Pass CompTIA CY0-001 Exam with Guarantee Updated 136 Questions
Latest CY0-001 Pass Guaranteed Exam Dumps Certification Sample Questions
NEW QUESTION # 62
Which of the following is an example of how a security analyst uses generative AI in the triage process?
- A. To tag malware using machine learning (ML) algorithms
- B. To use statistical analysis for malicious code assessment
- C. To summarize security findings by category
- D. To predict the next attack target with higher accuracy
Answer: C
Explanation:
Basic Concept: Generative AI produces natural language content based on input data. In a security operations context, triage involves rapidly understanding and prioritizing security events. Generative AI ' s strength lies in synthesizing information and producing readable summaries from complex data. CompTIA SecAI+ Study Guide covers generative AI applications in security operations.
Why C is Correct: Summarizing security findings by category is a natural application of generative AI in triage. The AI can process large volumes of alerts and security events, group them by type or severity, and generate concise natural language summaries that enable analysts to quickly understand the current threat landscape without reading individual alerts. This directly reduces triage time and cognitive load.
Why A is Wrong: Predicting the next attack target requires predictive analytics and threat intelligence correlation. While AI can assist with this, it is a forecasting task better suited to analytical ML models rather than generative AI, and it is a strategic intelligence function rather than a triage task.
Why B is Wrong: Statistical analysis for malicious code assessment uses mathematical and ML techniques to analyze code characteristics. This is a traditional ML classification task, not a generative AI application, and is performed during malware analysis rather than alert triage.
Why D is Wrong: Tagging malware using ML algorithms is a classification task that uses supervised ML models trained on malware features. It is a detection and classification function, not a generative AI triage application.
NEW QUESTION # 63
A team of engineers builds an application using a large language model (LLM). The application is built on Linux and is hosted on a virtual server. Users must create an account in order to access and use the platform.
Which of the following should the team do to protect the account credentials?
- A. Patch the model with the latest data set.
- B. Implement hashing and encryption.
- C. Deploy an authenticated application programming interface (API).
- D. Update the Linux and virtual servers.
Answer: B
Explanation:
Basic Concept: User account credentials stored in a database must be protected against unauthorized disclosure. The security of credentials at rest requires cryptographic controls that prevent even database administrators or attackers with database access from reading plaintext passwords. CompTIA SecAI+ Study Guide covers credential security controls as part of AI application security.
Why C is Correct: Implementing hashing and encryption for credential protection is the industry-standard approach. Passwords should be hashed using strong, slow algorithms such as bcrypt, Argon2, or scrypt with unique salts, making them computationally infeasible to reverse even if the database is compromised.
Additional sensitive credential data can be encrypted. Together, hashing and encryption ensure that account credentials remain protected even if the underlying storage is accessed by unauthorized parties.
Why A is Wrong: Patching the model with new datasets updates the AI model ' s training data and knowledge. It does not address the security of user account credentials stored in the application ' s authentication database.
Why B is Wrong: Updating Linux and virtual server software patches system vulnerabilities and is important for overall security hygiene. However, it does not implement specific protections for the account credentials themselves stored in the application database.
Why D is Wrong: Deploying an authenticated API requires users to authenticate to use the API, improving access control. While this complements credential security, it does not protect the storage of credentials at rest and does not replace hashing and encryption of the credential values themselves.
NEW QUESTION # 64
Which of the following is the best example of an AI model that is trained to identify multiple points from input using a neural network to provide output for authentication?
- A. Open Authorization (OAuth)
- B. Encryption key
- C. Bounding box
- D. Facial recognition
Answer: D
Explanation:
Basic Concept: Neural networks can be trained to identify and match complex multi-point patterns in data.
For biometric authentication, facial recognition uses deep neural networks to extract and compare dozens to hundreds of facial feature points from an input image. CompTIA SecAI+ covers neural network-based authentication under basic AI concepts.
Why A is Correct: Facial recognition systems use neural networks specifically trained to identify multiple facial landmarks and feature points such as eye distance, nose shape, and jawline contour from input images.
These extracted feature vectors are compared against stored templates to authenticate individuals, making this the ideal example of multi-point neural network-based authentication output.
Why B is Wrong: An encryption key is a cryptographic artifact, not an AI model output. Encryption keys are generated mathematically, not through neural network training or multi-point feature identification from biometric inputs.
Why C is Wrong: OAuth is an open authorization protocol framework that handles delegated access and permission grants between services. It is an authentication delegation standard, not an AI model that processes input through neural networks.
Why D is Wrong: A bounding box is an output of object detection models that draws a rectangular box around detected objects in an image. While it uses neural networks, it identifies object location rather than multiple feature points for authentication purposes.
NEW QUESTION # 65
Which of the following attacks would be the best to automate with AI during dynamic application software testing (DAST)?
- A. Threat modeling
- B. Distributed denial-of-service (DDoS)
- C. Data poisoning
- D. Payload creation
Answer: D
Explanation:
Basic Concept: Dynamic Application Security Testing (DAST) tests running applications by sending various inputs to discover vulnerabilities. AI can significantly enhance DAST by intelligently generating diverse, targeted test payloads that traditional tools might miss. CompTIA SecAI+ covers AI augmentation of security testing methodologies.
Why C is Correct: Payload creation is highly suitable for AI automation during DAST. AI can generate diverse, contextually appropriate attack payloads such as SQL injection strings, XSS vectors, command injection attempts, and format string exploits tailored to the specific application ' s behavior observed during testing. AI can learn from the application ' s responses to previous payloads and generate increasingly targeted inputs, discovering vulnerabilities more efficiently than static payload databases.
Why A is Wrong: DDoS attacks are volume-based attacks designed to overwhelm network or application infrastructure. Automating DDoS during DAST is inappropriate as it would disrupt service availability rather than discover application security vulnerabilities, and it is harmful to legitimate operations.
Why B is Wrong: Data poisoning is an attack targeting AI/ML model training data integrity. It is relevant to securing AI systems but is not a DAST technique for testing web or software application security vulnerabilities during dynamic testing.
Why D is Wrong: Threat modeling is a structured analysis process performed before development or testing to identify potential threats and design appropriate countermeasures. It is a planning activity, not an attack technique that can be automated during dynamic application security testing.
NEW QUESTION # 66
Which methods identify vulnerabilities BEFORE deployment? (Choose two.)
- A. Patch management
- B. Penetration testing
- C. Behavior analytics
- D. Static code analysis
- E. Design reviews
Answer: D,E
Explanation:
Pre-deployment assessments rely on design evaluation and code inspection.
NEW QUESTION # 67
A company wants to reduce IDS false positives. What tuning should occur FIRST?
- A. Disable low-priority alerts
- B. Baseline normal behavior
- C. Add new signatures
- D. Increase signature sensitivity
Answer: B
Explanation:
A behavioral baseline enables effective tuning and alert reduction.
NEW QUESTION # 68
A company develops an AI model to diagnose patients. Hospitals access the model through an integrated application programming interface (API). The security team performs a denial-of-service (DoS) attack via brute force on the model.
Which of the following controls would have prevented this issue?
- A. Prompt firewall
- B. Rate limiting
- C. Tokenization
- D. Model guardrails
Answer: B
Explanation:
Basic Concept: API-based AI systems are susceptible to DoS attacks where excessive requests overwhelm the system ' s ability to respond to legitimate users. Rate limiting is the standard control for preventing both intentional and unintentional API abuse. CompTIA SecAI+ Study Guide covers rate limiting as a key availability control for AI APIs.
Why C is Correct: Rate limiting restricts the number of requests a client can make to an API within a defined time window. In this scenario, a brute-force DoS attack works by sending a massive volume of requests to exhaust the model ' s resources. Rate limiting would have automatically throttled or blocked the excessive request volume, preventing the attack from succeeding and preserving service availability for legitimate hospital users.
Why A is Wrong: Tokenization replaces sensitive data values with non-sensitive placeholders. It is a data security control for protecting sensitive information such as patient identifiers, not a control for managing API request volumes or preventing DoS attacks.
Why B is Wrong: Model guardrails filter and constrain model inputs and outputs for safety and policy compliance. They inspect content quality, not request volume, and cannot prevent a volume-based DoS attack.
Why D is Wrong: A prompt firewall inspects the content of prompts for malicious patterns or policy violations. Like guardrails, it analyzes content rather than controlling request frequency and cannot prevent resource exhaustion from a high-volume brute-force attack.
NEW QUESTION # 69
An AI architect reviews AI utilization and wants to improve the user experience. Which of the following should the architect review within the logs?
- A. Access controls
- B. Model accuracy
- C. Data storage
- D. Rate monitoring
Answer: B
Explanation:
To improve user experience, the architect should review model accuracy in the logs. High accuracy ensures users receive relevant, reliable responses, directly impacting satisfaction and effectiveness of the AI system.
NEW QUESTION # 70
Which of the following should an auditor reference when reviewing a company ' s human resources AI systems for legal non-compliance?
- A. National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF)
- B. International Organization for Standardization (ISO)
- C. Organization for Economic Cooperation and Development (OECD) standard
- D. European Union (EU) AI Act
Answer: D
Explanation:
Basic Concept: Various regulatory frameworks govern AI use in different contexts. For auditing legal compliance in high-risk AI applications such as employment and HR, binding regulatory legislation takes precedence over voluntary standards. CompTIA SecAI+ Exam Objectives cover AI governance and compliance frameworks under Domain 4.
Why C is Correct: The EU AI Act is the world ' s first comprehensive, legally binding AI regulation. It explicitly classifies AI systems used in employment, worker management, and recruitment as high-risk AI systems, subjecting them to strict compliance requirements including conformity assessments, transparency obligations, and human oversight mandates. An auditor reviewing HR AI for legal non-compliance must reference this binding legislation.
Why A is Wrong: The OECD AI Principles are non-binding international guidelines promoting responsible AI. They offer policy guidance but carry no legal enforcement power for compliance auditing.
Why B is Wrong: The NIST AI RMF is a voluntary, risk management-focused framework. It is not a legal compliance standard and cannot be used to assess legal non-compliance.
Why D is Wrong: ISO standards such as ISO 42001 are voluntary international best practice standards. They are not legal compliance instruments with enforceable penalties for HR AI systems.
NEW QUESTION # 71
A recently deployed AI system becomes persistently unavailable. A restart temporarily fixes the issue, but the issue happens again. Upon examination of application programming interface (API) logs, an analyst finds that external calls continued to use system resources after the action completed.
Which of the following is the best way to improve availability of the system?
- A. Creating token limits
- B. Increasing system memory
- C. Implementing multifactor authentication (MFA)
- D. Enforcing session expiration
Answer: D
Explanation:
The persistent unavailability is caused by external calls consuming resources even after completion, indicating sessions are not being closed. Enforcing session expiration ensures unused sessions are terminated, freeing resources and improving system availability.
NEW QUESTION # 72
A security administrator needs to improve an AI model. During an initial investigation, the administrator notices that two successive login failures are recorded every day, and then a successful login occurs after a specific time interval. All the successful login attempts have been during office hours.
Which of the following techniques should the administrator use to improve the AI model ' s security?
- A. Access management
- B. Vulnerability analysis
- C. Signature matching
- D. Pattern recognition
Answer: D
Explanation:
Basic Concept: Pattern recognition is an AI technique that enables a system to identify recurring sequences or structures within data. In cybersecurity, detecting behavioral patterns such as consistent pre-login failure sequences followed by successful access is critical for threat detection. CompTIA SecAI+ Exam Objectives cover this under AI-assisted security.
Why B is Correct: The scenario describes a highly regular, repeating behavioral pattern - two failures followed by success at a specific time interval, consistently during office hours. Pattern recognition enables the AI model to learn this sequence and flag it as indicative of credential stuffing or an automated brute-force attack with timing controls. ML-driven pattern recognition is specifically designed for such behavioral anomaly detection.
Why A is Wrong: Access management controls who can log in and under what conditions. It enforces authorization policies but does not analyze or detect suspicious behavioral sequences in authentication logs.
Why C is Wrong: Signature matching compares known attack signatures against observed data. The described pattern is behavioral and time-based rather than a known malware or exploit signature, making this technique unsuitable.
Why D is Wrong: Vulnerability analysis identifies weaknesses in systems and code. It does not analyze authentication log sequences or detect behavioral patterns in user activity data.
NEW QUESTION # 73
A security consultant must summarize the impact of posture management on a machine learning (ML) use case. Which of the following is the most appropriate reference for this purpose?
- A. European Union AI Act
- B. National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF)
- C. Generative adversarial network (GAN)
- D. Organization for Economic Co-operation and Development (OECD) standards
Answer: B
Explanation:
The NIST AI RMF provides structured guidance for assessing and managing risks across the AI lifecycle, including posture management. It helps organizations align AI security practices with governance, resilience, and trustworthiness requirements.
NEW QUESTION # 74
A security team is using an AI-based tool to try to bypass organizational boundaries. The team uses AI to look at the current state and suggest different attack vectors based on the outcome of the previous ones. Which of the following techniques is the team most likely using?
- A. Code quality testing
- B. Manual signature matching
- C. Fraud detection
- D. Automated penetration testing
Answer: D
Explanation:
The described behavior - iteratively assessing the environment and adapting attack paths based on prior outcomes - matches automated penetration testing, where AI-driven tools simulate attack chains and adjust tactics dynamically.
NEW QUESTION # 75
A healthcare company deploys an AI chatbot that implements retrieval-augmented generation (RAG) using the company ' s historical data set. The chatbot output contains patient information.
Which of the following is the most effective technique to mitigate this vulnerability?
- A. Masking
- B. Normalization
- C. Minimization
- D. Classification
Answer: A
Explanation:
Basic Concept: When an AI chatbot powered by RAG retrieves and outputs sensitive patient information such as names, medical histories, or identifiers, the risk of Protected Health Information (PHI) disclosure must be mitigated. CompTIA SecAI+ Study Guide covers data protection techniques for AI systems handling sensitive health data.
Why A is Correct: Masking replaces sensitive data values such as patient names, dates of birth, medical record numbers, and diagnoses with redacted or anonymized equivalents in the chatbot ' s output. Even if the RAG system retrieves records containing patient information, masking ensures that the sensitive fields are obscured before the response is presented to the user. This directly prevents PHI disclosure while allowing the chatbot to provide useful responses based on the underlying data patterns.
Why B is Wrong: Classification involves categorizing data by its sensitivity level such as public, internal, confidential, or restricted. While it identifies which data requires protection, classification alone does not transform or obscure the sensitive values in chatbot outputs.
Why C is Wrong: Data minimization is a privacy principle that limits data collection to only what is necessary for the specified purpose. While valuable as a design principle when building the RAG knowledge base, it is a data governance strategy rather than a technical output control that can be applied to mitigate existing PHI disclosure in chatbot responses.
Why D is Wrong: Normalization is a data processing technique that scales numerical values to a standard range or standardizes data formats. It is a preprocessing step for improving model training efficiency, not a data protection technique for preventing patient information disclosure in AI outputs.
NEW QUESTION # 76
Faculty members at a university are concerned about potential inherent bias and inconsistency in one department ' s AI plagiarism detection service.
Which of the following principles will most likely address their concerns?
- A. Explainability
- B. Transparency
- C. Consistency
- D. Accountability
Answer: C
Explanation:
Basic Concept: Responsible AI principles each address different aspects of trustworthy AI behavior. When stakeholders are concerned about both bias and inconsistency - specifically that the same or equivalent work might receive different treatment from the AI system - the principle of consistency is most directly relevant.
CompTIA SecAI+ covers responsible AI principles under governance.
Why C is Correct: Consistency in AI systems means the model applies the same rules, standards, and decision criteria uniformly across all inputs and user groups without variation based on characteristics unrelated to the task. An AI plagiarism detection system that produces inconsistent results across different student submissions or demographic groups fails the consistency principle, which directly addresses both the bias concern (differential treatment) and inconsistency concern the faculty have raised.
Why A is Wrong: Transparency relates to openness about how the AI system works and what data it uses.
While valuable for understanding the system, transparency alone does not ensure that the system applies its rules uniformly or consistently.
Why B is Wrong: Explainability means the system can articulate why it made a particular decision. While useful for understanding individual cases, it does not guarantee that decisions are made with equal consistency across different submissions or groups.
Why D is Wrong: Accountability identifies who is responsible for AI system decisions and outcomes. It is a governance principle about ownership and responsibility rather than about ensuring uniform application of evaluation criteria.
NEW QUESTION # 77
A multinational company wants to implement an AI-assisted job screening solution.
Which of the following should the company reference to reduce the risk of incurring compliance-related fines?
- A. National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF)
- B. International Organization for Standardization (ISO) AI standards
- C. Corporate policy
- D. European Union (EU) AI Act
Answer: D
Explanation:
Basic Concept: AI systems used in employment contexts such as job screening carry significant regulatory risk. For a multinational company operating in or serving markets covered by the EU AI Act, compliance with this binding regulation is mandatory to avoid substantial fines. CompTIA SecAI+ Exam Objectives cover AI regulatory compliance under Domain 4.
Why B is Correct: The EU AI Act explicitly classifies AI systems used for employment screening, candidate evaluation, and worker management as high-risk AI applications. These systems are subject to strict compliance requirements including mandatory conformity assessments, human oversight, transparency obligations, and registration. Non-compliance can result in fines up to 30 million euros or 6% of global annual turnover. A multinational company implementing AI job screening must reference the EU AI Act as the primary compliance obligation.
Why A is Wrong: ISO AI standards such as ISO 42001 are voluntary management system standards. While useful for best practices, they do not carry legal enforcement power and adherence does not prevent regulatory fines from binding legislation like the EU AI Act.
Why C is Wrong: Corporate policy is an internal governance document that sets organizational standards. It cannot supersede external legal obligations and following only corporate policy does not protect against fines from regulatory bodies enforcing the EU AI Act.
Why D is Wrong: NIST AI RMF is a voluntary American risk management framework. While excellent for AI risk governance, it is not a binding regulation and does not address the legal compliance requirements that generate fines from regulatory authorities in jurisdictions covered by the EU AI Act.
NEW QUESTION # 78
A security analyst needs to conduct a security assessment of the output from an AI-enabled development tool.
Which of the following should the analyst do first?
- A. Perform a source code review.
- B. Enable sensitive data discovery on code repositories.
- C. Remove hard-coded secrets from the source code.
- D. Enforce strict access controls for code repositories.
Answer: A
Explanation:
Basic Concept: Security assessment of AI-generated code requires a systematic review of the code itself to understand what has been generated and identify potential vulnerabilities before remediation steps are taken.
Security assessments follow a structured methodology beginning with understanding the current state.
CompTIA SecAI+ Study Guide covers AI-generated code security assessment under AI-assisted security.
Why D is Correct: Performing a source code review is the first and most fundamental step in assessing AI- generated code security. Before removing secrets, enforcing access controls, or scanning for sensitive data, the analyst must understand what the AI tool has generated by reviewing the code for security vulnerabilities, insecure patterns, logic flaws, and policy violations. The review provides the baseline knowledge needed to prioritize and direct all subsequent remediation actions.
Why A is Wrong: Removing hard-coded secrets is a specific remediation action for a specific finding. This step should come after the source code review has identified the presence and location of hard-coded secrets, not before the initial assessment reveals whether they exist.
Why B is Wrong: Enforcing access controls for code repositories is a security hardening measure for the repository infrastructure. It protects access to existing code but does not constitute an assessment of what the AI tool has generated from a security standpoint.
Why C is Wrong: Enabling sensitive data discovery scans repositories for PII and sensitive information patterns. While valuable as part of the assessment, it is a specific automated scanning tool best used after or alongside a manual code review that provides contextual understanding of the codebase.
NEW QUESTION # 79
An analyst finds failed login attempts across multiple systems using different usernames but from the same IP. Which attack is MOST likely?
- A. Credential stuffing
- B. Privilege escalation
- C. Password spraying
- D. Brute-force attack
Answer: C
Explanation:
Password spraying uses common passwords across many usernames.
NEW QUESTION # 80
A data set containing medical information is put into a machine learning (ML) model that is designed to predict specific illnesses for a population. In the process of verifying the reliability of the system, the compliance officer realizes that the system cannot reliably predict illnesses for certain segments of the population. Which of the following types of risk is most applicable to this case?
- A. Consistency
- B. Bias
- C. Transparency
- D. Inclusiveness
Answer: B
Explanation:
The model's inability to reliably predict illnesses for certain population segments indicates bias in the dataset or training process. This leads to unfair or inaccurate outcomes for specific groups, making bias the most applicable risk in this case.
NEW QUESTION # 81
A penetration tester is assessing the controls of a deployed AI system that is designed to search and return the contents of files. The tester runs the following:
Which of the following is the best control to prevent abuse of the system?
- A. Segmenting the workload into a separate virtual private cloud (VPC)
- B. Adding a large language model (LLM) guardrails library to the application code
- C. Reducing the privilege scope of the service account
- D. Implementing custom detection rules for anomalous model behavior
Answer: C
Explanation:
The penetration test shows that the system accepts arbitrary commands like deleteBuckets or listPermissions, which could lead to privilege abuse. The most effective control is least privilege, ensuring the service account only has access to what is strictly necessary (e.g., reading files) and not sensitive operations like deleting buckets or altering permissions.
NEW QUESTION # 82
Which of the following is required first in order to send a prompt query and response in a language model (LLM) system when authentication is enabled?
- A. Front-end web proxy gateway
- B. Application programming interface gateway
- C. Endpoint access control
- D. Back-end access gateway
Answer: C
Explanation:
Basic Concept: When authentication is enabled on an LLM system, users must prove their identity before the system processes any requests. The authentication process must occur at the point where users first attempt to access the system before any data can be transmitted. CompTIA SecAI+ Study Guide covers the order of authentication controls in AI system access architectures.
Why B is Correct: Endpoint access control is the first requirement when authentication is enabled, as it governs the initial connection from the user ' s device to the system. Before any prompt can be sent or response received, the endpoint must be authenticated and authorized to access the LLM service. Endpoint access control verifies user identity and device compliance at the earliest possible point in the request flow, gating all subsequent processing.
Why A is Wrong: A front-end web proxy gateway routes and manages web traffic between users and backend services. While it may participate in the authentication flow, it is a routing and mediation component that operates after the endpoint has been validated, not the first authentication requirement.
Why C is Wrong: An API gateway manages API traffic, authentication tokens, and rate limiting for API interactions. It processes requests after initial endpoint authentication has been established and the request is being routed to the LLM backend.
Why D is Wrong: A back-end access gateway controls access to backend services and resources. It operates downstream from both endpoint authentication and API gateway processing, representing a deeper layer of the access control architecture rather than the first authentication requirement.
NEW QUESTION # 83
......
New CY0-001 Test Materials & Valid CY0-001 Test Engine: https://www.practicematerial.com/CY0-001-exam-materials.html
CY0-001 Updated Exam Dumps [2026] Practice Valid Exam Dumps Question: https://drive.google.com/open?id=1e048MCFm2EBOL6jEG_7F0TWIfwgMT0q1
