10 free CompTIA SecAI+ CY0-001 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 126 questions. Work through them, then open each answer to check your reasoning.
Get all 126 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following job roles in an organizational governance structure develops a model from business use cases?
Show answer and explanation
Correct answer: D. Data scientist
Data scientists develop predictive models from business use cases and requirements. They translate business problems into machine learning models, working directly with use case specifications to create the model architecture and approach. While platform architects design systems and MLOps engineers operationalize models, the data scientist role is specifically focused on model development from business requirements.
Why the other options are wrong
- A. Platform architects design overall system infrastructure, not develop individual models from use cases.
- B. AI risk analysts focus on identifying and mitigating risks, not developing models from business requirements.
- C. MLOps engineers manage model deployment and operations, not the initial model development from use cases.
Question 2
An administrator, who works for a financial institution, is required to implement data security controls for data at rest within AI systems that involve data disclosure.
Which of the following is the most suitable control?
Show answer and explanation
Correct answer: C. Encryption
Encryption is the most suitable control for protecting data at rest, especially in financial institutions where data disclosure is a concern. Encryption renders data unreadable without the proper decryption keys, providing a fundamental security layer that prevents unauthorized access to sensitive information regardless of how the data is stored or breached.
Why the other options are wrong
- A. Data lineage tracks data flow and origins but does not protect data from disclosure.
- B. Rate limits control access frequency but do not protect the data itself from being read if accessed.
- D. Masking obscures data display but does not prevent access to underlying plaintext data at rest.
Question 3
A security engineer needs to monitor an AI-based system for runtime operations. The engineer is mostly concerned about the visibility of internal activity.
Which of the following is the most appropriate monitoring solution?
Show answer and explanation
Correct answer: D. Enabling stack call and debugging level traces at the function level
function level Enabling stack call and debugging level traces at the function level provides the deepest visibility into internal activity and execution flow of an AI system. This approach captures detailed function-level execution information, variable states, and control flow, which is essential for understanding internal behavior during runtime operations.
Why the other options are wrong
- A. SIEM tools are designed for security event management across infrastructure but may not provide sufficient granularity into AI model internal operations.
- B. WAF with header logging focuses on web layer attacks and request/response headers, not internal AI system activity.
- C. Relying solely on vendor controls and prompt input monitoring does not provide visibility into the internal computational processes and function-level execution of the AI system.
Question 4
Which of the following should an auditor reference when reviewing a company’s human resources AI systems for legal non-compliance?
Show answer and explanation
Correct answer: C. European Union (EU) AI Act
The European Union AI Act is the most directly applicable legal framework for reviewing HR AI systems for compliance. This regulation specifically addresses AI systems used in employment and hiring decisions, establishing legal requirements for high-risk AI applications in human resources. It provides the binding legal standards that auditors must reference for legal compliance in this context.
Why the other options are wrong
- A. OECD standards provide guidance and principles but are not binding legal requirements like the EU AI Act.
- B. NIST RMF is a risk management framework for the US and provides best practices but is not the legal standard for EU HR AI systems.
- D. ISO standards provide general quality and management frameworks but do not specifically address the legal requirements for AI systems in HR.
Question 5
An airline corporation wants to implement a chatbot application using a large language model (LLM) so its customers:
Can ask question and receive answers about flight details.
Have the option to upload files.
Which of the following security controls should the airline use to protect against malicious input and unauthorized use beyond the service-level agreement? (Choose two.)
Show answer and explanation
Correct answer: A, D
A. Prompt guardrails D. Model token quotas Prompt guardrails prevent malicious input by filtering and validating user prompts before they reach the model, protecting against prompt injection and harmful queries. Model token quotas limit resource usage and prevent unauthorized use beyond the service agreement by capping the number of tokens each user or session can consume. Together, these controls address both the malicious input threat and the unauthorized usage concern specific to the airline's requirements.
Why the other options are wrong
- B. Role-based access controls manage who can access the system but do not specifically protect against malicious input content or token-based overuse.
- C. Firewall rules control network traffic but do not address malicious input within valid API requests or token consumption limits.
Question 6
A security operations center (SOC) has a very high volume of logs and alerts. The manager proposes the implementation of machine learning (ML) system to help with triage.
Which of the following tasks is most suitable?
Show answer and explanation
Correct answer: C. Identifying and classifying alerts
Identifying and classifying alerts is the most suitable ML task for handling high-volume alert triage. Machine learning excels at pattern recognition and categorization, allowing the system to automatically sort and classify alerts by severity, type, and relevance. This reduces noise and helps SOC teams focus on the most critical incidents, directly addressing the high-volume problem.
Why the other options are wrong
- A. Applying filters is a static, rule-based task that does not leverage ML capabilities and requires manual filter creation.
- B. Automatically patching systems is a remediation action, not a triage task, and carries operational risk that requires human oversight.
- D. Summarizing alert content is a generative task but does not address the core triage challenge of identifying and prioritizing which alerts matter most.
Question 7
An organization recently created a custom model that integrates with a language model (LLM). The developer notices that the application programming interface (API) costs have increased.
Which of the following is the best control to reduce cost?
Show answer and explanation
Correct answer: D. Adjusting token limits
Adjusting token limits directly controls API costs for LLM integrations, as most LLM providers charge per token consumed. By setting appropriate token limits on requests, responses, or user sessions, the organization can prevent excessive token usage that drives up costs while maintaining service functionality.
Why the other options are wrong
- A. Prompt templates improve consistency but do not directly reduce token consumption or API costs.
- B. Increasing CPU and memory increases infrastructure costs rather than reducing LLM API costs.
- C. Reducing model size may impact quality and capabilities; token limits are a more direct cost control mechanism.
Question 8
A security administrator needs to improve an AI model. During an initial investigation, the administrator notices that two successive login features are recorded every day, and then a successful login occurs after a specific time interval. All the successful login attempts have been during office hours.
Which of the following techniques should the administrator use to improve the AI model’s security?
Show answer and explanation
Correct answer: B. Pattern recognition
Pattern recognition is the technique that identifies the recurring pattern of two failed login attempts followed by a successful login during office hours. This behavioral pattern detection is essential for improving the model's ability to distinguish normal from anomalous login behavior. Pattern recognition can identify this repeating sequence and potentially flag deviations from it as security risks.
Why the other options are wrong
- A. Access management controls who can access systems but does not analyze the pattern of login attempts and their timing.
- C. Signature matching looks for known malicious indicators or hashes, not behavioral patterns in login sequences.
- D. Vulnerability analysis identifies weaknesses in systems or code, not behavioral patterns in user activity and login attempts.
Question 9
Which of the following is the most concerning risk for a company that allows corporate end users to use public-facing large language models (LLMs)?
Show answer and explanation
Correct answer: C. Data security regulatory violations
When corporate end users input data into public-facing LLMs, that data may be retained, used for model training, or accessed by third parties, creating exposure of confidential business information and personal data. This violates data protection regulations like GDPR, CCPA, and HIPAA. While hallucinations and malicious code are real concerns, they affect output quality rather than regulatory compliance. Outdated acceptable use policies are a governance issue but less immediately threatening than direct data exposure.
Why the other options are wrong
- A. Hallucinations reduce output quality but don't create regulatory or compliance violations.
- B. Outdated policies are a governance problem, not the most acute risk compared to data exposure.
- D. Malicious code generation is a capability concern, not the primary risk from data submission to public services.
Question 10
Which of the following requires developers to harden infrastructure to protect AI systems?
Show answer and explanation
Correct answer: D. Configuration standards
Configuration standards establish baseline security requirements, secure defaults, and hardening procedures that developers must implement to protect AI systems from attack, unauthorized access, and data breaches. Intake processes handle onboarding, acceptable use policies define user behavior rules, and development guidelines provide coding best practices, but only configuration standards directly mandate the technical hardening of infrastructure.
Why the other options are wrong
- A. Intake processes manage initial requirements gathering, not infrastructure hardening.
- B. Acceptable use policies define user conduct, not infrastructure security controls.
- C. Development guidelines cover coding practices but configuration standards specifically mandate hardening deployment and infrastructure setup.
That was 10 of 126.
The full CompTIA SecAI+ CY0-001 pack has all 126 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.