70 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
What is the appropriate first design step for introducing generative AI to internal support?
Answer: Define target users, business outcomes, and tolerated errors
Defining the use case, affected people, success and failure criteria, and risk tolerance provides a basis for model, RAG, and human-review choices.
What baseline helps keep instructions distinct from user input and retrieved documents in a prompt?
Answer: Use roles and delimiters and state how quoted data is handled
Explicit instruction hierarchy and data boundaries clarify intent, though delimiters alone cannot fully prevent prompt injection.
Which parameter is commonly adjusted first to reduce output variability for the same prompt?
Answer: Set a lower temperature value
Lower temperature reduces sampling randomness but does not guarantee full determinism; critical workflows also need schema and deterministic validation.
Is a JSON-looking LLM response safe to pass directly to a downstream API?
Answer: Use schema constraints and still validate in the app
Even with structured-output features, validate types, ranges, business rules, and authorization in application code before execution.
Which design reduces hallucination impact when answering questions about internal policies?
Answer: Retrieve approved documents, cite them, and abstain when unsure
Combine grounding, source display, and abstention when evidence is insufficient, escalating consequential decisions to humans.
Why consider RAG before fine-tuning for frequently updated private company knowledge?
Answer: Knowledge is easy to update and access-controlled evidence can be supplied
RAG manages knowledge in an external index, supporting updates, citations, and retrieval filtered by user authorization.
What is a primary use of embeddings?
Answer: Turn text into vectors to search by semantic similarity
Embeddings encode semantic features for similarity search and clustering. Authorization filters and sensitivity controls remain separate.
What is an appropriate way to choose chunk size for RAG?
Answer: Consider document structure and compare sizes by retrieval evaluation
Oversized chunks add noise; undersized chunks lose context. Compare recall, precision, answer quality, and cost on representative queries.
Which retrieval approach supports both exact product-code matches and natural-language semantic search?
Answer: Hybrid search combining keyword and vector retrieval
Lexical retrieval excels at identifiers and exact terms, while vector retrieval captures semantic similarity. Evaluate score fusion and filters.
After broad first-stage retrieval, what technique can improve relevance of the top context?
Answer: Rerank candidates with a cross-encoder or similar
A reranker scores query-candidate pairs more precisely, improving ordering at additional latency and cost, so bound the candidate set.
What is the most important access design for internal RAG where document permissions differ by department?
Answer: Filter retrieval by user identity and ACL and authorize at the source
Unauthorized content should never enter model context. Keep ACL metadata and deletions synchronized when updating the index.
How should a team distinguish retrieval failures from generation failures in RAG?
Answer: Evaluate retrieval recall and answer groundedness separately
Separating whether gold evidence was retrieved from whether it was used correctly identifies whether to improve indexing, retrieval, prompting, or the model.
Which evaluation dimension measures whether an answer is supported by the supplied context?
Answer: Groundedness
Groundedness checks whether claims are supported by evidence. Evaluate it separately from correctness, relevance, and completeness.
What makes an appropriate evaluation dataset before production release?
Answer: Versioned representative queries, adversarial inputs, and expected answers
Maintain a dataset reflecting real traffic and risks, and run it as a regression gate for model, prompt, and index changes.
What is an appropriate caution when using an LLM as a judge?
Answer: State rubrics, calibrate against human labels, and monitor bias
Judge models have biases and variance. Validate against human gold labels and consider multiple judges and blinded comparisons.
What is a safe implementation when a model selects external functions through tool calling?
Answer: Use allowlisted tools with server-side authorization and validation
Treat model output as a proposed plan. A deterministic dispatcher validates tool name, arguments, user permissions, and rate limits.
An agent only summarizes documents. Which tool permission design is appropriate?
Answer: Read-only access to the required documents only
Avoid excessive agency by minimizing functionality, permissions, and autonomy to what the task actually requires.
An agent can propose payments or production deletions. What control is appropriate before execution?
Answer: Show the change and impact and require explicit approval by an authorized person
Use human-in-the-loop and separation of duties for irreversible or high-impact actions. Bind approval to exact action details and reapprove changes.
Agent retries created the same order twice. What should improve in the tool API?
Answer: Implement idempotency keys, duplicate detection, and explicit result states
Agent orchestration retries after ambiguous timeouts. Make side-effect APIs idempotent so one intent is applied only once.
A web-summarization agent obeyed text in a page saying to send secrets. What is this?
Answer: Indirect prompt injection through untrusted content
Treat retrieved content as data rather than instructions. Layer least privilege, instruction-data separation, output checks, and human approval.
How should LLM-generated HTML be handled before displaying it in a browser?
Answer: Escape it as untrusted output and apply controls such as CSP
Generated output may contain attack payloads or unsafe code. Use context-appropriate encoding, sanitization, and allowlists.
What data design is appropriate before sending customer-support transcripts to an external model API?
Answer: Minimize to what is needed, redact PII, and check provider terms
Apply purpose limitation, minimization, redaction, and review contractual retention, region, and access controls before transmission.
What is an appropriate policy for storing prompts and responses in AI request logs?
Answer: Log structured fields, redact sensitive values, and limit retention
Prompts and responses may contain sensitive data. Define required metadata and sampling, with redaction, encryption, retention, and audit controls.
A multi-tenant AI service exposed tenant A's RAG document to tenant B. What is the core prevention?
Answer: Isolate indexes, caches, and logs at the tenant boundary
Derive tenant identity from trusted authentication and propagate it through every data path. Post-retrieval prompt filtering is insufficient.
Model API rate limits cause cascading failures during traffic spikes. What design is appropriate?
Answer: Use concurrency limits, queues, and bounded retries with backoff
Backpressure and retry budgets protect both provider and service. Also design async processing, priority, fallback, and explicit degraded responses.
What is a critical consideration when caching LLM responses?
Answer: Include tenant, permissions, versions, and TTL in the key
AI caches risk data leakage and stale answers. Account for security context and all input versions, with invalidation and encryption.
Simple classification and complex analysis have different cost and latency needs. What model-selection design fits?
Answer: Use an evaluated router that prefers small models and escalates hard cases
Choose the smallest model meeting each task's quality gate to reduce cost and latency, and evaluate routing mistakes.
How should a service maintain minimum functionality during a primary model-provider outage?
Answer: Combine timeouts and circuit breakers with a degraded mode
Pre-evaluate fallback quality and safety, disclose degraded behavior, and verify data residency and API differences.
How should a P95 latency SLO be designed for an AI chat system?
Answer: Break down retrieval, reranking, model, and tools and allocate budgets
AI chat latency is the sum of retrieval, reranking, model generation, tools, and queueing. Allocate the end-to-end SLO across stages and measure time to first token separately from completion.
What metric design helps understand generative-AI unit economics?
Answer: Cost per successful task alongside quality
Aggregate token, retrieval, tool, and infrastructure cost per successful business outcome, and track it with quality and latency to optimize without eroding value.
Which observability design best supports root-cause analysis for an AI agent?
Answer: Correlate traces per request and record versions
Generative-AI failures span retrieval, prompts, models, and tools. Correlated traces with prompt, model, index, and tool versions make failures diagnosable.
What is an appropriate way to detect quality degradation in a production RAG system?
Answer: Continuously measure groundedness and success and correlate with corpus changes
Answer quality can fall while HTTP requests still succeed. Combine golden-set checks, sampled review, and user signals, correlated with data, index, prompt, and model changes.
Which release-management practice improves reproducibility and rollback of AI responses?
Answer: Version prompts, models, and indexes and link them to evaluations
AI behavior depends on many artifacts beyond code. Version the full release configuration with evaluation evidence to support staged rollout and rollback.
How should user thumbs-up/down feedback be used for improvement?
Answer: Collect context and reasons, screen for bias, and use it as evaluation candidates
Feedback contains selection bias, possible manipulation, and ambiguous intent. Review it with context and first use it for failure analysis and evaluation-set improvement.
Which principle is appropriate for generative-AI content-safety design?
Answer: Classify risk and layer input/output guardrails with human review
Safety has false-positive and false-negative tradeoffs. Use risk-tiered policy and layered controls, evaluating refusal quality, bypass rates, and appeals.
How should fairness and accessibility be evaluated for a multilingual AI assistant?
Answer: Measure quality by language, region, and assistive tech with stakeholder review
Aggregate averages can hide severe subgroup failures. Combine representative test sets with qualitative review, checking task success and harmful disparities beyond translation fluency.
Which control should be prepared first for an incident where an AI agent starts making incorrect external-system changes?
Answer: A kill switch for tool execution and credential revocation
For an agent incident, first contain capabilities and credentials while preserving evidence. Then roll back changes, notify affected users, analyze root cause, and improve controls.
How should model, dataset, and library supply-chain risks in an AI system be managed?
Answer: Inventory provenance, licenses, and hashes and use only approved artifacts
AI artifacts carry tampering, malware, licensing, data-provenance, and vulnerability risks. Pin sources, verify integrity, evaluate in isolation, and monitor updates.
When is fine-tuning an appropriate choice?
Answer: When enough quality examples exist to stabilize repeated formats or behavior
Fine-tuning suits task-behavior adaptation, but it does not replace fresh knowledge retrieval or security boundaries. Compare quality, safety, and cost against a baseline on a holdout set.
Which lifecycle design is appropriate for generative-AI risk management?
Answer: Keep governing, measuring, and managing with owners through retirement
Generative-AI risk changes with models, data, usage, and the external environment. Define owners and risk tolerance and manage continuously from pre-deployment through monitoring, major changes, incidents, and retirement.
A public benchmark's questions and answers leaked into prompt optimization or fine-tuning data. What is the primary way to restore evaluation credibility?
Answer: Build a provenance-tracked unseen holdout set and keep it separate
Keep evaluation items isolated from optimization and track lineage plus exact and near-duplicate checks so the test measures generalization to unseen data.
Models A and B differ only slightly and their outputs are stochastic. Which comparison method is appropriate for release decisions?
Answer: Run the same set repeatedly and inspect variance and confidence intervals
Repeat stochastic evaluations, compare paired outputs on the same items, and quantify uncertainty. Require a predefined practically meaningful gain, not merely a tiny statistical difference.
Normal evaluations pass, but policy evasion by malicious users must be assessed before release. Which activity fits?
Answer: Run threat-model-driven red teaming including multi-step attacks
Red teaming explores adversarial paths that structured evaluations can miss. Convert findings into regression cases and track mitigations across permissions, output handling, and monitoring.
A provider model-version update may change behavior. Which release method is safest?
Answer: Pin the version, evaluate, then roll out by canary
Version the model, prompt, and safety configuration, then validate gradually on real traffic after offline evals. Roll back on quality, safety, latency, or cost guardrail breaches.
A healthcare process assistant gives definitive answers even when evidence is insufficient. What is the central risk-reduction design?
Answer: Require evidence conditions and escalate to a person when unmet
High-impact use cases need explicit answerability criteria and escalation paths. Validate confidence calibration rather than trusting a model's self-reported certainty.
Documents received from external partners are automatically indexed for RAG. Which data-poisoning control is appropriate?
Answer: Authenticate sources, inspect content, approve, and use a quarantine index
Treat ingestion as a trust boundary, recording source, reviewer, hash, and version before promotion. Preserve tenant and authorization filters plus citations at retrieval time.
A retired internal policy still appears in RAG answers because old chunks remain searchable. Which update design is appropriate?
Answer: Track source IDs and validity and propagate updates and deletions
A RAG index needs update, tombstone, and delete lifecycle operations, not append-only ingestion. Track source-to-chunk lineage and stale-hit metrics.
An embedding model must change, but old and new vectors are not comparable in one space. Which migration is safe?
Answer: Re-embed into a versioned index and switch after evaluation
Embedding space depends on model version. Backfill a new index, compare recall, latency, and cost on the same retrieval eval, then switch an alias with rollback available.
In a long conversation, important system instructions or recent user constraints fall out of the context window. Which mitigation is appropriate?
Answer: Manage token budgets by layer with retention priority and summaries
Prioritize system and safety instructions, the current task, and required evidence. Compress older conversation into validated summaries or memory and evaluate boundary cases.
While a streamed answer is being displayed, later content is classified as prohibited. Which design is safer?
Answer: Inspect output per chunk and support stop and replacement
Streaming trades latency against delayed safety decisions. Choose buffering by risk and design incremental checks, emergency stop, safe completion, and handling of already displayed content.
After a required field was added to a tool API, older prompts and models still generated the previous argument shape. Which compatibility design is appropriate?
Answer: Version the schema, validate at the boundary, and migrate in stages
Treat tool contracts like normal APIs: validate model output against a versioned schema and test old/new migration, defaults, errors, and rollback.
One slow external agent tool consumed all request workers and caused a cascading failure. Which resilience design is appropriate?
Answer: Use per-tool timeouts, concurrency limits, and circuit breakers
Give each external tool a latency budget and bulkhead, retry only transient failures with bounded jitter, and degrade to partial answers or human handoff.
An agent stored an attacker's instruction to redirect future payments in long-term memory. What is the core prevention?
Answer: Make memory writes authorized with validated source and TTL
Agent memory is a new trust boundary. Enforce write criteria, tenant and user scope, provenance, expiration, deletion, and restrictions on use for consequential actions.
After a person approved an agent's payment proposal, the amount and destination changed before execution. What is the safe execution condition?
Answer: Bind approval to the payload and expiry and reapprove after changes
Bind human approval to the exact action payload to prevent time-of-check/time-of-use changes. Invalidate approval when amount, destination, authority, or expiry changes.
A support AI confidently continues handling exception cases outside policy. Which human-handoff design is appropriate?
Answer: Define escalation criteria and hand off a summary and evidence to a person
Use out-of-policy, low-confidence, repeated failure, high-impact, and user-requested triggers. Transfer minimum necessary context to an authorized queue with clear ownership.
Automated high-volume queries attempt model extraction and cost exhaustion. Which layered mitigation is appropriate?
Answer: Combine per-identity quotas, anomaly detection, throttling, and cost alerts
Control unbounded consumption at the application layer. Combine identity, tenant, IP, and API-key signals, limit anomalous patterns, and enforce budget ceilings.
To hide implementation details, database passwords and authorization rules exist only inside the system prompt. What is the correct improvement?
Answer: Move secrets to a store and enforce authorization in the app layer
A system prompt is neither a secret boundary nor an authorization engine. Store credentials in a vault and validate authenticated identity and policy when tools execute.
A team claims watermarking generated images completely solves misinformation and provenance. Which explanation is appropriate?
Answer: It is one signal; robustness and verification are also needed
Content provenance helps assess origin but does not prove truthfulness. Evaluate metadata stripping, re-encoding, unsupported tools, and false positives and negatives.
In a multi-agent system, a planner executed another agent's task result directly as a tool command. Which trust design is appropriate?
Answer: Validate identity and schema and separate data from commands
Treat inter-agent messages as external input. Validate sender identity, capability, tenant, and provenance, then reauthorize with least privilege at the actual tool boundary.
A generative-AI incident must be reproduced and analyzed while protecting personal data in prompts. Which evidence design is appropriate?
Answer: Store versions and decisions minimized and redacted with retention limits
AI incidents require reproducible configuration lineage and traces. Because prompt content can be sensitive, use purpose-specific minimization, tokenization, access auditing, legal hold, and deletion schedules.
A RAG query has four relevant documents in its ground-truth set. The top five results contain three of them with no duplicates. What is Recall@5?
Answer: Three of four relevant documents were found, so it is 75%.
Recall@5 is the fraction of relevant documents found in the top five: 3/4=75%. The 3/5 ratio is Precision@5.
A RAG answer links to a real internal document, but that document does not state the amount claimed. What citation check is needed?
Answer: Check whether the cited passage actually supports the answer's claim.
A real source is not necessarily supporting evidence. Compare amounts and applicable conditions with the cited passage and correct or withhold unsupported claims.
A pricing-table PDF is ingested into RAG, but extraction keeps numbers while losing the monthly-price heading and the thousand-yen unit. What should be fixed first?
Answer: Preserve table structure, headings, and units during ingestion.
Retrieval cannot reliably recover meaning lost at ingestion. Preserve table structure and units so chunks remain interpretable, then validate extraction on representative tables.
Overlapping RAG chunks dominate the top results, filling context with nearly identical text and excluding other evidence. What is a suitable improvement?
Answer: Deduplicate context and evaluate evidence diversity and quality.
Overlap can preserve context at boundaries but also consume the context budget redundantly. Revisit chunking and candidate deduplication while checking that distinct necessary evidence remains.
An LLM judge often changes its preferred answer when two candidates are shown in reverse order. How should the evaluation be improved?
Answer: Swap order, inspect disagreements, and compare with human review.
Position bias may be influencing the judge. Randomize or swap order and compare with explicit rubrics and human judgments; order balancing alone does not eliminate every bias.
Out of 100 cases, the old system answered 80 with 72 correct; the new one answers 20 with 19 correct and abstains on the rest. What is missing from reporting only an accuracy rise from 90% to 95%?
Answer: Also report answer coverage falling from 80% to 20% and assess requirements.
Accuracy among answered cases and coverage are different metrics. Abstention can reduce wrong answers while reducing usefulness; evaluate both against risk and service requirements.
A multilingual RAG service checks only character counts and exceeds model context limits for some languages. What is an appropriate budget design?
Answer: Budget all input and output using the target model's token rules.
Character-to-token ratios vary by language and tokenizer. Budget according to the target model's limits, including its output and any other counted tokens, while preserving required instructions.
An agent repeatedly searches and replans. Individual calls do not time out, but total cost keeps growing. Which control is needed?
Answer: Bound total steps, time, and cost per task and stop when limits are reached.
Per-call limits cannot stop endless successful calls. Enforce task-level budgets outside the model and define how to report incomplete work or hand it over.
A team proposes publishing embeddings derived from confidential documents because they are not the original text. What is the appropriate judgment?
Answer: Assess inference risks and protect embeddings according to the source data.
Embeddings are not inherently anonymized or encrypted. Assess inference and retrieval leakage risks and include them in access, retention, and deletion controls.
An internal RAG user loses access to a document, yet a cached answer created earlier still reveals its contents. What should change?
Answer: Apply current authorization to cached answers and design invalidation or revalidation.
A cache must not bypass authorization. Track source dependencies or permission versions and invalidate or reauthorize after changes. Avoid sharing sensitive cached answers when dependencies cannot be enforced safely.