2026 Easy Success CompTIA CY0-001 Exam in First Try [Q24-Q42]

2026 Easy Success CompTIA CY0-001 Exam in First Try

Best CY0-001 Exam Dumps for the Preparation of Latest Exam Questions

NEW QUESTION # 24
An organization recently created a custom model that integrates with a language model (LLM).
The developer notices that the application programming interface (API) costs have increased.
Which of the following is the best control to reduce cost?

A. Reducing the model size
B. Increasing central processing unit (CPU) and memory
C. Implementing prompt templates
D. Adjusting token limits

Answer: D

Explanation:
API costs for large language model integrations are directly tied to token usage (input + output tokens). By adjusting token limits, the organization can reduce unnecessary processing of overly long prompts or responses, thereby lowering overall API costs without changing model size or infrastructure resources.

NEW QUESTION # 25
An attacker successfully completes a denial-of-service (DoS) attack through the context window of an AI system. Thousands of characters are obfuscated and hidden behind an emoji. Which of the following techniques best mitigates this type of attack?

A. Pattern recognition
B. Large language model (LLM)-as-a-judge
C. Prompt filter
D. Fraud detection

Answer: C

Explanation:
A DoS attack through the context window relies on overwhelming the model with excessive or obfuscated input. Prompt filtering prevents such malicious or oversized inputs from being processed, ensuring that the model only receives safe, properly structured data within acceptable limits.

NEW QUESTION # 26
A healthcare company deploys an AI chatbot that implements retrieval-augmented generation (RAG) using the company ' s historical data set. The chatbot output contains patient information.
Which of the following is the most effective technique to mitigate this vulnerability?

A. Masking
B. Minimization
C. Classification
D. Normalization

Answer: A

Explanation:
Basic Concept: When an AI chatbot powered by RAG retrieves and outputs sensitive patient information such as names, medical histories, or identifiers, the risk of Protected Health Information (PHI) disclosure must be mitigated. CompTIA SecAI+ Study Guide covers data protection techniques for AI systems handling sensitive health data.
Why A is Correct: Masking replaces sensitive data values such as patient names, dates of birth, medical record numbers, and diagnoses with redacted or anonymized equivalents in the chatbot ' s output. Even if the RAG system retrieves records containing patient information, masking ensures that the sensitive fields are obscured before the response is presented to the user. This directly prevents PHI disclosure while allowing the chatbot to provide useful responses based on the underlying data patterns.
Why B is Wrong: Classification involves categorizing data by its sensitivity level such as public, internal, confidential, or restricted. While it identifies which data requires protection, classification alone does not transform or obscure the sensitive values in chatbot outputs.
Why C is Wrong: Data minimization is a privacy principle that limits data collection to only what is necessary for the specified purpose. While valuable as a design principle when building the RAG knowledge base, it is a data governance strategy rather than a technical output control that can be applied to mitigate existing PHI disclosure in chatbot responses.
Why D is Wrong: Normalization is a data processing technique that scales numerical values to a standard range or standardizes data formats. It is a preprocessing step for improving model training efficiency, not a data protection technique for preventing patient information disclosure in AI outputs.

NEW QUESTION # 27
Which of the following is the best example of an AI model that is trained to identify multiple points from input using a neural network to provide output for authentication?

A. Open Authorization (OAuth)
B. Bounding box
C. Encryption key
D. Facial recognition

Answer: D

Explanation:
Facial recognition uses neural networks to analyze multiple points or features from an input image (such as eyes, nose, mouth, and facial structure) to generate a unique identifier for authentication purposes.

NEW QUESTION # 28
During an update, an AI system flags some potential compatibility issues and provides recommendations. An administrator reviews the recommendations before addressing the issues.
Which of the following processes describes this scenario?

A. Data validation
B. Human-in-the-loop
C. Data preparation
D. Model evaluation

Answer: B

Explanation:
Basic Concept: Human-in-the-loop is a design pattern where AI systems generate recommendations or decisions but require human review and approval before those recommendations are acted upon. This approach maintains human oversight and accountability in AI-assisted workflows. CompTIA SecAI+ Study Guide covers human-in-the-loop as a key responsible AI principle and operational pattern.
Why C is Correct: The scenario precisely describes the human-in-the-loop pattern: the AI system identifies potential issues and provides recommendations, but an administrator must review those recommendations before any action is taken. This deliberate inclusion of human judgment in the AI ' s decision or recommendation workflow ensures human oversight is maintained, which is the defining characteristic of the human-in-the-loop process.
Why A is Wrong: Data validation verifies that data meets expected quality standards and formats before being used in AI processing. It is a data quality control activity, not a workflow pattern describing human review of AI recommendations.
Why B is Wrong: Data preparation involves transforming raw data into a format suitable for AI model training or inference. It encompasses cleaning, normalizing, and formatting data, not the process of human review of AI-generated recommendations during system updates.
Why D is Wrong: Model evaluation assesses a model ' s performance against metrics such as accuracy, precision, and recall on test datasets. It is a technical assessment of model quality, not a workflow process where humans review AI-generated recommendations before acting on them.

NEW QUESTION # 29
A management team is concerned about an unexpected cost increase for a public-facing AI chatbot.
Which of the following should a security administrator examine first to determine the root cause?

A. Model token usage
B. Firewall logs
C. Vector database input/output operations per second performance
D. Web application firewall (WAF) rules

Answer: A

Explanation:
Basic Concept: AI chatbot operational costs are primarily driven by token consumption - the number of tokens processed in requests and generated in responses. Unexpected cost increases in LLM-based chatbots almost always trace back to abnormal token usage patterns. CompTIA SecAI+ Study Guide covers AI cost monitoring and token-based billing under securing AI systems.
Why D is Correct: Model token usage logs directly show how many tokens are being consumed per request, by which users or endpoints, and whether usage has increased abnormally. Examining token usage data is the most direct path to identifying the root cause of unexpected cost increases - whether from a denial-of-wallet attack, user abuse, a new feature generating verbose responses, or legitimate organic growth in usage. This is the first and most relevant examination point for LLM cost analysis.
Why A is Wrong: Firewall logs capture network-level traffic information. While they can reveal unusual access patterns or volumes, they do not contain token consumption data that directly explains LLM billing increases.
Why B is Wrong: WAF rules define filtering policies for web traffic. Reviewing rule configurations does not reveal whether token usage has increased or why costs have risen; it shows security policy settings rather than consumption metrics.
Why C is Wrong: Vector database IOPS performance measures how quickly the database processes read and write operations. While relevant to RAG system performance, IOPS metrics do not directly explain LLM API cost increases driven by token consumption.

NEW QUESTION # 30
What control reduces the impact radius when a single host is compromised?

A. Network segmentation
B. Obfuscation
C. Tokenization
D. Redaction

Answer: A

Explanation:
Segmentation isolates systems and limits lateral movement.

NEW QUESTION # 31
A social media company with more than a million lines of code wants to reduce the mean time to fix bugs and issues. Which of the following is the most balanced AI strategy to automate the vulnerability management flow?

A. Having security analysts triage discovered issues and create tickets, but using AI to merge software
B. Using AI to triage discovered issues, create tickets, and merge software fixes
C. Having security analysts triage discovered issues and create tickets, but having a software engineer merge software
D. Using AI to triage discovered issues and create tickets, but having a software engineer merge software

Answer: D

Explanation:
This approach balances automation and human oversight. AI accelerates vulnerability management by triaging issues and generating tickets, while software engineers retain responsibility for merging code changes, ensuring quality and reducing the risk of insecure or unstable code being deployed.

NEW QUESTION # 32
An employee wants a consulting company to procure a data set that contains age, ethnicity, and diabetes status. During development, the employer wants to ensure the integrity of the data.
Which of the following is the best strategy to accomplish this task?

A. Conducting human evaluation
B. Enabling log monitoring
C. Querying the model
D. Implementing checksums

Answer: D

Explanation:
Checksums ensure data integrity by detecting any unauthorized or accidental changes to the dataset. This provides a reliable way to confirm that sensitive attributes such as age, ethnicity, and diabetes status remain unaltered during development.

NEW QUESTION # 33
An AI security administrator notices that the information referenced by the model is incorrectly formatted and missing values. Which of the following job roles would most likely be responsible for correcting this error?

A. AI architect
B. Platform engineer
C. Data engineer
D. Machine learning operations (MLOps) engineer

Answer: C

Explanation:
A data engineer is responsible for preparing, cleaning, and formatting data pipelines. When information is incorrectly formatted or missing values, the data engineer ensures data integrity and quality before it is used by AI models.

NEW QUESTION # 34
A data set containing medical information is put into a machine learning (ML) model that is designed to predict specific illnesses for a population. In the process of verifying the reliability of the system, the compliance officer realizes that the system cannot reliably predict illnesses for certain segments of the population. Which of the following types of risk is most applicable to this case?

A. Inclusiveness
B. Transparency
C. Consistency
D. Bias

Answer: D

Explanation:
The model's inability to reliably predict illnesses for certain population segments indicates bias in the dataset or training process. This leads to unfair or inaccurate outcomes for specific groups, making bias the most applicable risk in this case.

NEW QUESTION # 35
A security analyst is preparing a presentation for the sales team that describes the most common vulnerabilities that are specific to AI applications.
Which of the following is the best source for the analyst to consult?

A. Common Weakness Enumeration (CWE)
B. Open Worldwide Application Security Project (OWASP)
C. International Organization for Standards (ISO) 27001
D. National Institute of Technologies Risk Management Framework (NIST-RMF)

Answer: B

Explanation:
Basic Concept: Identifying AI-specific application vulnerabilities requires consulting a resource that has cataloged and documented the unique vulnerability types that affect AI systems, particularly LLMs. Different security standards serve different purposes, and selecting the right reference for AI application vulnerabilities is essential. CompTIA SecAI+ Study Guide references OWASP for AI application vulnerability guidance.
Why C is Correct: OWASP maintains the OWASP Top 10 for Large Language Model Applications, which specifically catalogs the most critical and common vulnerabilities in AI applications including prompt injection, sensitive information disclosure, excessive agency, insecure output handling, and training data poisoning. This AI-specific vulnerability list is the most directly relevant and accessible resource for a presentation on AI application vulnerabilities.
Why A is Wrong: ISO 27001 is a general information security management system standard covering broad organizational security controls. It does not specifically catalog AI application vulnerabilities or LLM-specific weakness categories.
Why B is Wrong: CWE catalogues software weakness types at a code and design level for traditional software. While some weaknesses apply to AI systems, CWE does not have a dedicated AI application vulnerability taxonomy comparable to the OWASP LLM Top 10.
Why D is Wrong: NIST RMF is a risk management framework providing guidance for managing and reducing information security risk. It is a process framework, not a vulnerability catalog, and does not list specific AI application vulnerability types suitable for a vulnerabilities presentation.

NEW QUESTION # 36
A manufacturing company wants to use AI within its operations to improve the efficiency and accuracy of its processes. Which of the following should the organization do first to enable adoption and achieve the business objectives?

A. Achieve International Organization for Standardization (ISO) 42001 certification.
B. Select a large language model (LLM).
C. Hire a data and AI architect.
D. Introduce a generative adversarial network (GAN).

Answer: C

Explanation:
The first step in adopting AI to meet business objectives is to establish the right expertise. A data and AI architect can design the overall strategy, infrastructure, and data pipelines needed for effective AI integration, ensuring alignment with operational goals before selecting specific models or certifications.

NEW QUESTION # 37
Which of the following should an auditor reference when reviewing a company ' s human resources AI systems for legal non-compliance?

A. International Organization for Standardization (ISO)
B. European Union (EU) AI Act
C. Organization for Economic Cooperation and Development (OECD) standard
D. National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF)

Answer: B

Explanation:
Basic Concept: Various regulatory frameworks govern AI use in different contexts. For auditing legal compliance in high-risk AI applications such as employment and HR, binding regulatory legislation takes precedence over voluntary standards. CompTIA SecAI+ Exam Objectives cover AI governance and compliance frameworks under Domain 4.
Why C is Correct: The EU AI Act is the world ' s first comprehensive, legally binding AI regulation. It explicitly classifies AI systems used in employment, worker management, and recruitment as high-risk AI systems, subjecting them to strict compliance requirements including conformity assessments, transparency obligations, and human oversight mandates. An auditor reviewing HR AI for legal non-compliance must reference this binding legislation.
Why A is Wrong: The OECD AI Principles are non-binding international guidelines promoting responsible AI. They offer policy guidance but carry no legal enforcement power for compliance auditing.
Why B is Wrong: The NIST AI RMF is a voluntary, risk management-focused framework. It is not a legal compliance standard and cannot be used to assess legal non-compliance.
Why D is Wrong: ISO standards such as ISO 42001 are voluntary international best practice standards. They are not legal compliance instruments with enforceable penalties for HR AI systems.

NEW QUESTION # 38
An organization wants to reduce vulnerabilities after deployment. The organization decides to incorporate an AI-assisted early detection and vulnerability identification process in its development workflow.
Which of the following AI-assisted functions is the best option?

A. Automated deployment/rollback
B. Incident management
C. Code linting
D. System auditing

Answer: C

Explanation:
Basic Concept: Reducing post-deployment vulnerabilities requires catching security issues as early as possible in the development workflow. AI-assisted tools that analyze code during development provide the earliest possible intervention point. CompTIA SecAI+ Study Guide covers AI integration in secure development under AI-assisted security.
Why A is Correct: AI-assisted code linting analyzes source code in real time during development to identify security vulnerabilities, insecure coding patterns, policy violations, and quality issues before code is compiled or committed. By catching vulnerabilities at the coding stage - the earliest possible point in the development workflow - AI code linting prevents vulnerable code from progressing to testing, staging, or production, directly reducing post-deployment vulnerabilities at their source.
Why B is Wrong: Incident management handles security events and incidents after they have occurred in production. It is a reactive capability focused on response and recovery rather than early-stage vulnerability identification in the development workflow.
Why C is Wrong: Automated deployment/rollback automates the process of pushing code to production and reverting to previous versions when issues are detected post-deployment. It is a deployment safety mechanism rather than an early detection tool during the development phase.
Why D is Wrong: System auditing reviews and records system activities and configurations for compliance verification. It is primarily a detective and compliance control for systems that are already deployed, not an early development-phase vulnerability identification tool.

NEW QUESTION # 39
An internal user enters a client credit card number into an internal generative machine learning (ML) model:
#User prompt: Customer Jane Doe has a new credit card that she wants to add to her account. The number is
5555-5555-5555-5555
Which of the following is the most effective way to prevent prompt injection attacks against a large language model (LLM)?

A. Antivirus
B. Role-based access control
C. Guardrails
D. Web application firewall (WAF)

Answer: C

Explanation:
Basic Concept: Prompt injection occurs when malicious content embedded in user input manipulates an LLM
' s behavior, causing it to leak sensitive data, bypass restrictions, or execute unintended actions. Preventing such attacks requires mechanisms that inspect and filter content at the prompt level. CompTIA SecAI+ covers LLM-specific security controls extensively.
Why A is Correct: Guardrails are purpose-built controls that inspect, filter, and constrain both input prompts and output responses in LLM systems. They can detect sensitive data patterns such as credit card numbers, block prompt injection payloads, enforce content policies, and prevent the model from processing or outputting restricted information. Guardrails are the primary LLM-native defense against prompt injection as cited in the CompTIA SecAI+ Study Guide.
Why B is Wrong: Antivirus software detects known malware signatures in files and executables. It does not inspect or understand the semantic content of LLM prompts and cannot detect or block prompt injection attacks.
Why C is Wrong: A WAF operates at the HTTP layer inspecting web requests and responses against rule sets.
While it can block some patterns, it lacks the contextual intelligence to understand LLM prompt semantics and cannot prevent sophisticated injection attacks.
Why D is Wrong: Role-based access control manages who can access which resources. It controls authorization but does not inspect the content of prompts to prevent injection attacks once a user has legitimate access.

NEW QUESTION # 40
A SOC team has an AI agent that performs web searches and calls to the SOAR solution. The team is concerned about enterprise uptime and case resolution time.
Which of the following is the most appropriate use of the AI agent?

A. To create tabletop exercises so the team can increase its incident response speed
B. To perform research using open-source intelligence to enrich the alerts
C. To aggregate SOC metrics and generate reports for the leadership team
D. To analyze and contain offending users or hosts using SOAR playbooks

Answer: D

Explanation:
Basic Concept: AI agents in SOC environments can automate repetitive, rules-based response actions that previously required human intervention. When the primary concerns are enterprise uptime and case resolution time, the AI agent ' s ability to autonomously execute containment actions through SOAR is the most impactful application. CompTIA SecAI+ Study Guide covers AI agent use cases in security operations.
Why A is Correct: Using the AI agent to analyze incidents and execute containment actions through SOAR playbooks directly addresses both uptime and resolution time concerns. The agent can immediately analyze alert details, determine the appropriate playbook, and execute containment actions such as isolating compromised hosts or disabling compromised accounts autonomously, without waiting for human intervention. This dramatically reduces mean time to contain threats, improving both uptime and resolution speed.
Why B is Wrong: Enriching alerts with open-source intelligence improves analyst context but is a preparatory step rather than a response action. While valuable, it does not directly reduce resolution time by taking containment actions to stop ongoing threats.
Why C is Wrong: Aggregating metrics and generating leadership reports is an administrative function that consumes agent capacity for non-operational purposes. It improves visibility but does not directly improve uptime or case resolution time for active incidents.
Why D is Wrong: Creating tabletop exercises improves team preparedness over time through training scenarios. While beneficial for long-term capability development, it does not directly address the immediate concerns of enterprise uptime and active case resolution time.

NEW QUESTION # 41
Instructions: Use the drop-down menus to define two appropriate security controls for each component of the AI system. Each control may be used only once.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.

Answer:

Explanation:

Explanation:

Basic Concept: This is a Performance-Based Question (PBQ) - a HOTSPOT/simulation item requiring interactive selection in the actual exam. It tests the candidate ' s ability to map appropriate security controls to AI system components such as API gateway, model endpoint, data layer, and authentication layer.
Key Concept - Appropriate Controls by Component: For an API gateway connecting an AI system, typical controls include API key authentication, rate limiting, TLS encryption, and input validation. For the model endpoint, controls include IAM role-based access, audit logging, and guardrails. For data access components, encryption at rest and data masking are appropriate. For the authentication layer, MFA and expiring session tokens are relevant.
Why This Matters: The CompTIA SecAI+ Study Guide emphasizes defense-in-depth for AI system integration, ensuring each architectural layer has dedicated, appropriate security controls. The principle of least privilege should guide access control assignments at each component, while availability controls such as rate limiting protect against abuse.
Reference: CompTIA SecAI+ Exam Objectives Domain 2 (Securing AI Systems) covers AI system component security controls. Candidates should study the mapping of controls to infrastructure components including API gateways, model serving endpoints, data stores, and identity management layers. In the live exam, select the most specific and directly relevant control for each component based on the component ' s function and risk profile.