Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A security analyst notices that regardless of user-submitted prompts, an AI model always returns unsanitized responses. These responses are then passed to multiple plug-ins. The analyst is concerned with the potential security implications.
Which of the following Open Worldwide Application Security Project (OWASP) categories addresses this vulnerability?
Basic Concept: OWASP has published the Top 10 vulnerabilities for Large Language Model Applications, each addressing a distinct category of LLM security risk. Understanding which OWASP category maps to specific LLM vulnerability scenarios is a key competency in the CompTIA SecAI+ Study Guide under securing AI systems.
Why D is Correct: Improper output handling (OWASP LLM02) occurs when an application passes LLM-generated outputs to downstream systems such as plug-ins, web browsers, or databases without proper validation, sanitization, or encoding. This can enable XSS, SQL injection, remote code execution, or other injection attacks against plug-ins and downstream systems. The scenario exactly matches this: unsanitized AI responses are automatically passed to multiple plug-ins, which could execute malicious content in the model's output.
Why A is Wrong: Misinformation refers to the AI generating false or misleading content that users might believe. It is a content accuracy concern related to hallucinations and false information propagation, not a vulnerability describing how model outputs are handled by downstream systems.
Why B is Wrong: Prompt injection involves crafting inputs to manipulate model behavior and override instructions. While it can be a contributing cause of unsafe outputs, the vulnerability described --- passing unsanitized outputs to plug-ins --- is specifically the output handling failure, not the injection mechanism itself.
Why C is Wrong: Unbounded consumption (OWASP LLM10) refers to resource exhaustion attacks including denial-of-wallet and denial-of-service through excessive token consumption. It addresses resource management vulnerabilities, not the security implications of passing model outputs to downstream systems.
An IT company implements an adaptable chatbot that learns from user prompts. Based on the conversation shown --- where User 2 injected false information about a company acquisition that caused the chatbot to give incorrect responses to User 3 --- which of the following compensating controls should an administrator implement to mitigate the issue?
Basic Concept: A chatbot that learns from user prompts is vulnerable to data poisoning through conversational injection. Malicious users can deliberately introduce false information that the chatbot incorporates into its knowledge, corrupting responses for subsequent users. CompTIA SecAI+ Study Guide identifies this as a real-time data poisoning vector requiring guardrail controls.
Why D is Correct: Guardrails prevent the chatbot from accepting and incorporating unverified, irrelevant, or potentially malicious information injected by users. They enforce boundaries on what the chatbot can learn from user interactions, validate that information aligns with the system's purpose and known facts, and block outputs based on poisoned knowledge. Guardrails are specifically designed to prevent the type of conversational data poisoning demonstrated where a user's false claim corrupted the model's subsequent responses.
Why A is Wrong: Data encryption protects the confidentiality of data in transit and at rest. It does not prevent a chatbot from accepting and acting on false information that users deliberately inject into the conversation.
Why B is Wrong: API rate limiting restricts the frequency of requests. While it can limit the number of poisoning attempts a single user can make, it does not prevent the chatbot from learning from and propagating false information when requests are made at an acceptable rate.
Why C is Wrong: Transfer learning is a training technique that adapts knowledge from one domain to another. It is a model development approach, not a runtime control that prevents users from injecting false information into a deployed chatbot.
Which of the following is an example of how a security analyst uses generative AI in the triage process?
Basic Concept: Generative AI produces natural language content based on input data. In a security operations context, triage involves rapidly understanding and prioritizing security events. Generative AI's strength lies in synthesizing information and producing readable summaries from complex data. CompTIA SecAI+ Study Guide covers generative AI applications in security operations.
Why C is Correct: Summarizing security findings by category is a natural application of generative AI in triage. The AI can process large volumes of alerts and security events, group them by type or severity, and generate concise natural language summaries that enable analysts to quickly understand the current threat landscape without reading individual alerts. This directly reduces triage time and cognitive load.
Why A is Wrong: Predicting the next attack target requires predictive analytics and threat intelligence correlation. While AI can assist with this, it is a forecasting task better suited to analytical ML models rather than generative AI, and it is a strategic intelligence function rather than a triage task.
Why B is Wrong: Statistical analysis for malicious code assessment uses mathematical and ML techniques to analyze code characteristics. This is a traditional ML classification task, not a generative AI application, and is performed during malware analysis rather than alert triage.
Why D is Wrong: Tagging malware using ML algorithms is a classification task that uses supervised ML models trained on malware features. It is a detection and classification function, not a generative AI triage application.
A short AI-generated video shows a celebrity's likeness talking about a fake public security event.
Which of the following was used to create this video?
Basic Concept: Creating realistic deepfake videos that convincingly replicate a real person's facial expressions, movements, and voice requires deep learning models capable of learning and synthesizing complex spatial and temporal features from existing video data. CompTIA SecAI+ covers deepfake technologies under basic AI concepts.
Why B is Correct: Convolutional Neural Networks are foundational to deepfake video generation. CNNs excel at learning spatial features from visual data and are used within deepfake architectures to analyze source and target faces, extract facial features, and synthesize realistic face swaps or face animations. Modern deepfake systems typically combine CNNs with autoencoders and GANs to generate convincing video content showing a person saying or doing things they never did.
Why A is Wrong: Statistical analysis involves mathematical methods for analyzing data distributions and relationships. It does not have the capability to generate synthetic video content or replicate a person's visual likeness in motion.
Why C is Wrong: An ML classifier assigns input data to predefined categories. Classification models detect and label content rather than generating new synthetic video content of a person's likeness. They are detection tools, not generation tools.
Why D is Wrong: Random forest is an ensemble ML method using multiple decision trees for classification and regression tasks. It works on structured, tabular data and cannot process or generate visual, spatial data needed for realistic deepfake video synthesis.
An organization recently created a custom model that integrates with a language model (LLM). The developer notices that the application programming interface (API) costs have increased.
Which of the following is the best control to reduce cost?
Basic Concept: LLM API pricing is primarily based on token consumption --- the number of tokens processed in both input prompts and output responses. Controlling token usage is the most direct lever for managing and reducing LLM API costs. CompTIA SecAI+ Study Guide covers AI cost management and resource controls under securing AI systems.
Why D is Correct: Adjusting token limits directly caps the maximum number of tokens used per request for both input and output. By setting appropriate token limits, the organization prevents excessively long prompts or verbose responses from consuming unnecessary tokens, directly translating to lower API costs and providing hard budget control.
Why A is Wrong: Prompt templates standardize how queries are structured, which can indirectly improve efficiency. However, they do not enforce a hard cap on token usage and cannot prevent costs from escalating with large volumes or verbose responses.
Why B is Wrong: Increasing CPU and memory addresses computational infrastructure performance on the client side. LLM API costs are billed by the API provider based on token usage, not on the client's hardware resources.
Why C is Wrong: Reducing model size means using a smaller, less powerful model version. While this may lower cost per token, it is a model selection decision, not an ongoing operational control that can be adjusted to manage cost in real time.
Which of the following is the best example of an AI model that is trained to identify multiple points from input using a neural network to provide output for authentication?
Basic Concept: Neural networks can be trained to identify and match complex multi-point patterns in data. For biometric authentication, facial recognition uses deep neural networks to extract and compare dozens to hundreds of facial feature points from an input image. CompTIA SecAI+ covers neural network-based authentication under basic AI concepts.
Why A is Correct: Facial recognition systems use neural networks specifically trained to identify multiple facial landmarks and feature points such as eye distance, nose shape, and jawline contour from input images. These extracted feature vectors are compared against stored templates to authenticate individuals, making this the ideal example of multi-point neural network-based authentication output.
Why B is Wrong: An encryption key is a cryptographic artifact, not an AI model output. Encryption keys are generated mathematically, not through neural network training or multi-point feature identification from biometric inputs.
Why C is Wrong: OAuth is an open authorization protocol framework that handles delegated access and permission grants between services. It is an authentication delegation standard, not an AI model that processes input through neural networks.
Why D is Wrong: A bounding box is an output of object detection models that draws a rectangular box around detected objects in an image. While it uses neural networks, it identifies object location rather than multiple feature points for authentication purposes.
A security alert triggers an agentic system. An analyst notices the following payload in the logs. The alert includes multiple shell commands that are not typically run as part of any hardening:
Which of the following is the most effective control to implement?
Basic Concept: Agentic AI systems that execute shell commands based on model-generated output are vulnerable to prompt injection attacks where malicious actors craft inputs that cause the agent to run unauthorized commands. Input validation using allowlists is a critical defense mechanism. CompTIA SecAI+ Study Guide covers agentic AI security controls.
Why A is Correct: Adding logic that validates shell commands against an approved allowlist before execution is the most direct and effective defense. This ensures only pre-approved, safe commands can be executed regardless of what the agentic system's model generates, preventing malicious command injection from reaching the operating system. This principle of allowlist-based input validation is a foundational secure agentic AI control.
Why B is Wrong: Deprecating and retraining the model is a lengthy process that addresses root cause training issues but does not provide immediate protection against ongoing injection attacks in the current deployed system.
Why C is Wrong: Modifying the application to ignore a specific tag merely removes one attack surface while leaving the system vulnerable to other injection vectors. It is not a comprehensive defense.
Why D is Wrong: Using only approved libraries controls which code libraries the agentic system can call, but does not validate or restrict the shell commands generated by the model at runtime based on arbitrary user input.
Exam domains verified against: Official CompTIA CY0-001 exam guide, last checked October 2026.
Understand core AI principles and terminology including machine learning, deep learning, natural language processing, and automation. Recognize AI applications in security use cases for threat detection and defense, and identify AI-driven threats such as automated phishing, polymorphic malware, and adversarial machine learning.
Implement security controls to protect AI systems, data, and models using technical safeguards. Apply best practices for securing AI deployment environments across on-premises, cloud, and hybrid infrastructures. Mitigate adversarial risks and defend against attacks targeting AI models, data pipelines, and inference layers.
Use AI-driven tools to identify anomalies, detect threats, and accelerate incident remediation and response. Automate security workflows by integrating AI for event triage, alert correlation, and response orchestration. Apply AI techniques including threat modeling, behavior analysis, and continuous monitoring in security operations.
Sample question from this domain above: Q3
Understand global governance requirements and regulatory frameworks applicable to AI adoption. Integrate governance, risk management, and compliance practices throughout the AI lifecycle and projects. Ensure responsible AI use by applying ethical guidelines, legal standards, and industry frameworks such as GDPR and NIST AI RMF.
Common questions about the exam itself
