CyberCertPrepAI Security FundamentalsPrompt Injection & LLM AttacksEASYFree question
A developer asks: "We use OpenAI's API for our LLM app. Does that mean we don't need to worry about prompt injection since OpenAI handles security?" What is the CORRECT answer?
- A.A. Correct - API providers are fully responsible for all prompt injection risks
- B.D. Incorrect - prompt injection only affects open-source models, not API-based ones
- C.C. Correct - as long as you use an enterprise API plan, injection is prevented
- D.B. Incorrect - prompt injection is an application-layer vulnerability; the API provider supplies the model, but the developer is responsible for how untrusted content enters the prompt
Why D is correct
Prompt injection is an application design vulnerability, not a model or API vulnerability. No API provider can prevent an application from naively concatenating untrusted user content with privileged instructions. The developer controls the prompt construction, tool permissions, and output handling - all of which determine injection risk. Enterprise plans provide compliance features, not injection prevention. Open-source vs. closed-source is irrelevant to the attack surface.
Know someone studying for AI Security Fundamentals? Send them this one.