Exam for engine

Basic Concept: Assessing attack probability and impact for ML systems requires a resource specifically built to catalog real-world adversarial attacks against AI and ML systems, including documented techniques with associated impact information. CompTIA SecAI+ Exam Objectives identify MITRE ATLAS as the authoritative ML threat landscape resource.
Why B is Correct: MITRE ATLAS is specifically designed as a comprehensive knowledge base of adversarial tactics, techniques, and case studies targeting AI and ML systems. It catalogs real-world attacks with associated probability factors derived from actual incidents and provides impact assessments for various attack types including data poisoning, model evasion, model extraction, and inference attacks. This directly enables the probability and impact assessment the team requires.
Why A is Wrong: The CVE AI working group focuses on identifying and cataloging specific vulnerability instances in AI software components. While useful for vulnerability management, it does not provide the comprehensive threat landscape coverage with probability and impact assessments for ML-specific attack tactics that ATLAS provides.
Why C is Wrong: The MIT risk repository is an academic resource cataloging general AI-related risks. It is research-oriented and does not provide the practitioner-focused, operational attack taxonomy and case study library that MITRE ATLAS offers for ML threat modeling.
Why D is Wrong: OWASP provides application security guidance including the OWASP LLM Top 10. While valuable for LLM-specific risks, OWASP does not provide the comprehensive ML threat landscape coverage or the probability and impact data that MITRE ATLAS offers for assessing the full spectrum of ML attack scenarios.

Fine-tuning allows an AI model to adapt to unstructured data (such as text, audio, or images) by retraining it on domain-specific datasets. This process improves the model’s ability to handle and generate outputs aligned with the unstructured data context.

User and Entity Behavior Analytics detects deviations from normal patterns.

Basic Concept: Before deploying an AI chatbot that has specific behavioral requirements – no harmful content, professional language, and accurate responses – organizations must verify that the controls designed to enforce these requirements actually work as intended. This pre-deployment verification is essential for customer-facing systems. CompTIA SecAI+ Study Guide covers guardrail testing as a required pre- deployment activity.
Why C is Correct: Guardrail testing and validation specifically verifies that the content filtering, safety controls, and behavioral constraints implemented in the chatbot function correctly before customer exposure.
This involves systematically testing with edge cases, adversarial prompts, and boundary conditions to confirm that harmful content is blocked, language remains professional, and responses are accurate. This directly validates the three requirements stated in the question.
Why A is Wrong: Data labeling and classification is a data preparation activity performed during model training and development. By the time the chatbot is fully developed, this work should already be complete.
Why B is Wrong: Model auditing and evaluation assesses overall model performance, accuracy, and compliance at a broader level. While important, it does not specifically verify that the guardrails enforcing the three behavioral requirements work correctly for the specific failure modes customers might trigger.
Why D is Wrong: Regression modeling and minimization refers to statistical techniques for continuous outcome prediction. This is not a relevant pre-deployment activity for a conversational chatbot requiring behavioral safety validation.

Providing examples in a prompt is referred to as one-shot prompting when a single example is given and multi-shot prompting when multiple examples are provided.

Explanation:
Part 1 – Select the protocol or cipher
System component
Select
API gateway
TLS 1.2
Database storage
CAMELLIA
AI model storage
HMAC-SHA512
Part 2 – Select the data-protection technique
Enter the techniques from the first row to the fifth row in this exact order:
Row Data modification Select
1 The name field is removed, while patient_id and dob remain De-identification
2 ip_addr and name are removed, leaving cookie and uid Anonymization
3 The card number is replaced by 0x0193828829 Tokenization
4 sensitivity: ” SECRET ” is added Classification
5 Part of the PIN is replaced by XXXX Masking
See Explanation
Why these are the intended answers
API gateway # TLS 1.2
The API gateway handles data moving between the client and backend systems. TLS is the only listed transport-security protocol and therefore protects the data in transit . OWASP recommends encrypting sensitive data in transit by using TLS with secure parameters.
Database storage # CAMELLIA
CAMELLIA is a symmetric block cipher suitable for encrypting substantial quantities of stored data. It is therefore the valid storage-encryption choice among the listed options.
Do not select AES-512 . AES-512 is not a standardized AES variant. NIST defines only AES-128, AES-192, and AES-256 .
AI model storage # HMAC-SHA512
The scenario separately emphasizes protection against loss or modification of intellectual property. HMAC- SHA512 supplies message authentication and integrity verification, allowing unauthorized modification of the AI model to be detected. HMAC is not confidentiality encryption, but it is the most appropriate listed additional control for protecting model integrity. OWASP specifically identifies HMACs as cryptographic controls for stored-data integrity.
Why the other options are not selected
* SHA-2 512: Hashing only; no secret key and no encryption.
* Elliptical curve: A family of cryptographic techniques, not a specific storage or transport protocol.
* ECDH: Used for key agreement, not direct bulk-data encryption.
* AES-512: Invalid AES key size.
* RSA-2048: Primarily used for asymmetric encryption, signatures, or key transport; inefficient for bulk database or model encryption.
* CAMELLIA: Appropriate symmetric encryption for stored data.
* HMAC-SHA512: Integrity and authenticity, not confidentiality.
Final Part 2 order
* De-identification
* Anonymization
* Tokenization
* Classification
* Masking
Explanation:
De-identification removes an explicitly identifying field-in this case, the person’s name-while retaining other fields needed for processing. The remaining patient ID and date of birth could potentially permit re- identification when combined with other information, so this is de-identification rather than complete anonymization. OWASP describes de-identification as deleting, scrambling, or pseudonymizing direct and indirect identifiers.
Anonymization removes identifying attributes so that the displayed record is not directly tied to the named individual. Here, both the name and IP address are removed.
Tokenization substitutes a sensitive value with a non-sensitive representative token. The original payment- card number is replaced with the hexadecimal-style value 0x0193828829. OWASP recognizes tokenization as a method for reducing exposure of stored sensitive data.
Classification labels information according to sensitivity. Adding sensitivity: ” SECRET ” does not conceal or transform the PIN; it categorizes the record so appropriate controls can be applied. OWASP recommends classifying processed, stored, and transmitted data and applying controls based on that classification.
Masking obscures only part of a sensitive value while preserving its general format. Changing 999-99-9999 to 999-99-XXXX is partial masking.

The penetration test shows that the system accepts arbitrary commands like deleteBuckets or listPermissions, which could lead to privilege abuse. The most effective control is least privilege, ensuring the service account only has access to what is strictly necessary (e.g., reading files) and not sensitive operations like deleting buckets or altering permissions.

Basic Concept: Before implementing any security controls for an AI system, especially in a highly regulated sector such as healthcare, a risk assessment must first be conducted to understand the specific threats, vulnerabilities, regulatory obligations, and compliance requirements. CompTIA SecAI+ Study Guide emphasizes risk assessment as the foundational first step in any AI security program.
Why C is Correct: A risk assessment identifies what assets need protection, what threats exist, what regulations apply such as HIPAA for healthcare AI, and what the potential impact of various failure modes would be. In healthcare, this is especially critical given the sensitivity of patient records and strict regulatory requirements. The risk assessment results then inform and prioritize all subsequent security control implementations.
Why A is Wrong: Implementing prompt firewalls is a technical security control appropriate after risks have been identified and prioritized. Deploying controls before conducting a risk assessment may address the wrong threats or miss critical vulnerabilities.
Why B is Wrong: Role-based access management is a security control that should be designed based on identified roles and access requirements discovered during risk assessment. It is an implementation step, not the first step.
Why D is Wrong: Using a secure communication channel is a specific technical control for data in transit.
While important, it addresses only one specific risk and should be implemented as part of a comprehensive security strategy informed by a prior risk assessment.

The communications plan specifies notification roles and timelines.

Basic Concept: Prompt injection occurs when malicious content embedded in user input manipulates an LLM
‘ s behavior, causing it to leak sensitive data, bypass restrictions, or execute unintended actions. Preventing such attacks requires mechanisms that inspect and filter content at the prompt level. CompTIA SecAI+ covers LLM-specific security controls extensively.
Why A is Correct: Guardrails are purpose-built controls that inspect, filter, and constrain both input prompts and output responses in LLM systems. They can detect sensitive data patterns such as credit card numbers, block prompt injection payloads, enforce content policies, and prevent the model from processing or outputting restricted information. Guardrails are the primary LLM-native defense against prompt injection as cited in the CompTIA SecAI+ Study Guide.
Why B is Wrong: Antivirus software detects known malware signatures in files and executables. It does not inspect or understand the semantic content of LLM prompts and cannot detect or block prompt injection attacks.
Why C is Wrong: A WAF operates at the HTTP layer inspecting web requests and responses against rule sets.
While it can block some patterns, it lacks the contextual intelligence to understand LLM prompt semantics and cannot prevent sophisticated injection attacks.
Why D is Wrong: Role-based access control manages who can access which resources. It controls authorization but does not inspect the content of prompts to prevent injection attacks once a user has legitimate access.

Basic Concept: Domain-specific AI chatbots can produce contextually inappropriate responses when they lack sufficient domain grounding to disambiguate terms that have different meanings in different contexts.
Guardrails can enforce domain-appropriate interpretation and response constraints. CompTIA SecAI+ Study Guide covers guardrails as a mechanism for maintaining model behavioral boundaries.
Why A is Correct: Configuring guardrails allows the organization to enforce domain-specific behavioral constraints on the chatbot, ensuring it interprets ambiguous terms within the correct technical context.
Guardrails can include context-aware rules that recognize when a query is in a cybersecurity context and constrain the model to provide domain-appropriate responses. This directly addresses the issue of the model providing biologically-framed responses to a technical cybersecurity question.
Why B is Wrong: Encrypting model weights at rest protects the model parameters from unauthorized access or modification. It is a data protection control for model intellectual property and does not influence how the model interprets or responds to domain-specific queries at inference time.
Why C is Wrong: Model access controls restrict who can query and modify the model. They manage authorization at the user and system level but do not enforce domain-appropriate response constraints or prevent contextually incorrect answers from being generated.
Why D is Wrong: Prompt templates provide structured, reusable formats for common queries. While they can help standardize how cybersecurity questions are asked, they require users to use the template and do not provide real-time enforcement of domain-appropriate response generation for all input variations.

Signature matching allows the detection of known malicious patterns, inputs, or behaviors targeting an LLM firewall. It is an effective technique for identifying and blocking prompt injection or other recognized attack methods.

Basic Concept: LLM API pricing is primarily based on token consumption – the number of tokens processed in both input prompts and output responses. Controlling token usage is the most direct lever for managing and reducing LLM API costs. CompTIA SecAI+ Study Guide covers AI cost management and resource controls under securing AI systems.
Why D is Correct: Adjusting token limits directly caps the maximum number of tokens used per request for both input and output. By setting appropriate token limits, the organization prevents excessively long prompts or verbose responses from consuming unnecessary tokens, directly translating to lower API costs and providing hard budget control.
Why A is Wrong: Prompt templates standardize how queries are structured, which can indirectly improve efficiency. However, they do not enforce a hard cap on token usage and cannot prevent costs from escalating with large volumes or verbose responses.
Why B is Wrong: Increasing CPU and memory addresses computational infrastructure performance on the client side. LLM API costs are billed by the API provider based on token usage, not on the client ‘ s hardware resources.
Why C is Wrong: Reducing model size means using a smaller, less powerful model version. While this may lower cost per token, it is a model selection decision, not an ongoing operational control that can be adjusted to manage cost in real time.

Basic Concept: Generative AI chatbots interact with users in natural language and may access organizational knowledge bases, databases, or prior conversations. The conversational nature of these systems creates unique risks around sensitive information disclosure. CompTIA SecAI+ Study Guide ranks data leakage as the primary security concern for generative AI chatbots.
Why B is Correct: Data leakage occurs when a generative AI chatbot inadvertently reveals sensitive information including PII, confidential business data, intellectual property, training data, or system configurations in its responses. This can happen through prompt injection attacks, insufficient output filtering, or the model memorizing and reproducing sensitive training data. The impact is immediate, potentially irreversible, and can result in regulatory violations, competitive disadvantage, and reputational damage.
Why A is Wrong: Overly permissive access is a contributing factor that can exacerbate data leakage but is an access control design issue rather than the most directly impactful runtime risk of operating a generative AI chatbot.
Why C is Wrong: Weak encryption is a data protection concern for data in transit or at rest. While important, it is a configuration issue separate from the generative AI chatbot ‘ s core operational risks and is not specific to chatbot technology.
Why D is Wrong: Model validation ensures a model performs as expected before deployment. While important for quality assurance, it is a development lifecycle activity rather than an ongoing operational security risk associated with running a chatbot.

Polymorphic malware changes its code structure while maintaining functionality.

Basic Concept: Suspicious or unexpected AI system outputs are often caused by malicious or malformed user inputs that exploit the AI ‘ s input processing. Validating and sanitizing user inputs before they reach the AI model prevents many classes of attacks including prompt injection, data exfiltration attempts, and input manipulation. CompTIA SecAI+ Study Guide emphasizes input validation as a foundational AI security control.
Why B is Correct: Implementing user input validation applies checks and constraints to all user-submitted content before it is processed by the AI system. Input validation can enforce length limits, detect injection patterns, filter disallowed characters or command structures, and ensure inputs conform to expected formats.
By rejecting malicious or malformed inputs at the entry point, this control prevents them from reaching the model and causing the suspicious outputs observed.
Why A is Wrong: Data sanitization processes data to remove harmful elements and is closely related to validation. However, input validation is broader and more proactive, checking conformance to rules before processing, while sanitization typically operates during or after processing. Validation at the input boundary is the more appropriate first-line control.
Why C is Wrong: Monitoring logs for attack keywords is a detective control that identifies attacks after they have already affected the system. It does not prevent suspicious outputs from being generated in the first place.
Why D is Wrong: Hardening the Model Context Protocol server improves the security of the infrastructure hosting the AI components. While important for infrastructure security, it does not directly validate or inspect the content of user inputs that cause suspicious outputs.