CY0-001 CompTIA SecAI+ v1 Exam Questions and Answers

Basic Concept: System prompt injection — where an unauthorized party modifies the AI system ' s core instructions — represents a serious integrity attack. Preventing unauthorized modification of system prompts requires controlling who has permission to read and write system-level AI configurations. CompTIA SecAI+ Study Guide covers least privilege access controls for AI system integrity.

Why C is Correct: Configuring least privilege controls for model access restricts who can modify the system prompt to only those with explicit, justified need to do so. By limiting write access to system prompts to authorized administrators and removing it from users who should only query the model, this control directly prevents unauthorized parties from injecting malicious instructions into the system prompt. Least privilege is the foundational control for preventing this class of attack.

Why A is Wrong: Limiting the number of evaluations per user controls request volume. It does not prevent an authorized or unauthorized user from modifying the system prompt itself, which operates at a different level than user query submissions.

Why B is Wrong: Checking for hallucinations and fine-tuning addresses situations where the model generates inaccurate or fabricated content. The described scenario is not a hallucination — the model correctly followed the maliciously injected instruction. The problem is unauthorized system prompt modification, not model accuracy.

Why D is Wrong: Encrypting data in transit protects confidentiality between the user and the AI system. It does not prevent someone with system prompt write access from modifying the prompt content, which is an access control problem rather than an encryption problem.

Basic Concept: AI models can inadvertently memorize sensitive information from their training data. Certain attack techniques can exploit this memorization to extract private information from a deployed model, even without direct access to the training dataset. CompTIA SecAI+ Study Guide covers model inversion as an AI-specific data exposure attack vector.

Why B is Correct: Model inversion is an attack where an adversary queries a deployed AI model with carefully crafted inputs to reconstruct or infer sensitive training data. For example, an attacker could query a facial recognition model with optimized images to reconstruct faces of individuals from the training set, or query a medical diagnosis model to infer patient records used in training. This directly exposes sensitive data that was supposed to be protected.

Why A is Wrong: Overfitting is a model training quality issue where a model learns training data too specifically and performs poorly on new data. While it can indicate that sensitive data was memorized, overfitting itself is a performance concern rather than directly a data exposure attack vector.

Why C is Wrong: Data normalization is a preprocessing technique that scales numerical features to a common range to improve training performance. It is a data preparation step with no direct relevance to sensitive data exposure or privacy attacks.

Why D is Wrong: Hyperparameter tuning adjusts configuration parameters of a model to optimize its performance during training. It is an optimization technique with no relevance to protecting against sensitive data exposure attacks.

Basic Concept: Data integrity ensures that data has not been tampered with, corrupted, or modified during storage or transmission. For AI training data that is procured from external sources, cryptographic integrity verification is essential to confirm the data arrived unmodified. CompTIA SecAI+ Study Guide covers data integrity controls for AI data pipelines.

Why A is Correct: Implementing checksums provides cryptographic verification of data integrity. A checksum or hash value such as SHA-256 is computed from the dataset at the source. The receiver computes the same hash and compares it to the provided value. Any modification to the data during transit or storage will produce a different hash, immediately detecting tampering or corruption. This is the most reliable, automated, and scalable strategy for ensuring the integrity of procured training data.

Why B is Wrong: Human evaluation can verify data quality and relevance but is impractical for verifying integrity across large datasets of medical records. Human reviewers cannot detect subtle bit-level corruption or intentional small modifications, and the process is not scalable.

Why C is Wrong: Querying the model tests model performance rather than verifying the integrity of the underlying training data. The model cannot tell you whether its training data was modified after collection or during procurement.

Why D is Wrong: Log monitoring tracks system activities and events over time. While useful for auditing access to data, it cannot retroactively confirm that data content has not been modified and does not provide cryptographic integrity guarantees.

Basic Concept: LLM hallucinations occur when the model generates plausible-sounding but factually incorrect or fabricated information. For internal content management solutions where accuracy is critical, detecting and handling hallucinated responses before they are acted upon is essential. CompTIA SecAI+ Study Guide covers response validation as a mitigation for hallucination risks.

Why B is Correct: Response validation implements checks that verify the accuracy and relevance of LLM-generated responses before they are presented to users or acted upon. This can involve cross-referencing responses against authoritative internal data sources, using a secondary model to evaluate response accuracy, or implementing confidence scoring that flags low-confidence responses for human review. Response validation directly addresses the hallucination problem by catching inaccurate responses before they cause harm.

Why A is Wrong: Model training addresses hallucinations at the model level by providing more accurate training data or fine-tuning. While effective long-term, it requires significant time and resources and does not provide immediate protection against hallucinations in the currently deployed model.

Why C is Wrong: Access controls manage who can query the LLM and what resources they can access. They do not inspect or validate the accuracy of the model ' s responses, so they cannot mitigate hallucination risks.

Why D is Wrong: Integrity monitoring tracks whether data or systems have been tampered with or changed unexpectedly. It is relevant for detecting unauthorized modifications but does not validate whether LLM-generated content accurately reflects reality or internal authoritative data.

Basic Concept: Preventing vulnerable code from reaching production requires an automated, mandatory gate in the software delivery pipeline. The CI/CD pipeline is the enforcement point where all code must pass before deployment. CompTIA SecAI+ Study Guide covers AI integration in secure development pipelines under AI-assisted security.

Why C is Correct: Implementing an LLM in the CI/CD runner creates a mandatory automated security gate that every code change must pass. The LLM can analyze code for vulnerabilities, insecure patterns, and policy violations, then automatically fail the build if issues are found. This prevents vulnerable code from progressing toward production without human bypass capability, making it the most effective enforcement mechanism.

Why A is Wrong: IDE plug-ins provide warnings to developers during coding, but developers can choose to ignore them and proceed with compilation and commits. Warnings are advisory, not preventive, and cannot guarantee vulnerable code is blocked from the pipeline.

Why B is Wrong: SOAR platforms with ML models are excellent for incident response and security operations automation. However, they are not positioned in the code delivery pipeline and do not gate code from progressing to production.

Why D is Wrong: An agentic penetration testing tool validates vulnerabilities reactively after code is written or deployed. This approach does not intercept code before production deployment and is typically used for post-deployment assessment rather than prevention.

Basic Concept: Prompting techniques determine how effectively an LLM is guided to produce desired outputs. Providing a single example within a prompt is a well-established technique known as one-shot prompting, which leverages in-context learning. CompTIA SecAI+ Study Guide covers prompting strategies under basic AI concepts.

Why C is Correct: One-shot prompting involves providing exactly one example of the desired input-output format within the prompt to guide the model ' s responses. In this scenario, the HR officer includes one example resume matching a successful candidate to show the model what a qualifying candidate looks like. This single example instructs the model on the evaluation criteria through demonstration rather than explicit description.

Why A is Wrong: Distillation is a model training technique where a smaller student model is trained to replicate the behavior of a larger teacher model. It is a model compression methodology, not a prompting technique used at query time.

Why B is Wrong: A prompt template is a reusable, structured format for prompts with placeholders that can be filled in for different queries. While templates may incorporate examples, the term specifically describes the structural framework, not the act of providing a single example.

Why D is Wrong: A system role defines the AI model ' s persona, context, and behavioral guidelines at the system level before user interaction begins. It sets the model ' s overall behavior, not a specific technique of providing examples within queries.

Basic Concept: Generative AI systems in healthcare settings incur costs from multiple operational activities. Understanding the cost drivers specific to generative AI helps administrators implementaccurate cost monitoring and controls. CompTIA SecAI+ Study Guide covers AI cost management under securing AI systems.

Why C is Correct: Storage retrieval and prompt processing are the two primary cost drivers for generative AI systems in healthcare. Storage retrieval refers to the cost of querying vector databases or document stores in RAG-based AI systems to fetch relevant patient records, clinical guidelines, or historical data for context. Prompt processing encompasses the token-based cost of the LLM processing the combined retrieved content and user query to generate a response. Together these two activities represent the billable units that drive generative AI costs in healthcare RAG deployments, making them the most accurate basis for cost calculation and monitoring.

Why A is Wrong: Connection access and exchange gateway costs relate to network infrastructure and API gateway usage fees. While there may be minor costs associated with API calls, these are not the primary cost drivers for generative AI systems where the dominant expenses are computational token processing and data retrieval operations.

Why B is Wrong: Encryption and decryption processing costs relate to cryptographic operations for data security. While encryption is important for healthcare data protection under HIPAA, cryptographic processing overhead is minimal compared to the substantial token-based LLM processing and storage retrieval costs that dominate generative AI operational expenses.

Why D is Wrong: Catalog servicing and exchange processing are terms associated with data catalog management and data exchange infrastructure. These are not recognized primary cost components of generative AI systems in healthcare, where storage retrieval and token-based prompt processing are the established cost measurement criteria.

Basic Concept: When an AI fraud detection model produces false positives (blocking legitimate transactions), this indicates the model ' s decision boundary is insufficiently calibrated. The model needs improved training data to better distinguish fraudulent from legitimate transactions. CompTIA SecAI+ covers model performance improvement under AI-assisted security.

Why A is Correct: Retraining the model with more data and recent transaction patterns directly addresses the root cause of false positives. Additional representative legitimate transaction data helps the model learn more accurate decision boundaries, reducing false positives while maintaining detection sensitivity for actual fraud. This improves model accuracy without abandoning AI-based detection.

Why B is Wrong: Token usage and rate limits are cost and resource management controls for LLM APIs. They have no relevance to improving the accuracy of a fraud detection ML model that incorrectly classifies legitimate transactions.

Why C is Wrong: Encrypting data and applying access controls are data security measures that protect confidentiality and integrity. They do not address model classification accuracy or the false positive problem in fraud detection.

Why D is Wrong: Rolling back to a traditional system abandons the capabilities of AI-based fraud detection. The appropriate response to model performance issues is to improve the model through retraining, not to regress to less capable detection approaches.

Basic Concept: When a non-ML engineer can accidentally trigger model retraining during a UI update, this indicates a lack of proper lifecycle management and change controls around the AI model. Uncontrolled retraining on unverified data is a critical vulnerability in the development and deployment process. CompTIA SecAI+ Study Guide identifies the Model Development Life Cycle as the framework for preventing such issues.

Why C is Correct: Implementing a Model Development Life Cycle (MDLC) establishes formal, controlled processes for every stage of model development and updates including data validation requirements before training, change management gates, testing and validation stages, and separation of duties between UI development and model training activities. An MDLC would have prevented the accidental retraining by requiring explicit, controlled authorization before any model training occurs.

Why A is Wrong: A WAF filters HTTP traffic at the application boundary. It does not govern internal development processes or control when and how model retraining occurs within the AI development pipeline.

Why B is Wrong: Role-based access control can restrict who has permission to trigger model retraining, which would help prevent this specific incident. However, it is one component of a broader MDLC governance framework and does not address data validation, testing stages, or the complete change management process.

Why D is Wrong: A GAN is a model architecture for generating synthetic data. It is a training technique unrelated to lifecycle governance or preventing accidental retraining from unverified data during unrelated application updates.

Basic Concept: When authentication is enabled on an LLM system, users must prove their identity before the system processes any requests. The authentication process must occur at the point where users first attempt to access the system before any data can be transmitted. CompTIA SecAI+ Study Guide covers the order of authentication controls in AI system access architectures.

Why B is Correct: Endpoint access control is the first requirement when authentication is enabled, as it governs the initial connection from the user ' s device to the system. Before any prompt can be sent or response received, the endpoint must be authenticated and authorized to access the LLM service. Endpoint access control verifies user identity and device compliance at the earliest possible point in the request flow, gating all subsequent processing.

Why A is Wrong: A front-end web proxy gateway routes and manages web traffic between users and backend services. While it may participate in the authentication flow, it is a routing and mediation component that operates after the endpoint has been validated, not the first authentication requirement.

Why C is Wrong: An API gateway manages API traffic, authentication tokens, and rate limiting for API interactions. It processes requests after initial endpoint authentication has been established and the request is being routed to the LLM backend.

Why D is Wrong: A back-end access gateway controls access to backend services and resources. It operates downstream from both endpoint authentication and API gateway processing, representing a deeper layer of the access control architecture rather than the first authentication requirement.

Basic Concept: Unstructured data such as free-form text, images, and audio does not have predefined labels or rigid schema. Training an AI model effectively on unstructured data requires techniques that can leverage patterns within the data itself or adapt a pre-trained model to new data types. CompTIA SecAI+ covers AI training methodologies under basic AI concepts.

Why B is Correct: Fine-tuning takes a pre-trained foundation model that has already learned rich representations from massive unstructured datasets and further trains it on a specific, potentially smaller unstructured dataset. This adapts the model to a new domain, task, or data type without requiring labeled data for every training example. Fine-tuning is the most practical and effective approach for working with unstructured data in modern AI development.

Why A is Wrong: Statistical learning typically refers to classical machine learning approaches that often assume structured, numerical data with defined features. These methods generally struggle with high-dimensional unstructured data without significant preprocessing.

Why C is Wrong: Supervised learning requires labeled training data where each example has an associated correct output label. Applying supervised learning to unstructured data requires extensive manual labeling, which is the opposite of working with raw unstructured data.

Why D is Wrong: Reinforcement learning trains models through reward signals based on actions taken in an environment. It is designed for sequential decision-making tasks and is not the standard approach for learning representations from unstructured data at scale.

Basic Concept: This is a Performance-Based Question (PBQ) — a simulation item requiring interactive drag-and-drop assignment of threat categories to appropriate frameworks in the actual exam. It tests knowledge of how different AI threat frameworks categorize and address specific threat types for agentic systems.

Key Concept — Framework-to-Threat Mapping: MITRE ATLAS covers ML-specific adversarial tactics such as model evasion, data poisoning, model extraction, and prompt injection for agentic systems. OWASP LLM Top 10 addresses application-level LLM vulnerabilities such as insecure output handling, excessive agency, and supply chain risks. NIST AI RMF addresses governance-level risks across the AI lifecycle. STRIDE addresses architectural threats including spoofing, tampering, repudiation, information disclosure, DoS, and elevation of privilege.

Why This Matters: Agentic AI systems have a unique threat landscape combining traditional software vulnerabilities with AI-specific attacks. Correctly mapping threat categories to frameworks is essential for comprehensive threat modeling of systems that autonomously execute multi-step tasks with tool access and real-world consequences.

Basic Concept: Generative AI produces natural language content based on input data. In a security operations context, triage involves rapidly understanding and prioritizing security events. Generative AI ' s strength lies in synthesizing information and producing readable summaries from complex data. CompTIA SecAI+ Study Guide covers generative AI applications in security operations.

Why C is Correct: Summarizing security findings by category is a natural application of generative AI in triage. The AI can process large volumes of alerts and security events, group them by type or severity, and generate concise natural language summaries that enable analysts to quickly understand the current threat landscape without reading individual alerts. This directly reduces triage time and cognitive load.

Why A is Wrong: Predicting the next attack target requires predictive analytics and threat intelligence correlation. While AI can assist with this, it is a forecasting task better suited to analytical ML models rather than generative AI, and it is a strategic intelligence function rather than a triage task.

Why B is Wrong: Statistical analysis for malicious code assessment uses mathematical and ML techniques to analyze code characteristics. This is a traditional ML classification task, not a generative AI application, and is performed during malware analysis rather than alert triage.

Why D is Wrong: Tagging malware using ML algorithms is a classification task that uses supervised ML models trained on malware features. It is a detection and classification function, not a generative AI triage application.

Basic Concept: Data integrity in AI systems requires not only that data is accurate at a point in time, but that its entire history of transformation and usage can be traced and verified. Tracking how data has been used and transformed throughout the AI system lifecycle provides ongoing integrity assurance. CompTIA SecAI+ Study Guide covers data governance controls including lineage for AI integrity.

Why D is Correct: Data lineage tracks and documents the complete journey of data from its origin through every transformation, processing step, and use within an AI system. By recording what happened to the data, when, by whom, and through which processes, data lineage provides the audit trail needed to ensure data integrity throughout the AI system ' s data usage lifecycle. It enables verification that data has been used as intended and has not been improperly modified at any stage.

Why A is Wrong: Data masking replaces sensitive data values with anonymized equivalents to protect privacy. It is a confidentiality control that modifies data values rather than a mechanism for ensuring or tracking data integrity across the system.

Why B is Wrong: Data cleansing removes or corrects errors, inconsistencies, and noise in datasets to improve data quality. It is a data preparation activity that improves data accuracy at a point in time but does not track data usage or provide ongoing integrity assurance throughout the AI system lifecycle.

Why C is Wrong: Data verification confirms that data meets expected quality standards and validates its accuracy at a specific check point. While important for quality assurance, it provides a point-in-time check rather than continuous tracking of data usage and transformations as data lineage does.

Basic Concept: Operating AI systems within a budget requires direct control over the primary cost driver of LLM usage. For research environments where users may run extensive queries, token consumption management is the most effective budget control mechanism. CompTIA SecAI+ Study Guide covers token limits as the key cost management control for AI environments.

Why D is Correct: Token limits set hard caps on the maximum tokens consumed per request and per session, directly controlling the per-interaction cost of LLM API usage. In a research environment where users may submit complex, multi-part queries generating long responses, token limits prevent any single interaction from consuming disproportionate budget and enable the administrator to enforce aggregate budget constraints across all users and research activities.

Why A is Wrong: Prompt firewalls inspect and filter prompt content for security and policy compliance. They are security controls designed to prevent malicious or policy-violating prompts, not financial controls for managing token consumption or enforcing budget limits.

Why B is Wrong: API access controls manage authentication and authorization for API interactions, governing who can connect to the AI API. While restricting API access could limit who uses the system, it does not control how much budget individual authorized users consume through their research queries.

Why C is Wrong: Model guardrails enforce content policy and behavioral constraints on model inputs and outputs. They ensure safe and appropriate responses but do not limit the computational resources or tokens consumed by interactions, making them unsuitable as budget enforcement controls.

Basic Concept: AI manipulation attacks exploit vulnerabilities in systems, interfaces, and content. Some security approaches are inherently more resistant to AI-driven attacks because they reduce the available avenues through which manipulation can occur, rather than attempting to detect or block individual attacks. CompTIA SecAI+ Study Guide covers defensive strategies for AI system protection.

Why D is Correct: Attack surface reduction minimizes the number of entry points, interfaces, and components available for exploitation. By eliminating unnecessary services, APIs, integrations, and features, it reduces the total number of pathways through which AI-driven manipulation attacks can be attempted. Unlike signature-based or behavioral detection, attack surface reduction provides structural resistance regardless of how sophisticated or novel the AI manipulation technique is.

Why A is Wrong: Payloads are the malicious content used in attacks, not a defensive control. Attackers using AI can generate increasingly sophisticated payloads designed to evade detection, making them highly susceptible to AI-driven manipulation rather than resistant to it.

Why B is Wrong: AI-generated content is a product of AI systems and can itself be manipulated or weaponized by adversarial AI. It is not a defense mechanism and is inherently vulnerable to AI-driven manipulation and poisoning.

Why C is Wrong: An API gateway provides a managed access point for API traffic with authentication and filtering capabilities. However, APIs are primary attack targets for AI manipulation and require ongoing security updates. API gateways are less fundamentally resistant than structural attack surface reduction.

Why E is Wrong: Antivirus relies on signatures and behavioral heuristics to detect known malware. AI-powered attacks can generate novel, polymorphic payloads that evade signature detection, making antivirus less resistant to AI manipulation than attack surface reduction.

Basic Concept: Reducing post-deployment vulnerabilities requires catching security issues as early as possible in the development workflow. AI-assisted tools that analyze code during development provide the earliest possible intervention point. CompTIA SecAI+ Study Guide covers AI integration in secure development under AI-assisted security.

Why A is Correct: AI-assisted code linting analyzes source code in real time during development to identify security vulnerabilities, insecure coding patterns, policy violations, and quality issues before code is compiled or committed. By catching vulnerabilities at the coding stage — the earliest possible point in the development workflow — AI code linting prevents vulnerable code from progressing to testing, staging, or production, directly reducing post-deployment vulnerabilities at their source.

Why B is Wrong: Incident management handles security events and incidents after they have occurred in production. It is a reactive capability focused on response and recovery rather than early-stage vulnerability identification in the development workflow.

Why C is Wrong: Automated deployment/rollback automates the process of pushing code to production and reverting to previous versions when issues are detected post-deployment. It is a deployment safety mechanism rather than an early detection tool during the development phase.

Why D is Wrong: System auditing reviews and records system activities and configurations for compliance verification. It is primarily a detective and compliance control for systems that are already deployed, not an early development-phase vulnerability identification tool.

Basic Concept: Jailbreaking through prompt injection exploits the LLM ' s tendency to follow instructions embedded in user input, overriding its intended behavior. The model was manipulated to offer unauthorized discounts, demonstrating that its operational boundaries were not properly enforced. CompTIA SecAI+ Study Guide identifies guardrails as the primary defense against jailbreaking attacks.

Why D is Correct: Guardrails are robust, layered controls that enforce behavioral boundaries on LLM inputs and outputs. They can detect and block jailbreaking attempts, enforce business logic constraints such as preventing unauthorized discounts, validate outputs against policy rules before delivery, and prevent the model from operating outside its defined scope. Guardrails are specifically designed to make models more robust against prompt injection and jailbreaking.

Why A is Wrong: Bias filtering is designed to detect and remove biased, discriminatory, or offensive content from model outputs. It addresses content fairness issues but does not prevent jailbreaking attacks that manipulate the model into performing unauthorized actions.

Why B is Wrong: A system prompt sets the model ' s base instructions and persona, but the jailbreak attack already demonstrates that the current prompt can be overridden. Guardrails provide enforcement at a layer that is more resistant to prompt manipulation than the system prompt alone.

Why C is Wrong: Log monitoring detects jailbreaking attempts after they have already succeeded. It is a detective control that enables incident response but does not prevent the model from offering unauthorized discounts in the first place.

Basic Concept: A denial-of-wallet (DoW) attack deliberately generates excessive API calls or token consumption to exhaust an organization ' s AI budget. Since LLM providers charge based on tokens processed, attackers can cause significant financial damage by driving massive usage. CompTIA SecAI+ Study Guide addresses financial abuse vectors in AI systems.

Why E is Correct: API rate controls limit the number of requests a user or application can make within a defined time period. By capping request frequency, rate controls directly prevent attackers from generating the massive API call volume needed to execute a denial-of-wallet attack.

Why F is Correct: Output token controls cap the maximum number of tokens the model can generate per response. Since billing is based on tokens consumed including outputs, limiting output tokens directly caps the cost per request, preventing attackers from triggering extremely long, expensive responses.

Why A is Wrong: Endpoint access controls manage device or network access. They do not directly limit token consumption or API call volume that drives denial-of-wallet costs.

Why B is Wrong: A CDN distributes content geographically to improve performance and absorb traffic. It does not control LLM API billing or token consumption.

Why C is Wrong: Model fine-tuning adjusts model parameters for improved performance on specific tasks. It is a training process that does not address active cost-exhaustion attacks.

Why D is Wrong: Modality controls restrict which input types such as text, images, or audio a model accepts. While useful for reducing attack surface, they do not directly address the rate or volume of API calls in a DoW attack.

Basic Concept: Different ML model architectures offer varying degrees of explainability. In cybersecurity, understanding why a model classified a log entry as malicious or benign is critical for analyst trust, investigation, and regulatory compliance. CompTIA SecAI+ covers model explainability under responsible AI and basic AI concepts.

Why C is Correct: Decision trees are inherently interpretable models that classify data through a series of transparent if-then rules. Every classification decision can be traced through the exact path of conditions that led to it, showing precisely which log entry features triggered the classification. Analysts can read and understand the decision path, making decision trees the gold standard for explainable ML classification in security applications where understanding the reason for a classification is as important as the classification itself.

Why A is Wrong: Large language models are complex transformer architectures with hundreds of billions of parameters. They function as black boxes — their internal decision-making processes are not human-interpretable, making them poor choices when explainability is the primary requirement.

Why B is Wrong: Neural networks are non-linear black box models. While they can achieve high classification accuracy, their multi-layer architecture makes it extremely difficult to explain why specific decisions were made in human-understandable terms.

Why D is Wrong: Generative adversarial networks are designed for generating synthetic data, not for classification tasks. They consist of competing generator and discriminator networks and are fundamentally unsuitable for log entry classification with explainability requirements.

Part 1 — Select the protocol or cipher

System component

Select

API gateway

TLS 1.2

Database storage

CAMELLIA

AI model storage

HMAC-SHA512

Part 2 — Select the data-protection technique

Enter the techniques from the first row to the fifth row in this exact order:

Row Data modification Select

1 The name field is removed, while patient_id and dob remain De-identification

2 ip_addr and name are removed, leaving cookie and uid Anonymization

3 The card number is replaced by 0x0193828829 Tokenization

4 sensitivity: " SECRET " is added Classification

5 Part of the PIN is replaced by XXXX Masking

See Explanation

Why these are the intended answers

API gateway → TLS 1.2

The API gateway handles data moving between the client and backend systems. TLS is the only listed transport-security protocol and therefore protects the data in transit . OWASP recommends encrypting sensitive data in transit by using TLS with secure parameters.

Database storage → CAMELLIA

CAMELLIA is a symmetric block cipher suitable for encrypting substantial quantities of stored data. It is therefore the valid storage-encryption choice among the listed options.

Do not select AES-512 . AES-512 is not a standardized AES variant. NIST defines only AES-128, AES-192, and AES-256 .

AI model storage → HMAC-SHA512

The scenario separately emphasizes protection against loss or modification of intellectual property. HMAC-SHA512 supplies message authentication and integrity verification, allowing unauthorized modification of the AI model to be detected. HMAC is not confidentiality encryption, but it is the most appropriate listed additional control for protecting model integrity. OWASP specifically identifies HMACs as cryptographic controls for stored-data integrity.

Why the other options are not selected

SHA-2 512: Hashing only; no secret key and no encryption.

Elliptical curve: A family of cryptographic techniques, not a specific storage or transport protocol.

ECDH: Used for key agreement, not direct bulk-data encryption.

AES-512: Invalid AES key size.

RSA-2048: Primarily used for asymmetric encryption, signatures, or key transport; inefficient for bulk database or model encryption.

CAMELLIA: Appropriate symmetric encryption for stored data.

HMAC-SHA512: Integrity and authenticity, not confidentiality.

Final Part 2 order

De-identification

Anonymization

Tokenization

Classification

Masking

Explanation

De-identification removes an explicitly identifying field—in this case, the person’s name—while retaining other fields needed for processing. The remaining patient ID and date of birth could potentially permit re-identification when combined with other information, so this is de-identification rather than complete anonymization. OWASP describes de-identification as deleting, scrambling, or pseudonymizing direct and indirect identifiers.

Anonymization removes identifying attributes so that the displayed record is not directly tied to the named individual. Here, both the name and IP address are removed.

Tokenization substitutes a sensitive value with a non-sensitive representative token. The original payment-card number is replaced with the hexadecimal-style value 0x0193828829. OWASP recognizes tokenization as a method for reducing exposure of stored sensitive data.

Classification labels information according to sensitivity. Adding sensitivity: " SECRET " does not conceal or transform the PIN; it categorizes the record so appropriate controls can be applied. OWASP recommends classifying processed, stored, and transmitted data and applying controls based on that classification.

Masking obscures only part of a sensitive value while preserving its general format. Changing 999-99-9999 to 999-99-XXXX is partial masking.

Basic Concept: Monitoring an AI system ' s internal runtime behavior requires deep observability into what the system is doing at the code and function execution level, not just at the perimeter. CompTIA SecAI+ Study Guide addresses AI system observability and runtime monitoring under securing AI infrastructure.

Why D is Correct: Enabling stack call and debugging level traces at the function level provides the highest granularity of visibility into internal operations. This approach exposes what functions are called, in what order, with what inputs, and what is returned, offering genuine insight into the AI system ' s internal activity at runtime precisely as the engineer requires.

Why A is Wrong: A SIEM aggregates and correlates log and event data from multiple sources. While useful for security alerting, it does not inherently provide visibility into internal function-level operations of an AI model at runtime.

Why B is Wrong: A WAF with header logging monitors and filters HTTP traffic at the application boundary. It captures external request and response data, not the AI system ' s internal runtime mechanics.

Why C is Wrong: Relying on vendor controls and monitoring prompt inputs is a passive, externally-focused approach. It provides no visibility into intermediate computations or internal operations within the AI model itself.

Basic Concept: AI chatbots are designed with safety guidelines and content policies that prevent them from generating harmful, offensive, or inappropriate content. When users find ways to bypass these restrictions through crafted prompts, they have " jailbroken " the model. CompTIA SecAI+ Study Guide covers jailbreaking as a key AI vulnerability category.

Why C is Correct: Jailbreaking is the process of using cleverly crafted prompts to bypass an AI model ' s built-in safety restrictions, content policies, and behavioral guardrails, causing it to produce outputs it was designed to refuse. The scenario describes a chatbot that was designed for automobile configuration assistance but is producing offensive responses following customer prompts, indicating that customers have successfully prompted the model to bypass its safety constraints and generate prohibited content.

Why A is Wrong: Model skewing refers to attacks or biases that cause a model to favor certain outputs or perspectives systematically over time, often through data manipulation. It describes a gradual distortion of model behavior, not a direct user-prompted bypass of safety restrictions in a single interaction.

Why B is Wrong: Model theft involves extracting or replicating a proprietary model ' s functionality or architecture through repeated queries. It is an intellectual property attack aimed at stealing the model ' s knowledge, not an attack that causes the model to produce offensive content.

Why D is Wrong: Insecure output handling occurs when an application fails to properly validate or sanitize AI-generated outputs before using them in ways that could cause harm such as passing AI output directly to a system command or database query. It describes a developer implementation vulnerability, not the act of a user prompting a model to bypass its safety constraints.

Basic Concept: DoS attacks overwhelm AI systems by sending excessive requests that exhaust computational resources, memory, or bandwidth, preventing legitimate users from being served. The primary defense against volume-based attacks is throttling the rate at which requests can be processed. CompTIA SecAI+ Exam Objectives identify rate limiting as the key DoS mitigation control for AI systems.

Why B is Correct: Rate limiting directly addresses the root mechanism of DoS attacks by restricting the number of requests any single client or IP address can submit within a defined time window. By enforcing request quotas, rate limiting prevents attackers from generating the request volume necessary to overwhelm the system while preserving capacity for legitimate users. It is the most direct and effective preventive control against DoS attacks on AI APIs and services.

Why A is Wrong: Model guardrails inspect and filter the content of prompts and responses for policy compliance and safety. They operate at the semantic content level, not at the request volume level, and cannot prevent resource exhaustion from high-volume request flooding.

Why C is Wrong: End-to-end encryption protects the confidentiality and integrity of data in transit. Encrypted DoS traffic is just as damaging as unencrypted traffic; encryption does not limit request rates or prevent resource exhaustion.

Why D is Wrong: Access controls restrict who can interact with the system, which can reduce the potential attacker pool. However, authenticated users and compromised accounts can still launch DoS attacks, and access controls alone cannot prevent high-volume attacks from authorized sources.

Basic Concept: AI-based security tools for detecting malicious websites and phishing links operate by analyzing URLs, page content, and link characteristics against known malicious patterns and behavioral signatures. CompTIA SecAI+ Study Guide covers pattern recognition and signature matching as fundamental AI-assisted threat detection techniques.

Why B is Correct: Pattern recognition and signature matching are the core techniques used in malicious website and phishing link detection. The AI plug-in uses pattern recognition to identify characteristics of phishing pages such as login form structures mimicking legitimate sites, suspicious domain patterns, and redirect behaviors. Signature matching compares URLs and page content against databases of known malicious sites and phishing infrastructure. Together these techniques enable accurate detection of threats in email links before users click them.

Why A is Wrong: Code quality testing analyzes source code for bugs, vulnerabilities, and adherence to coding standards during software development. It has no application for detecting malicious websites or phishing links in real-time email scanning.

Why C is Wrong: Automated penetration testing proactively exploits vulnerabilities to assess security posture. It is an offensive security assessment technique, not a real-time threat detection technique for identifying malicious links in email.

Why D is Wrong: Automated incident response executes predefined response actions when security incidents are detected, such as isolating endpoints or blocking users. It operates after threats are detected, not during the detection phase that identifies malicious websites and links.

Basic Concept: Context window DoS attacks flood an LLM ' s context with obfuscated content to exhaust processing resources or manipulate model behavior. Attackers may hide large amounts of text behind Unicode characters like emojis. CompTIA SecAI+ Study Guide identifies prompt filtering as the primary defense against input-based attacks on LLMs.

Why D is Correct: A prompt filter inspects incoming inputs before they reach the LLM, detecting and blocking malicious content including obfuscated text hidden behind Unicode characters or emojis. By analyzing input structure, character counts, hidden content, and encoding anomalies, prompt filters can identify and reject attacks that attempt to abuse the context window, preventing resource exhaustion.

Why A is Wrong: Fraud detection systems are designed to identify fraudulent transactions or activities in structured data contexts. They are not designed to inspect LLM prompt structures for obfuscated content attacks on context windows.

Why B is Wrong: LLM-as-a-judge uses a secondary LLM to evaluate the quality or safety of another model ' s outputs. It operates post-generation and cannot prevent a DoS attack that occurs during input processing before output is generated.

Why C is Wrong: Pattern recognition can identify known attack patterns but requires the attack to match pre-learned patterns. Novel obfuscation techniques using Unicode or emoji hiding may evade pattern-based detection without dedicated prompt filtering logic.

Basic Concept: Prompt injection occurs when malicious content embedded in user input manipulates an LLM ' s behavior, causing it to leak sensitive data, bypass restrictions, or execute unintended actions. Preventing such attacks requires mechanisms that inspect and filter content at the prompt level. CompTIA SecAI+ covers LLM-specific security controls extensively.

Why A is Correct: Guardrails are purpose-built controls that inspect, filter, and constrain both input prompts and output responses in LLM systems. They can detect sensitive data patterns such as credit card numbers, block prompt injection payloads, enforce content policies, and prevent the model from processing or outputting restricted information. Guardrails are the primary LLM-native defense against prompt injection as cited in the CompTIA SecAI+ Study Guide.

Why B is Wrong: Antivirus software detects known malware signatures in files and executables. It does not inspect or understand the semantic content of LLM prompts and cannot detect or block prompt injection attacks.

Why C is Wrong: A WAF operates at the HTTP layer inspecting web requests and responses against rule sets. While it can block some patterns, it lacks the contextual intelligence to understand LLM prompt semantics and cannot prevent sophisticated injection attacks.

Why D is Wrong: Role-based access control manages who can access which resources. It controls authorization but does not inspect the content of prompts to prevent injection attacks once a user has legitimate access.

Basic Concept: Security assessment of AI-generated code requires a systematic review of the code itself to understand what has been generated and identify potential vulnerabilities before remediation steps are taken. Security assessments follow a structured methodology beginning with understanding the current state. CompTIA SecAI+ Study Guide covers AI-generated code security assessment under AI-assisted security.

Why D is Correct: Performing a source code review is the first and most fundamental step in assessing AI-generated code security. Before removing secrets, enforcing access controls, or scanning for sensitive data, the analyst must understand what the AI tool has generated by reviewing the code for security vulnerabilities, insecure patterns, logic flaws, and policy violations. The review provides the baseline knowledge needed to prioritize and direct all subsequent remediation actions.

Why A is Wrong: Removing hard-coded secrets is a specific remediation action for a specific finding. This step should come after the source code review has identified the presence and location of hard-coded secrets, not before the initial assessment reveals whether they exist.

Why B is Wrong: Enforcing access controls for code repositories is a security hardening measure for the repository infrastructure. It protects access to existing code but does not constitute an assessment of what the AI tool has generated from a security standpoint.

Why C is Wrong: Enabling sensitive data discovery scans repositories for PII and sensitive information patterns. While valuable as part of the assessment, it is a specific automated scanning tool best used after or alongside a manual code review that provides contextual understanding of the codebase.

Basic Concept: Suspicious queries in AI system logs indicate that potentially malicious or policy-violating prompts are reaching the AI model. Proactively intercepting and filtering suspicious prompts before they are processed requires a prompt-level security control. CompTIA SecAI+ Study Guide identifies prompt firewalls as the appropriate control for blocking suspicious AI queries.

Why A is Correct: A prompt firewall analyzes incoming queries using a combination of pattern matching, semantic analysis, and policy rules to identify and block suspicious prompts before they reach the AI model. It can detect prompt injection attempts, jailbreaking patterns, sensitive data extraction queries, and other suspicious prompt characteristics. By intercepting malicious prompts at the perimeter, it prevents them from influencing model behavior or extracting sensitive information.

Why B is Wrong: Data size controls limit the volume or size of data in requests. While controlling input size can prevent some attacks, it does not analyze the content or semantics of queries to detect suspicious patterns. A small suspicious prompt can be just as harmful as a large one.

Why C is Wrong: Rate limiting controls the frequency of requests from a source. While it can slow down automated attack campaigns, it does not inspect query content for suspicious patterns and allows suspicious queries through as long as they are submitted below the rate threshold.

Why D is Wrong: Agentic AI is an AI architecture for autonomous multi-step task execution. It is a type of AI system, not a security control for filtering suspicious queries from an existing AI system ' s logs.

Basic Concept: RAG-based AI systems retrieve information from knowledge bases to augment their responses. The differential access to sensitive employee data based on user role demonstrates that role-based data access controls are functioning correctly, restricting what data different users can retrieve through the AI interface. CompTIA SecAI+ Study Guide covers data access controls as the primary mechanism for preventing sensitive data exposure in RAG systems.

Why A is Correct: Data access controls define what information each user role is permitted to retrieve from the knowledge base. In this scenario, administrator-level users can access employee directory information while employee-level users cannot. The RAG system enforces these permissions when retrieving data for the AI ' s responses, preventing unauthorized users from accessing sensitive employee data through the chatbot interface regardless of how they phrase their queries.

Why B is Wrong: Model-specific guardrails filter responses based on content policies. While they can prevent certain categories of sensitive information from being disclosed, the scenario specifically shows differential access based on user role, which is the characteristic of access control enforcement, not content-based guardrail filtering.

Why C is Wrong: Rate limiting restricts request frequency. It does not differentiate what data different users can access; it only controls how often they can make requests. Both the administrator and employee could be subject to the same rate limit while still receiving different data based on their access controls.

Why D is Wrong: Prompt templates standardize how queries are structured. They do not implement user role-based data access restrictions or prevent specific user types from accessing sensitive information in the underlying knowledge base.

Basic Concept: Data validation is a critical step in the AI development pipeline that involves verifying that the data used for training and inference meets quality standards, is representative, and is free from systematic errors that could introduce bias. The quality of training data directly determines the quality and fairness of model outputs. CompTIA SecAI+ Study Guide covers data validation under AI development and responsible AI principles.

Why D is Correct: The primary purpose of data validation for an AI system is to ensure that the data is accurate, representative, and free from systematic errors that would cause the model to produce biased or discriminatory outcomes. Validating data checks for class imbalance, demographic underrepresentation, labeling errors, and corrupted values that could embed biases into the model. This ensures the AI system produces fair, accurate, and trustworthy outputs across all user groups.

Why A is Wrong: Automating the process is a benefit of using automated data validation tools but is not the primary purpose of validation itself. The automation serves the validation goal rather than being the reason validation is performed.

Why B is Wrong: Reducing resource consumption is an engineering optimization concern. Data validation may reduce resource waste by preventing training on poor-quality data, but this is a secondary benefit, not the primary purpose.

Why C is Wrong: Optimizing storage databases is a database engineering concern about performance and efficiency. Data validation examines data quality and representativeness for AI purposes, not database architecture optimization.

Basic Concept: AI chatbot operational costs are primarily driven by token consumption — the number of tokens processed in requests and generated in responses. Unexpected cost increases in LLM-based chatbots almost always trace back to abnormal token usage patterns. CompTIA SecAI+ Study Guide covers AI cost monitoring and token-based billing under securing AI systems.

Why D is Correct: Model token usage logs directly show how many tokens are being consumed per request, by which users or endpoints, and whether usage has increased abnormally. Examining token usage data is the most direct path to identifying the root cause of unexpected cost increases — whether from a denial-of-wallet attack, user abuse, a new feature generating verbose responses, or legitimate organic growth in usage. This is the first and most relevant examination point for LLM cost analysis.

Why A is Wrong: Firewall logs capture network-level traffic information. While they can reveal unusual access patterns or volumes, they do not contain token consumption data that directly explains LLM billing increases.

Why B is Wrong: WAF rules define filtering policies for web traffic. Reviewing rule configurations does not reveal whether token usage has increased or why costs have risen; it shows security policy settings rather than consumption metrics.

Why C is Wrong: Vector database IOPS performance measures how quickly the database processes read and write operations. While relevant to RAG system performance, IOPS metrics do not directly explain LLM API cost increases driven by token consumption.

Basic Concept: AI systems that repeatedly query external data sources for similar information during a single report generation process spend significant time on redundant network requests. Caching frequently accessed data locally eliminates this overhead. CompTIA SecAI+ Study Guide covers AI performance optimization strategies in security operations contexts.

Why B is Correct: Downloading the full CVE database locally before starting the cross-referencing process eliminates the need for multiple individual external API calls as the AI processes each OS version ' s patch list. Instead of making thousands of small external queries to look up CVE information for each patch-OS combination, the AI can query the locally cached database internally. This transforms multiple slow external network operations into fast local lookups, dramatically reducing report generation time.

Why A is Wrong: Using an MCP server to run multiple LLM queries simultaneously could improve throughput through parallelization. However, the fundamental bottleneck is external CVE database queries, not LLM processing capacity. Parallelizing LLM calls does not eliminate the external query latency.

Why C is Wrong: Specifying summarization algorithms in the system prompt affects how the AI structures its output. It does not address the time-consuming external data retrieval process that is the actual performance bottleneck in this cross-referencing workflow.

Why D is Wrong: Increasing token limits prevents session restarts for long contexts but does not address the external query latency that makes the report slow to generate. The bottleneck is data retrieval speed, not token limit constraints causing session breaks.

Option B is correct because a human resources AI application processes highly sensitive employee and applicant information and may influence consequential employment decisions. Privacy and security therefore determine whether the system can be deployed responsibly. The design must address data minimization, lawful collection, access control, encryption, retention, auditability, secure model integration, and protection against unauthorized disclosure. It should also evaluate whether training data or outputs expose protected or confidential information and whether human review is required before decisions affect candidates or employees. Option A concerns friendliness and presentation, not the protection of people or organizational data. Option C may improve usability, but visual design cannot compensate for insecure handling of resumes, performance records, or identity data. Option D can make outputs easier to consume, yet brevity and summarization do not control privacy risk or system compromise. The NIST AI Risk Management Framework identifies privacy enhancement, security, resilience, accountability, and transparency as characteristics of trustworthy AI, making privacy and security the controlling considerations in this scenario.

================

Basic Concept: LLM firewalls inspect prompts and responses to identify malicious content, policy violations, and attack attempts. To detect known attack patterns, these systems apply inspection techniques that compare content against established threat indicators. CompTIA SecAI+ Study Guide covers LLM security monitoring and detection techniques.

Why A is Correct: Signature matching compares incoming prompts and outgoing responses against a library of known attack signatures, including common prompt injection patterns, jailbreaking attempts, data exfiltration queries, and known malicious payload strings. When content matches a known attack signature, the LLM firewall can block or flag it. Signature matching is an efficient, proven detection technique for identifying known attack patterns traversing an LLM firewall.

Why B is Wrong: Distributed denial-of-service is itself a type of attack, not a detection technique. DDoS floods systems with traffic to cause service unavailability and has no role in detecting attacks through an LLM firewall.

Why C is Wrong: Translation analysis involves converting content between languages or formats. While it might be used to detect obfuscated attacks in different encodings, it is not a standard detection technique for identifying attacks crossing an LLM firewall.

Why D is Wrong: Vulnerability enumeration systematically identifies and catalogs vulnerabilities in systems or applications during security assessments. It is an assessment activity used to discover weaknesses, not a real-time detection technique for attacks traversing an LLM firewall.

Basic Concept: Different regulatory and standards bodies address different aspects of technology governance. For AI-specific compliance guidance that addresses the unique characteristics of AI systems including transparency, fairness, accountability, and societal impact, a framework specifically designed for AI is required. CompTIA SecAI+ Study Guide identifies OECD as a key source of AI-specific compliance guidance.

Why A is Correct: The OECD AI Principles and Recommendation on AI provide internationally recognized, AI-specific guidance on compliance with responsible AI values including transparency, accountability, robustness, security, safety, and human-centric values. The OECD has developed a dedicated framework specifically addressing the compliance considerations unique to AI systems across sectors and national boundaries, making it the most AI-specific compliance guidance option listed.

Why B is Wrong: ISO 27001 is a general information security management standard addressing broad organizational security controls. It is not AI-specific and does not address the unique compliance considerations of AI transparency, fairness, or algorithmic accountability.

Why C is Wrong: PCI DSS is a payment card industry security standard focused on protecting payment card data. It has no AI-specific compliance provisions and is limited to financial transaction security requirements.

Why D is Wrong: GDPR is a European data protection regulation focused on personal data privacy rights and obligations. While relevant to AI systems that process personal data, GDPR is a privacy regulation rather than AI-specific compliance guidance addressing the full spectrum of AI governance considerations.

Basic Concept: When AI models are deployed in production, they interact with real data including sensitive business information, personal data, and confidential records. The intersection of AI capabilities and sensitive data creates significant security risks. CompTIA SecAI+ Exam Objectives identify data exposure as the primary production security risk for AI deployments.

Why D is Correct: Data exposure is the primary security risk in production AI deployments. AI models in production process sensitive data through queries and responses, and vulnerabilities such as prompt injection, model inversion attacks, insecure output handling, and misconfigured access controls can expose confidential training data, user PII, proprietary information, or system credentials. The consequences include regulatory violations, legal liability, and reputational damage, making data exposure the most critical ongoing security concern.

Why A is Wrong: GPU acceleration is a performance optimization technique that uses graphics processors for faster AI computation. While hardware security is important, GPU acceleration itself is not a security risk — it is a performance feature that does not inherently expose data.

Why B is Wrong: Model overfitting is a model quality issue where a model performs poorly on new data after memorizing training data too specifically. While it can indirectly contribute to data memorization, it is primarily a performance and generalization concern during development rather than a primary production security risk.

Why C is Wrong: Model encryption is a security control used to protect AI model weights from unauthorized access, not a risk itself. Framing a protection mechanism as a primary risk conflates controls with threats.