Exam Bundle

Poisoned or superseded records are excluded and answers link to the authorized version. This would be relevant evidence for a different failure: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata, usually addressed by Validate source provenance, signed approvals, and current revision before incorporating retrieved text. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Injected document instructions cannot trigger private-data disclosure or unapproved tools.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Injected document instructions cannot trigger private-data disclosure or unapproved tools.

Attempted command execution is denied while authorized summaries remain functional. This would be relevant evidence for a different failure: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization, usually addressed by Remove general execution privileges and expose only a narrow read-only interface with audited scope. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Injected document instructions cannot trigger private-data disclosure or unapproved tools.

Filter search candidates by authenticated tenant and document entitlements before returning context. That action fits another problem: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. It does not directly remediate the current finding at Oak River Energy: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. The relevant corrective control for this case is: Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model.

Remove general execution privileges and expose only a narrow read-only interface with audited scope. That action fits another problem: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. It does not directly remediate the current finding at Oak River Energy: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. The relevant corrective control for this case is: Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model.

Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. That action fits another problem: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. It does not directly remediate the current finding at Oak River Energy: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. The relevant corrective control for this case is: Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model.

Adversarial requests do not disclose secrets and legitimate support tasks still work. This would be relevant evidence for a different failure: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials, usually addressed by Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Injected document instructions cannot trigger private-data disclosure or unapproved tools.

The same search returns only permitted documents for each tested tenant. This would be relevant evidence for a different failure: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels, usually addressed by Filter search candidates by authenticated tenant and document entitlements before returning context. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Injected document instructions cannot trigger private-data disclosure or unapproved tools.

Attempted command execution is denied while authorized summaries remain functional. This would be relevant evidence for a different failure: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization, usually addressed by Remove general execution privileges and expose only a narrow read-only interface with audited scope. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Injected document instructions cannot trigger private-data disclosure or unapproved tools.

Remove general execution privileges and expose only a narrow read-only interface with audited scope. That action fits another problem: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. It does not directly remediate the current finding at Westlake Retail: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. The relevant corrective control for this case is: Remove secrets from prompt context and enforce privileged instruction boundaries and output testing.

Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. That action fits another problem: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. It does not directly remediate the current finding at Westlake Retail: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. The relevant corrective control for this case is: Remove secrets from prompt context and enforce privileged instruction boundaries and output testing.

Validate source provenance, signed approvals, and current revision before incorporating retrieved text. That action fits another problem: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. It does not directly remediate the current finding at Westlake Retail: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. The relevant corrective control for this case is: Remove secrets from prompt context and enforce privileged instruction boundaries and output testing.

Attempted command execution is denied while authorized summaries remain functional. This would be relevant evidence for a different failure: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization, usually addressed by Remove general execution privileges and expose only a narrow read-only interface with audited scope. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Adversarial requests do not disclose secrets and legitimate support tasks still work.

Injected document instructions cannot trigger private-data disclosure or unapproved tools. This would be relevant evidence for a different failure: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records, usually addressed by Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Adversarial requests do not disclose secrets and legitimate support tasks still work.

Poisoned or superseded records are excluded and answers link to the authorized version. This would be relevant evidence for a different failure: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata, usually addressed by Validate source provenance, signed approvals, and current revision before incorporating retrieved text. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Adversarial requests do not disclose secrets and legitimate support tasks still work.

Filter search candidates by authenticated tenant and document entitlements before returning context. That action fits another problem: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. It does not directly remediate the current finding at Blue Haven Media: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. The relevant corrective control for this case is: Remove secrets from prompt context and enforce privileged instruction boundaries and output testing.

Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. That action fits another problem: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. It does not directly remediate the current finding at Blue Haven Media: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. The relevant corrective control for this case is: Remove secrets from prompt context and enforce privileged instruction boundaries and output testing.

Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. That action fits another problem: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. It does not directly remediate the current finding at Blue Haven Media: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. The relevant corrective control for this case is: Remove secrets from prompt context and enforce privileged instruction boundaries and output testing.

Injected document instructions cannot trigger private-data disclosure or unapproved tools. This would be relevant evidence for a different failure: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records, usually addressed by Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: Adversarial requests do not disclose secrets and legitimate support tasks still work.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: Adversarial requests do not disclose secrets and legitimate support tasks still work.

The same search returns only permitted documents for each tested tenant. This would be relevant evidence for a different failure: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels, usually addressed by Filter search candidates by authenticated tenant and document entitlements before returning context. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: Adversarial requests do not disclose secrets and legitimate support tasks still work.

Remove general execution privileges and expose only a narrow read-only interface with audited scope. That action fits another problem: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. It does not directly remediate the current finding at Linden Manufacturing: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. The relevant corrective control for this case is: Filter search candidates by authenticated tenant and document entitlements before returning context.

Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. That action fits another problem: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. It does not directly remediate the current finding at Linden Manufacturing: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. The relevant corrective control for this case is: Filter search candidates by authenticated tenant and document entitlements before returning context.

Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. That action fits another problem: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. It does not directly remediate the current finding at Linden Manufacturing: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. The relevant corrective control for this case is: Filter search candidates by authenticated tenant and document entitlements before returning context.

Adversarial requests do not disclose secrets and legitimate support tasks still work. This would be relevant evidence for a different failure: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials, usually addressed by Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

Injected document instructions cannot trigger private-data disclosure or unapproved tools. This would be relevant evidence for a different failure: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records, usually addressed by Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

Attempted command execution is denied while authorized summaries remain functional. This would be relevant evidence for a different failure: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization, usually addressed by Remove general execution privileges and expose only a narrow read-only interface with audited scope. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. That action fits another problem: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. It does not directly remediate the current finding at Lakeview Insurance: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. The relevant corrective control for this case is: Filter search candidates by authenticated tenant and document entitlements before returning context.

Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. That action fits another problem: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. It does not directly remediate the current finding at Lakeview Insurance: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. The relevant corrective control for this case is: Filter search candidates by authenticated tenant and document entitlements before returning context.

Validate source provenance, signed approvals, and current revision before incorporating retrieved text. That action fits another problem: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. It does not directly remediate the current finding at Lakeview Insurance: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. The relevant corrective control for this case is: Filter search candidates by authenticated tenant and document entitlements before returning context.

Adversarial requests do not disclose secrets and legitimate support tasks still work. This would be relevant evidence for a different failure: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials, usually addressed by Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

Poisoned or superseded records are excluded and answers link to the authorized version. This would be relevant evidence for a different failure: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata, usually addressed by Validate source provenance, signed approvals, and current revision before incorporating retrieved text. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.