{ "module": "S01 — Security Harness Architecture", "course": "2A — Building AI Harnesses for Cybersecurity", "version": "1.0.0", "duration_minutes": 45, "total_questions": 20, "bloom_distribution": { "target": "20% recall / 40% application / 40% analysis-design", "actual": { "recall": 4, "application": 8, "analysis": 8 } }, "passing_score_percent": 70, "questions": [ { "id": "Q01", "bloom": "recall", "type": "multiple_choice", "prompt": "Name the six states of the offensive state machine in order.", "options": [ "Plan → Execute → Verify → Report", "Recon → Hypothesis → Exploit Attempt → Evidence Capture → Triage → Report", "Scan → Enumerate → Attack → Document", "Discover → Assess → Exploit → Remediate" ], "answer_index": 1, "rationale": "The offensive state machine: Recon, Hypothesis, Exploit Attempt, Evidence Capture, Triage, Report. It cycles back to Recon for the next finding and stops when scope is exhausted or evidence threshold is met." }, { "id": "Q02", "bloom": "recall", "type": "multiple_choice", "prompt": "What is the InjecAgent finding regarding indirect prompt injection via tool outputs?", "options": [ "~5% of tasks are vulnerable", "~20% of tasks are vulnerable", "~50% of tasks are vulnerable", "~90% of tasks are vulnerable" ], "answer_index": 2, "rationale": "InjecAgent found approximately 50% of agentic tasks are vulnerable to indirect prompt injection via tool outputs — half the time, an injected instruction causes the model to deviate from intended behavior." }, { "id": "Q03", "bloom": "recall", "type": "multiple_choice", "prompt": "Which CAI autonomy levels are appropriate for production offensive engagements?", "options": ["Level 0–1", "Level 2–3", "Level 4–5", "Level 5 only"], "answer_index": 1, "rationale": "Production offensive harnesses sit at Level 2 (guided — human approves each action) to Level 3 (supervised — autonomous in bounded scope, human monitors). Level 4 is for lab/CTF/benchmark only; Level 5 is research only." }, { "id": "Q04", "bloom": "recall", "type": "multiple_choice", "prompt": "What are the three components of a scope file?", "options": [ "IPs, passwords, exploits", "Authorized targets, rules of engagement, evidence constraints", "Scanners, tools, reports", "Domains, ports, CVEs" ], "answer_index": 1, "rationale": "The three components: authorized targets (in_scope — exhaustive list), rules of engagement (behavioral: rate caps, forbidden actions), and evidence constraints (minimum proof, classification, retention). Each enforced independently." }, { "id": "Q05", "bloom": "application", "type": "multiple_choice", "prompt": "Your harness is running at Level 2. The model proposes scanning an in-scope target. What must happen before the scan executes?", "options": [ "Nothing — Level 2 is autonomous within scope", "A human must approve the action; the approval is recorded as a legal control", "The scope file must be re-fetched from the program", "The InjecAgent benchmark must be re-run" ], "answer_index": 1, "rationale": "Level 2 = Guided. The harness proposes; a human approves each action. The approval gate is a legal control — it records a human decision for every legally sensitive action. This is the bounded-autonomy pattern: propose → approve → execute." }, { "id": "Q06", "bloom": "application", "type": "multiple_choice", "prompt": "A tool call to scan an out-of-scope host reaches the scope enforcement middleware. What does the middleware return?", "options": [ "A crash/exception that halts the harness", "A structured result saying 'out_of_scope' with the reason logged — the model learns and adjusts", "Nothing — it silently drops the call", "An email alert to the program owner" ], "answer_index": 1, "rationale": "Blocked calls return structured results, not errors. The model receives 'out_of_scope' as a normal tool result, learns it was blocked, and adjusts its plan. The block is logged. The call never reaches the network." }, { "id": "Q07", "bloom": "application", "type": "multiple_choice", "prompt": "Your offensive harness has a strong Docker sandbox but no scope enforcement. An attacker injects a prompt that makes the model try to reach an external server. What happens?", "options": [ "The sandbox blocks it — the agent cannot reach the network", "The sandbox allows network access; the call reaches the external server unimpeded. The agent attacked the world despite local containment", "The harness automatically detects the injection", "The OS kernel blocks unauthorized network calls" ], "answer_index": 1, "rationale": "A sandbox without scope enforcement has contained the agent locally but let it attack the world — the agent can reach any endpoint the sandbox's network policy permits. Scope enforcement is the missing control plane. Both are required." }, { "id": "Q08", "bloom": "application", "type": "multiple_choice", "prompt": "An HTTP response from the target contains ''. Without defense, what happens?", "options": [ "The harness's firewall blocks the evil domain", "The raw response enters the model's context as an observation; the model may follow the injected instruction (~50% chance per InjecAgent)", "The scope enforcement middleware strips HTML comments", "Nothing — HTML comments are ignored by all models" ], "answer_index": 1, "rationale": "Without defense, the raw adversarial output enters the model's context as a normal observation. The model may follow the injected instruction — InjecAgent shows ~50% vulnerability. This is the indirect prompt injection attack pattern." }, { "id": "Q09", "bloom": "application", "type": "multiple_choice", "prompt": "You implement untrusted-content tagging. The same injection is served. What happens now?", "options": [ "The injection is completely eliminated — tagging is a full defense", "The output is wrapped in tags. The model is instructed to treat it as data only. This raises the bar significantly but is defense-in-depth, not a complete solution", "The tagging has no effect on injection rates", "The model crashes on encountering the tags" ], "answer_index": 1, "rationale": "Untrusted-content tagging wraps target reads as data-only. It significantly reduces injection success but is NOT a complete solution — InjecAgent shows models can be tricked past tagging. It is one layer in the defense-in-depth stack." }, { "id": "Q10", "bloom": "application", "type": "multiple_choice", "prompt": "You are building a high-assurance offensive harness for a real engagement. Which architecture best defends against adversarial tool outputs?", "options": [ "Untrusted-content tagging alone", "Output sanitization alone", "Reader-actor separation: a Reader Model ingests raw target output and produces structured summaries; the Actor Model sees only summaries, never raw content", "Running the harness at Level 5 autonomy so the model can handle it" ], "answer_index": 2, "rationale": "Reader-actor separation is the strongest single defense (InjecAgent-recommended). The Actor Model never sees raw adversarial content — only structured summaries from the Reader Model. Injection can affect the summary but cannot directly instruct the actor." }, { "id": "Q11", "bloom": "application", "type": "multiple_choice", "prompt": "Your harness is in the middle of a 10-step kill chain and the context window compacts. Step 3's details are lost from context. What prevents the harness from losing its place?", "options": [ "Nothing — the harness must restart the kill chain", "The attack-graph state: a persistent structure in engagement memory tracks each step's state (unexplored/attempting/succeeded/failed), surviving context compaction", "The model re-derives the kill chain from the system prompt", "The scope file contains the kill chain plan" ], "answer_index": 1, "rationale": "The attack graph lives in engagement memory, not the context window. It survives compaction and session boundaries. The model reads the graph's current state to know where it is in the kill chain." }, { "id": "Q12", "bloom": "application", "type": "multiple_choice", "prompt": "The offensive state machine reaches the 'Report' state after one finding. What happens next?", "options": [ "The harness stops — the task is complete", "The harness cycles back to Recon for the next hypothesis, unless scope is exhausted or evidence threshold is met", "The harness waits for human input", "The harness publishes the finding immediately" ], "answer_index": 1, "rationale": "Report is not terminal — it feeds back to Recon for the next finding. The stop condition is externally defined: evidence threshold met OR scope exhausted. The model does not decide when to stop." }, { "id": "Q13", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why is scope enforcement described as 'a legal control, not an engineering preference'?", "options": [ "Because it improves performance", "Because the legal posture must not depend on model compliance. 'The LLM got confused' is not a defense. The middleware makes authorization binary and auditable — 'did the scope file authorize this?'", "Because it is required by the CFAA", "Because it prevents prompt injection" ], "answer_index": 1, "rationale": "If scope is in the system prompt, model non-compliance creates liability with no defense. Hard-wired middleware makes the question binary and auditable: did the scope file authorize this specific call? The legal exposure collapses to an auditable question." }, { "id": "Q14", "bloom": "analysis", "type": "multiple_choice", "prompt": "Compare the stop conditions of a general ReAct loop vs. the offensive state machine. What is the key difference?", "options": [ "ReAct stops on error; the offensive loop stops on success", "ReAct's stop is model-determined (end_turn); the offensive loop's stop is externally defined (evidence threshold or scope exhausted)", "Both stop when the token budget is exhausted", "There is no difference — both use end_turn" ], "answer_index": 1, "rationale": "In ReAct, the model decides when to stop by emitting end_turn. In the offensive loop, the stop condition is externally defined: enough evidence collected or every in-scope target assessed. The model does not decide when to stop." }, { "id": "Q15", "bloom": "analysis", "type": "multiple_choice", "prompt": "A team uses the same model instance to read target HTTP responses and decide the next action. What risk does this create, and what is the cure?", "options": [ "No risk — this is the standard pattern", "Risk: reader-actor collapse. An injection in target content directly controls the action-deciding model. Cure: separate Reader and Actor models; the actor sees only structured summaries", "Risk: the model uses too many tokens. Cure: increase the token budget", "Risk: the model becomes biased. Cure: add more system prompt instructions" ], "answer_index": 1, "rationale": "Reader-actor collapse is the anti-pattern where the same model ingests raw adversarial content and decides actions. An injection directly controls the harness. Cure: separate models, where the actor never sees raw target content." }, { "id": "Q16", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why does the attack graph store 'failed' nodes rather than deleting them?", "options": [ "For performance — failed nodes speed up future scans", "Failed nodes inform future hypothesis generation and plan correction. A failed exploit path is evidence; it tells the harness that approach does not work, guiding re-hypothesization (S03.2)", "For legal compliance — all actions must be logged", "Failed nodes are deleted in production; this is a debug-only feature" ], "answer_index": 1, "rationale": "Failed nodes are retained because they inform plan correction (S03.2 RedTeamLLM pattern). A failed exploit path tells the harness that approach does not work, guiding re-hypothesization. The attack graph is the harness's accumulated knowledge of what was tried." }, { "id": "Q17", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why is the approval gate at Level 2 NOT a performance bottleneck, despite adding latency to each action?", "options": [ "Because it runs in parallel with execution", "Because it is a legal control: it records a human decision for every legally sensitive action. The latency is the point — it is the difference between a defensible engagement and an indictment", "Because it can be disabled for speed", "Because it only applies to the first action" ], "answer_index": 1, "rationale": "The approval gate's function is legal, not performance. It records a human decision for every legally sensitive action. Removing it for speed gains is the most common production failure mode — it eliminates the documented human oversight that protects the operator." }, { "id": "Q18", "bloom": "analysis", "type": "multiple_choice", "prompt": "An offensive harness reads a target response suggesting a vulnerability. The model immediately formalizes it as a finding. What principle was violated, and what should happen instead?", "options": [ "No principle violated — target responses are authoritative", "Evidence cross-validation violated. The target can lie in responses. The harness must re-test the hypothesis independently before formalizing evidence", "Scope enforcement violated — the response was out of scope", "The autonomy level was too high" ], "answer_index": 1, "rationale": "Findings are never accepted from a single observation. The target is adversarial and can lie. The harness verifies by independent observation (re-testing the hypothesis) before formalizing it as evidence. This is evidence cross-validation." }, { "id": "Q19", "bloom": "analysis", "type": "multiple_choice", "prompt": "Why does the scope enforcement middleware stamp a scope_ref on every PERMITTED call, not just blocked ones?", "options": [ "For performance metrics", "The scope_ref is the evidence chain's legal anchor — it records which scope entry authorized each permitted call, producing 'authorization to the atom' that protects the operator if any action is questioned", "To help the model remember which targets are in scope", "For CVSS scoring" ], "answer_index": 1, "rationale": "The scope_ref stamp records: target::action::timestamp for each permitted call. It ties every tool call to the specific authorization that permitted it. If any call is questioned, the audit log reconstructs the full authorization chain." }, { "id": "Q20", "bloom": "analysis", "type": "multiple_choice", "prompt": "How does the offensive state machine differ from a general ReAct loop in its treatment of observations (tool outputs)?", "options": [ "Observations are discarded immediately in the offensive loop", "In ReAct, observations are trusted data for reasoning. In the offensive loop, observations are potentially adversarial inputs that need untrusted-tagging, sanitization, and cross-validation before the model acts on them", "The offensive loop does not use observations", "Both treat observations identically" ], "answer_index": 1, "rationale": "In a general harness, observations are trusted. In an offensive harness, observations are potentially hostile — they may contain injection payloads. The trust model inverts: every external read is tagged as untrusted, sanitized, and cross-validated before the model acts." } ] }