Download Exam CY0-001 Practice Test Questions with 100% Verified Answers
Share Latest CY0-001Test Practice Test Questions, Exam Dumps
NEW QUESTION # 27
Which of the following is used to train an AI model with unstructured data?
- A. Reinforcement training
- B. Statistical learning
- C. Fine-tuning
- D. Supervised learning
Answer: C
Explanation:
Basic Concept: Unstructured data such as free-form text, images, and audio does not have predefined labels or rigid schema. Training an AI model effectively on unstructured data requires techniques that can leverage patterns within the data itself or adapt a pre-trained model to new data types. CompTIA SecAI+ covers AI training methodologies under basic AI concepts.
Why B is Correct: Fine-tuning takes a pre-trained foundation model that has already learned rich representations from massive unstructured datasets and further trains it on a specific, potentially smaller unstructured dataset. This adapts the model to a new domain, task, or data type without requiring labeled data for every training example. Fine-tuning is the most practical and effective approach for working with unstructured data in modern AI development.
Why A is Wrong: Statistical learning typically refers to classical machine learning approaches that often assume structured, numerical data with defined features. These methods generally struggle with high- dimensional unstructured data without significant preprocessing.
Why C is Wrong: Supervised learning requires labeled training data where each example has an associated correct output label. Applying supervised learning to unstructured data requires extensive manual labeling, which is the opposite of working with raw unstructured data.
Why D is Wrong: Reinforcement learning trains models through reward signals based on actions taken in an environment. It is designed for sequential decision-making tasks and is not the standard approach for learning representations from unstructured data at scale.
NEW QUESTION # 28
A security operations center (SOC) analyst needs to automate multiple security tasks by breaking them down into smaller parts. Which of the following AI tools is the best for this task?
- A. Chatbot
- B. Generative AI
- C. Agentic AI
- D. Retrieval-augmented generation (RAG) AI
Answer: C
Explanation:
Agentic AI is designed to autonomously break down complex tasks into smaller steps and execute them in sequence. This makes it the best tool for automating multiple security tasks in a SOC environment.
NEW QUESTION # 29
A developer is selecting authentication controls for an AI system.
Which of the following is the best way to prevent threat actor replay attacks?
- A. Identity and access management access keys
- B. Secure Shell (SSH)-based certificate authentication
- C. Identity provider (IdP) federation
- D. Expiring session tokens
Answer: D
Explanation:
Basic Concept: A replay attack occurs when an attacker captures a valid authentication token or credential and reuses it to impersonate a legitimate user. Preventing replay attacks requires ensuring that captured credentials cannot be successfully reused after a defined period or after their intended single use. CompTIA SecAI+ Study Guide covers replay attack prevention under AI system authentication.
Why C is Correct: Expiring session tokens have a limited validity window, typically a few minutes to hours.
If an attacker captures a token, they can only use it until it expires. Short expiration times dramatically reduce the window of opportunity for replay attacks. This is the most direct and effective control specifically targeting replay attack prevention, as expired tokens are rejected even if intercepted.
Why A is Wrong: IdP federation enables single sign-on across multiple systems using federated identity providers. While it standardizes authentication, it does not inherently prevent replay attacks on captured tokens unless combined with short token expiration and proper validation.
Why B is Wrong: SSH certificate authentication uses cryptographic certificates for strong authentication.
While more secure than password-based SSH, certificates alone do not prevent replay attacks unless they include timestamps, nonces, or other anti-replay mechanisms that invalidate captured credentials.
Why D is Wrong: IAM access keys are long-lived credentials that provide programmatic access to services.
They are typically static and do not expire automatically, making them vulnerable to replay attacks if intercepted. They are less suitable for replay attack prevention than expiring session tokens.
NEW QUESTION # 30
Which of the following improves the observability and auditing of an AI system?
- A. Using manual detection
- B. Implementing machine learning operations (MLOps)
- C. Using anomaly detections
- D. Redeploying the model
Answer: B
Explanation:
MLOps provides structured monitoring, logging, and version control for AI models. This improves observability and ensures detailed auditing of model behavior, data pipelines, and changes throughout the AI lifecycle.
NEW QUESTION # 31
A security team is using an AI-based tool to try to bypass organizational boundaries. The team uses AI to look at the current state and suggest different attack vectors based on the outcome of the previous ones.
Which of the following techniques is the team most likely using?
- A. Fraud detection
- B. Manual signature matching
- C. Automated penetration testing
- D. Code quality testing
Answer: C
Explanation:
Basic Concept: Modern penetration testing increasingly leverages AI to automate the reconnaissance, exploitation, and pivoting process. AI-assisted automated penetration testing can adapt its strategy based on previous results, simulating intelligent adversary behavior more realistically than static scripts. CompTIA SecAI+ covers AI-assisted offensive security techniques.
Why D is Correct: Automated penetration testing uses AI to systematically discover and attempt to exploit vulnerabilities while adapting tactics based on the results of previous attempts. The described behavior - looking at the current state, suggesting attack vectors, and adjusting based on outcomes - precisely describes an adaptive AI-driven penetration testing tool that iteratively explores the attack surface, mimicking how an advanced persistent threat would operate.
Why A is Wrong: Manual signature matching compares network traffic or files against a database of known threat signatures. It is a passive detection technique used by defensive tools like IDS/IPS, not an adaptive offensive technique for bypassing organizational boundaries.
Why B is Wrong: Code quality testing analyzes source code for bugs, vulnerabilities, and adherence to coding standards. It is a development quality assurance activity, not an offensive security technique for testing organizational security boundaries.
Why C is Wrong: Fraud detection uses ML to identify suspicious patterns in transactions or user behavior for defensive purposes. It is a preventive security measure, not an offensive technique for penetration testing.
NEW QUESTION # 32
Which of the following is a key principle of responsible AI systems?
- A. Using protected data for training
- B. Ensuring transparency and explainability
- C. Operating with human-in-the-loop
- D. Maximizing model security
Answer: B
Explanation:
Basic Concept: Responsible AI encompasses a set of principles designed to ensure AI systems operate ethically, fairly, and accountably. These principles guide AI development and deployment to minimize harm and maximize trustworthiness. CompTIA SecAI+ Exam Objectives list transparency and explainability as foundational responsible AI principles under Domain 4.
Why B is Correct: Transparency and explainability are cornerstone principles of responsible AI. Transparency means AI systems are open about their nature, capabilities, limitations, and how they make decisions.
Explainability means the system can articulate the reasons behind its decisions in human-understandable terms. Together, they enable accountability, support regulatory compliance, allow bias detection, and build user trust. The CompTIA SecAI+ Study Guide and responsible AI frameworks including OECD and NIST AI RMF consistently identify this as a key principle.
Why A is Wrong: Using protected data for training would violate privacy and intellectual property rights.
This is not a responsible AI principle - responsible AI actually requires ensuring that training data respects privacy, consent, and legal protections.
Why C is Wrong: Human-in-the-loop is an important operational practice for high-stakes AI decisions, but it is one design pattern rather than the key overarching principle of responsible AI. Not all responsible AI systems require human-in-the-loop operation for every decision.
Why D is Wrong: Maximizing model security is a cybersecurity objective for AI systems. While important, it is an operational security concern rather than a responsible AI governance principle focused on fairness, accountability, and trustworthiness in AI decision-making.
NEW QUESTION # 33
What is the PRIMARY purpose of an MSSP for small businesses?
- A. Develop internal apps
- B. Perform required compliance audits
- C. Replace all internal IT
- D. Provide outsourced monitoring and threat detection
Answer: D
Explanation:
MSSPs specialize in outsourced security monitoring and alerting.
NEW QUESTION # 34
Which of the following helps in managing potential security issues related to model training?
- A. General Data Protection Regulation (GDPR)
- B. Organization for Economic Co-operation and Development (OECD)
- C. National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF)
- D. International Organization for Standardization (ISO) 27001
Answer: C
Explanation:
Basic Concept: Managing security risks in AI model training requires a comprehensive framework specifically designed for AI risk identification, assessment, and mitigation across the entire AI lifecycle including data collection, training, and deployment. CompTIA SecAI+ Study Guide identifies NIST AI RMF as the primary resource for AI-specific risk management.
Why A is Correct: The NIST AI Risk Management Framework is purpose-built for managing risks throughout the AI lifecycle. It provides structured guidance for identifying, assessing, and mitigating risks specific to AI systems including training data quality, model bias, data poisoning, and training pipeline vulnerabilities. Its AI-specific scope makes it the most appropriate framework for managing model training security issues.
Why B is Wrong: ISO 27001 is an information security management system standard focused on general IT security controls and risk management. It does not specifically address AI model training risks, data pipeline integrity, or ML-specific vulnerabilities.
Why C is Wrong: The OECD provides high-level AI governance principles and policy recommendations at an international level. It offers ethical and policy guidance but does not provide operational risk management guidance for securing AI model training processes.
Why D is Wrong: GDPR is a European data protection regulation focused on personal data privacy, consent, and individual rights. While relevant to training data governance, it does not address the technical security risks of model training pipelines or ML system vulnerabilities.
NEW QUESTION # 35
Which of the following responsible AI standards refers to a principle that clearly states the reasons behind the decisions for a particular conclusion?
- A. Accountability
- B. Auditability
- C. Transparency
- D. Explainability
Answer: D
Explanation:
Basic Concept: Responsible AI encompasses several key principles governing how AI systems should behave to be trustworthy and ethical. These principles are distinct but related. Understanding their precise definitions is essential for CompTIA SecAI+ Domain 4 governance questions.
Why D is Correct: Explainability in responsible AI means the AI system can clearly articulate the specific reasons, factors, and logic that led to a particular decision or output. It answers the question " why did the AI make this specific decision? " For example, an explainable credit scoring AI would not only give a score but also explain which factors such as payment history or credit utilization contributed most to that specific score.
This directly matches the question ' s description of " clearly stating reasons behind decisions. " Why A is Wrong: Accountability refers to the ability to identify who is responsible for AI system decisions and their consequences. It addresses ownership and responsibility assignment rather than explaining the reasoning behind specific decisions.
Why B is Wrong: Auditability refers to the ability to examine and verify an AI system ' s decisions, processes, and outputs through systematic review. It enables after-the-fact verification but does not mean the system itself explains its reasoning.
Why C is Wrong: Transparency refers to openness about how an AI system works at a general level, including its purpose, capabilities, limitations, and the data it was trained on. It is broader than explainability and does not specifically address articulating reasons for individual decisions.
NEW QUESTION # 36
Which of the following is an example of how a security analyst uses generative AI in the triage process?
- A. To summarize security findings by category
- B. To use statistical analysis for malicious code assessment
- C. To tag malware using machine learning (ML) algorithms
- D. To predict the next attack target with higher accuracy
Answer: A
Explanation:
In triage, generative AI is most effective for quickly summarizing and categorizing large volumes of alerts or findings. This helps analysts prioritize incidents and streamline the investigation process.
NEW QUESTION # 37
A vulnerability scan produces many false positives. What does this indicate?
- A. Low sensitivity, high specificity
- B. High sensitivity, low specificity
- C. High specificity, low sensitivity
- D. High confidence scoring
Answer: B
Explanation:
High sensitivity → catches many issues but lowers accuracy (more false positives).
NEW QUESTION # 38
A security analyst is preparing a presentation for the sales team that describes the most common vulnerabilities that are specific to AI applications.
Which of the following is the best source for the analyst to consult?
- A. Common Weakness Enumeration (CWE)
- B. International Organization for Standards (ISO) 27001
- C. National Institute of Technologies Risk Management Framework (NIST-RMF)
- D. Open Worldwide Application Security Project (OWASP)
Answer: D
Explanation:
Basic Concept: Identifying AI-specific application vulnerabilities requires consulting a resource that has cataloged and documented the unique vulnerability types that affect AI systems, particularly LLMs. Different security standards serve different purposes, and selecting the right reference for AI application vulnerabilities is essential. CompTIA SecAI+ Study Guide references OWASP for AI application vulnerability guidance.
Why C is Correct: OWASP maintains the OWASP Top 10 for Large Language Model Applications, which specifically catalogs the most critical and common vulnerabilities in AI applications including prompt injection, sensitive information disclosure, excessive agency, insecure output handling, and training data poisoning. This AI-specific vulnerability list is the most directly relevant and accessible resource for a presentation on AI application vulnerabilities.
Why A is Wrong: ISO 27001 is a general information security management system standard covering broad organizational security controls. It does not specifically catalog AI application vulnerabilities or LLM-specific weakness categories.
Why B is Wrong: CWE catalogues software weakness types at a code and design level for traditional software. While some weaknesses apply to AI systems, CWE does not have a dedicated AI application vulnerability taxonomy comparable to the OWASP LLM Top 10.
Why D is Wrong: NIST RMF is a risk management framework providing guidance for managing and reducing information security risk. It is a process framework, not a vulnerability catalog, and does not list specific AI application vulnerability types suitable for a vulnerabilities presentation.
NEW QUESTION # 39
Which of the following is most resistant to AI manipulation?
- A. Attack surface reduction
- B. Application programming interface (API) gateway
- C. Antivirus
- D. AI-generated content
- E. Payloads
Answer: A
Explanation:
Basic Concept: AI manipulation attacks exploit vulnerabilities in systems, interfaces, and content. Some security approaches are inherently more resistant to AI-driven attacks because they reduce the available avenues through which manipulation can occur, rather than attempting to detect or block individual attacks.
CompTIA SecAI+ Study Guide covers defensive strategies for AI system protection.
Why D is Correct: Attack surface reduction minimizes the number of entry points, interfaces, and components available for exploitation. By eliminating unnecessary services, APIs, integrations, and features, it reduces the total number of pathways through which AI-driven manipulation attacks can be attempted. Unlike signature- based or behavioral detection, attack surface reduction provides structural resistance regardless of how sophisticated or novel the AI manipulation technique is.
Why A is Wrong: Payloads are the malicious content used in attacks, not a defensive control. Attackers using AI can generate increasingly sophisticated payloads designed to evade detection, making them highly susceptible to AI-driven manipulation rather than resistant to it.
Why B is Wrong: AI-generated content is a product of AI systems and can itself be manipulated or weaponized by adversarial AI. It is not a defense mechanism and is inherently vulnerable to AI-driven manipulation and poisoning.
Why C is Wrong: An API gateway provides a managed access point for API traffic with authentication and filtering capabilities. However, APIs are primary attack targets for AI manipulation and require ongoing security updates. API gateways are less fundamentally resistant than structural attack surface reduction.
Why E is Wrong: Antivirus relies on signatures and behavioral heuristics to detect known malware. AI- powered attacks can generate novel, polymorphic payloads that evade signature detection, making antivirus less resistant to AI manipulation than attack surface reduction.
NEW QUESTION # 40
Which of the following is required first in order to send a prompt query and response in a language model (LLM) system when authentication is enabled?
- A. Endpoint access control
- B. Front-end web proxy gateway
- C. Application programming interface gateway
- D. Back-end access gateway
Answer: A
Explanation:
When authentication is enabled, the first requirement for sending a prompt query and receiving a response is endpoint access control. It ensures only authenticated and authorized users or systems can interact with the LLM endpoint.
NEW QUESTION # 41
A web server shows signs of SQL injection. Which control BEST prevents this?
- A. SSL encryption
- B. Input validation
- C. Account lockout
- D. Runtime application self-protection (RASP)
Answer: B
Explanation:
Validating and sanitizing user input is the core SQLi defense.
NEW QUESTION # 42
Which log type is MOST useful for detecting DNS tunneling?
- A. Netflow logs only
- B. Firewall allow logs
- C. Authentication logs
- D. DNS query logs
Answer: D
Explanation:
DNS logs reveal abnormal query lengths and frequencies typical of tunneling.
NEW QUESTION # 43
During an update, an AI system flags some potential compatibility issues and provides recommendations. An administrator reviews the recommendations before addressing the issues.
Which of the following processes describes this scenario?
- A. Model evaluation
- B. Data validation
- C. Data preparation
- D. Human-in-the-loop
Answer: D
Explanation:
Basic Concept: Human-in-the-loop is a design pattern where AI systems generate recommendations or decisions but require human review and approval before those recommendations are acted upon. This approach maintains human oversight and accountability in AI-assisted workflows. CompTIA SecAI+ Study Guide covers human-in-the-loop as a key responsible AI principle and operational pattern.
Why C is Correct: The scenario precisely describes the human-in-the-loop pattern: the AI system identifies potential issues and provides recommendations, but an administrator must review those recommendations before any action is taken. This deliberate inclusion of human judgment in the AI ' s decision or recommendation workflow ensures human oversight is maintained, which is the defining characteristic of the human-in-the-loop process.
Why A is Wrong: Data validation verifies that data meets expected quality standards and formats before being used in AI processing. It is a data quality control activity, not a workflow pattern describing human review of AI recommendations.
Why B is Wrong: Data preparation involves transforming raw data into a format suitable for AI model training or inference. It encompasses cleaning, normalizing, and formatting data, not the process of human review of AI-generated recommendations during system updates.
Why D is Wrong: Model evaluation assesses a model ' s performance against metrics such as accuracy, precision, and recall on test datasets. It is a technical assessment of model quality, not a workflow process where humans review AI-generated recommendations before acting on them.
NEW QUESTION # 44
A short AI-generated video shows a celebrity's likeness talking about a fake public security event.
Which of the following was used to create this video?
- A. Random forest
- B. Statistical analysis
- C. Machine learning (ML) classifier
- D. Convolutional neural network
Answer: D
Explanation:
Convolutional neural networks (CNNs) are commonly used in generating deepfake videos, where a person's likeness is realistically mapped and animated to create fake but convincing audiovisual content.
NEW QUESTION # 45
A social media company with more than a million lines of code wants to reduce the mean time to fix bugs and issues. Which of the following is the most balanced AI strategy to automate the vulnerability management flow?
- A. Using AI to triage discovered issues, create tickets, and merge software fixes
- B. Using AI to triage discovered issues and create tickets, but having a software engineer merge software
- C. Having security analysts triage discovered issues and create tickets, but having a software engineer merge software
- D. Having security analysts triage discovered issues and create tickets, but using AI to merge software
Answer: B
Explanation:
This approach balances automation and human oversight. AI accelerates vulnerability management by triaging issues and generating tickets, while software engineers retain responsibility for merging code changes, ensuring quality and reducing the risk of insecure or unstable code being deployed.
NEW QUESTION # 46
A company develops an AI model to diagnose patients. Hospitals access the model through an integrated application programming interface (API). The security team performs a denial-of-service (DoS) attack via brute force on the model.
Which of the following controls would have prevented this issue?
- A. Prompt firewall
- B. Model guardrails
- C. Tokenization
- D. Rate limiting
Answer: D
Explanation:
Basic Concept: API-based AI systems are susceptible to DoS attacks where excessive requests overwhelm the system ' s ability to respond to legitimate users. Rate limiting is the standard control for preventing both intentional and unintentional API abuse. CompTIA SecAI+ Study Guide covers rate limiting as a key availability control for AI APIs.
Why C is Correct: Rate limiting restricts the number of requests a client can make to an API within a defined time window. In this scenario, a brute-force DoS attack works by sending a massive volume of requests to exhaust the model ' s resources. Rate limiting would have automatically throttled or blocked the excessive request volume, preventing the attack from succeeding and preserving service availability for legitimate hospital users.
Why A is Wrong: Tokenization replaces sensitive data values with non-sensitive placeholders. It is a data security control for protecting sensitive information such as patient identifiers, not a control for managing API request volumes or preventing DoS attacks.
Why B is Wrong: Model guardrails filter and constrain model inputs and outputs for safety and policy compliance. They inspect content quality, not request volume, and cannot prevent a volume-based DoS attack.
Why D is Wrong: A prompt firewall inspects the content of prompts for malicious patterns or policy violations. Like guardrails, it analyzes content rather than controlling request frequency and cannot prevent resource exhaustion from a high-volume brute-force attack.
NEW QUESTION # 47
A machine learning (ML) engineer is working with a security engineer to identify the best practices for securing a system with various AI models.
Which of the following actions should the engineers suggest?
- A. Conducting guardrail testing and security validation
- B. Implementing comprehensive security architecture
- C. Using a secure software development life cycle (SDLC)
- D. Following a secure model development life cycle (MDLC)
Answer: D
Explanation:
A secure MDLC is tailored to AI and ML systems, ensuring security is integrated throughout the model's design, training, validation, deployment, and monitoring phases. This directly addresses best practices for securing systems with AI models.
NEW QUESTION # 48
A line of business wants to onboard an application that uses a custom AI model for employee assessments.
The Chief Information Officer (CIO) agrees to allow the engagement to proceed but first wants a threat model.
Which of the following is the most appropriate to use for an AI threat model?
- A. International Organization for Standardization (ISO)
- B. Organization for Economic Co-operation and Development (OECD)
- C. Adversarial Threat Landscape for AI Systems (ATLAS)
- D. Responsible AI
Answer: C
Explanation:
Basic Concept: Threat modeling for AI systems requires a framework specifically designed to address AI- specific attack techniques, tactics, and procedures. General cybersecurity or governance frameworks do not capture the unique adversarial attack surface of AI and ML systems. CompTIA SecAI+ Exam Objectives identify MITRE ATLAS as the primary AI threat modeling resource.
Why B is Correct: MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is specifically designed as an AI and ML threat modeling framework. It catalogs real-world adversarial tactics, techniques, and procedures targeting AI systems, enabling security architects to identify and assess threats unique to ML models such as data poisoning, model extraction, and evasion attacks. It is the industry standard for AI- specific threat modeling.
Why A is Wrong: Responsible AI is a set of ethical principles and governance guidelines for developing and deploying AI systems fairly and safely. It addresses ethics and fairness, not technical adversarial threat modeling.
Why C is Wrong: The OECD provides non-binding policy recommendations and principles for AI governance at an international level. It does not provide technical threat modeling taxonomies or AI-specific attack catalogs.
Why D is Wrong: ISO standards such as ISO 42001 establish management system requirements for AI governance. They are compliance and management frameworks, not threat modeling tools for identifying adversarial AI attack vectors.
NEW QUESTION # 49
......
Positive Aspects of Valid Dumps CY0-001 Exam Dumps!: https://actualtests.testinsides.top/CY0-001-dumps-review.html