Title: Quiz 1 — AI Security Landscape and the LLM Threat Model
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 01 — AI Security Landscape and the LLM Threat Model

Q: What structural property of LLMs makes prompt injection a fundamentally new attack surface rather than a traditional AppSec problem?
- LLMs are too slow to filter input in real time
- Instructions and data share a single text channel that the model cannot cleanly separate
- LLMs only accept input in English
- LLMs cannot be patched after deployment
A: Instructions and data share a single text channel that the model cannot cleanly separate

Q: Jailbreaking and prompt injection are interchangeable terms that describe the same attack.
- True
- False
A: False

Q: In one sentence, explain the difference between what jailbreaking targets and what prompt injection targets.
Feedback: Sample/expected answer: Jailbreaking targets the model's own safety/alignment training (getting the model to ignore behaviors it was trained to exhibit), while prompt injection targets the application's instructions (getting the model to disobey the developer's system prompt or task framing via smuggled instructions in data).

Q: As of version 5.1.0 (November 2025), how many tactics does MITRE ATLAS catalog?
- 8
- 16
- 42
- 84
A: 16

Q: Which pair of generative-AI-specific techniques was added to MITRE ATLAS in spring 2025?
- Model Extraction and Data Exfiltration
- RAG Poisoning and AI Supply Chain Compromise
- Denial of Service and Credential Theft
- Phishing and Social Engineering
A: RAG Poisoning and AI Supply Chain Compromise

Q: NIST AI 600-1 (the Generative AI Profile) extends the AI Risk Management Framework with GenAI-specific risk categories such as confabulation and information security.
- True
- False
A: True

Q: Name the CVE referenced in the NSA/CISA 2026 MCP Security guidance, and briefly describe why it matters (one sentence is enough).
Feedback: Sample/expected answer: CVE-2025-49596 — an unauthenticated remote-code-execution vulnerability in MCP Inspector rated CVSS 9.4, showing that agentic infrastructure risk is a documented, present-day concern, not a hypothetical one.

Q: Why is a chat-only view of the threat surface insufficient for agentic LLM systems (systems with memory, tools, and the ability to act)?
- Chat interfaces are always encrypted, so there is nothing left to secure
- Agentic systems can only be attacked during training, never at runtime
- Memory, tools, and multi-step state introduce emergent, compositional, and time-delayed attacks that a single-turn chat view misses
- Agentic systems do not process natural language, so injection is impossible
A: Memory, tools, and multi-step state introduce emergent, compositional, and time-delayed attacks that a single-turn chat view misses