AI Security Engineer

Sample question 1

An AI security engineer is compiling attack surface documentation for Harwick Savings' mobile banking app ahead of an assessment. The documentation so far lists the REST API endpoints, the login screen, and a third-party analytics SDK. Reviewing the app's manifest and design notes, the engineer also finds that the app enforces certificate pinning on its API connections, registers the custom URL scheme harwick:// so that campaign emails and the bank's website can open specific in-app screens such as transfer confirmation, ships root-detection and anti-tampering checks, and displays a set of permission request dialogs at first launch. Which additional element belongs in the attack surface documentation?

1. A.The certificate pinning configuration, since a bypass of pinning would expose every API call the documentation already covers to interception.
2. B.The permission request dialogs, since permissions granted at first launch determine how much device data a compromised app process could reach.
3. C.The root-detection and anti-tampering checks, since attackers operating on jailbroken devices routinely defeat these protections before doing anything else.
4. D.The harwick:// scheme handler and the parameters it accepts, since other apps and web pages can invoke it outside the login flow.

Sample question 2

You are the AI security engineer at a manufacturing company modernizing its factory-floor monitoring platform. The DevOps team proposes a single service identity for the deployment pipeline: it can merge pull requests into the main branch, run the Terraform plan and apply steps, and hold the long-lived cloud credentials that create and modify production resources, all so one integration reduces pipeline complexity. Applying access control principles, what is the strongest objection you should raise before approving this design?

1. A.The strongest objection is that the identity would be over-privileged, carrying broad standing rights to create and modify production resources far beyond any single step, so the design violates least privilege, and scoping its permissions down to only the specific Terraform resources this pipeline manages is what applying separation of duties to this design requires before approval.
2. B.The strongest objection is that the identity would depend on long-lived cloud credentials, so a single theft would grant lasting access, and the separation of duties this design lacks is restored once those credentials are replaced with short-lived tokens issued fresh and rotated automatically before each individual pipeline run, which keeps any stolen credential from being reused across deployments.
3. C.The strongest objection is that one identity would hold both the authority to merge a change into the main branch and the authority to apply it to production; those two functions must sit with separate identities, because otherwise a single compromise of the pipeline identity, including through the build runner, could push an unreviewed change straight into production.
4. D.The strongest objection is that separation of duties is absent at the merge step, so requiring a second independent reviewer to approve each pull request before it merges supplies that separation between author and approver, which addresses the concern right at the point where new changes actually enter the main branch that the deployment pipeline consumes.

Sample question 3

An AI security engineer supports a US-based HR technology vendor whose AI tool screens job applicants via resume and video-interview analysis. A German bank client wants to use the tool for EU-based roles, with applicant data hosted on US servers. The client's legal team argues that because the vendor's servers sit in the US, GDPR does not apply to this processing. The engineer must correct this understanding before the engagement proceeds. Which explanation is accurate?

1. A.GDPR territorial scope is tied to where a company's servers are physically hosted, so moving the applicant data to US-based infrastructure takes this processing outside GDPR's reach.
2. B.The contract between the vendor and the bank specifies US law as governing, and that contractual choice of law determines whether GDPR requirements attach to this processing.
3. C.GDPR applies because the bank is established in the EU, so processing its EU applicants' data is governed by GDPR wherever it occurs; hosting the data on US servers raises cross-border transfer requirements rather than removing that obligation.
4. D.As a processor rather than a controller, the vendor has no independent compliance duties under GDPR; the bank's status as controller absorbs any GDPR obligations that might otherwise apply here.