Title: Quiz 2 — OWASP LLM Top 10 (2025) Deep Dive
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 02 — OWASP LLM Top 10 (2025) Deep Dive

Q: Which risk has held the #1 position in both the 2023 and 2025 editions of the OWASP Top 10 for LLM Applications?
- Sensitive Information Disclosure
- Prompt Injection
- Excessive Agency
- Unbounded Consumption
A: Prompt Injection

Q: The OWASP Top 10 for LLM Applications is essentially the same list as the classic OWASP Top 10 for web applications, just relabeled for AI.
- True
- False
A: False

Q: In the 2025 edition, which risk moved from 6th place up to 2nd place?
- Supply Chain
- Sensitive Information Disclosure
- Data and Model Poisoning
- Misinformation
A: Sensitive Information Disclosure

Q: Name the three structural root causes of Excessive Agency (LLM06) identified by OWASP.
Feedback: Sample/expected answer: Excessive functionality, excessive permissions, and excessive autonomy.

Q: A leaked system prompt is generally harmless because it only contains instructions, not real secrets.
- True
- False
A: False

Q: Improper Output Handling (LLM05) is best described as:
- The model being too verbose in its responses
- A failure to validate/encode untrusted model output before passing it downstream, enabling XSS/SSRF/SQLi/RCE
- A weakness only relevant to fine-tuned models
- The same issue as Prompt Injection, just renamed
A: A failure to validate/encode untrusted model output before passing it downstream, enabling XSS/SSRF/SQLi/RCE

Q: Name one of the two entirely new/renamed categories (besides System Prompt Leakage) added in the 2025 list to reflect agentic and RAG deployments.
Feedback: Sample/expected answer: Vector and Embedding Weaknesses (LLM08) or Unbounded Consumption (LLM10) — either is acceptable.

Q: What is the recommended mitigation approach for Excessive Agency, per this week's lecture?
- Softening the system prompt's tone so the model is less proactive
- Least-privilege tool design and human-approval gates on consequential actions
- Disabling all tool use entirely
- Increasing the model's temperature setting
A: Least-privilege tool design and human-approval gates on consequential actions