AI Reconnaissance and Threat Profiling

COASP · 44 questions

• A city SOC must inventory vendor-hosted AI endpoints used by departments using only authorized public OSINT. Which activity best fits that recon objective?
• During an authorized purple-team, testers fingerprint the permitting API’s model version from response headers and behavioral cues. What is the primary security purpose of that step?
• An analyst probes a 311 bot with benign capability questions to map supported tools without attempting exploitation. What recon goal does this technique serve?
• During an authorized purple-team of a public-health AI assistant, testers observe that carefully worded capability probes cause the model to echo fragments of its hidden system instructions. How should the civic red team treat that observation?
• County IT is reconnoitering the clerk's document-summarizer agent under an MoU. Beyond model fingerprinting, which reconnaissance objective best maps the agent's integration attack surface?
• A transit authority purple team is building a threat map for a rider-facing LLM that drafts service alerts. What linkage should the map emphasize for leadership?
• While mapping a municipal open-data RAG portal, the SOC discovers architecture notes, vendor names, and corpus descriptions in public documentation. What is the most appropriate recon use of that material?
• During citywide AI asset discovery, the SOC finds departmental chatbots that never appeared in the central inventory. What recon finding does this primarily represent?
• Authorized endpoint enumeration of an assessor-office valuation assistant reveals undocumented debug query parameters that alter verbosity and return internal metadata. How should the team classify this?
• A water-utility chatbot shares authentication boundaries with its vector-store indexes. What should AI reconnaissance include that classic app inventories often miss?
• An emergency-operations status page publicly discloses the model family used by the city's crisis assistant. What should threat intelligence do with that indicator?
• Library chatbot recon shows the public chat endpoint is tightly rate-limited while an adjacent admin summarization endpoint is far less constrained. What should the mapping note emphasize?
• A grant-funded municipal AI pilot must undergo authorized recon. The CISO asks how data-policy obligations should affect the engagement. What is the best practice?
• Housing-authority threat profiling references a prior industry pattern where internal FAQ text leaked through prompt abuse. How should that history be used in the civic profile?
• Permitting leadership wants recon findings ranked for remediation. Which prioritization approach best fits civic AI reconnaissance?
• The city SOC facilitates a workshop to threat-map the 311 LLM, its RAG corpus, and ticketing integrations. What is the primary output of that exercise?
• An analyst is choosing techniques to inventory a county agency's AI assistants. How should AI-appropriate enumeration differ from classic network port scanning alone?
• A county CISO asks which reconnaissance activities stay inside the rules of engagement for a production 311 bot. Which approach is most appropriate?
• Fingerprinting shows the elections FAQ bot shares a model stack with another city's vendor deployment. What risk insight should municipal threat profiling take from that?
• Public-health recon finds that long guidance replies truncate mid-sentence when context limits are hit, cutting off isolation steps. How should this be documented?
• During authorized transit purple-team tests, error messages reveal internal plugin names used by the rider assistant. What recon value do those messages provide?
• City recon discovers three undocumented departmental LLM wrappers. What is the correct follow-through?
• Building a threat profile for a county clerk summarization AI, which scenario belongs in the profile alongside external abuse classes?
• The SOC must sequence AI reconnaissance across many municipal bots. Which prioritization best reflects offensive AI security judgment?
• An authorized test shows a 311 bot's ticket-priority wording can be steered by untrusted user text that the model treats as instructions. What risk class does this illustrate?
• A public-health assistant test floods prior turns with lengthy content until safety-oriented instructions are no longer reflected in later replies. What pattern is being identified?
• During a permitting red-team, an uploaded notes file contains text that tries to override policy instructions when the copilot summarizes the document. What issue should testers report?
• A purple team needs to report how injection could lead to a tool call and then a ticket update on a civic agent. How should they document it for leadership?
• During an authorized test of a city library chatbot, what is the purple team evaluating when it runs jailbreak-class prompts against age-restricted content filters?
• In authorized testing, a county clerk bot discloses internal routing hints when asked to repeat its rules. Which risk class does that finding primarily represent?
• A transit authority's rider-alert LLM can be steered into misinformation-class outputs about service status during authorized testing. What risk should the assessment highlight?
• A housing-authority caseworker assistant concatenates untrusted resident email text directly into the model context. What injection-enabling flaw should the red team flag?
• An emergency-management chatbot assessment includes advanced prompt-chaining scenarios. What should those authorized tests primarily map?
• After prompt-injection findings on a municipal assistant, how should the city map them into the AI risk register for governance?
• A city SOC writes an operational-risk note that successful injection against the 311 bot could spam field crews. What skill does that note demonstrate?
• Compliance asks how authorized prompt-exploitation tests on a resident-facing bot should intersect with PII handling rules. What is the appropriate design stance?
• When mission-mapping prompt-test priority across city bots, which systems should rank highest?
• A water-utility RAG assistant answers with an attacker-controlled snippet from a poisoned knowledge page during an authorized exercise. What abuse class does this illustrate?
• An assessor AI ignores conflicting tax-code snippets when the context is stuffed with noise during testing. What does that finding primarily demonstrate?
• During authorized testing, a Fire/EMS assistant's tool calls appear influenced by injected natural-language 'parameters' in the chat. Which risk class should be recorded?
• City red-team leads must brief leadership on a prompt-attack chain against a municipal assistant. What communication approach fits COASP-aligned civic practice?
• A parks booking agent gradually loses system constraints after a long multi-turn conversation in an authorized test. What failure mode is demonstrated?
• An elections FAQ bot is tested to see whether civic neutrality instructions survive adversarial prompting. What is the assessment primarily evaluating?
• A purple team comparing paths into a permitting assistant needs to distinguish injection types. Which contrast is correct?