Agentic AI Security & Shadow AI MCQ 60 Tests With Answers (2026)

Incorrect·D: Jailbreaks attempt to bypass the model's safety alignments to generate forbidden content, whereas prompt injection hijacks the agent's functional logic

Jailbreaks bypass safety guardrails to generate harmful content (violence, illegal instructions). Prompt injections hijack the agent's tool-calling logic to execute unintended actions (unauthorized API calls, data access). These are distinct attack vectors.

Incorrect·A: Attackers manipulate the underlying vector database documents to force the agent to retrieve and output malicious context

In RAG data poisoning, attackers modify documents within the vector database. When the agent retrieves these poisoned documents and cites them as authoritative, the model outputs misinformation, credentials, or malicious instructions.

Incorrect·C: To analyze the inputs and outputs of the primary agent against policy rules before the user sees the response

A guardrail model runs LLM outputs through a secondary classifier that checks for policy violations, jailbreak attempts, or unsafe content. If violations are detected, the output is blocked or modified before reaching the user.

Incorrect·B: General Data Protection Regulation (GDPR)

GDPR requires explicit data processing consent and regulates any EU resident's personal data. If employee inputs containing customer PII were uploaded to unsanctioned AI tools and subsequently breached, GDPR violations and hefty fines are inevitable.

Incorrect·A: An attacker manipulating the agent's reasoning process to force it to call a legitimate internal API with malicious parameters

Tool abuse exploits flawed agent reasoning. An attacker tricks the agent into calling a legitimate API (e.g., delete_user()) with malicious parameters, causing harm while the agent's action appears authorized.

Incorrect·D: By intercepting prompts at the API gateway and masking Personally Identifiable Information (PII) before transmission

DLP for AI involves intercepting API calls at the enterprise gateway, detecting sensitive data (SSNs, credit cards, passwords) using regex or ML classifiers, masking or blocking the transmission, and logging the attempt.

Incorrect·B: The non-deterministic nature of LLMs means the exact same inputs can yield wildly different reasoning paths and tool calls

LLMs are fundamentally probabilistic. The same input can generate different outputs, reasoning paths, and tool selections on repeated runs. Traditional software executing the same code always produces identical results, making comparison and auditing straightforward.

Incorrect·C: A malicious actor spinning up thousands of rogue agents to artificially manipulate a decentralized AI consensus network

In distributed AI networks, a Sybil attack involves creating thousands of fake agent identities to overwhelm consensus mechanisms or voting systems. This allows a single attacker to control network outcomes.

Incorrect·B: Indirect Prompt Injection via DOM manipulation

Attackers can hide malicious CSS (e.g., display: none) or Unicode zero-width characters containing prompt injection instructions in webpages. When a browsing agent fetches the page, it processes these invisible instructions.

Incorrect·D: Employees using their personal credit cards to fund unsanctioned API usage, bypassing IT budget and security oversight

Employees often use personal credit cards to subscribe to premium LLM APIs (ChatGPT Pro, Claude+) to avoid detection. This circumvents budget controls and makes Shadow AI financially invisible to IT/finance teams.

Incorrect·A: The agent's database connection string is restricted to a dedicated service account with strictly limited read/write permissions

RBAC restricts agents to minimal necessary permissions. A read-only summarization agent connects with read-only credentials; agents requiring write access use separate, narrowly scoped credentials limited to specific tables.

Incorrect·C: The agent might inadvertently or maliciously execute OS-level shell commands that compromise the host container

If an agent can execute arbitrary code (Python, bash), an attacker can craft prompts containing shell commands (e.g., `rm -rf /`) that execute with the container's privileges, exfiltrating data or destroying systems.

Incorrect·D: By deploying fake APIs or documents designed to trigger an alert if a rogue or compromised agent attempts to interact with them

Security honeypots are decoy resources (fake database endpoints, sensitive fake documents) that are never used by legitimate agents. Any access is immediately flagged as malicious or compromised agent activity.

Incorrect·B: Enforcing parameterized queries and strict schema validation at the tool execution layer

Parameterized queries (prepared statements) separate SQL logic from user input. Strict schema validation ensures agents can only operate on pre-approved tables/columns. This prevents arbitrary SQL injection regardless of prompt manipulation.

Incorrect·A: An attack where adversaries repeatedly query an API to reverse-engineer and extract the sensitive training data memorized by the model

Model inversion exploits LLLMs' tendency to memorize training data. Attackers craft specific queries that trick the model into outputting verbatim excerpts from its training set, recovering sensitive information (passwords, API keys, PII).

Incorrect·C: Security teams lack the necessary access logs and telemetry to investigate exactly what data was compromised during a breach

Shadow AI systems operate outside security monitoring. If breached, incident responders cannot access logs, API call histories, or data transfer records, making scope assessment, root cause analysis, and damage quantification impossible.

Incorrect·D: To record the exact sequence of thought, tool selection, and intermediate outputs for debugging and security auditing

Tracing captures a complete execution log: the agent's reasoning steps, tool choices, API responses, and intermediate outputs. This is critical for auditing, debugging, and detecting when an agent was manipulated into executing unintended actions.

Incorrect·B: Because natural language instructions lack strict logical boundaries, allowing clever user prompts to mathematically outweigh the system prompt's attention weights

LLMs operate probabilistically; inputs with high enough salience can overpower the system prompt in attention weights. Additionally, multi-turn conversations allow attackers to gradually steer the agent through seemingly benign escalations.

Incorrect·A: Crafting specific inputs designed to maximize the computational complexity of the model's generation, causing a Denial of Service

Sponge poisoning exploits the quadratic time complexity of transformer attention. Attackers craft extremely long, complex prompts that force the model into expensive computation loops, consuming massive compute resources and causing service degradation.

Incorrect·C: Establishing a dedicated, private network link (like AWS PrivateLink) to bypass the public internet

Private network links (AWS PrivateLink, Azure Private Link) establish encrypted, non-internet-routable paths to API endpoints. This prevents MITM attacks and ensures sensitive data never traverses public internet infrastructure.

Incorrect·C: By slowly steering the conversation through a series of seemingly benign, escalating questions that gradually trick the model into producing harmful content

Crescendo attacks use conversational steering. Instead of direct jailbreaking, attackers engage the model in seemingly innocent escalations (e.g., role-play scenarios) that gradually lower guardrail thresholds until forbidden content is generated.

Incorrect·D: To physically and logically isolate the agent's code execution environment (e.g., via heavily restricted Docker containers or gVisor) to prevent host compromise

Sandboxing isolates code execution in restricted containers (Docker with dropped capabilities, gVisor, WebAssembly). Even if an agent is compromised or tricked into executing malicious code, the host system remains protected.

Incorrect·A: Forcing the agent to output its proprietary, highly engineered system prompt and internal tool descriptions

The Walrus attack (prompt leaking) tricks agents into repeating or revealing their hidden system prompt. By extracting the system prompt, attackers gain full knowledge of the agent's capabilities, constraints, and internal tool APIs.

Incorrect·B: By introducing microscopic, mathematically calculated pixel noise into an image that forces the agent to misclassify the object entirely

Adversarial perturbations exploit VLM pixel-space vulnerabilities. Attackers add imperceptible noise patterns that, while invisible to humans, cause the model to misclassify objects. This bypasses visual security controls.

Incorrect·D: The evaluating LLM is susceptible to the exact same injection attacks and hallucination biases as the target LLM

Using an LLM to evaluate another LLM's output is insufficient. Both models share identical vulnerabilities to prompt injection, hallucination, and jailbreaking. A malicious output can trick both simultaneously.

Incorrect·C: Utilizing OAuth integration analysis to identify third-party applications that employees have granted access to corporate environments

Shadow SaaS discovery involves auditing OAuth token grants and third-party integrations. Employees often authorize unauthorized AI apps to access corporate email, files, or databases, creating data exfiltration pathways.

Incorrect·B: The attacker commands the agent to fetch a URL pointing to internal, non-routable IP addresses (e.g., 169.254.169.254) to exfiltrate cloud metadata

SSRF exploits a web-scraping agent to access internal IP ranges. In AWS, the IP 169.254.169.254 hosts instance metadata (credentials, IAM roles). An attacker tricks the agent into fetching this URL, exfiltrating AWS credentials.

Incorrect·A: Zero-Knowledge Machine Learning (ZK-ML) proofs

ZK-ML proofs allow verification that a model processed a specific input and produced a specific output without revealing the model weights or intermediate computations. This enables cryptographically auditable AI alignment.

Incorrect·C: They introduce complex inter-agent communication protocols where a compromised sub-agent can socially engineer a highly privileged master agent

In multi-agent systems, agents communicate and influence each other. A compromised or rogue sub-agent can manipulate privileged agents through misinformation, false reports, or coordinated attacks, creating lateral privilege escalation.

Incorrect·A: Utilizing invisible Unicode tags or specific control characters that the LLM processes as instructions, but are completely invisible to human reviewers

ASCII smuggling exploits Unicode encoding. Attackers embed zero-width spaces, invisible control characters, or alternate Unicode representations that tokenizers process as instructions but are invisible to human code review.

Incorrect·D: By deploying a localized proxy agent that utilizes Named Entity Recognition (NER) to strip sensitive data from HTTP payloads before they reach external LLM endpoints

Data redaction at the edge uses NLP models to detect PII, secrets, and sensitive patterns in real-time. Before HTTP traffic reaches external AI APIs, a local proxy strips or masks sensitive data, preventing exfiltration.

Incorrect·B: An attack where the agent's internal state is corrupted, causing it to execute repetitive, resource-draining tool calls without ever reaching a termination state

Sleepwalking attacks corrupt agent state machines, causing infinite loops. An agent repeatedly calls the same tool without progress, consuming CPU/API budget while appearing to "work." Detection requires monitoring tool-call patterns.

Incorrect·A: Implementing strict RBAC at the vector database level, ensuring the retrieval agent only accesses embeddings tagged with the requesting user's authorization level

Document injection mitigation requires layered controls: RBAC on vector database access, document versioning/provenance tracking, and cryptographic signatures on trusted documents. Only authorized users can retrieve their respective documents.

Incorrect·B: If an attacker extracts the prompt, they instantly obtain valid examples of internal API structures, endpoints, and potentially hardcoded sample tokens

Few-shot examples in prompts often contain real API endpoints, request/response formats, and sometimes sample tokens. If a prompt is extracted (via prompt leaking attacks), attackers gain a complete API blueprint.

Incorrect·C: By utilizing a multi-layered approach combining heuristic filters, a dedicated LLM analyzer, and a vector database of known attack signatures

Rebuff uses multiple defense layers: regex-based heuristic detection, a secondary LLM that analyzes prompts for injection patterns, and similarity searches against a database of known jailbreak/injection attacks.

Incorrect·D: Requiring the agent to possess cryptographically signed authorization tokens that dynamically expire based on the risk level of the requested action

Cryptographic alignment uses signed capability tokens and risk-based expiration. An agent can only execute actions it has explicit cryptographic authorization for, and token validity is reassessed before each action based on context risk.

Incorrect·B: The attacker tricks the agent into formatting a response containing sensitive internal data as an external image link (``), forcing the rendering client to execute a blind GET request

Markdown image syntax can encode data in URLs. An attacker tricks the agent into formatting sensitive information as a markdown image link, and when rendered, the browser fetches the link, exfiltrating the data to the attacker's server.

Incorrect·C: A centralized, immutable repository that mandates cryptographic hashing and vulnerability scanning of all approved foundation models before they can be deployed internally

A model registry is a controlled repository where all approved models are cryptographically signed, versioned, and scanned for security vulnerabilities. Deployments must originate from the registry, preventing rogue or compromised models.

Incorrect·D: It isolates the untrusted user input to a sandboxed parsing LLM, ensuring the highly privileged execution LLM only receives sanitized, strictly formatted API JSON payloads

The dual-LLM pattern uses a restricted parser LLM to process untrusted user input, converting it into strict JSON schemas. The privileged executor LLM only receives validated payloads, preventing injection attacks from reaching execution.

Incorrect·A: It trains the model locally on decentralized edge devices and only aggregates the mathematical weight updates, ensuring raw user data never leaves the local environment

Federated learning trains models on local edge devices and only shares aggregated weight updates to a central server. Raw user data remains local and is never transmitted, drastically reducing privacy risks.