GOAA practice questions
GIAC · GOAA · 200 questions
Original practice questions for the GIAC Offensive AI Analyst (GOAA) exam, covering AI fundamentals for offense (NLP, GAN, RAG, vector databases, custom GPTs), deepfake audio/image/video social-engineering concepts, defensive-control evasion awareness, AI-assisted malware concepts for ethical pentesting, AI-driven phishing tooling and prompt techniques, malware fundamentals, network scanning and AI-agent vuln contextualization, social-engineering psychology with legal/ethical bounds, AI-assisted OSINT, and AI-aided web-exploitation workflow concepts — framed in civic and municipal defensive scenarios such as city / county SOC and fusion centers, authorized municipal red/purple-team exercises, transit / utilities / emergency-management validation, public-health phishing readiness, and permitting / 311 / courts infrastructure assessments. Live GOAA is CyberLive; this bank is original 4-option MCQ similar-concept practice for defensive readiness, not a lab dump and not crime how-to.
This course contains the use of artificial intelligence.
About the GOAA exam
- Time allowed
- 2 hours
- Questions
- 56
- Passing score
- 67% (for exam versions released on or after January 24, 2026)
- Format
- 1 proctored exam, web-based; tagged CyberLive hands-on; remote proctoring via ProctorU or onsite via PearsonVUE
Exam details published by the vendor, checked 6 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
Artificial Intelligence Fundamentals · 20 questions
- A city CISO asks the purple team whether a permitting FAQ assistant that retrieves ordinance PDFs is better modeled as retrieval-augmented generation or as a fine-tuned ticket classifier. Which choice best matches the design?
- A county fusion center compares generative adversarial networks used in deepfake pipelines with retrieval-augmented generation used in analyst assistants. Which statement best captures the contrast?
- A transit SOC evaluates NLP entity extraction on rider-complaint tickets against a custom GPT that answers from ops playbooks. Which distinction is most accurate?
- A water-utility red team debates ‘adversarial AI’ model-poisoning risk versus ‘offensive AI’ techniques used in authorized emulation. Which framing is correct for municipal purple-team language?
- A housing-authority security lead inventories commercial LLM APIs versus open-source local models for an isolated court-adjacent lab. Which comparison best fits constrained civic environments?
- A 311 program stores ordinance chunks in a vector database so an assistant can cite source passages during resident chats. What role does the vector database primarily play?
- A public-health IR desk builds a custom GPT that only answers from approved outbreak playbooks. What fundamental capability is being applied?
- A school-district SOC asks whether prompt-based summarization of phishing tickets is primarily NLP understanding of existing text or generative composition of new narrative. Which characterization is best?
- A parks IT team wonders if embedding search over trail-policy docs is the same as training a new foundation model. Which statement is correct?
- A municipal legal-tech pilot uses a GAN demo to illustrate synthetic ID-photo risk to clerk staff. Which AI-fundamentals concept is being taught?
- A city purple team labels an AI that helps craft authorized phishing lures as offensive AI, not merely ‘AI security automation.’ Why is that classification appropriate?
- A county auditor asks whether a vendor chatbot with no retrieval layer can still hallucinate ordinance numbers. Which fundamentals insight is most accurate?
- An emergency-management desk evaluates multimodal models that read handwritten shelter intake forms. Which AI-fundamentals consideration applies?
- A transit architecture review asks which AI platform pattern best supports private on-prem inference for an OT-adjacent security lab. Which answer fits?
- A court-clerk modernization team maps ‘assistant’ tools that call ticketing APIs versus pure chat summarizers. What distinction should they document?
- A city threat-intel unit explains that poisoning a model is adversarial ML while AI-written phishing is offensive AI tradecraft. Which statement reinforces that distinction?
- A library consortium prototypes RAG over public-meeting minutes and must explain chunking and embeddings to IT governance. Which description is most accurate?
- A municipal SOC compares token-prediction chat models with discriminative classifiers used for malware-family labels. Which contrast is correct?
- A county CIO asks which fundamentals topic covers why vector similarity search can surface ‘near’ but wrong policy passages in a civic RAG system. Which explanation is best?
- A purple-team charter requires staff to name NLP, GAN, RAG, vector databases, and custom GPTs before any deepfake lab. What is the charter enforcing?
Audio, Image, and Video Deepfakes · 20 questions
- A city finance director voice clone appears in a weekend wire-transfer voicemail; the SOC briefs accounts payable. Which deepfake risk is the briefing primarily addressing?
- A mayor’s likeness is spliced into a fake emergency video urging residents to visit a phishing domain; the fusion center classifies the medium. Which classification is most accurate?
- An authorized purple team plans a controlled audio-deepfake drill against the water-utility call center under strict rules of engagement. Which framing is appropriate?
- A county clerk training explains that high-quality speech cloning for awareness demos needs sufficient clean speech samples of the target official. Which concept-level takeaway is correct?
- A transit security awareness session shows face-swap image deepfakes used to spoof badge photos in tabletop exercises. Which recognition point should staff take away?
- A public-health communications team reviews a suspected clip where a department director appears to announce sudden clinic-hour changes that never went through official channels. Which deepfake technique family most directly enables that talking-head deception?
- A school-district SOC prepares principals for a vishing campaign that impersonates the superintendent by phone. Which deepfake modality most closely matches that channel?
- A housing-authority IR playbook receives an urgent payment video that appears to show the director's face authorizing a same-day wire. What is the most appropriate first defensive response?
- During a municipal red-team lab, analysts notice that voice clones trained on noisy multi-speaker hallway recordings sound less believable than clones trained on clean single-speaker samples. What factor is primarily affecting realism?
- A parks department receives a donation-drive flyer image that includes a fabricated superintendent signature and a QR code to an unknown payment site. Which deepfake or synthetic-media concern does this primarily illustrate?
- A county fusion center compares a static face-swapped photo of a mayor with a full talking-head video deepfake of the same official. For threat-briefing severity, what distinction should analysts emphasize?
- An emergency-ops tabletop uses a cloned OEM director voice that calls asking staff to reset privileged credentials. What is the primary learning goal of that authorized audio-deepfake element?
- A city CISO asks awareness trainers whether GAN-based face generation differs from simple Photoshop compositing when explaining synthetic-identity risk to clerk staff. What distinction is most accurate?
- A county elections office prepares poll-worker supervisors for a scenario where a deepfake audio message claims the clerk is canceling shifts at the last minute. What should staff treat as the core risk?
- A transit purple team notes that convincing video deepfakes of an official often depend on having usable on-camera speaking footage of that person. What concept-level requirement does this highlight?
- A municipal legal brief warns security teams about using deepfake likenesses of residents during internal demos. What constraint should the purple team apply?
- A city SOC triage checklist for suspected deepfake tickets asks analysts to label the artifact before escalating. Which classification step is most appropriate at intake?
- A water-utility awareness module highlights callers who sound like internal IT and ask employees to read back VPN one-time codes. Which deepfake application does this primarily represent?
- A city communications director requires controls on any internal deepfake clips used for security training. Which practice best aligns with responsible civic use?
- A purple-team after-action report asks which speech characteristics made a mayor voice clone convincing enough to fool some staff in an authorized drill. Which answer best reflects deepfake audio believability factors?
Bypassing Defensive Controls · 20 questions
- A city purple team must brief leadership before any AI-assisted evasion tests on lab endpoints. What should they explain first about Windows Defender in that authorized validation context?
- A county SOC investigates malware on a municipal workstation that appeared dormant until automated sandbox analysis timers elapsed. Which evasion class best describes that behavior?
- An authorized school-district red team asks why living-off-the-land binaries can reduce antivirus signature hits during a scoped Windows assessment. What concept explains that observation?
- A transit blue team reviews threat reports describing AMSI-related bypass themes affecting Windows fleets. How should civic defenders treat that information at a concept level?
- A water-utility lab considers using an AI assistant to suggest milder-looking PowerShell patterns for an authorized control-validation exercise. What constraint must remain primary?
- A fusion center brief explains why Windows Defender sometimes misses a municipal malware sample. Which distinction should analysts draw?
- A city endpoint engineering team maps Windows Defender surfaces that authorized testers may exercise in a lab. Which set best reflects architectural control surfaces relevant to civic bypass discussions?
- A housing-authority purple team disables tamper protection on lab VMs to observe certain evasion behaviors. What lesson should the after-action emphasize?
- A municipal IR playbook is tagging behaviors observed during a Defender-centric investigation. How should 'process injection family' techniques typically be categorized?
- A county red-team charter covers AI-aided research into defensive-control bypass techniques. Which ethical boundary is most appropriate?
- A municipal SOC detection engineer asks which AI-assisted change to a benign admin script most challenges static signature controls during authorized validation?
- A parks IT tabletop covers how adversaries stage payloads to reduce defensive hits on municipal Windows hosts. Which evasion concept should analysts recognize?
- A city CISO asks analysts why some AI-mutated scripts still get caught after they evade hash signatures. What explanation fits best in a Defender-aware briefing?
- An emergency-management Windows image includes Controlled Folder Access. What should a purple team plan first for authorized validation of that surface?
- A transit threat hunter correlates host behaviors linked to defensive-control evasion. Which pattern is most relevant to flag for follow-up?
- A municipal malware lab notes AI can rewrite loader stubs faster than signature teams can catalog hashes. What defensive implication should leadership take away?
- A court IT security review asks whether 'disable real-time protection' advice belongs in production remediation for municipal judges' workstations. What is the correct stance?
- A county purple team briefs leadership on Defender visibility limits at a high level. Which statement is most accurate for authorized planning?
- A public-health SOC updates its municipal taxonomy for anti-detection techniques. How should memory-only loaders be classified?
- A city red-team report uses AI after an authorized range exercise. What is the most appropriate use of AI in that after-action workflow?
Creating Malicious Software with AI · 20 questions
- A city authorized pentest lab considers asking an LLM to draft a benign proof-of-concept dropper skeleton. Under what condition is that use aligned with ethical municipal practice?
- A county purple team documents prompt patterns that try to jailbreak a public LLM into providing weaponized code. What should policy do?
- A transit security engineer reviews city AI acceptable-use enforcement. How should 'hypothetically write ransomware' prompts be treated?
- A school-district red team needs AI help generating lab samples. Which deployment choice best protects municipal data boundaries?
- A water-utility ROE covers AI-generated scripts for lab endpoints. Which control is most appropriate before any execution?
- A fusion center training contrasts two AI uses related to malware. Which distinction should instructors emphasize?
- Municipal legal counsel reviews AI malware-sample generation for a purple team. What authorization question is most important?
- A housing-authority lab observes staff iteratively prompting 'make it evade AV' against an LLM. How should security classify that behavior?
- A city SOC detection lab wants AI help improving signatures. Which generation target is appropriate?
- A county CISO sets rules for AI-assisted offensive labs. Which data-handling rule is most important?
- A parks IT purple team evaluates AI-generated offensive artifacts. What reliability limit should they brief stakeholders on?
- An emergency-ops cyber exercise wants AI assistance with malware samples. Which constraint best matches authorized civic scope?
- A transit auditor asks how the team proves AI-generated lab samples stayed controlled. What evidence matters most?
- A public-health red team notes vendor chatbots refuse malware help, yet some staff then attempt role-play jailbreaks. What should the team do?
- A city malware-analysis unit chooses how to use AI on opaque scripts. Which use best matches defensive municipal practice?
- A court IT security charter reviews commercial LLM services that advertise auto-generated defensive-control bypasses when fed customer telemetry. Which policy stance best protects the municipal environment?
- A municipal purple-team checklist must run before any AI-assisted malware-sample prompt in the city range. Which gate set best matches ethical lab practice?
- A county threat brief explains that adversaries attempt LLM guardrail-bypass prompts at scale when seeking malware help. How should civic defenders frame that pattern?
- A school-district SOC asks whether AI code-completion inside an IDE on an isolated lab VM still counts as malware generation under purple-team policy. Which classification is most accurate?
- A city after-action notes that AI sped up boilerplate loader scaffolding during an authorized range exercise, yet leadership still asks who owned payload intent. Which accountability statement is correct?
Creating Phishing Emails with AI · 20 questions
- A city security-awareness program needs an authorized phishing simulation platform for permitting staff. Which tool best fits a campaign that sends tracked emails and records clicks under ROE?
- A county purple team compares Social Engineering Toolkit (SET) modules with GoPhish for a controlled clerk-office drill. Which distinction best guides tool choice?
- A transit SOC uses generative AI to draft a believable badge-renewal phishing lure for an authorized drill. What step most improves quality while staying inside civic controls?
- A water-utility phishing exercise uses AI to draft templates for an authorized staff campaign. Which privacy constraint is most appropriate?
- A school-district phishing campaign uses GoPhish dashboards after an authorized send. How should leaders best use the resulting click-rate data?
- A housing-authority communicator asks generative AI to rewrite an authorized phishing lure into multiple languages for multilingual staff. Which condition keeps the approach in bounds?
- A municipal legal review covers a planned SET-based credential-harvest simulation against employees. Which control set is most appropriate before launch?
- A fusion-center awareness brief warns staff that AI-polished phishing can differ from classic typo-ridden lures. Which detection challenge should trainers emphasize?
- A city red team feeds materials into AI prompts while drafting authorized portal-lookalike phishing content. Which scoping rule best protects the municipality?
- A parks department GoPhish simulation needs a landing-page outcome that supports learning without endangering production identity. Which design is most appropriate?
- A public-health purple team prompt-engineers urgency cues such as ‘lab results ready’ for an authorized staff phishing drill. Which adjustment best balances realism and ethics?
- A county SOC distinguishes AI-written phishing email bodies from what GoPhish must still provide in an authorized campaign. Which statement is most accurate?
- A transit after-action finds that AI suggested risky CEO-fraud wording that violated the city’s exercise tone guidelines. What should the team do with such drafts?
- A court clerk drill plans to use SET for an authorized phishing-related simulation. Which deployment control is most appropriate?
- A city CISO runs a tabletop where staff examine AI-generated phishing that appears personalized from public professional bios. What should analysts recognize?
- A municipal campaign calendar schedules GoPhish sends for an authorized awareness program. Which timing practice is most responsible?
- A school IT team uses AI to suggest attachment filenames for an authorized phishing drill. Which constraint keeps the exercise non-destructive?
- A water-utility awareness lead compares static template-only phishing with AI-varied per-user lures for an authorized program. What evaluation focus is most appropriate?
- A housing SOC integrates GoPhish with existing staff phishing-report workflows. Which integration goal is most important?
- A county purple-team checklist sequences an authorized AI-assisted phishing exercise end to end. Which order best reflects sound municipal practice?
Malware Fundamentals · 20 questions
- A city SOC reviews a malicious Word macro on a permitting workstation that writes a second-stage binary to disk before launching it. Which malware role best matches that behavior?
- A county IR team finds that a clerk PC was compromised through a browser vulnerability, after which a remote-access tool ran. How should they separate those two concepts?
- A transit malware investigation shows the sample spread when technicians reused an infected USB stick for bus-garage diagnostic laptops. Which concept does that illustrate?
- A water-utility alert shows malware that performs environment checks and only then retrieves a final tool from the network. Which malware stage best describes that sample?
- A school-district forensics note lists new scheduled tasks and HKCU Run keys on a compromised lab host. Which malware fundamental do those findings primarily demonstrate?
- A housing-authority reverse engineer observes a lab sample that detects a debugger and immediately exits before revealing useful strings. Which category best fits that behavior?
- A fusion-center brief tells analysts that packing and string encryption hide indicators from scanners but do not themselves exploit a new vulnerability. How should the brief classify those techniques?
- A parks IT ticket shows malware copying itself across shared drives to new hosts, unlike a single-host trojan planted once by a user. Which distinction should the SOC emphasize?
- A public-health endpoint investigation finds malicious code executing primarily from memory after a user clicked a malicious link, with little lasting on disk. Which characteristic does that highlight?
- A city malware taxonomy chart for new SOC analysts sequences classic delivery stages. Which order correctly reflects dropper, downloader, and payload roles?
- A county detection rule fires on unusual Windows service creation on a finance workstation days after the phishing email was deleted. Which kill-chain concept does the rule primarily target?
- A transit IR playbook lists sandbox evasion and VM artifact checks under one heading and beaconing to a controller under another. How should analysts categorize sandbox evasion?
- A municipal malware lab notes a sample consistent with process hollowing concepts used to run code under a legitimate process image. Without rewriting code, what anti-detection goal should analysts document?
- A court workstation incident involved a fake invoice attachment; after opening it, a remote-access tool executed. Which role separation is most accurate?
- A water SCADA-adjacent Windows jump box investigation finds persistence achieved through DLL search-order abuse. How should the report tag that finding?
- A school SOC trainer tells staff that an ‘exploit’ takes advantage of a vulnerability while a ‘payload’ is what runs afterward. Which statement best reinforces that teaching point?
- A city threat hunt observes a downloader beaconing and retrieving modules days before any encryption activity appears. What malware-fundamentals insight should hunters emphasize?
- A county purple team prepares a municipal attack-surface brief on how malware commonly arrives. Which set best represents common propagation vectors they should map?
- An emergency-operations Windows host shows persistence implemented through WMI event subscriptions. How should IR classify that mechanism?
- A housing SOC glossary draft must distinguish techniques that hide from antivirus from techniques that frustrate reverse engineers. Which distinction belongs in the glossary?
Network Scanning and Vulnerability Detection · 20 questions
- A city authorized assessment team plans work against the permitting VLAN under an approved ROE. Which activity should come before any exploitation discussion?
- A county purple team exports Nmap XML from an approved scan and asks an AI agent to summarize likely exposed municipal services for human analysts. What Domain 7 practice does this illustrate?
- A transit security engineer plans an internal drill on jumphosts and must choose a vulnerability-scanning approach. Which choice best fits an authenticated internal assessment?
- A water-utility assessment charter forbids scanning OT controllers. How should AI workflows that contextualize vulnerabilities be constrained?
- A school-district team runs vulnerability scanners to find missing patches, then asks AI to rank findings using internet exposure of student portals. What is the sound use of AI in that workflow?
- A housing-authority purple team notices an AI agent reported a CVE that does not appear in the raw scanner output. What should the team do first?
- A county fusion-center lab asks analysts to separate network enumeration from vulnerability detection. Which contrast is most accurate?
- A parks IT assessment wants scanner results joined to city asset-owner context so analysts see who owns each finding. Which approach best fits that goal?
- A municipal red team must scan networks that include systems supporting 911 computer-aided dispatch. What practice best operationalizes safe scanning?
- A city SOC wants an AI agent to help analysts see that many clerk-office findings share one underlying issue, such as outdated TLS. What task best matches that need?
- A county external scan finds exposed RDP on a temporary construction-trailer PC. How should an AI agent best support the investigation?
- A transit purple team compares approaches for a bus-yard lab assessment. Which statement correctly contrasts passive and active enumeration?
- A public-health assessment wants fewer false positives on clinic kiosk inventories. Which scanning choice best addresses that goal?
- A court network authorized test must keep evidence-locker subnets out of vulnerability scanners. What practice meets that requirement?
- A water IT lead reviews an AI agent wired to vulnerability scanner output. Which constraint correctly reflects typical municipal ROE?
- A city CISO dashboard shows scan-coverage gaps on several agency VLANs. What limitation should leaders remember about AI contextualization?
- A school SOC designs a pipeline that combines network scanning with an AI agent. Which sequence best reflects sound municipal operations?
- A housing-authority methodology write-up must distinguish discovery scanning from full vulnerability policy scans. Which distinction is correct?
- A municipal AI agent receives scanner JSON plus CMDB excerpts during an authorized assessment. What enrichment is most appropriate?
- A county after-action review finds an AI agent overstated severity by ignoring compensating firewalls documented beside the scan. What calibration lesson applies?
Social Engineering Fundamentals · 20 questions
- A city red-team charter sets goals for an authorized social-engineering exercise. Which objective best aligns with ethical municipal awareness practice?
- A county clerk tabletop maps social-engineering attack surfaces for civic centers. Which set best represents common surfaces to inventory?
- A transit SE exercise uses an approved script where a caller claims rail control needs VPN access immediately. Which psychological levers are most clearly in play?
- Water-utility counsel reviews a planned social-engineering test involving employee pretexting. What legal-control practice is most appropriate first?
- A school-district policy governs authorized social-engineering drills. Which boundary best reflects ethical civic/education constraints?
- A housing-authority awareness brief must explain common social-engineering technique families at a concept level. Which contrast is most accurate?
- A fusion-center briefing covers recording vishing-style authorized test calls. What legal consideration should testers articulate?
- A parks department physical social-engineering test checks access to badge-only maintenance areas. What surface is primarily under test?
- A public-health social-engineering objective focuses on desks that handle protected health information. Which objective framing is most appropriate?
- A city ethics board reviews proposed pretexts for an employee social-engineering drill. Which judgment best reflects ethical scenario design?
- A county attack-surface briefing ranks social-engineering targets for an authorized awareness program. Why is the shared help desk often treated as a high-value target?
- A transit purple team runs live authorized social-engineering scenarios. Which OPSEC practice best protects the engagement?
- A municipal SE psychology module maps classic influence principles to permit-office scam patterns. Which mapping best illustrates those principles in a civic context?
- A court security policy covers authorized employee social-engineering drills. Which control best embeds welfare and ethics stop-conditions?
- A water SOC reviews proposed social-engineering activities. Which distinction correctly keeps practice inside authorized civic scope?
- A school board asks how social-engineering exercise results should be used for staff. Which recommendation best reflects ethical municipal practice?
- A city social-engineering program defines success metrics for culture change. Which objective is most realistic and aligned with defensive practice?
- A housing-authority IR playbook categorizes how adversaries first get in. Where does social engineering correctly belong?
- A county legal memo addresses social-engineering and pentest boundaries. Which statement best captures the legal risk of exceeding rules of engagement?
- A municipal SE fundamentals quiz asks why a 'mayor's office' pretext can be unusually effective against staff. Which principle best explains it?
Using AI for OSINT · 20 questions
- A city authorized assessment plans its reconnaissance phase. Which approach best places OSINT correctly before more active techniques?
- A county purple team wants AI help summarizing publicly visible transit-authority org charts from professional networking sites. Which practice best applies AI under civic ethical constraints?
- A water-utility ROE addresses AI-assisted OSINT for an authorized assessment. Which rule best protects residents?
- A school-district assessor inventories common OSINT data-gathering tools for staff training. Which set best fits that inventory?
- A housing-authority recon team uses AI during OSINT on publicly visible code hosting. Which use best fits authorized exposure triage?
- A fusion center warns analysts about AI use during civic OSINT. Which action represents an OPSEC failure?
- A parks assessment team discusses reconnaissance techniques. Which distinction is most accurate?
- A public-health recon lead considers AI language assistance on foreign-language open posts about hospital-targeted phishing themes. Which use is most appropriate?
- A city CISO asks which sources are legitimate OSINT inputs for a municipal authorized test. Which answer is best?
- A transit purple team uses AI to propose reconnaissance questions and leads. Which practice best prevents hallucination from becoming false OSINT?
- A county clerk OSINT review finds public meeting agendas that disclose VPN vendor names. How should that finding typically be treated?
- A municipal recon checklist governs AI-assisted OSINT. Which item set best encodes safe practice for government testers?
- A water IT OSINT task maps cloud bucket naming patterns visible in public error pages. What boundary should the team respect at this stage?
- A school SOC examines publicly posted PDF handbooks during authorized OSINT. Which metadata insight is most relevant?
- A housing red team reviews AI suggestions for social-media OSINT during an authorized assessment. Which decision best reflects ethical municipal practice?
- A city threat-intel unit compares manual OSINT note-taking with AI-assisted entity extraction from open news. Which evaluation best guides civic OSINT workflow choice?
- A court-adjacent municipal assessment is authorized for broader city recon. Which OSINT boundary best reflects special ethical exclusions around judicial contexts?
- A transit after-action review finds AI-generated OSINT timelines mixed rumor with verified fact. Which process change best restores trustworthy municipal OSINT?
- A county recon phase uses AI-assisted OSINT packaging before any active scanning. Which sequencing decision best aligns with civic change control?
- A municipal analyst briefs leadership on OSINT capability classes for authorized recon training. Which description best fits concept-level tool recognition without a how-to dump?
Using AI for Web Exploitation · 20 questions
- A city authorized web test of the permitting app uses AI to help organize injection test cases. Which practice best keeps the workflow safe and controlled?
- A county purple team studies SQL-injection technique families against a civic license portal in a lab. Which recognition best matches concept-level understanding?
- A transit rider-account app assessment reviews a debug admin feature under ROE. Which risk surface best indicates possible command-injection exposure?
- A water-utility web test uses AI assistance in staging. Which constraint best keeps AI-assisted web exploitation non-destructive?
- A school-district bug-bounty-style drill uses AI while building XSS and SQLi checklists. Which use best streamlines repetitive authorized web-test inputs?
- A housing-authority web report notes AI suggested a SQL-injection payload irrelevant to a NoSQL backend. Which response best validates AI suggestions against the civic tech stack?
- A fusion-center training maps an AI-augmented authorized web-test workflow. Which sequence best reflects disciplined civic practice?
- A parks permitting form relies on legacy CGI wrappers that invoke OS commands. Before AI helps craft authorized tests, which identification best flags command-injection exposure?
- A public-health portal test produces dense Burp or ZAP findings. Which AI use best helps clinic IT owners without turning the engagement into unsupervised exploitation?
- A city CISO reviews whether AI 'auto-exploit' agents may run against production 311. Which policy stance best fits authorized municipal web testing?
- A court e-filing app assessment focuses on SQL injection in search filters on staging. Which AI-assisted approach best stays thoughtful and minimal-impact?
- A transit API gateway assessment must classify injection findings correctly. Which distinction best separates SQL injection from command injection?
- A water customer-portal purple team uses AI to propose parameter names to probe. Which control best keeps humans in the loop?
- A county web methodology allows AI to help draft attack narratives in reports. Which rule best prevents fabrication of exploit success?
- A school LMS staging site allows AI-assisted SQL-injection detection under ROE. Which scoping choice best keeps proofs minimal-impact?
- A municipal secure-coding workshop discusses AI pair-programming on civic web apps. Which dual-use insight best prepares developers and testers?
- A housing web test uses AI to triage which endpoints most need SQL-injection scrutiny. Which prioritization approach best fits authorized practice?
- A city after-action review finds command injection through an intranet admin page that exposed unsanitized traceroute-style tools. Which recognition best captures the pattern?
- After an authorized SQL-injection demo on a transit staging app, the blue team wants AI help. Which follow-up use best prefers defensive hardening over new exploit variants?
- A county GOAA-aligned web module checklist summarizes safe AI-assisted web-exploitation practice for municipal testers. Which set of expectations best belongs on that checklist?
These questions are original practice material and are NOT actual exam questions, CyberLive lab tasks, or brain-dump content. This site is not affiliated with, endorsed by, or sponsored by GIAC or SANS Institute. All GIAC, SANS, GOAA, and related marks are trademarks of their respective owners.