Week 10 self-check | AI GRCA Practice Lab

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

Why might an outdated document being used in a chatbot's answer be worse than the chatbot admitting it doesn't know?

It isn't worse — outdated confident answers are always preferableA confidently outdated answer can mislead a user into acting on wrong information without any signal that verification is neededUsers always check the document date themselvesStale information is never actually a real risk

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

'Source quality' as a RAG risk refers to:

How fast a document loadsWhether the underlying documents being retrieved are accurate, current and trustworthyThe visual design of the source documentOnly the file format used

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

A cited source doesn't actually support the claim made in the answer. This is a failure of:

Database rightsPurpose limitationData minimisationGrounding and citation traceability

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

'Overreliance' as an LLM risk means:

A synonym for prompt injectionThe model is used too rarelyUsers trusting AI-generated output without appropriate scrutiny or verificationThe model requires too much compute

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

Between a small, single-purpose model and a large, general-purpose model, which factor most matters for a narrow, well-defined task?

A smaller, purpose-built model can often perform as well or better on a narrow task with lower cost and easier evaluationSmall models cannot be evaluated for accuracyLarge models are always cheaper to runAlways choose the largest model regardless of task

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

In LLM application architecture, what's the difference between a system prompt and a user prompt?

The system prompt sets persistent behaviour/instructions set by the application; the user prompt is the live input from the person using itUser prompts are always hidden from the modelSystem prompts are only used in RAG systemsThey are identical and interchangeable

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

Why is 'source traceability' particularly important in a compliance or legal RAG use case?

Traceability only matters for marketing contentTraceability is irrelevant to compliance workBeing able to trace a stated conclusion back to a specific authoritative source is often essential for defensibilityCompliance use cases never require citations

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

A vector database returns technically similar but contextually wrong content for a query. What RAG risk does this best illustrate?

Toxic outputFine-tuning failureAccess-control failureIncorrect retrieval, where similarity doesn't guarantee true relevance