CompTIA SecAI+ practice questions and exam guide

Which BEST distinguishes Deep Learning from traditional ML?

1. DL avoids GPU acceleration and runs on CPUs alone
2. DL depends on labeled data for every training task
3. DL stacks neural layers for hierarchical features
4. DL supports unsupervised objectives exclusively

Answer: C — DL stacks neural layers for hierarchical features

C) Correct — deep learning is the subset of ML that stacks many neural layers to learn hierarchical representations. A) GPU acceleration is the norm for DL, not something it avoids. B) Labels are common but self-supervised and unsupervised DL exist. D) DL spans supervised, unsupervised and reinforcement paradigms.

Transfer learning typically:

1. Always trains from scratch using randomly initialized weights
2. Eliminates any need for task-specific labeled training data
3. Works only on tabular data made of fixed numeric columns
4. Starts from a pretrained model and fine-tunes it downstream

Answer: D — Starts from a pretrained model and fine-tunes it downstream

D) Correct — transfer learning reuses representations already learned by a pretrained model and adapts them to the new task, which also means the provenance of that base model becomes part of your supply chain. A) Incorrect — random initialization is training from scratch, the opposite of transfer. B) Incorrect — fine-tuning still needs labeled downstream examples, just fewer of them. C) Incorrect — transfer learning is most associated with vision and language, not only tabular data.

Tokenization in modern LLMs typically uses:

1. Whole-word lookup against a fixed dictionary of known words
2. Raw ASCII byte values passed straight into the model input
3. Subword schemes such as byte-pair encoding or SentencePiece
4. Manually curated splitting rules maintained by staff linguists

Answer: C — Subword schemes such as byte-pair encoding or SentencePiece

C) Correct — modern LLMs split text into subword units with schemes such as byte-pair encoding or SentencePiece, which bounds vocabulary size while still covering unseen strings. A) Incorrect — a fixed whole-word dictionary fails on any out-of-vocabulary token. B) Incorrect — pure byte input is possible in research settings but is not the typical production scheme. D) Incorrect — hand-written splitting rules were the pre-statistical approach and do not scale across languages.

Which request pattern is MOST likely to cause resource exhaustion against a self-hosted language model service?

1. Many short prompts with small output limits
2. Long-context requests with big outputs in parallel
3. Requests that use a lower sampling temperature
4. Requests sent over HTTP/2 rather than HTTP/1.1

Answer: B — Long-context requests with big outputs in parallel

B) Correct - memory and compute scale with sequence length, so long-context, long-output concurrent requests exhaust accelerators far faster than request count alone suggests. A) Short prompts are the cheap case. C) Temperature has no meaningful effect on resource cost. D) Protocol version does not change model compute.

Jailbreaking refers to:

1. Publishing model source code under an open-source license
2. Crafting prompts that bypass safety policies and guardrails
3. A firmware exploit that unlocks the underlying host device
4. A violation of the model provider's commercial license terms

Answer: B — Crafting prompts that bypass safety policies and guardrails

B) Correct — jailbreaking works through language: the prompt is shaped to talk the model past its alignment training or guardrails and produce restricted output. A) Incorrect — releasing code is a licensing decision, not an attack. C) Incorrect — device-level firmware exploits borrow the word but target hardware, not model policy. D) Incorrect — breaching licence terms is a contractual matter with no technical bypass.

An open-source project accepts community pull requests that add examples to the corpus used for a nightly fine-tune. An attacker contributes crafted samples over several months. This is BEST described as:

1. Model extraction via the API
2. Insecure output handling downstream
3. Excessive agency in tool use
4. Poisoning of the training data

Answer: D — Poisoning of the training data

D) Correct - deliberately shaping the training corpus to alter learned behaviour is the definition of data poisoning. A) Extraction steals a model's function through queries; nothing is being copied here. B) Output handling concerns how downstream code consumes responses. C) Excessive agency is about over-broad permissions granted to a model, not corrupted data.

An internal model endpoint is currently reachable by any workload in the VPC with no credential. The MOST appropriate first improvement is:

1. Rotate the deployed model artefact every month
2. Require authenticated per-service identities
3. Compress requests to reduce network bandwidth
4. Increase the model's available context window

Answer: B — Require authenticated per-service identities

B) Correct - model access control begins with authenticating callers and authorising them per request so usage is attributable and constrained. A) Rotating artefacts addresses integrity, not who may call the endpoint. C) Compression is a performance measure. D) Context size is a capability setting with no access implication.

Differential privacy (DP) provides:

1. Encryption of stored training datasets while they sit at rest
2. An automatic improvement in accuracy on the downstream task
3. Faster training through reduced gradient computation cost
4. An epsilon-bounded limit on any single record's influence

Answer: D — An epsilon-bounded limit on any single record's influence

D) Correct — differential privacy adds calibrated noise so that the presence or absence of any one record changes the output distribution by no more than the epsilon budget, which is what blunts membership inference. A) Incorrect — encryption at rest protects storage but says nothing about what the model reveals. B) Incorrect — the added noise generally costs accuracy rather than improving it. C) Incorrect — the mechanism adds work rather than accelerating training.

A SOC uses a model to triage reported phishing messages. Which input feature is MOST likely to cause the model to fail against a targeted campaign?

1. Whether the sending domain was registered within the last month
2. Whether the display name differs from the underlying envelope sender
3. Whether authentication results for the sending domain passed or failed
4. Whether the message body matches previously reported campaign text

Answer: D — Whether the message body matches previously reported campaign text

D) Correct — matching against previously reported text is a similarity feature that a targeted campaign trivially defeats, because bespoke messages have no prior instances to match. A) remains useful, as newly registered infrastructure is a durable signal that costs the attacker something to avoid. C) is a protocol-level check the attacker does not fully control when spoofing a real brand domain. B) captures a structural mismatch that persists even in tailored messages and is not defeated by rewriting the body.

An ROC curve plots:

1. Precision against recall at varying thresholds
2. Training loss against the completed epoch count
3. True positive rate against false positive rate
4. Accuracy against maximum decision tree depth

Answer: C — True positive rate against false positive rate

C) Correct — an ROC curve sweeps the decision threshold and plots true positive rate against false positive rate. A) That describes the precision-recall curve, which is preferred under heavy imbalance. B) Loss against epoch is a training curve. D) Accuracy against depth is a tuning plot.

AI governance documentation that should accompany a deployed model includes:

1. The source code repository and nothing further
2. Model card, intended use, metrics, monitoring
3. A single headline accuracy number for the model
4. Product marketing copy describing the capability

Answer: B — Model card, intended use, metrics, monitoring

B) Correct — deployment documentation should support audit: model card and datasheet, intended use, disaggregated metrics, limitations and an ongoing monitoring plan. A) Code alone gives an auditor no context. C) One aggregate number is not evidence of fitness. D) Marketing material is not a governance artifact.

Reproducibility in ML experiments requires:

1. Documenting only the GPU brand used during the training run
2. Adding explanatory comments throughout the training scripts
3. Fixed seeds, pinned environments, versioned data and code
4. Skipping run logging so experiment directories stay small

Answer: C — Fixed seeds, pinned environments, versioned data and code

C) Correct — a run reproduces only when randomness, dependencies, data and configuration are all pinned and recorded, which is the same evidence an auditor asks for. A) Incorrect — hardware notes alone leave every software variable free. B) Incorrect — comments explain intent but pin nothing. D) Incorrect — discarding logs destroys the record reproducibility depends on.

GDPR Article 22?

Restricts automated decision-making that has legal/significant effects. Requires human review option.

Name the four SecAI+ (CY0-001) domains and their exam weights.

Basic AI concepts related to cybersecurity 17% • Securing AI systems 40% • AI-assisted security 24% • AI governance, risk and compliance 19%.

What is model extraction (model stealing)?

An attacker sends many crafted queries to an exposed model and uses the input-output pairs to train a substitute model that approximates its behaviour. This steals intellectual property and gives the attacker a local copy for offline crafting of evasive inputs.

What does model signing achieve, and what does it not achieve?

Signing binds a cryptographic signature to a model artefact so a consumer can verify integrity and publisher identity before loading it, defeating tampering and substitution in transit or storage. It does not prove the model is free of backdoors or bias - it authenticates origin, not behaviour.

Why is rate limiting a confidentiality control and not only an availability control for AI systems?

Model extraction, model inversion and membership inference all require large volumes of crafted queries. Per-identity rate and quota limits, plus anomaly alerting on query patterns, raise the cost of these attacks enough to make them impractical, so limiting throughput protects the model and its training data, not just uptime.

What is model or data provenance failure, and why is an unverified pre-trained model dangerous?

Provenance failure means you cannot demonstrate where a model or dataset came from, who modified it or how it was trained. An unverified pre-trained model may carry a backdoor, memorised sensitive data or a licence defect, and none of these are visible from benchmark accuracy alone.