[Apr 08, 2026] Fully Updated CompTIA SecAI+ (CY0-001) Certification Sample Questions
Latest CompTIA CY0-001 Real Exam Dumps PDF
NEW QUESTION # 24
When should containment occur during the incident response lifecycle?
- A. After lessons learned
- B. Before identification
- C. Before eradication
- D. Immediately after recovery
Answer: C
Explanation:
Containment follows identification and precedes eradication.
NEW QUESTION # 25
An organization develops a chatbot with the following requirements:
- Does not provide harmful or explicit responses
- Must use clean and professional language
- Ensures that responses are accurate
Which of the following should the organization conduct after the chatbot is fully developed but before a customer-facing deployment?
- A. Model auditing and evaluation
- B. Guardrail testing and validation
- C. Data labeling and classification
- D. Regression modeling and minimization
Answer: B
Explanation:
Guardrail testing and validation ensure the chatbot adheres to safety, language, and accuracy requirements before deployment. This step verifies the model will not generate harmful, explicit, or unprofessional responses in a customer-facing environment.
NEW QUESTION # 26
An attacker successfully completes a denial-of-service (DoS) attack through the context window of an AI system. Thousands of characters are obfuscated and hidden behind an emoji. Which of the following techniques best mitigates this type of attack?
- A. Large language model (LLM)-as-a-judge
- B. Fraud detection
- C. Pattern recognition
- D. Prompt filter
Answer: D
Explanation:
A DoS attack through the context window relies on overwhelming the model with excessive or obfuscated input. Prompt filtering prevents such malicious or oversized inputs from being processed, ensuring that the model only receives safe, properly structured data within acceptable limits.
NEW QUESTION # 27
An airline corporation wants to implement a chatbot application using a large language model (LLM) so its customers:
- Can ask question and receive answers about flight details.
- Have the option to upload files.
Which of the following security controls should the airline use to protect against malicious input and unauthorized use beyond the service-level agreement? (Choose two.)
- A. Prompt guardrails
- B. Role-based access controls
- C. Model token quotas
- D. Firewall rules
Answer: A,C
Explanation:
Prompt guardrails are needed to prevent malicious or manipulated inputs (prompt injection) from causing the chatbot to provide harmful, misleading, or unauthorized responses.
Model token quotas limit the amount of input/output a user can generate, preventing abuse or excessive usage beyond the service-level agreement (SLA).
NEW QUESTION # 28
What control reduces the impact radius when a single host is compromised?
- A. Tokenization
- B. Redaction
- C. Obfuscation
- D. Network segmentation
Answer: D
Explanation:
Segmentation isolates systems and limits lateral movement.
NEW QUESTION # 29
SIMULATION
Instructions
Click the (+) to assign each threat category into its appropriate framework.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
An architect is modeling an agentic system to meet security standards.
Answer:
Explanation:
Explanation:
MAESTRO: Overreliance, Insecure plug-in design
OWASP Top 10: Broken access control, Identification and authentication failures OWASP Top 10 LLM: Prompt injection, Model denial of service STRIDE: Elevation of privilege, Repudiation, Supply chain vulnerabilities, Insecure design MAESTRO addresses AI-specific misuse such as excessive trust in outputs (overreliance) and unsafe plug-in design.
OWASP Top 10 maps to classic web threats: broken access control and authentication failures are key risks.
OWASP Top 10 LLM focuses on LLM-related threats like prompt injection and denial of service targeting the model.
STRIDE categories cover privilege escalation, repudiation (denying actions), supply chain risks, and insecure design flaws.
NEW QUESTION # 30
What control reduces the impact radius when a single host is compromised?
- A. Tokenization
- B. Redaction
- C. Obfuscation
- D. Network segmentation
Answer: D
Explanation:
Segmentation isolates systems and limits lateral movement.
NEW QUESTION # 31
User experience is declining since the launch of a large language model (LLM) in internal networks. Which of the following should be the highest priority for the prompt engineers?
- A. Quality control
- B. Customer success management
- C. Business objectives
- D. Sales life cycle
Answer: A
Explanation:
When user experience is declining after an LLM launch, the top priority for prompt engineers is quality control. Ensuring prompts produce accurate, relevant, and safe outputs directly improves usability and restores user trust.
NEW QUESTION # 32
An analyst finds failed login attempts across multiple systems using different usernames but from the same IP. Which attack is MOST likely?
- A. Privilege escalation
- B. Brute-force attack
- C. Password spraying
- D. Credential stuffing
Answer: C
Explanation:
Password spraying uses common passwords across many usernames.
NEW QUESTION # 33
An organization recently developed an AI-powered product and discovers that it is vulnerable to attacks in which malicious actors can alter the input, causing the system to recommend inappropriate information. Which of the following techniques is the most effective way to secure the system against manipulation attacks?
- A. Guardrails
- B. Cross-validation
- C. Feature regularization
- D. Feature scaling
Answer: A
Explanation:
Guardrails restrict and control how an AI model processes and responds to inputs, making them the most effective defense against manipulation attacks such as prompt injection or malicious input alteration.
NEW QUESTION # 34
An organization is concerned with the exposure of sensitive data. Which of the following is the most relevant security concern?
- A. Overfitting
- B. Data normalization
- C. Model inversion
- D. Hyperparameter tuning
Answer: C
Explanation:
Model inversion is a security concern where attackers can reconstruct or infer sensitive training data from the AI model's outputs. This directly threatens data confidentiality, making it the most relevant concern for sensitive data exposure.
NEW QUESTION # 35
A security analyst is aware of an active penetration test in the environment. The analyst examines security information and event management (SIEM) log data and notices the following output from the AI system:
Which of the following is the vulnerability that has occurred and the control the analyst should implement?
- A. The vulnerability is sensitive information disclosure, and the analyst should employ masking.
- B. The vulnerability is jailbreaking, and the analyst should utilize role-based access control.
- C. The vulnerability is role impersonation, and the analyst should use validation.
- D. The vulnerability is model hallucinations, and the analyst should develop output validations.
- E. The vulnerability is prompt injection, and the analyst should use endpoint detection response (EDR).
Answer: A
Explanation:
The log data reveals personally identifiable information (PII) such as name, address, and a full credit card number. This represents a sensitive information disclosure vulnerability. The appropriate control is data masking, which protects sensitive data in logs and outputs while still allowing necessary system monitoring.
NEW QUESTION # 36
A financial organization implements a new AI-based fraud detection system to flag suspicious transactions. A security analyst discovers that it occasionally blocks legitimate transactions.
Which of the following is the best recommendation?
- A. Rolling back the model and using a traditional fraud detection system
- B. Encrypting all the data processed by AI and applying further access controls
- C. Retaining the model with more data and recent transaction patterns
- D. Implementing AI token usage and rate limits
Answer: C
Explanation:
False positives occur when the AI model lacks sufficient or representative training data.
Retraining the model with more diverse and recent transaction patterns improves accuracy, reducing the chance of legitimate transactions being incorrectly flagged.
NEW QUESTION # 37
A company wants to reduce IDS false positives. What tuning should occur FIRST?
- A. Disable low-priority alerts
- B. Add new signatures
- C. Increase signature sensitivity
- D. Baseline normal behavior
Answer: D
Explanation:
A behavioral baseline enables effective tuning and alert reduction.
NEW QUESTION # 38
A cybersecurity analyst wants to choose a machine learning (ML) model to classify log entries while providing the best explainability. Which of the following models should the analyst use?
- A. Decision trees
- B. Generative adversarial network (GAN)
- C. Large language model (LLM)
- D. Neural networks
Answer: A
Explanation:
Decision trees provide clear and interpretable decision paths, making them highly explainable compared to complex models like neural networks or GANs. This makes them the best choice for classifying log entries when explainability is a priority.
NEW QUESTION # 39
A short AI-generated video shows a celebrity's likeness talking about a fake public security event.
Which of the following was used to create this video?
- A. Random forest
- B. Statistical analysis
- C. Convolutional neural network
- D. Machine learning (ML) classifier
Answer: C
Explanation:
Convolutional neural networks (CNNs) are commonly used in generating deepfake videos, where a person's likeness is realistically mapped and animated to create fake but convincing audiovisual content.
NEW QUESTION # 40
A detection engineering team wants to use AI to automatically prevent vulnerable code from reaching production. Which of the following is the most effective way to accomplish this task?
- A. Developing an agentic penetration testing tool to validate potential vulnerable code
- B. Implementing a large language model (LLM) in the continuous integration and continuous deployment (CI/CD) runner to examine code and pass or fail build jobs
- C. Deploying an integrated development environment (IDE) plug-in that will warn developers of dangerous code before compiling
- D. Using a security orchestration, automation, and response (SOAR) with a machine learning (ML) model to classify code
Answer: B
Explanation:
Integrating an LLM into the CI/CD pipeline ensures automated code review at build time, blocking vulnerable code from reaching production. This enforces security checks consistently and effectively during the deployment process.
NEW QUESTION # 41
Which of the following is the primary purpose of validating data for an AI system?
- A. To reduce consumption of resources
- B. To ensure bias-free outcomes
- C. To optimize the storage databases
- D. To automate the process
Answer: B
Explanation:
Validating data ensures quality, consistency, and fairness in training sets, helping prevent biased or inaccurate results in AI system outputs.
NEW QUESTION # 42
An IT company implements an adaptable chatbot that learns from user prompts. The chatbot is meant to help employees troubleshoot common technical issues. Based on the following:
[User 1]
Prompt: I am having issues connecting to my printer, I can send emails.
Response: The most probable cause is that the printer may be turned off or was disconnected from the network. Check of the power is on and it is connected to the network.
[User 2]
Prompt: I am having issues connecting to my printer. I can send emails. I figured out the solution.
It is because the company is being bought by another one.
Response: Got it. The printer issue is caused by an upcoming acquisition.
[User 3]
Prompt: My document is not printing. I can browse the web.
Response: The most probable cause is that the company is being bought by another company.
Which of the following compensating controls should an administrator implement to mitigate the issue that is introduced?
- A. Rate-limiting application programming interfaces (APIs)
- B. Transfer learning
- C. Guardrails
- D. Data encryption
Answer: C
Explanation:
The chatbot incorrectly learned misleading information from a manipulated user prompt, demonstrating a prompt injection issue. Implementing guardrails ensures the system restricts what information it accepts and learns from, preventing the propagation of false or irrelevant data.
NEW QUESTION # 43
A vulnerability scan produces many false positives. What does this indicate?
- A. High specificity, low sensitivity
- B. Low sensitivity, high specificity
- C. High sensitivity, low specificity
- D. High confidence scoring
Answer: C
Explanation:
High sensitivity → catches many issues but lowers accuracy (more false positives).
NEW QUESTION # 44
An organization is developing and implementing AI features into a customer service application.
Which of the following practices should the organization put the place before releasing the application for customer trials?
- A. Third-party risk management
- B. External compliance audits
- C. Approved AI vendor lists
- D. Data masking and sanitization
Answer: D
Explanation:
Before releasing AI features for customer trials, it is critical to protect sensitive information that may be used during testing. Data masking and sanitization ensure customer or corporate data is anonymized or obfuscated, reducing the risk of data exposure while still allowing realistic evaluation of the AI system.
NEW QUESTION # 45
Which of the following are considered threat intelligence sources? (Choose two.)
- A. Group policy objects
- B. Netflow logs
- C. ISACs
- D. Open-source intelligence (OSINT)
- E. File integrity monitoring
Answer: C,D
Explanation:
ISACs and OSINT provide structured and open-source threat intelligence feeds.
NEW QUESTION # 46
Faculty members at a university are concerned about potential inherent bias and inconsistency in one department's AI plagiarism detection service.
Which of the following principles will most likely to address their concerns?
- A. Explainability
- B. Transparency
- C. Consistency
- D. Accountability
Answer: C
Explanation:
Consistency ensures that an AI system applies rules and produces results in a uniform manner across all cases. This principle directly addresses concerns about bias and irregular outcomes in the plagiarism detection service.
NEW QUESTION # 47
Which of the following controls is the best way to mitigate a denial-of-service (DoS) attack?
- A. Model guardrails
- B. End-to-end encryption
- C. Rate limiting
- D. Access controls
Answer: C
Explanation:
Rate limiting restricts the number of requests within a set timeframe, preventing attackers from overwhelming the system with excessive traffic, making it the best control to mitigate a DoS attack.
NEW QUESTION # 48
Which of the following responsible AI standards refers to a principle that clearly states the reasons behind the decisions for a particular conclusion?
- A. Explainability
- B. Auditability
- C. Transparency
- D. Accountability
Answer: A
Explanation:
Explainability is the responsible AI principle that ensures AI systems can provide clear reasoning for their decisions, allowing users to understand how and why a particular conclusion was reached.
NEW QUESTION # 49
......
CompTIA CY0-001 Dumps - Secret To Pass in First Attempt: https://www.real4dumps.com/CY0-001_examcollection.html
CY0-001 Practice Test Questions Updated 102 Questions: https://drive.google.com/open?id=1ulnoP_DsgMhu6COBkF974ZWk3Q7a9I_K
