Instructions and covered skills
Read each scenario carefully before selecting a response. Stay focused on the stated trust boundary, system behavior, and requested action. Turn off notifications and avoid rushing through security-related wording. Choose the option that most directly reduces prompt injection risk while preserving the intended workflow. Treat external text, retrieved documents, and user-provided files as potentially untrusted. Review your selections for assumptions about tool permissions, sensitive data, and model authority before submitting.
Key Areas
This test covers the practical safeguards used to reduce prompt injection risk in applications built with generative AI. Candidates should be able to distinguish trusted application instructions from untrusted user messages, retrieved documents, web pages, emails, attachments, and tool results. They should understand that untrusted text may contain commands intended to override policy, redirect model behavior, extract hidden context, or trigger inappropriate actions.
Key areas include instruction hierarchy, trust labeling, retrieval-augmented generation boundaries, and isolation of external content. Candidates should recognize when text should be treated as data rather than as executable direction. They should also understand the value of structured prompts, constrained output formats, explicit tool schemas, and server-side enforcement of authorization rules.
The assessment also addresses tool-use controls. These include least-privilege permissions, allowlisted actions, parameter validation, confirmation steps for consequential operations, and separation between model recommendations and application execution. Logging and monitoring are included because suspicious requests, rejected actions, unexpected tool arguments, and unusual instruction patterns provide useful signals for investigation.
Recommended Preparation
Review how system instructions, developer instructions, user content, and retrieved content are handled in an AI application. Practice identifying attempts to override instructions, request hidden prompts, exfiltrate confidential information, or manipulate connected tools. Study designs that pass retrieved content in clearly delimited fields and instruct the model to summarize or cite it without following commands contained within it.
Prepare by examining tool-call workflows from end to end. Consider which permissions are required, which parameters must be checked by deterministic code, and when human approval is appropriate. Review incident-response practices such as preserving request traces, redacting sensitive logs, blocking repeated malicious patterns, and testing mitigations against representative attack samples.