AI Security Awareness Demo Exam — Express Operations

Question 1 :

An employee uses a publicly available Generative AI service to summarize an internal incident report. The employee removes customer names but leaves transaction identifiers, internal IP addresses, system names, timestamps, and portions of authentication logs in the prompt. After receiving the summary, the employee deletes the conversation. Which statement BEST describes the remaining security concern?

Options

The primary risk has been sufficiently reduced because direct identifiers were removed before submission.

The principal remaining risk is inaccurate summarization because security logs are difficult for generative AI systems to interpret.

Deleting the conversation eliminates the material confidentiality risk unless the AI provider explicitly retains the response.

Sensitive operational information may already have been disclosed to an external service, and deletion does not by itself establish how submitted information was processed, retained, logged, or reused.

The information should be considered safe because technical identifiers normally fall outside organizational confidentiality requirements.

Question 2 :

A service representative wants an AI assistant to draft a reply about a customer’s disability-related accommodation request. The assistant is approved for ordinary customer correspondence, but its approval record does not address accommodation information. What is the best next action?

Options

Confirm that this data category and purpose are authorized before entering the request into the assistant.

Omit the customer’s name and enter the request because the remaining facts cannot be personal data.

Enter the request with an instruction that the assistant must not retain the information.

Enter the request only after obtaining a colleague’s informal assurance that the tool is approved.

Use a general-purpose account to avoid placing the information in the organization’s workspace.

Question 3 :

On a video call, someone who looks and sounds like a colleague from the IT help desk says your account is locked and asks you to read out the six-digit code that just reached your phone. He already knows your employee ID and your manager's name. What is the correct response?

Options

Ask him a personal question that only the real colleague could answer, and read out the code if he answers it correctly the first time

Read out the code, since he plainly knows internal details that an outsider would be very unlikely to have obtained

Ask him to speak a few more sentences with his camera on, and share the code if his voice and face look natural enough

Share only the first three digits, then confirm the remaining digits through the help desk chat window to be safe

Decline to share any part of the code, end the interaction, reach the help desk on a channel you already know, and report it

Question 4 :

A finance analyst asks an AI tool to build a reconciliation workbook. It returns a spreadsheet containing macros and a link to an external data source, and nothing in the formulas looks suspicious to her. What is the best practice before the file is used for real work or shared?

Options

Open it on her own machine with macros enabled to see whether the formulas behave, and scan it afterward only if the results look wrong

Circulate it to the team for testing first, since several reviewers are more likely to notice a problem than one analyst working alone

Treat it as untrusted, scan it under existing file-handling and malware procedures, and have the macros and external link reviewed first

Remove the external link but keep the macros, since the outside data source is the only element that could introduce risk here

Use it as delivered, because the file came out of an approved session and the model itself was not compromised at any point

Question 5 :

An employee sees a confidential figure in an AI-generated draft, although that figure was not included in the employee’s prompt. The draft has already been shared with one coworker. The employee does not know whether the assistant obtained the figure from another accessible file. What should happen first?

Options

Ask the assistant to identify its source, then decide whether reporting is warranted.

Delete the draft from the employee’s workspace and ask the coworker to do the same.

Stop further distribution, preserve relevant evidence, and report the possible disclosure.

Re-run the prompt to determine whether the figure appears consistently.

Remove the figure from the draft and continue work if no external recipient saw it.