IncludeHelp_logo
Skip Navigation Links

Home » Trending Technologies MCQs

AI Security MCQs (Multiple-Choice Questions)

AI Security focuses on protecting artificial intelligence and machine learning systems, their models, data, infrastructure, applications, and users from attacks, misuse, unauthorized access, and unintended behavior. These AI Security MCQs cover important concepts such as adversarial attacks, prompt injection, data poisoning, model security, privacy, RAG security, AI agents, access control, model extraction, supply-chain security, red teaming, monitoring, and AI risk management.

AI Security MCQs

These AI Security multiple-choice questions are useful for students, cybersecurity professionals, AI engineers, developers, researchers, and candidates preparing for technical interviews and examinations related to artificial intelligence, machine learning, and cybersecurity.

List of AI Security MCQs

The following AI Security MCQs cover fundamental and advanced security concepts for protecting AI systems throughout their development, deployment, and operational lifecycle.

1. What is AI Security?

  1. Protecting AI systems, models, data, infrastructure, and applications from security threats
  2. Increasing the number of parameters in an AI model
  3. Improving only the visual design of an AI application
  4. Training a model without validation

Answer: A) Protecting AI systems, models, data, infrastructure, and applications from security threats

Explanation: AI Security addresses threats to the confidentiality, integrity, and availability of AI systems, as well as security risks introduced by AI-specific components and workflows.

2. Which three security properties are commonly represented by the CIA triad?

  1. Confidentiality, Integrity, and Availability
  2. Classification, Inference, and Automation
  3. Control, Intelligence, and Accuracy
  4. Consistency, Integration, and Authentication

Answer: A) Confidentiality, Integrity, and Availability

Explanation: Confidentiality protects information from unauthorized disclosure, integrity protects against unauthorized alteration, and availability ensures systems and resources remain accessible when needed.

3. What makes AI Security different from traditional application security?

  1. AI systems introduce additional risks involving models, training data, inference behavior, and AI-specific inputs
  2. AI systems do not require authentication
  3. Traditional security controls cannot be used with AI
  4. AI systems never interact with external data

Answer: A) AI systems introduce additional risks involving models, training data, inference behavior, and AI-specific inputs

Explanation: AI systems still require conventional security controls, but they also introduce unique attack surfaces involving training data, model behavior, prompts, embeddings, model outputs, and autonomous actions.

4. What is an adversarial attack against an AI model?

  1. An attack designed to cause a model to produce incorrect or undesirable behavior
  2. A method for increasing model accuracy
  3. A process for compressing model weights
  4. A method for backing up training data

Answer: A) An attack designed to cause a model to produce incorrect or undesirable behavior

Explanation: Adversarial attacks manipulate inputs, data, or other aspects of an AI system to cause incorrect predictions, unsafe behavior, information leakage, or other unintended outcomes.

5. What is an adversarial example?

  1. An input intentionally modified to cause an AI model to make an incorrect prediction or decision
  2. A correctly labeled training example
  3. A model backup file
  4. A security policy document

Answer: A) An input intentionally modified to cause an AI model to make an incorrect prediction or decision

Explanation: An adversarial example contains carefully designed perturbations or modifications intended to influence a model's output incorrectly.

6. What is an evasion attack in machine learning?

  1. Manipulating inputs at inference time to evade model detection or classification
  2. Changing training labels before training
  3. Stealing model weights from storage
  4. Deleting a model after deployment

Answer: A) Manipulating inputs at inference time to evade model detection or classification

Explanation: Evasion attacks occur during inference and attempt to make malicious or manipulated inputs appear benign to a deployed model.

7. What is data poisoning?

  1. Manipulating training, fine-tuning, or other data so that the resulting model behaves undesirably
  2. Encrypting a dataset before storage
  3. Compressing a dataset
  4. Removing duplicate records from a dataset

Answer: A) Manipulating training, fine-tuning, or other data so that the resulting model behaves undesirably

Explanation: Data poisoning attacks introduce malicious or misleading data into a learning pipeline to influence model behavior. OWASP identifies data and model poisoning as an important GenAI security risk.

8. What is a backdoor attack on a machine learning model?

  1. Embedding behavior that is activated by a particular trigger or condition
  2. Removing all model parameters
  3. Encrypting the model with a strong password
  4. Improving model generalization

Answer: A) Embedding behavior that is activated by a particular trigger or condition

Explanation: A backdoored model can behave normally for most inputs but produce attacker-controlled or undesirable behavior when a specific trigger is present.

9. What is prompt injection?

  1. Manipulating an LLM through crafted input so that it behaves in an unintended way
  2. Injecting additional RAM into a server
  3. Adding neurons to a neural network
  4. Encrypting a prompt before transmission

Answer: A) Manipulating an LLM through crafted input so that it behaves in an unintended way

Explanation: Prompt injection attempts to influence an LLM's behavior through malicious or unexpected instructions contained in direct user input or external content. OWASP identifies prompt injection as a major LLM security risk.

10. What is indirect prompt injection?

  1. Malicious instructions embedded in external content that an AI system processes
  2. A user changing their password
  3. A developer updating model weights
  4. An administrator restarting an AI server

Answer: A) Malicious instructions embedded in external content that an AI system processes

Explanation: In indirect prompt injection, instructions may be hidden in webpages, documents, emails, retrieved data, or other content that the AI system later processes.

11. Why is prompt injection difficult to eliminate completely?

  1. Natural-language instructions and untrusted content can influence model behavior in complex ways
  2. LLMs cannot process text
  3. Prompt injection only affects operating systems
  4. Encryption automatically prevents all prompt attacks

Answer: A) Natural-language instructions and untrusted content can influence model behavior in complex ways

Explanation: LLMs process instructions and data through the same general language-processing mechanism, making it difficult to guarantee that every malicious instruction embedded in content will be ignored.

12. Which is an important defense against prompt injection?

  1. Treating external content as untrusted and enforcing controls outside the model
  2. Giving the model unrestricted system access
  3. Trusting every retrieved document
  4. Removing authentication from the application

Answer: A) Treating external content as untrusted and enforcing controls outside the model

Explanation: Prompt-level instructions alone are not sufficient security boundaries. Applications should isolate untrusted content and enforce authorization, validation, and tool restrictions outside the model where possible.

13. What is jailbreaking in the context of generative AI?

  1. Attempting to bypass a model's intended behavioral or safety restrictions through crafted inputs
  2. Encrypting an AI model
  3. Deleting model checkpoints
  4. Training a model on clean data

Answer: A) Attempting to bypass a model's intended behavioral or safety restrictions through crafted inputs

Explanation: Jailbreaking refers to attempts to induce a model to ignore or circumvent restrictions that are intended to govern its responses or actions.

14. What is sensitive information disclosure in an AI application?

  1. Unintended exposure of confidential, personal, proprietary, or otherwise sensitive information
  2. Increasing model accuracy
  3. Improving tokenization
  4. Reducing model latency

Answer: A) Unintended exposure of confidential, personal, proprietary, or otherwise sensitive information

Explanation: AI systems can expose sensitive information through prompts, retrieved documents, model outputs, logs, training data, or integrations if appropriate controls are missing.

15. Which principle is useful for limiting an AI agent's access to sensitive resources?

  1. Least privilege
  2. Maximum privilege
  3. Anonymous access
  4. Unrestricted delegation

Answer: A) Least privilege

Explanation: Least privilege gives a component only the permissions required for its intended task, reducing the potential impact if the component or its inputs are compromised.

16. What is excessive agency in an AI application?

  1. Giving an AI system excessive functionality, permissions, or autonomy to perform actions
  2. Reducing the number of tools available to an agent
  3. Using a read-only database
  4. Adding authentication to an API

Answer: A) Giving an AI system excessive functionality, permissions, or autonomy to perform actions

Explanation: Excessive agency can allow unexpected model outputs or manipulated inputs to cause harmful actions. OWASP identifies excessive functionality, permissions, and autonomy as common causes.

17. Which design most directly reduces excessive agency?

  1. Granting only necessary tools and permissions and requiring approval for high-impact actions
  2. Giving the agent administrator access to every system
  3. Allowing unrestricted tool execution
  4. Removing authorization checks

Answer: A) Granting only necessary tools and permissions and requiring approval for high-impact actions

Explanation: Restricting available functions, permissions, and autonomy limits the potential impact of incorrect or manipulated model decisions.

18. What is insecure output handling?

  1. Passing AI-generated output to downstream systems without adequate validation or security controls
  2. Encrypting model output before storage
  3. Checking model output against a schema
  4. Filtering sensitive output

Answer: A) Passing AI-generated output to downstream systems without adequate validation or security controls

Explanation: AI output should not automatically be trusted. If output is used in HTML, SQL, code, commands, or other sensitive contexts, appropriate validation and sanitization are required.

19. Why should AI-generated SQL be treated carefully?

  1. Unvalidated generated SQL could access or modify data beyond the intended scope
  2. SQL cannot be generated by AI systems
  3. SQL is always safe when generated by an LLM
  4. Database permissions have no effect on AI applications

Answer: A) Unvalidated generated SQL could access or modify data beyond the intended scope

Explanation: Generated database queries should be constrained, validated, parameterized where appropriate, and executed using narrowly scoped database permissions.

20. What is model extraction?

  1. Attempting to reproduce or approximate a model's behavior through queries or other access
  2. Removing unnecessary model layers during optimization
  3. Exporting a model for legitimate backup
  4. Compressing a model for edge deployment

Answer: A) Attempting to reproduce or approximate a model's behavior through queries or other access

Explanation: Model extraction attacks attempt to obtain information that allows an attacker to recreate or approximate a target model's functionality.

21. Which control can help limit model extraction through an API?

  1. Rate limiting and monitoring query behavior
  2. Unlimited anonymous requests
  3. Removing authentication
  4. Publishing model internals

Answer: A) Rate limiting and monitoring query behavior

Explanation: Rate limits, authentication, usage monitoring, anomaly detection, and controlled output can make large-scale model extraction more difficult.

22. What is membership inference?

  1. An attack that attempts to determine whether a particular record was part of a model's training data
  2. An attack that changes model architecture
  3. A technique for generating synthetic data
  4. A method for reducing inference latency

Answer: A) An attack that attempts to determine whether a particular record was part of a model's training data

Explanation: Membership inference attacks attempt to infer whether specific data was included in a model's training set, creating potential privacy risks.

23. What is model inversion?

  1. Attempting to infer sensitive characteristics or information about training data from model behavior
  2. Flipping a model's weights randomly
  3. Converting a neural network into a decision tree
  4. Removing all model parameters

Answer: A) Attempting to infer sensitive characteristics or information about training data from model behavior

Explanation: Model inversion attacks use model outputs or other information to infer properties or information associated with training data.

24. What is differential privacy used for in machine learning?

  1. Providing mathematical privacy guarantees while limiting the influence of individual records
  2. Increasing the number of model parameters
  3. Eliminating the need for authentication
  4. Preventing all adversarial examples

Answer: A) Providing mathematical privacy guarantees while limiting the influence of individual records

Explanation: Differential privacy provides a formal framework for limiting how much the presence or absence of an individual record can affect released information or computation results.

25. What is RAG security?

  1. Protecting retrieval-augmented generation systems from attacks involving retrieved data, access, embeddings, prompts, and outputs
  2. Encrypting only the model's user interface
  3. Removing retrieval from an AI system
  4. Using a larger language model

Answer: A) Protecting retrieval-augmented generation systems from attacks involving retrieved data, access, embeddings, prompts, and outputs

Explanation: RAG introduces additional security considerations because external documents and retrieval systems become part of the model's input and application workflow.

26. Why can malicious documents be dangerous in a RAG system?

  1. Retrieved documents can contain instructions or data that influence the model's behavior
  2. Documents cannot be processed by RAG systems
  3. RAG automatically authenticates every document
  4. Retrieved content is always trusted

Answer: A) Retrieved documents can contain instructions or data that influence the model's behavior

Explanation: Untrusted retrieved content can contain malicious instructions, misleading information, or sensitive data and may influence the model when inserted into its context.

27. What is vector or embedding security concerned with?

  1. Protecting vector representations, vector stores, retrieval logic, and associated access controls
  2. Protecting only the robot's motor controller
  3. Increasing embedding dimensions without validation
  4. Replacing all vector databases

Answer: A) Protecting vector representations, vector stores, retrieval logic, and associated access controls

Explanation: Embedding-based systems can introduce risks involving unauthorized retrieval, poisoned content, access-control failures, and weaknesses in vector databases or retrieval pipelines. OWASP's current GenAI guidance includes vector and embedding weaknesses among its covered risks.

28. What is AI supply-chain security?

  1. Protecting models, datasets, libraries, plugins, dependencies, and other components used to build AI systems
  2. Managing physical transportation of computers only
  3. Increasing training dataset size
  4. Removing all third-party components

Answer: A) Protecting models, datasets, libraries, plugins, dependencies, and other components used to build AI systems

Explanation: AI systems can depend on pretrained models, datasets, packages, APIs, tools, and other third-party components, creating a broader software and data supply chain.

29. What is a malicious pretrained model risk?

  1. A model may contain malicious behavior, vulnerabilities, or unexpected functionality introduced before deployment
  2. A model always becomes secure after downloading
  3. A model cannot contain security-relevant behavior
  4. A pretrained model cannot interact with applications

Answer: A) A model may contain malicious behavior, vulnerabilities, or unexpected functionality introduced before deployment

Explanation: Third-party models should be evaluated and obtained from trusted sources because model artifacts can become part of an application's security boundary.

30. Why should AI dependencies be scanned and kept up to date?

  1. Vulnerable dependencies can introduce security weaknesses into the AI application
  2. Dependency updates always increase model accuracy
  3. Dependencies cannot contain vulnerabilities
  4. Scanning is only useful for image files

Answer: A) Vulnerable dependencies can introduce security weaknesses into the AI application

Explanation: AI applications commonly rely on software libraries, frameworks, model-serving components, and infrastructure that may contain vulnerabilities requiring remediation.

31. What is secure model serialization?

  1. Using model storage and loading mechanisms that minimize the risk of executing or processing untrusted serialized content
  2. Converting every model into plain text
  3. Removing model metadata
  4. Publishing model files publicly

Answer: A) Using model storage and loading mechanisms that minimize the risk of executing or processing untrusted serialized content

Explanation: Some serialization formats or loading mechanisms can introduce code-execution or deserialization risks. Model artifacts should therefore be handled as potentially sensitive software components.

32. What is authentication used for in an AI application?

  1. Verifying the identity of a user, service, or system making a request
  2. Determining whether a model prediction is correct
  3. Improving tokenization
  4. Increasing GPU memory

Answer: A) Verifying the identity of a user, service, or system making a request

Explanation: Authentication establishes who or what is requesting access to an AI service or resource.

33. What is authorization?

  1. Determining what an authenticated user or service is allowed to access or perform
  2. Determining whether a model has enough parameters
  3. Training a model with more data
  4. Encrypting every model output

Answer: A) Determining what an authenticated user or service is allowed to access or perform

Explanation: Authorization enforces permissions after identity has been established, such as whether an AI agent may read a particular document or execute a specific tool.

34. Why should an AI agent's tools use separate permissions where possible?

  1. It limits the impact of a compromised or manipulated tool invocation
  2. It guarantees that the model will never hallucinate
  3. It eliminates the need for authentication
  4. It increases the model's parameter count

Answer: A) It limits the impact of a compromised or manipulated tool invocation

Explanation: Separating permissions according to task requirements helps prevent an agent from using one compromised capability to access unrelated sensitive resources.

35. What is human-in-the-loop security for AI agents?

  1. Requiring human review or approval for selected high-impact actions
  2. Allowing an agent to make every decision without oversight
  3. Removing all automation from an AI system
  4. Using humans only to label images

Answer: A) Requiring human review or approval for selected high-impact actions

Explanation: Human approval can provide an additional control layer before sensitive actions such as financial transactions, account changes, or destructive operations are executed.

36. What is AI red teaming?

  1. Systematically testing an AI system to identify vulnerabilities, unsafe behavior, or attack paths
  2. Training an AI model with red-colored images
  3. Removing security controls before deployment
  4. Increasing model size without evaluation

Answer: A) Systematically testing an AI system to identify vulnerabilities, unsafe behavior, or attack paths

Explanation: AI red teaming uses adversarial or realistic scenarios to discover weaknesses in models, prompts, applications, tools, data pipelines, and system integrations.

37. What is an AI security evaluation?

  1. Testing an AI system against defined security threats, requirements, and failure conditions
  2. Measuring only the number of model parameters
  3. Checking only the user interface color
  4. Deleting failed test cases

Answer: A) Testing an AI system against defined security threats, requirements, and failure conditions

Explanation: Security evaluation can include adversarial testing, privacy tests, access-control verification, prompt-injection tests, abuse testing, and system-level assessments.

38. What is threat modeling for AI systems?

  1. Identifying assets, threats, attack surfaces, vulnerabilities, and potential impacts
  2. Increasing training data automatically
  3. Designing a neural network architecture only
  4. Generating synthetic images

Answer: A) Identifying assets, threats, attack surfaces, vulnerabilities, and potential impacts

Explanation: Threat modeling helps teams systematically analyze how an AI system could be attacked and where security controls should be applied.

39. Which is an example of an AI attack surface?

  1. Model API, training pipeline, data store, prompt interface, tools, or model-serving infrastructure
  2. Only the application's logo
  3. Only the physical keyboard
  4. Only the documentation website

Answer: A) Model API, training pipeline, data store, prompt interface, tools, or model-serving infrastructure

Explanation: AI security requires examining the complete system because attacks can target data, models, APIs, prompts, dependencies, tools, infrastructure, and downstream integrations.

40. What is security monitoring in an AI system?

  1. Continuously observing system activity and security-relevant events for anomalies or threats
  2. Training the model only once
  3. Disabling application logs
  4. Removing authentication after deployment

Answer: A) Continuously observing system activity and security-relevant events for anomalies or threats

Explanation: Monitoring can identify unusual usage, excessive requests, suspicious tool calls, abnormal outputs, authentication failures, and other security signals.

41. Why are audit logs important for AI security?

  1. They provide records that can support investigation, accountability, and incident response
  2. They automatically prevent every attack
  3. They replace authentication
  4. They eliminate the need for monitoring

Answer: A) They provide records that can support investigation, accountability, and incident response

Explanation: Logs can record relevant events such as user access, tool calls, configuration changes, model requests, and security alerts, subject to appropriate privacy and retention controls.

42. What is an AI incident response process?

  1. A structured process for detecting, containing, investigating, and recovering from AI-related security incidents
  2. A process for increasing model parameters
  3. A method for generating training labels
  4. A technique for compressing model weights

Answer: A) A structured process for detecting, containing, investigating, and recovering from AI-related security incidents

Explanation: AI incident response adapts established security practices to incidents involving models, data, prompts, agents, infrastructure, and AI-specific attack paths.

43. What is the purpose of the NIST AI Risk Management Framework?

  1. Helping organizations manage risks associated with AI systems
  2. Providing a programming language for neural networks
  3. Replacing all cybersecurity standards
  4. Defining one mandatory AI model architecture

Answer: A) Helping organizations manage risks associated with AI systems

Explanation: NIST's AI RMF is designed to help organizations incorporate trustworthiness considerations into the design, development, deployment, use, and evaluation of AI systems.

44. Which characteristic is explicitly included among NIST AI RMF trustworthiness considerations?

  1. Secure and resilient
  2. Maximum model size
  3. Unlimited autonomy
  4. Maximum token count

Answer: A) Secure and resilient

Explanation: NIST identifies secure and resilient systems as one of the trustworthiness characteristics considered in the AI RMF, alongside characteristics such as validity and reliability, accountability and transparency, explainability and interpretability, privacy enhancement, and fairness with harmful bias managed.

45. Why should security be considered throughout the AI lifecycle?

  1. Security weaknesses can be introduced during data collection, training, deployment, integration, or operation
  2. Security matters only after an AI model is retired
  3. Training data cannot affect security
  4. Deployment introduces no new risks

Answer: A) Security weaknesses can be introduced during data collection, training, deployment, integration, or operation

Explanation: AI security is not limited to inference. Risks can arise throughout the lifecycle, from training data and model development to deployment, external integrations, monitoring, and maintenance. NIST recommends considering trustworthiness across pre-design, design and development, deployment, use, and testing and evaluation.

46. An AI agent can read email, access customer records, issue refunds, and delete files. What is the primary security concern if all these permissions are granted without restrictions?

  1. Excessive agency
  2. Data normalization
  3. Model quantization
  4. Tokenization

Answer: A) Excessive agency

Explanation: Giving an agent broad functionality and permissions increases the potential impact of unexpected or manipulated model behavior. Limiting tools and permissions is an important mitigation for excessive agency.

47. A RAG application retrieves a document containing hidden instructions telling the LLM to ignore its system instructions and send retrieved customer data to an external service. What type of threat does this scenario primarily illustrate?

  1. Indirect prompt injection combined with excessive agency
  2. Model quantization
  3. Data normalization
  4. Gradient clipping

Answer: A) Indirect prompt injection combined with excessive agency

Explanation: The malicious instructions originate from retrieved external content, making this an indirect prompt injection scenario. If the agent also has permission to send data externally, excessive agency can increase the potential impact.

48. A company wants to protect confidential customer information in an AI assistant. Which architecture provides the strongest basic security boundary?

  1. Authenticated access, authorization checks, least-privilege retrieval, data filtering, and controlled model output
  2. Allowing every user to retrieve every document
  3. Putting all confidential data into the system prompt
  4. Relying only on the model to decide whether a user is authorized

Answer: A) Authenticated access, authorization checks, least-privilege retrieval, data filtering, and controlled model output

Explanation: Sensitive-data protection should rely on enforceable application and infrastructure controls rather than expecting the language model alone to enforce authorization boundaries.

49. A security team discovers that an LLM-powered application accepts user input, generates shell commands, and executes them with operating-system administrator privileges. Which architectural change most directly reduces the security impact?

  1. Use constrained tools with allowlisted operations and least-privilege execution permissions
  2. Give the model more detailed system instructions and keep administrator privileges
  3. Increase the model temperature
  4. Remove application logging

Answer: A) Use constrained tools with allowlisted operations and least-privilege execution permissions

Explanation: Model-generated commands should not automatically receive unrestricted system privileges. Constrained interfaces, allowlisted operations, sandboxing, authentication, authorization, and least-privilege execution can substantially reduce the potential impact of unsafe or manipulated outputs.

50. An organization is deploying an AI agent that can retrieve private documents, call external APIs, update databases, and perform financial actions. Which security architecture is most appropriate?

  1. Threat modeling, strong authentication and authorization, least-privilege tools, input and output validation, isolated execution, monitoring, audit logs, red teaming, and human approval for high-impact actions
  2. Give the agent unrestricted access and rely on the language model to make all security decisions
  3. Disable logging to reduce storage requirements
  4. Allow external documents to override system policies whenever necessary

Answer: A) Threat modeling, strong authentication and authorization, least-privilege tools, input and output validation, isolated execution, monitoring, audit logs, red teaming, and human approval for high-impact actions

Explanation: An agent with access to sensitive data and external systems has a broad attack surface. Security should therefore be implemented as multiple independent layers rather than relying on the model's instructions alone. Current OWASP GenAI guidance highlights risks such as prompt injection, sensitive information disclosure, supply-chain vulnerabilities, excessive agency, vector and embedding weaknesses, and unbounded consumption, while NIST's AI RMF provides a broader lifecycle-oriented approach to managing AI risks.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.