Practise the decision. Understand the answer.
Pick a topic, or mix them all, then a difficulty and a test length. Items are compact security scenarios: spot the trust boundary, pick the right control, judge a claim. Each answer comes with an explanation and a link to the complete worked question. New tests favour items you have not seen. Use the explanations to understand your mistakes before trying again.
Two sample items
Two items straight from the bank, shown with their answers. During a test you only see the explanation after choosing.
Prompt Injection & Jailbreaks · easy · sampleAn assistant summarizes customer tickets. Which event indicates an attempted prompt injection?Reveal the options and the answer →
The ticket author supplies task material and cannot grant access to another customer. That attempted authority change is the relevant signal; an actual forbidden read still needs evidence. Legitimate task instructions and quoted commands are not automatically attacks. Check source role, current grant and observed consequence.
Agent, Tool & MCP Security · easy · sampleWhat three things make up the lethal trifecta for AI agents?Reveal the options and the answer →
The combination identifies a possible confidentiality failure: untrusted input may influence how private data leaves the system. Verify the actual data path and enforcement points. Removing one capability closes this route only if alternate tools, rendering and agent handoffs do not restore it.
17 topics, three tiers
Easy items test vocabulary and direct reasoning. Medium items apply a mechanism to a concrete system such as an agent, a retrieval pipeline or an OAuth flow. Hard items reach the less obvious consequences: a control that fails open, a naive check that is easy to bypass, a metric that gives the wrong picture. Because every topic maps to its own questions and lessons, a weak score tells you exactly where to read.
Where practice tests fit
First: the assessment
The free assessment touches every one of the 17 topics and turns your misses into a study plan.
Take the assessment →Then: repeated drills
In learn mode each explanation appears straight after you answer; in exam mode they all wait until you submit. Read the score as a test of recognition only: choosing the right option is far easier than threat-modeling an agent or defending a design to a panel.
Finally: the worked answers
Every explanation points to its source lesson or question. There are 614 fully worked questions and 147 concept lessons to go deeper with.
Open the question library →Practice test FAQ
- What can I run without paying?
- Sign in for free and you can take easy tests in every topic, up to 20 items at a time, with all explanations. Premium unlocks medium and hard items, adaptive sessions and tests of up to 100 items.
- Do repeat tests reuse the same items?
- Only after you have seen everything. Your browser keeps track of answered items and serves new ones first; repeats begin when a topic and difficulty have no unseen items left. The bank currently holds 806 items.
- Assessment or practice test: which first?
- Start with the assessment, which looks across all 17 topics once and builds a study plan from what you got wrong. Then use practice tests to go deep on one topic with many items and a score to beat next time.
- Which topics are in the bank?
- The 17 topics of the AI security curriculum: Security Foundations & Threat Modeling, Systems, OS & Memory Safety, Network Security & Protocols, Cryptography, PKI & TLS, Identity, OAuth & Access Control, Application & API Security, Mobile Application Security, Cloud, Container & AI Infrastructure Security, Software, Data & Model Supply Chain, Detection Engineering & Incident Response, How LLM Systems Work, Prompt Injection & Jailbreaks, LLM Application Security, Agent, Tool & MCP Security, Adversarial ML & Model Privacy, AI Red Teaming, Evaluation & Response, AI Governance, Risk & Compliance.