What consolidation benefit should leadership cite?
- A finance chatbot relies on a community prompt pack with no active maintainer. What supply risk should the assessment raise?
- A school-district-adjacent tutoring bot downloads models over plain HTTP without TLS or integrity pinning. What distribution control is missing?
- During a city SOC tabletop, a malicious analytics plugin is assumed to exfiltrate 311 chat transcripts to an external endpoint. What should the exercise primarily validate?
- A purple-team review finds the permitting AI service runs on an outdated container base image with unpatched libraries. What infrastructure supply-chain issue should the report emphasize?
- Before new agent plugins reach production, a county CISO requires an inventory of models, tools, and dependencies similar to a software bill of materials. What practice is being instituted?
AI Model and Lifecycle Attacks · 40 questions
- A public-health FAQ model’s training tickets show a cluster of manipulated labels that always steer toward 'approve.' What training-time attack pattern should the AI red team flag?
- Open civic complaint text used to train a 311 triage model is flooded with noisy mislabeled examples across many categories. How does this differ from a small cluster of labels forcing one outcome?
- A permitting RAG system starts retrieving wrong zoning snippets for certain street addresses after an embedding refresh. What lifecycle attack class should investigators prioritize?
- Transit engineers authorize robustness tests that slightly alter camera frames fed to a traffic-vision model used in signal-timing studies. What attack class are they evaluating?
- A water-quality MLOps pipeline moves sensor datasets from collection to training without cryptographic signing or checksum verification. What control gap enables training-time attacks?
- During evaluation of a housing eligibility model, unexplained trigger phrases produce sudden approval flips that normal cases do not. What concern should the team document?
- A county structured risk assessment ranks training-data integrity as critical for a benefits-eligibility AI. What is the assessment primarily accomplishing?
- After a poison tabletop, the assessor office adds trustworthiness metrics to the valuation model scorecard beside accuracy. What lifecycle practice is that?
- Transit MLOps adds generic security scanners to training CI but never fails the pipeline when poison or integrity tests fail. What evaluation of DevSecOps depth is fair?
- An emergency demand forecast model trains partly on scraped social posts with no provenance or authenticity checks. What lifecycle risk does that create?
- A library recommendation model retrains nightly on click feedback that patrons can game with coordinated clicks. What training-time risk is this?
- A city pothole-severity model relies on crowd-sourced severity labels with weak integrity controls. What lifecycle hardening should the SOC recommend?
- A public-works model card omits poisoning and adversarial test results from the release package. What release requirement is missing?
- A health syndromic surveillance model will face messy clinic notes in production. What should authorized adversarial testing emphasize?
- During a drill, a clerk document classifier’s training set is mixed with synthetic malicious PDFs under change control. What is the primary purpose of that exercise?
- Before each retrain of an elections turnout model, the county verifies integrity of precinct feature tables. What lifecycle practice does this institutionalize?
- A utility fraud model’s metrics shift after seasonal billing changes, and analysts debate ordinary concept drift versus suspected poisoning. What monitoring judgment is required?
- A downstream civic safety model degrades after an open-data portal republishes altered historical crime statistics. What lifecycle integrity risk does this illustrate?
- County MLOps lets notebook users push datasets directly into production training buckets without dual review. What training-time risk path should be tightened?
- A parks vision model’s augmentation pipeline could insert stealthy trigger patterns if that stage were compromised. What should an authorized review treat that stage as?
- City policy requires two independent approvers before a newly trained 311 classifier can be promoted to production. What lifecycle defense is that?
- During a defensive poison canvass of an assessor valuation model, analysts map which input features most strongly sway outputs. Why does that matter for defenses?
- A fire-inspection NLP model is partly trained on vendor-provided corpora of unknown quality. What should an authorized lifecycle review require first?
- A city SOC playbook covers suspected training-data poisoning of a municipal classifier. What recovery action best fits an authorized training-time incident response?
- During an authorized assessment, testers use a capped query budget to see whether a permitting LLM can be closely approximated. What risk class are they evaluating?
- A city CISO fingerprints a vendor model family used by the resident chatbot to plan defenses. What is the legitimate purpose of that fingerprinting?
- A public-health bot undergoes authorized jailbreak and guardrail-evasion testing before clinical-advice filters go live. How should leadership treat those tests?
- A purple team builds a small surrogate of a transit delay model to study decision boundaries. Why is that useful in authorized defensive work?
- A county detection strategy aims to catch extraction-like activity against civic embedding and completion APIs. What signal should analysts prioritize?
- The city considers output watermarking for open municipal generative services. What problem class is that mitigation primarily addressing?
- Before releasing an internal LLM API to city departments, AI V&V procedures are updated. What extraction-related check should be included?
- A red team sizes query cost and time for a time-boxed extraction test against a water-quality model API. What planning skill does that demonstrate?
- Automation runs nightly jailbreak suites against the 311 staging bot. What lifecycle practice does that implement?
- A health model trained on rare-disease cohorts raises membership-inference concerns in an authorized review. What risk should the team document?
- A clerk document summarizer returns overly faithful detail that could reconstruct source filings. What extraction-related issue should reviewers flag?
- City IR KSAs are updated so analysts can tell extraction campaigns from normal civic API load. What capability is being built?
- Fingerprinting shows an elections chatbot behaves like a consumer model with weak filters. What should the authorized review conclude?
- A water-quality model API has no per-client quotas, enabling bulk boundary mapping in tests. What control should defenders prioritize?
- A housing model card claims the model is non-extractable but provides no evidence. What should an authorized review do?
- An assessor office bans exporting full logit vectors from internal valuation models. What defensive goal does that serve?
Governance and Defensive Engineering · 32 questions
- A city AI test-and-evaluation plan for the permitting copilot includes explicit go/no-go gates before public release. What governance practice is that?
- County compliance links assurance cases to procurement clauses for the 311 LLM vendor. Why does that matter?
- A public-health AI risk committee maps controls to NIST AI RMF-style functions for auditors. What governance skill does that demonstrate?
- A transit authority needs a purple-team AI security report that executives can act on. What should the report emphasize?
- An elections office applies heightened test-and-evaluation before any generative answers on voting topics. What principle guides that choice?
- A water utility compliance matrix assigns who signs off on AI safety evidence before release. What is being established?
- A housing authority AI policy references ISO/IEC 42001-style management-system practices. What is the intent?
- A clerk office wants to analyze how the records-assistant LLM could fail in ways that harm residents or records integrity. Which governance approach best fits?
- City council will only approve launching the permitting copilot after purple-team issues are fixed. What governance demand does that embody?
- A resident-data leak scare involving the 311 assistant requires one shared severity model. What should SOC and the privacy office do?
- Before the permitting AI goes live, the CISO wants one gate covering poison tests, prompt suites, and plugin review. What should the team build?
- A county attorney reviews plans for an authorized AI red team against a live clerk assistant. What governance issue must be settled first?
- After hardening the open-data RAG portal, residual risk remains. What should the project present to the risk committee?
- Emergency management runs AI tabletops for the crisis-comms assistant but never documents lessons. What governance practice is missing?
- A library ethics board will not approve the chatbot rollout until bias and representation tests are planned. What governance principle does that enforce?
- Finance wants the tax-FAQ chatbot’s controls mapped to specific statutory and policy obligations. What governance artifact is needed?
- The 311 bot needs defenses against instruction-override style prompts without banning every unusual phrasing residents use. What defensive engineering choice fits?
- A permitting agent can call tools that touch case systems. What mitigation best limits blast radius if the agent is steered poorly?
- Public-health analysts notice triage-assistant recommendations shifting week over week without an announced model change. What defensive control should they emphasize?
- The clerk bot shows signs of a suspected prompt-injection incident during business hours. What should the blue-team playbook prioritize?
- Housing documents in a RAG corpus include sensitive case notes. What hardening package best fits authorized defensive engineering?
- Benefits-eligibility explanations will go public soon. What defensive engineering step should run before release?
- The city SOC wants AI API anomalies visible alongside other security events. What defensive integration is appropriate?
- Engineers edit production system prompts for the transit assistant without tickets. What control alignment is missing?
- Automated clients hammer the transit bot and spike cloud LLM bills. What defensive engineering focus is needed?
- A water-utility agent can create work orders in the CMMS. What defensive control best reduces unchecked impact?
- An elections FAQ assistant must reduce generative misinformation risk for voters. What defensive combination is most appropriate?
- County IR responds to a suspected AI abuse case on a municipal assistant. What evidence set is specifically important?
- Library service owners complain that chatbot filters block too many legitimate research questions. What defensive engineering tradeoff must be governed?
- Departments call LLMs with inconsistent logging and policy. What architecture improves consistent civic defensive controls?
- Fire/EMS assistant logs must support attack investigation without exposing sensitive resident details broadly. What design goal fits?
- After every major model upgrade, the city wants automated AI security suites re-run before broader release. What practice does that embed?
These questions are original practice material and are NOT actual exam questions or brain-dump content. This site is not affiliated with, endorsed by, or sponsored by EC-Council. All EC-Council, COASP, C|OASP, and related marks are trademarks of their respective owners. Practice content discusses offensive AI security concepts for authorized defensive testing only and does not provide criminal how-to guidance.