Free CY0-001 Questions for CompTIA SecAI+ Certification CY0-001 Exam as PDF & Practice Test Engine
A security consultant needs to detect attacks across a large language model (LLM) firewall.
Which of the following techniques should the consultant use?
Which of the following techniques should the consultant use?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Which of the following is the most concerning risk for a company that allows corporate end users to use public-facing large language models (LLMs)?
Correct Answer: D
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
A data scientist is working with unlabeled data and wants to build a clustering model.
Which of the following techniques should a data scientist use?
Which of the following techniques should a data scientist use?
Correct Answer: A
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Instructions: Use the drop-down menus to define two appropriate security controls for each component of the AI system. Each control may be used only once.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.
Correct Answer:
Explanation:
Basic Concept: This is a Performance-Based Question (PBQ) - a HOTSPOT/simulation item requiring interactive selection in the actual exam. It tests the candidate ' s ability to map appropriate security controls to AI system components such as API gateway, model endpoint, data layer, and authentication layer.
Key Concept - Appropriate Controls by Component: For an API gateway connecting an AI system, typical controls include API key authentication, rate limiting, TLS encryption, and input validation. For the model endpoint, controls include IAM role-based access, audit logging, and guardrails. For data access components, encryption at rest and data masking are appropriate. For the authentication layer, MFA and expiring session tokens are relevant.
Why This Matters: The CompTIA SecAI+ Study Guide emphasizes defense-in-depth for AI system integration, ensuring each architectural layer has dedicated, appropriate security controls. The principle of least privilege should guide access control assignments at each component, while availability controls such as rate limiting protect against abuse.
Reference: CompTIA SecAI+ Exam Objectives Domain 2 (Securing AI Systems) covers AI system component security controls. Candidates should study the mapping of controls to infrastructure components including API gateways, model serving endpoints, data stores, and identity management layers. In the live exam, select the most specific and directly relevant control for each component based on the component ' s function and risk profile.
A line of business wants to onboard an application that uses a custom AI model for employee assessments.
The Chief Information Officer (CIO) agrees to allow the engagement to proceed but first wants a threat model.
Which of the following is the most appropriate to use for an AI threat model?
The Chief Information Officer (CIO) agrees to allow the engagement to proceed but first wants a threat model.
Which of the following is the most appropriate to use for an AI threat model?
Correct Answer: B
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
A team of data scientists is ready to release a model for enterprise use. The team wants to protect the model from unintentional changes or tampering.
Which of the following is the most appropriate action?
Which of the following is the most appropriate action?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
A management team is concerned about an unexpected cost increase for a public-facing AI chatbot.
Which of the following should a security administrator examine first to determine the root cause?
Which of the following should a security administrator examine first to determine the root cause?
Correct Answer: A
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Which of the following attacks would be the best to automate with AI during dynamic application software testing (DAST)?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
A security administrator sees suspicious queries on AI logs.
Which of the following should the administrator implement to address this issue?
Which of the following should the administrator implement to address this issue?
Correct Answer: D
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
0
0
0
10