1. What is the primary capability that Generative AI introduces to modern cyber threat actors?
- A) Completely eliminating the need for an internet connection during attacks
- B) Automating and scaling social engineering attacks, such as hyper-realistic phishing and deepfakes
- C) Physically destroying hardware components remotely via software signals
- D) Bypassing the need for encrypted protocols like HTTPS
Correct Answer: B
Explanation: Generative AI allows attackers to craft flawless, context-aware phishing emails at scale and generate deepfake audio/video to bypass traditional human verification and trust boundaries.
2. Which of the following best describes an “AI-powered polymorphic malware”?
- A) Malware that only executes on computers running specific versions of AI software
- B) Malware that automatically rewrites its own code structure using machine learning algorithms to evade signature-based detection
- C) A defensive AI tool used to quarantine infected network nodes
- D) An artificial intelligence model that accidentally deletes its own database
Correct Answer: B
Explanation: Polymorphic malware changes its identifiable features (signature) to avoid antivirus detection. AI-driven variants can dynamically adapt their code patterns more effectively based on the security controls they encounter.
3. In the context of AI-driven cybersecurity, what is an “Adversarial Attack” (or Adversarial Machine Learning)?
- A) A cyberattack launched by an artificial intelligence system against human hackers
- B) Manipulating input data with subtle, malicious modifications to trick an AI/ML model into making incorrect classifications
- C) A legal dispute between tech companies over AI patent ownership
- D) An automated denial-of-service attack targeting cloud-hosted neural networks
Correct Answer: B
Explanation: Adversarial machine learning involves feeding specially perturbed inputs to an AI (like placing tiny, imperceptible stickers on a stop sign or altering pixels in an image) to cause the model to misclassify it.
4. Which international framework or concept emphasizes mutual assistance and resilience among nations to counter malicious AI-driven cyber operations and digital harms?
- A) Digital Solidarity
- B) Automated Encryption Isolation
- C) The Static Firewall Protocol
- D) Closed-Source Governance
Correct Answer: A
Explanation: Initiatives like the U.S. International Cyberspace & Digital Policy Strategy emphasize “digital solidarity,” where international allies collaborate to defend against digital harms and support victims of advanced cyber threats.
5. How can machine learning models be maliciously leveraged during reconnaissance phases of a cyberattack?
- A) By manually typing passwords into target login pages
- B) By automatically scraping, aggregating, and analyzing massive volumes of open-source intelligence (OSINT) and social media data to map high-value targets
- C) By physically printing network architecture diagrams from corporate printers
- D) By broadcasting raw binary data across public radio frequencies
Correct Answer: B
Explanation: Threat actors use machine learning algorithms to quickly sort through vast amounts of public data to identify organizational hierarchies, key personnel, and potential security weaknesses.
6. What is a “Deepfake” vector most commonly used to achieve in targeted corporate cyberattacks (Business Email Compromise – BEC)?
- A) Overloading web servers with traffic to cause a crash
- B) Mimicking the voice or video of a company executive (like a CEO or CFO) to authorize fraudulent wire transfers or data disclosures
- C) Automatically cracking complex RSA encryption keys via brute-force
- D) Corrupting system backups stored in offline tape drives
Correct Answer: B
Explanation: Deepfake audio and video impersonation targets human trust by fabricating emergency requests from leadership, leading to massive financial fraud.
7. What role does AI play in modern Automated Threat Hunting?
- A) AI completely removes the requirement for network administrators
- B) AI proactively analyzes behavioral patterns and anomalies across network logs to uncover hidden or zero-day threats that static rules miss
- C) AI physically disconnects compromised physical cables from server racks
- D) AI generates random cryptographic keys to lock out legitimate users
Correct Answer: B
Explanation: Threat hunting relies on AI to baseline normal network behavior and flag anomalous activities indicative of advanced persistent threats (APTs).
8. Which of the following represents an AI “Data Poisoning” threat?
- A) Injecting malicious SQL commands into a web form database
- B) Intentionally corrupting or manipulating the training dataset of an AI model to compromise its future decision-making accuracy
- C) Spreading computer viruses through infected USB flash drives
- D) Overwhelming an AI chatbot with automated spam queries
Correct Answer: B
Explanation: Data poisoning occurs during the training phase, where attackers introduce corrupted data to ensure the resulting model behaves maliciously or inaccurately when deployed.
9. Why are AI-driven password cracking tools significantly more efficient than traditional dictionary or brute-force attacks?
- A) They guess passwords by directly accessing hardware memory chips
- B) They use machine learning models trained on leaked password databases to predict human password creation patterns and variations intelligently
- C) They bypass network routers by tunneling through Bluetooth frequencies
- D) They force the target server to reset passwords automatically
Correct Answer: B
Explanation: AI-based crackers analyze vast databases of previous credential leaks to learn human habits, greatly cutting down the time needed to guess customized passwords.
10. What is “Model Inversion” in the context of AI security vulnerabilities?
- A) A technique where attackers reconstruct private training data by observing an AI model’s output responses and confidence scores
- B) A process of reversing a software patch applied to a neural network
- C) Upgrading an AI model from a local server to a cloud-based architecture
- D) Converting an image recognition model into a text-to-speech engine
Correct Answer: A
Explanation: Model inversion attacks allow malicious actors to extract sensitive or private information (such as medical records or personal details) used to train a machine learning model.
11. In AI defense systems, what is the primary advantage of UEBA (User and Entity Behavior Analytics)?
- A) It blocks all incoming web traffic from foreign countries automatically
- B) It creates baseline profiles of normal user and device behavior to detect insider threats or compromised accounts acting abnormally
- C) It encodes all outgoing email messages using quantum cryptography
- D) It replaces multi-factor authentication with facial scanning
Correct Answer: B
Explanation: UEBA uses machine learning to detect subtle deviations from routine behavior, which helps spot compromised credentials and insider threats early.
12. Which type of cyber threat involves an attacker exploiting vulnerabilities in AI supply chains, such as pre-trained open-source models?
- A) Supply chain poisoning / malicious open-source model injection
- B) Distributed Denial of Service (DDoS)
- C) Man-in-the-Middle (MitM) packet sniffing
- D) Structured Query Language (SQL) injection
Correct Answer: A
Explanation: Just like traditional software supply chains, developers importing pre-trained public AI models may unknowingly inherit backdoors or compromised weights embedded by threat actors.
13. What is the definition of “Evasion Attacks” against AI classifiers in security operations?
- A) An attacker hiding their physical location using a Virtual Private Network (VPN)
- B) Crafting malicious payloads or inputs designed specifically to bypass machine learning-based detection filters (e.g., spam or malware filters)
- C) Deleting log files to evade forensic investigators
- D) Shutting down AI security servers during a network intrusion
Correct Answer: B
Explanation: Evasion attacks are runtime exploits where input data is modified so that the target machine learning classifier flags malicious content as benign.
14. How do threat actors weaponize Large Language Models (LLMs) like “WormGPT” or customized dark-web models?
- A) To automatically generate malware code, orchestrate phishing campaigns, and bypass safety guardrails built into commercial AI tools
- B) To secure corporate networks against unauthorized access
- C) To compress large archive files for faster transmission
- D) To translate source code between programming languages legally
Correct Answer: A
Explanation: Cybercriminals create or strip safety filters off LLMs to scale up malicious activities, generating functional exploit code and convincing text templates quickly.
15. What is the security risk associated with “Shadow AI” within an enterprise environment?
- A) Employees casting shadows on office webcams, causing authentication errors
- B) Employees inputting sensitive intellectual property, source code, or PII into unauthorized, public AI platforms, leading to data leaks
- C) AI models running in dark mode consuming extra electricity
- D) Hidden artificial intelligence scripts slowing down local Wi-Fi bandwidth
Correct Answer: B
Explanation: Shadow AI refers to the unapproved use of generative AI tools by staff, which often leaks confidential company data into third-party training datasets.
16. Which defense mechanism uses AI to create deceptive traps, mimicking real assets to mislead automated attacker tools and AI scripts?
- A) Honeytokens and AI-driven Honeypots
- B) Static packet filtering firewalls
- C) Standard public key infrastructures (PKI)
- D) Basic password complexity policies
Correct Answer: A
Explanation: Modern honeypots powered by AI can dynamically converse with or mimic vulnerable systems to waste attacker time, study their tactics, and trigger early alarms.
17. What distinguishes an Automated Orchestration, Automation, and Response (SOAR) platform enhanced with AI from traditional security tools?
- A) It completely eliminates computers from the network
- B) It uses machine learning to correlate massive incident alerts, prioritize threats, and execute rapid automated playbooks without constant human intervention
- C) It physically locks office doors when a breach occurs
- D) It plays automated alert sounds through computer speakers
Correct Answer: B
Explanation: AI-driven SOAR platforms drastically reduce Mean Time to Respond (MTTR) by triaging alerts and automating containment workflows.
18. In terms of national security, why is the intersection of AI and cyber threats considered a “double-edged sword”?
- A) Because swords are physical items used in modern cyber warfare
- B) Because both attackers and defenders use the exact same advanced AI capabilities to scale up offense and automate defense simultaneously
- C) Because AI code is written in dual languages (English and binary)
- D) Because it requires twice as many electricity generators to run
Correct Answer: B
Explanation: Both sides leverage AI—attackers use it to automate and refine scale-attacks, while defenders use it to predict, hunt, and neutralize breaches faster.
19. What is “Prompt Injection” when directed against AI-integrated web applications?
- A) Injecting physical electricity into an AI processor chip
- B) Tricking an LLM-based application via clever user input to ignore its safety guidelines and execute unintended, privileged commands
- C) A method used to speed up text-generation responses
- D) Connecting an external keyboard to a server rack
Correct Answer: B
Explanation: Prompt injection is a vulnerability where malicious inputs manipulate an AI application into overriding its system prompt and performing unauthorized actions.
20. Which future-focused concept represents the ultimate goal of implementing AI in international cybersecurity defense frameworks?
- A) Autonomous, self-healing cyber ecosystems that can predict, isolate, and patch zero-day vulnerabilities in real-time before human intervention is required
- B) Replacing all human network engineers with robots permanently
- C) Creating a global internet shutdown switch controlled by a single algorithm
- D) Ensuring zero data flows across international borders ever again
