AI and ML Concepts for Security — CompTIA SecAI+ practice questions

Tokenization in modern LLMs typically uses:

1. Whole-word lookup against a fixed dictionary of known words
2. Raw ASCII byte values passed straight into the model input
3. Subword schemes such as byte-pair encoding or SentencePiece
4. Manually curated splitting rules maintained by staff linguists

Answer: C — Subword schemes such as byte-pair encoding or SentencePiece

C) Correct — modern LLMs split text into subword units with schemes such as byte-pair encoding or SentencePiece, which bounds vocabulary size while still covering unseen strings. A) Incorrect — a fixed whole-word dictionary fails on any out-of-vocabulary token. B) Incorrect — pure byte input is possible in research settings but is not the typical production scheme. D) Incorrect — hand-written splitting rules were the pre-statistical approach and do not scale across languages.

K-NN at inference time:

1. Discards the training data once fitting completes
2. Stores training data and finds nearest neighbors
3. Runs a forward pass through a trained network
4. Applies gradient descent to update parameters

Answer: B — Stores training data and finds nearest neighbors

B) Correct — k-NN is a lazy learner: it keeps the training set and computes distances at query time. A) Discarding the data would leave nothing to compare against. C) A forward pass is what a neural network does. D) k-NN has no parameters to fit by gradient descent.

K-means clustering is an example of:

1. Unsupervised learning
2. Supervised classification
3. Reinforcement learning
4. Semi-supervised learning

Answer: A — Unsupervised learning

B) Incorrect — misstates the concept. A) Correct — Unsupervised learning. C) Incorrect — misstates the concept. D) Incorrect — misstates the concept.

RAG (Retrieval-Augmented Generation) PRIMARILY:

1. Eliminates hallucination entirely from every generated answer
2. Replaces the underlying weights of the language model itself
3. Grounds generation in retrieved documents to aid factuality
4. Shrinks the underlying language model and speeds up serving

Answer: C — Grounds generation in retrieved documents to aid factuality

C) Correct — RAG retrieves relevant passages and conditions generation on them, improving factual grounding and adding current knowledge without retraining; the retrieval corpus therefore inherits the trust requirements of any input path. A) Incorrect — grounding reduces but never eliminates fabrication. B) Incorrect — the model weights are untouched; only the context changes. D) Incorrect — RAG adds a retrieval hop and does not shrink the model.

Transfer learning typically:

1. Always trains from scratch using randomly initialized weights
2. Eliminates any need for task-specific labeled training data
3. Works only on tabular data made of fixed numeric columns
4. Starts from a pretrained model and fine-tunes it downstream

Answer: D — Starts from a pretrained model and fine-tunes it downstream

D) Correct — transfer learning reuses representations already learned by a pretrained model and adapts them to the new task, which also means the provenance of that base model becomes part of your supply chain. A) Incorrect — random initialization is training from scratch, the opposite of transfer. B) Incorrect — fine-tuning still needs labeled downstream examples, just fewer of them. C) Incorrect — transfer learning is most associated with vision and language, not only tabular data.

Which BEST distinguishes Deep Learning from traditional ML?

1. DL avoids GPU acceleration and runs on CPUs alone
2. DL depends on labeled data for every training task
3. DL stacks neural layers for hierarchical features
4. DL supports unsupervised objectives exclusively

Answer: C — DL stacks neural layers for hierarchical features

C) Correct — deep learning is the subset of ML that stacks many neural layers to learn hierarchical representations. A) GPU acceleration is the norm for DL, not something it avoids. B) Labels are common but self-supervised and unsupervised DL exist. D) DL spans supervised, unsupervised and reinforcement paradigms.

A Mixture of Experts (MoE) model:

1. Assigns each task to a separate human reviewer
2. A convolutional network variant used for vision
3. A synonym for ensembling many decision trees
4. Routes tokens to a subset of expert networks

Answer: D — Routes tokens to a subset of expert networks

D) Correct — a mixture-of-experts layer activates only a few expert sub-networks per token, raising capacity without a proportional compute increase. A) The experts are network components, not people. B) It is a routing layer, not a convolutional variant. C) Tree ensembles evaluate every member, not a sparse subset.

XGBoost is BEST described as:

1. A centroid-based clustering implementation
2. A framework for training deep neural networks
3. A gradient-boosted decision tree ensemble
4. A reinforcement learning policy optimizer

Answer: C — A gradient-boosted decision tree ensemble

C) Correct — XGBoost builds trees sequentially, each correcting the residual error of the ensemble so far. A) Centroid clustering is unsupervised and unrelated. B) It is not a neural network framework. D) It optimizes trees, not a control policy.

A 70/15/15 split refers to:

1. Hyperparameter search budget across three trials
2. Train, validation, and holdout test partitions
3. GPU memory allocation across three workers
4. Batch size ratios used in three training phases

Answer: B — Train, validation, and holdout test partitions

B) Correct — the split allocates data to training, tuning and a final untouched evaluation set. A) A search budget is measured in trials, not data shares. C) Memory allocation is an infrastructure setting. D) Batch size is a single training hyperparameter.

A diffusion model generates samples by:

1. Adversarial training of a generator against a discriminator
2. Denoising Gaussian noise through a learned reverse process
3. Beam search over candidate token sequences at decode time
4. Lookup against a static table of handwritten generation rules

Answer: B — Denoising Gaussian noise through a learned reverse process

B) Correct — a diffusion model starts from Gaussian noise and applies a learned reverse process step by step until a sample emerges. A) Incorrect — the generator-versus-discriminator setup is the GAN objective. C) Incorrect — beam search is a decoding strategy for autoregressive sequence models. D) Incorrect — static rule lookup is symbolic generation, with no learned distribution at all.

What are the length, time limit and passing score for the SecAI+ CY0-001 exam?

A maximum of 60 questions in 60 minutes. The passing score is 600 on a scaled range of 100-900. The exam mixes multiple-choice questions with performance-based questions.

What is an embedding, and what is a vector database used for?

An embedding is a numeric vector representation of text, code or an image where semantic similarity corresponds to closeness in vector space. A vector database stores embeddings and returns nearest neighbours, which is how a RAG system finds relevant passages for a query.

Supervised vs Unsupervised vs Reinforcement learning?

Supervised: labeled data. Unsupervised: find structure in unlabeled. Reinforcement: learn through trial + reward.

AI/ML lifecycle phases?

Problem definition → data collection → exploration → feature engineering → model selection → train → evaluate → deploy → monitor → iterate.