Get CompTIA CY0-001 Exam Practice Questions - Real and Updated

Answer : B

Basic Concept: Suspicious or unexpected AI system outputs are often caused by malicious or malformed user inputs that exploit the AI's input processing. Validating and sanitizing user inputs before they reach the AI model prevents many classes of attacks including prompt injection, data exfiltration attempts, and input manipulation. CompTIA SecAI+ Study Guide emphasizes input validation as a foundational AI security control.

Why B is Correct: Implementing user input validation applies checks and constraints to all user-submitted content before it is processed by the AI system. Input validation can enforce length limits, detect injection patterns, filter disallowed characters or command structures, and ensure inputs conform to expected formats. By rejecting malicious or malformed inputs at the entry point, this control prevents them from reaching the model and causing the suspicious outputs observed.

Why A is Wrong: Data sanitization processes data to remove harmful elements and is closely related to validation. However, input validation is broader and more proactive, checking conformance to rules before processing, while sanitization typically operates during or after processing. Validation at the input boundary is the more appropriate first-line control.

Why C is Wrong: Monitoring logs for attack keywords is a detective control that identifies attacks after they have already affected the system. It does not prevent suspicious outputs from being generated in the first place.

Why D is Wrong: Hardening the Model Context Protocol server improves the security of the infrastructure hosting the AI components. While important for infrastructure security, it does not directly validate or inspect the content of user inputs that cause suspicious outputs.

Answer : D

Basic Concept: ISO develops management system standards for various organizational domains. For organizations building and managing AI systems in a structured, compliant manner, the appropriate ISO standard must specifically address the unique requirements of AI management systems including risk governance, lifecycle management, and accountability. CompTIA SecAI+ Exam Objectives cover ISO standards applicable to AI governance.

Why D is Correct: ISO 42001 (Artificial Intelligence Management System --- AIMS) is the international standard specifically designed for building and managing AI management systems. It provides compliance requirements and guidance for establishing, implementing, maintaining, and continually improving an organization's AI management system, addressing AI-specific concerns including risk management, AI system governance, accountability, transparency, and continuous improvement for AI applications.

Why A is Wrong: ISO 20000 is the Information Technology Service Management (ITSM) standard covering IT service delivery processes, SLAs, incident management, and change management. It is not an AI management standard and does not address AI-specific governance requirements.

Why B is Wrong: ISO 27001 is the Information Security Management System (ISMS) standard addressing organizational information security risk management through controls and policies. While relevant to data security in AI systems, it does not contain requirements specifically for building an AI management system.

Why C is Wrong: ISO 27018 is a code of practice for protection of personally identifiable information (PII) in public cloud computing environments, extending ISO 27001 for cloud privacy. It addresses cloud PII protection rather than AI system management compliance requirements.

Answer : D

Basic Concept: When a storage misconfiguration leads to data exposure, the question is which encryption type would have protected the confidentiality of data stored in that misconfigured storage. The three states of data --- at rest, in transit, and in use --- each require different encryption mechanisms. CompTIA SecAI+ Study Guide covers encryption states and their applicability to AI data protection.

Why D is Correct: Encryption at rest protects data stored in databases, file systems, and storage media by encrypting it so that even if unauthorized parties gain access to the storage through a misconfiguration, the data remains unreadable without the decryption key. Since the exposure resulted from a storage misconfiguration that allowed access to stored data, encryption at rest would have maintained confidentiality of the customer information despite the misconfiguration granting storage access.

Why A is Wrong: Model encryption specifically protects AI model weights and parameters from unauthorized access. It does not protect customer data stored in databases or data stores associated with the AI system.

Why B is Wrong: Encryption in transit protects data moving between components over networks. It does not protect data stored at rest in misconfigured storage that is accessed directly rather than over a network connection.

Why C is Wrong: Encryption in use (homomorphic encryption or confidential computing) protects data while it is being actively processed in memory. It addresses runtime processing security, not the confidentiality of data stored in misconfigured storage that is not currently being processed.

Answer : A

Basic Concept: Managing security risks in AI model training requires a comprehensive framework specifically designed for AI risk identification, assessment, and mitigation across the entire AI lifecycle including data collection, training, and deployment. CompTIA SecAI+ Study Guide identifies NIST AI RMF as the primary resource for AI-specific risk management.

Why A is Correct: The NIST AI Risk Management Framework is purpose-built for managing risks throughout the AI lifecycle. It provides structured guidance for identifying, assessing, and mitigating risks specific to AI systems including training data quality, model bias, data poisoning, and training pipeline vulnerabilities. Its AI-specific scope makes it the most appropriate framework for managing model training security issues.

Why B is Wrong: ISO 27001 is an information security management system standard focused on general IT security controls and risk management. It does not specifically address AI model training risks, data pipeline integrity, or ML-specific vulnerabilities.

Why C is Wrong: The OECD provides high-level AI governance principles and policy recommendations at an international level. It offers ethical and policy guidance but does not provide operational risk management guidance for securing AI model training processes.

Why D is Wrong: GDPR is a European data protection regulation focused on personal data privacy, consent, and individual rights. While relevant to training data governance, it does not address the technical security risks of model training pipelines or ML system vulnerabilities.

Answer : B

Basic Concept: Securing AI systems requires a structured, end-to-end approach that addresses security at every phase of the AI model's lifecycle from data collection through training, testing, deployment, and ongoing monitoring. CompTIA SecAI+ Study Guide identifies the Model Development Life Cycle as the foundational framework for AI system security.

Why B is Correct: A secure Model Development Life Cycle (MDLC) integrates security practices at every stage of AI model development specifically tailored to ML workflows. It encompasses secure data handling, training data validation, model testing for adversarial robustness, secure deployment practices, and ongoing monitoring. Unlike generic software development lifecycles, the MDLC addresses ML-specific risks such as data poisoning, model drift, and adversarial attacks.

Why A is Wrong: Guardrail testing and security validation are important components of the MDLC but represent only the testing phase. They do not encompass the full lifecycle of security practices needed from data acquisition through production monitoring.

Why C is Wrong: Implementing comprehensive security architecture is a broad statement that describes an outcome rather than a specific actionable practice. It does not provide the structured, ML-specific guidance of an MDLC.

Why D is Wrong: A secure SDLC is designed for traditional software development and covers code security, testing, and deployment. While relevant to AI application development, it does not specifically address ML model-specific risks such as training data security, model integrity, and inference-time attacks.