GAIPS practice questions
GIAC · GAIPS · 200 questions
Original practice questions for the GIAC AI Platform Security (GAIPS) exam, covering GenAI and LLM foundations, model customization and alignment, knowledge augmentation and retrieval (RAG / vector stores), AI application architecture and development frameworks, agentic systems and AI integrations, AI infrastructure and deployment security, MLOps / MLSecOps pipelines, and AI risk management and strategic application — framed in civic and municipal scenarios such as city AI pilots, public-health records, permitting chatbots, 311 assistants, courts / clerk workflows, and transit / utilities operations.
This course contains the use of artificial intelligence.
About the GAIPS exam
- Time allowed
- 2 hours
- Questions
- 54
- Passing score
- 65% (for exam versions released on or after July 25, 2026)
- Format
- 1 proctored exam, web-based; remote proctoring via ProctorU or onsite via PearsonVUE
Exam details published by the vendor, checked 6 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
AI and LLM Foundations · 25 questions
- A city CIO asks security why the 311 assistant sometimes drops the start of a resident’s long case history mid-conversation. Which GenAI foundation concept best explains that behavior?
- A public-health chatbot tells a resident clinic hours that do not appear in any approved municipal source. Which GenAI risk best describes that failure?
- A permitting portal pilot receives a user message that tells the model to ignore ordinance-citation rules and approve every application. What GenAI attack surface does this primarily illustrate?
- County counsel worries a court-clerk summarizer may invent case citations that were never filed. Which LLM limitation should security emphasize for this legal-adjacent workflow?
- A transit rider-alert model confuses two stations with similar-sounding names when matching free-text complaints. Which foundation concept best explains that mix-up?
- IT security reviews a parks department model that only classifies trail-camera images as empty, occupied, or damaged with fixed labels and no free-text generation. How should they classify it before applying GAIPS-style GenAI platform controls?
- A school-district homework helper reveals its hidden system-prompt instructions after a student asks for them in a cleverly worded request. Which LLM attack surface does this demonstrate?
- Emergency management wants an LLM to draft after-action report narratives from unstructured field notes. What contrast with legacy NLP should security highlight when judging platform fit?
- A housing authority assistant answers eligibility questions in a tone that sounds like a final binding determination. What GenAI output risk should the platform owner address first?
- City open-data staff want ordinance FAQ answers to stay consistent across identical resident questions. Which decoding control should they understand first?
- A malicious resident uploads a PDF whose hidden white-on-white text tells the 311 RAG stack to ignore privacy rules. Which GenAI attack pattern is this?
- Water-utility analysts must summarize SCADA-adjacent logs and are choosing between a large general foundation model and a smaller specialized model. Which foundation security consideration should guide the choice?
- Library staff discover the chatbot’s training corpus may include copyrighted publisher blurbs scraped without a license. Which GenAI foundation concern does this raise?
- A county assessor imagery-captioning model returns a refusal message on some prompts; staff open a major outage ticket. What distinction should security teach first?
- A municipal developer treats an LLM API as a trusted database of parcel facts for fee calculations. What misconception should platform security correct?
- Security explains to a benefits clerk why pasting even a partial Social Security number into a prompt still matters. Which foundation idea supports that warning?
- During a tabletop, a city red-team pastes jailbreak-style roleplay that asks a benefits chatbot to pretend policies do not apply. What should defenders primarily recognize?
- Transit operations wants multimodal GenAI that reads bus photos and free-text complaints in one assistant. What foundation security implication should be evaluated?
- Procurement asks whether buying a closed commercial LLM removes all GenAI security risk for the permitting assistant. What is the accurate platform-security response?
- A parks volunteer bot’s few-shot prompt examples accidentally include real volunteer home addresses. What GenAI foundation risk does this create?
- IT maps confidentiality, integrity, and availability threats for a city council agenda drafter that uses GenAI. Which mapping best reflects GenAI-specific failure modes?
- A county AI working group confuses theft of model weight files with a successful prompt-injection against the live 311 bot. How should security differentiate the threats?
- Security reviews whether logit bias or stop sequences can help a 311 bot avoid emitting internal ticket ID formats. What are these controls in GenAI foundations terms?
- Public-records staff ask how stochastic decoding affects reproducibility of AI-drafted FOIA response letters. Which explanation is most accurate?
- A municipal CISO onboards appsec engineers to the city AI platform and wants shared GenAI vocabulary. Which set best represents foundational terms they must distinguish to secure LLM apps?
Model Customization and Alignment · 25 questions
- A city plans to fine-tune a foundation model on historical 311 transcripts that still contain resident phone numbers. What is the primary security concern for the customization corpus?
- County public health proposes LoRA adapters for a clinic FAQ model but plans to store adapter weights on the same shared host used by unrelated departmental apps. What should security require first?
- Permitting staff fine-tune a chatbot on an outdated building-code edition, and the bot later cites repealed sections to applicants. What customization risk does this illustrate?
- A housing authority adds RLHF-style preference data that rewards faster case answers more than eligibility accuracy. What alignment risk should the security lead highlight?
- Library IT enables a vendor moderation API for a youth-services chatbot but never maps blocked categories to the library's content policy. What gap remains?
- Transit operations fine-tunes a rider-alert model for production. What evaluation practice should security require around the customization?
- Court clerks request a custom system prompt that forbids legal advice, but developers deploy the change without regression tests. What control is missing?
- A school district wants to fine-tune a homework helper on student essays, but data-handling rules for the training set are unclear. What should security require before customization proceeds?
- A water utility considers continued pretraining on internal SOPs stored in a wide-access file share. What is the most important data-security step for that customization path?
- City appsec reviews a 311 bot and must choose where to place moderation and alignment controls. Which approach best matches layered defense for civic GenAI?
- Emergency management wants to fine-tune on after-action PDFs that still include unredacted personal narratives. What must happen before customization?
- Parks staff train a vision-language adapter on geotagged trail photos that reveal private property layouts beside park boundaries. What training-data risk should security flag?
- Procurement accepts a vendor 'aligned municipal model' that provides no documentation of safety evaluation harnesses. What should the city demand?
- County IT merges several departments' fine-tunes into one shared checkpoint without change control. What governance failure does this create?
- A benefits chatbot's safety filter blocks legitimate appeals language as 'self-harm adjacent,' preventing residents from completing appeals. What alignment action is needed?
- Security discovers a developer laptop running unsanctioned fine-tunes on production parcel data for a municipal assessor assistant. What platform risk does this represent?
- City open-data staff debate domain-adaptive fine-tuning versus a RAG-only design for ordinance Q&A. From a security perspective, what contrast matters most?
- After user complaints, operators weaken a clerk summarizer's refusal policy to 'be more helpful.' What alignment failure should the CISO call out?
- Transit security wants customized rider-alert models reproducible for incident review. Which practice best supports that goal?
- Public-health alignment evaluations for a clinic chatbot omit non-English languages used by many residents. What evaluation gap does this create?
- A housing authority stores RLHF preference-ranking labels in a spreadsheet with editor-wide write access. What integrity risk should security address?
- A municipal ML team uses 'synthetic' fine-tuning data but never checks whether case IDs from real records remain in the set. What validation is required?
- The city CISO requires human review when moderation confidence is low on 311 replies. What alignment pattern does this implement?
- County counsel asks whether fine-tuning a commercial foundation model on local ordinances may create licensing or derivative-work constraints. What should the platform team verify?
- After fine-tuning, a permitting bot begins emitting internal review checklists to public applicants. What customization side effect should security investigate?
Knowledge Augmentation and Retrieval · 25 questions
- A 311 RAG assistant indexes an internal SharePoint library that includes HR investigation notes. What corpus-scoping control should security require first?
- A county assessor's vector database lacks tenant isolation between public parcel FAQs and sealed appraisal notes. What isolation control should security enforce?
- A permitting RAG system returns confidential building plans because document ACLs were checked only at portal login, not at retrieve time. What authorization gap should appsec close?
- A resident uploads a forged 'new fee schedule' PDF into an open bucket that continuously feeds the city's permitting embeddings. What RAG threat does this illustrate?
- Transit ops embed official GTFS feeds plus unofficial blog posts, and the rider assistant prefers the blog for detour advice. What knowledge-source control should security prioritize?
- Public-health staff chunk clinic PDFs for RAG without stripping hidden prompt-like instructional text. What ingestion hygiene step is missing?
- A court-clerk RAG assistant cites a superseded local rule because embeddings were never rebuilt after the rulebook update. What lifecycle control failed?
- A housing-authority RAG service logs full retrieved chunks—including resident SSNs—into debug traces. What data-path risk should security remediate?
- A library open-data RAG allows cross-collection search that mixes youth-services records with general catalog FAQs. What segregation control is needed?
- City security tests whether department and classification metadata filters on similarity search are enforced only if the client sends them. What finding indicates a control failure?
- Emergency management RAG pulls live weather APIs through a mirrored cache that an attacker has poisoned. What trust-boundary issue should security highlight?
- A water utility stores embeddings of valve manuals on a vector service left on default public networking. What infrastructure exposure should security fix?
- A school-district RAG stores student names as plain metadata fields used as retrieval keys. What minimization control should privacy and security require?
- Appsec finds that a high top-k setting causes a parcel FAQ bot to overshare adjacent dispute notes. What retrieval-tuning tradeoff should they address?
- County FOIA staff note that the RAG bot's citations omit document version IDs needed to defend public-records responses. What retrieval-answer property is missing?
- A parks chatbot's hybrid BM25-plus-vector ranker is skewed by keyword-stuffed volunteer wiki pages. What RAG abuse pattern should security recognize?
- IT swaps the embedding model for ordinance RAG and nearest neighbors for key sections change, but no retrieval evaluation is rerun. What change-control gap exists?
- 311 engineering caches embeddings of every ticket indefinitely, including resolved sensitive cases. What retention control should security require?
- Security reviews RAG prompt templates for a permitting bot and finds retrieved context concatenated with no delimiter from user instructions. What structuring control reduces context/instruction confusion?
- Housing caseworkers need RAG that never surfaces another resident's notes when retrieving for the open case. What authorization design is required?
- A city open-data portal ships an unauthenticated embedding-search demo pointed at internal draft policy corpora. What exposure should security stop?
- Transit RAG redacts sensitive fields in the UI display but still embeds the unredacted source chunks. What sequencing flaw remains?
- A county bot uses multi-hop retrieval that chains across departments without purpose limitation. What privacy principle should constrain the design?
- Public-health leaders ask whether grounded RAG alone is enough to skip human review for outbreak notices. How should security judge residual risk?
- Appsec deletes a sensitive PDF from object storage but finds its vectors still return in similarity search. What consistency control is missing?
AI Application Architecture and Development Frameworks · 25 questions
- A city GenAI stack uses an orchestration framework whose plugins can call arbitrary HTTP tools. What should security require first for those plugins?
- A permitting app wires frontend to API gateway to LLM to RAG with no dedicated policy enforcement point. Where should security place authorization and content-policy checks in that GenAI architecture?
- County IT pins an old vulnerable version of a popular LLM SDK in the 311 service. What GenAI application-architecture risk does that primarily create?
- A housing chatbot trusts client-supplied “system” role messages sent from the browser. What architecture hardening is most appropriate?
- Transit builds a LangChain-style agent chain and security reviews callback URLs embedded in tool configs. Which integration-layer risk should they prioritize?
- Library services pull a third-party “municipal AI starter kit” from an unverified registry. What diligence step is most important before adopting it?
- A public-health app stores LLM provider API keys in the frontend JavaScript bundle. What architectural fix best protects those credentials?
- A court e-filing assistant streams tokens to the UI without output filtering middleware. What should architecture add before citizen display?
- A school-district architecture diagram omits the logging and analytics sidecar that receives full student prompts. Why does that matter for GenAI security?
- A water-utility GenAI microservice uses one shared service account across development, test, and production. What identity architecture change is most important?
- A city open-data GenAI API lacks rate limits, allowing scrapers to burn budget and probe jailbreaks. What API-design control should architecture add?
- Emergency operations integrates an SMS gateway as a GenAI tool without signing outbound messages. What integration security gap should be closed?
- Appsec reviews prompt-template repositories across municipal repos and finds hard-coded secrets. What hygiene practice should GenAI architecture enforce?
- A parks mobile app embeds a WebView that posts prompts to an undocumented staging LLM endpoint. What architecture problem should security raise?
- A county benefits bot uses multi-tenant SaaS LLM features without reviewing tenant data isolation guarantees. What should architecture evaluation demand?
- 311 architecture allows the model to write directly to the case-management database through ORM tools. How should write paths be constrained?
- Security finds unsigned model-serving containers being pulled into the city’s Kubernetes cluster. What supply-chain control should architecture require?
- A housing authority GenAI BFF aggregates tools from three vendors with inconsistent authentication schemes. What integration improvement is most important?
- A clerk workflow uses an AI coding assistant to generate production handlers that ship with unsanitized SQL. What supply-chain or quality risk should review gates address?
- A transit GenAI architecture diagram shows “trust the model” as the authorization layer for fare-dispute decisions. What correction should security insist on?
- A city CISO requires an AI SBOM listing models, embeddings, frameworks, and tool plugins for the civic GenAI platform. What does that inventory primarily enable?
- A public-records portal’s GenAI feature shares session cookies with a third-party widget. What integration privacy risk should architecture eliminate?
- County IT evaluates synchronous versus queued GenAI call patterns for a resident assistant. Which benefit do queued patterns most directly support?
- A permitting microservice conflates retrieval, generation, and payment APIs under one process identity. What separation should architecture apply?
- Appsec reviews whether a framework’s default memory and chat-history store encrypts resident conversations at rest. What control is being validated?
Agentic Systems and AI Integrations · 25 questions
- A city 311 agent can call refund, reopen-case, and email-resident tools under one broad OAuth scope. What should security require?
- County permitting designs a multi-agent planner that shares full applicant dossiers between every agent hop. What change best reduces exposure?
- Transit ops stands up an MCP-style tool server for fare systems without mutual authentication. What should be fixed first?
- A housing casework agent follows a poisoned tool description that directs it to post case notes to an external URL. What risk does this illustrate?
- A public-health orchestrator agent loops indefinitely calling lab lookup tools during an outbreak drill. What control should operators add?
- A court clerk agent persists sealed-case snippets in memory that later appears in unrelated public-counter sessions. What should be corrected?
- A school-district coding agent is allowed unrestricted shell tools on a shared build host. What should security require?
- An emergency-management multi-agent system can publish public alerts without a human approval gate. What control is missing?
- A water-utility agent receives conflicting supervisor prompts and selects the action that skips a safety interlock. What principle failed?
- A library discovery agent can invoke payment MCP tools meant only for fines-desk staff. What should be enforced?
- City security reviews how a 311 agent refreshes OAuth credentials to call resident email APIs. What practice should they verify?
- A parks maintenance agent treats free-text “approve work order” chat messages as authoritative without signed commands. What should change?
- A 311 supervisor agent delegates to subagents without passing purpose and retention limits. What is missing?
- A county assessor agent framework deserializes tool results as code-executable objects. What should security require instead?
- A transit customer agent can use LLM tool calls to reach internal network documentation stores. What control is needed?
- Appsec tests whether MCP and agent tool-protocol messages are integrity-protected in transit. What property is being verified?
- A public-benefits agent stores long-term memory of income documents in a shared vector memory store. What should security prioritize?
- City open-data research agents run in parallel and race-write the same briefing document. What should designers add?
- A housing agent’s planner prompt is editable by case aides in a low-code console. What should security enforce?
- Emergency ops evaluates design options after a rogue agent begins mass-texting residents. What capability is essential?
- A clerk agent chain loses track of which subagent asserted a filing deadline. What property should the workflow preserve?
- Security reviews whether tool allowlists are enforced in the agent runtime or only suggested in prompts. Why does that distinction matter?
- County IT maps inter-agent message schemas to stop agents from invoking payroll APIs on another service’s behalf. What failure is being prevented?
- A transit agent uses unconstrained web-browse tools during peak incident response. What risk should operators weigh first?
- A city CISO requires threat scenarios for agent goal hijacking before a production 311 agent rollout. What is the CISO demanding?
AI Infrastructure and Deployment Security · 25 questions
- A city deploys a permitting LLM on a managed cloud AI service. Security reviews how municipal prompts leave the city’s network toward the provider. What control focus is most appropriate?
- County public health runs open-weight models on GPU servers that share an unsegmented VLAN with unrelated clinic systems. What infrastructure change best reduces lateral risk?
- Transit exposes rider-assistant model endpoints behind a public load balancer without WAF rules tuned for prompt abuse patterns. What edge control is missing?
- A housing authority stores fine-tuned model weights in an object bucket with worldwide read ACLs “for convenience.” What risk is the team introducing?
- Library GenAI pods run as root and mount hostPath volumes to node scratch disks that may hold resident prompt fragments. What hardening priority applies?
- Emergency management compares a managed cloud AI service with self-hosted models for continuity if a regional cloud outage hits. What decision factor belongs in that hosting review?
- A school-district Kubernetes cluster colocates student GenAI tutoring apps with unrelated finance workloads on shared nodes. What isolation concern should platform security raise?
- Water-utility inference nodes lack disk encryption, and crash dumps may contain prompt fragments from resident service chats. What host control addresses residual GenAI data?
- City SOC finds unmanaged Ollama-style local model runtimes on analyst laptops processing case notes. What governance action fits infrastructure security?
- Permitting GPU nodes share a single cloud IAM role that can also modify IAM policies. What identity principle is violated for GenAI compute?
- County open-data GenAI caches personalized answers on a CDN keyed only by client IP. What cache-design risk should security call out?
- Appsec reviews whether model-serving admin consoles for the city’s inference platform enforce SSO and MFA. What control is under review?
- Transit’s DR plan replicates vector databases and model artifacts to a second region without reviewing encryption-in-transit on those paths. What gap exists?
- Public-health GenAI autoscaling launches new nodes that briefly expose ephemeral debug ports. What bootstrap hygiene is needed?
- Court AI summarizer VMs allow unrestricted outbound internet “to fetch citations.” What egress control should security require?
- A housing GenAI Kubernetes namespace has no network policies, so any pod can reach the vector database. What control is missing?
- The city evaluates confidential-computing options for GenAI processing of sealed juvenile records. What capability is being considered?
- Parks stores model-hub tokens in CI variables readable by all project members deploying GenAI. What credential-handling fix is needed?
- County IT considers GPU cloud spot instances for batch GenAI summarization against a strict data-residency policy. What hosting alignment check matters most?
- Overnight, the 311 production model endpoint still points at a shared “dev” inference cluster. What deployment hygiene failed?
- Security scans find a known CVE in the city’s self-hosted LLM inference gateway software. What infrastructure practice is indicated?
- Emergency operations wants air-gapped model updates delivered with signed USB transfer procedures. What update-channel property is essential?
- A clerk SaaS GenAI add-on processes court filings in a foreign region contrary to local records policy. What hosting validation failed?
- Transit exposes Jupyter on the same GPU nodes that serve production rider-assistant models. What separation is required?
- The city CISO requires logs of model ID, endpoint, and caller identity for every civic inference call. What infrastructure capability is being mandated?
Development Pipelines and MLOps Security · 25 questions
- A city MLOps pipeline trains a 311 triage model from a raw ticket export with no scrubbing of resident phone numbers or addresses. What pipeline control should security require first?
- Any county data analyst can edit the Airflow-style DAG that feeds production resident benefit tables into a model training job. What MLOps security gap is most urgent?
- A permitting team’s CI job promotes a GenAI model artifact to production without verifying a cryptographic signature. What MLSecOps gate is missing?
- Housing-authority training workers load community models from pickle files while running with broad operating-system privileges. What risk should the pipeline redesign address?
- Transit MLOps versions datasets but cannot show which source systems produced the features behind a deployed ridership model. What governance capability is missing?
- A public-health training job pulls an unsigned base container image from a public registry during the build. What supply-chain control should MLOps enforce?
- School-district MLOps jobs print cloud training-account API keys into shared CI logs. What control should be applied immediately?
- A water utility’s automated retraining job can swap the SCADA anomaly-detection model in production with no drift check or human approval. What lifecycle control is missing?
- City security wants SAST and secret scanning on repositories that define GenAI prompts and MLOps infrastructure-as-code. What practice does this extend?
- A library ML platform lets analysts publish live endpoints with a notebook “Run All” and no peer review. What separation should MLOps enforce?
- An emergency-management training pipeline caches intermediate datasets on a shared NFS volume with world-readable permissions. What control is most appropriate?
- AppSec discovers a poisoned dependency in a feature-engineering package used across city ML pipelines. What pipeline response best addresses the risk?
- A county benefits model registry allows an engineer to overwrite a production model tag with a new binary. What registry practice should security require?
- 311 feature-store access tokens are long-lived and shared across multiple city teams. What credential practice should replace that pattern?
- A court e-discovery ML pipeline has no quarantine path when malware scanners flag uploaded evidence PDFs. What ingestion control is missing?
- Transit plans a blue/green cutover of a safety-related GenAI assist model but has no automated evaluation suite comparing safety metrics. What MLSecOps step should precede cutover?
- A housing authority shadows production traffic to a candidate model, including sensitive eviction and disability case records. What constraint should MLOps add?
- A city open-data pipeline continuously embeds new documents into a RAG index with no malware or injection scanning on ingest. What job control should be added?
- Public-health MLOps retraining triggers are exposed as unauthenticated webhooks reachable from the internet. What hardening is required?
- Parks computer-vision training shares a GPU queue that lets one project read another project’s training datasets. What cluster control is needed?
- County IT wants model cards and security-review artifacts required before merging GenAI pipeline changes. What kind of gate is this?
- A clerk-automation pipeline serializes “quick demo” models whose metadata fields embed live API keys. What pipeline control should catch this?
- Emergency operations wants a tested rollback when a bad model starts generating false evacuation suggestions. What MLSecOps capability is that?
- Security monitors anomalous training-job data volumes that may indicate someone abusing a civic ML pipeline to exfiltrate datasets. What detection focus is this?
- The city CISO maps MLSecOps controls onto existing SDLC stages for GenAI services rather than inventing a separate unchecked process. What integration goal is this?
AI Risk Management and Strategic Application · 25 questions
- A city CIO wants structured threat modeling before launching a resident benefits GenAI portal. Which approach best fits Domain 8 responsible-AI planning?
- County counsel asks security to place GenAI platform risks on the existing municipal enterprise risk register. What is the sound strategic move?
- Transit leadership wants rapid GenAI pilots while security insists on stage gates tied to residual risk. How should planning balance agility with responsible AI?
- A housing authority plans a casework summarizer that may touch protected attributes but skips any privacy or impact assessment. What should strategic risk management require?
- A public-health GenAI program has no clear owner for model risk versus application security risk. What RACI clarification best supports strategic AI risk management?
- A school-district board wants metrics for responsible GenAI use that go beyond uptime SLAs. Which metric set best fits strategic AI risk oversight?
- Emergency management runs a tabletop but only models classic IT outages. What GenAI-specific scenario should strategic planning add?
- A city open-data AI strategy depends entirely on one commercial LLM vendor with no exit options. What strategic risk is missing from the plan?
- A permitting office accepts a GenAI vendor’s questionnaire answers at face value with no validation of AI-specific controls. What due-diligence improvement is needed?
- Court clerks paste sealed case text into public consumer LLMs because no acceptable-use policy exists. What strategic control should leadership prioritize?
- A water utility completes a classic STRIDE-style review of a GenAI ops assistant but omits misuse and data-poisoning classes. What should strategic threat modeling add?
- A library GenAI roadmap has no plan to retire models trained on donor data that later becomes restricted. What long-term security planning gap exists?
- 311 product owners call prompt injection a “content moderation issue” and keep it off the risk register. What strategic correction is required?
- A county board asks whether GenAI security investment should wait until federal AI rules fully settle. What is the best strategic response?
- A housing AI steering committee must decide control rigor for a FAQ chatbot versus an eligibility-scoring assistant. What strategic approach fits?
- Transit publishes an AI transparency note that boasts benefits but omits known residual security limitations. What responsible disclosure practice is missing?
- Public-health security’s annual plan still budgets zero hours for RAG and vector-database threat reviews. What roadmap update is needed?
- A city auditor asks for evidence that GenAI threat-model findings were closed before go-live. Which assurance practice answers that request?
- Parks department GenAI success metrics push maximizing personal data retention while privacy goals demand minimization. How should strategy resolve the conflict?
- Emergency operations needs a path when GenAI advice conflicts with the official Incident Action Plan. What governance control belongs in the strategy?
- School IT drafts a multi-year GenAI architecture plan. Which element best demonstrates long-term security capability building?
- A county risk committee compares inherent risk to residual risk after adding moderation and RAG ACL controls on a benefits assistant. What evaluation are they performing?
- The city CISO wants Protect-AI style GenAI security practices aligned with cloud and DevSecOps frameworks already adopted. What strategic integration is appropriate?
- After a housing-authority chatbot leak, the post-incident review never updates the AI risk register. What strategic feedback-loop step was missed?
- A municipal AI steering committee asks for a prioritized backlog of platform security epics derived from threat-model severity. What planning output meets that request?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by GIAC or the SANS Institute.