CompTIA SecAI+ CY0-001 Book

Option B is correct because the defect is a regression: a security behavior that should require reauthentication was previously corrected but reappeared after a software update. Automated AI-assisted regression testing in the CI/CD pipeline can repeatedly verify that protected account-balance functions still demand reauthentication before a release is promoted. The test should reproduce the prior defect, fail the build when authentication is bypassed, and preserve the case as a permanent security test. Option A adds an approval step, but an approver may not detect the reintroduced behavior without an executable test. Option C improves release scheduling and traceability but does not prove that security controls still function. Option D uses SAST to inspect source code for known weakness patterns; it may identify some authentication flaws, but it does not reliably validate the end-to-end runtime behavior described here. Regression testing is the direct control for preventing recurrence. The NIST AI Risk Management Framework emphasizes testing AI systems before deployment and regularly during operation, supporting automated security validation within the delivery pipeline.

================

Basic Concept: Various regulatory frameworks govern AI use in different contexts. For auditing legal compliance in high-risk AI applications such as employment and HR, binding regulatory legislation takes precedence over voluntary standards. CompTIA SecAI+ Exam Objectives cover AI governance and compliance frameworks under Domain 4.

Why C is Correct: The EU AI Act is the world ' s first comprehensive, legally binding AI regulation. It explicitly classifies AI systems used in employment, worker management, and recruitment as high-risk AI systems, subjecting them to strict compliance requirements including conformity assessments, transparency obligations, and human oversight mandates. An auditor reviewing HR AI for legal non-compliance must reference this binding legislation.

Why A is Wrong: The OECD AI Principles are non-binding international guidelines promoting responsible AI. They offer policy guidance but carry no legal enforcement power for compliance auditing.

Why B is Wrong: The NIST AI RMF is a voluntary, risk management-focused framework. It is not a legal compliance standard and cannot be used to assess legal non-compliance.

Why D is Wrong: ISO standards such as ISO 42001 are voluntary international best practice standards. They are not legal compliance instruments with enforceable penalties for HR AI systems.

Basic Concept: The relationship between AI system capabilities and security risk is a fundamental concept in AI governance. As AI models gain more functionality and capabilities, their potential for misuse, unintended consequences, and attack surface expansion grows proportionally. CompTIA SecAI+ Study Guide addresses capability-risk proportionality under AI governance.

Why D is Correct: The risks of a generative AI product are proportional to its capabilities. Each new feature expands what the model can do, which simultaneously expands what adversaries can manipulate it to do, what sensitive operations it can be directed to perform, and what unintended harm it can cause. A model that can generate text, images, execute code, and call external APIs has dramatically greater risk potential than one that can only generate text. Risk grows with capability scope.

Why A is Wrong: Risks do not remain constant when new features are added. New features introduce new attack vectors, expand the model ' s action space, and create new opportunities for misuse. Each addition fundamentally changes the system ' s risk profile.

Why B is Wrong: While risks do increase with new features, saying they simply increase does not capture the precise relationship. The increase is proportional to the nature and scope of the capabilities added, not a uniform increment for any feature addition.

Why C is Wrong: While risks can be measured qualitatively, stating that risks are measured qualitatively is a statement about measurement methodology rather than an explanation of how risks change when functionality is enabled. It does not accurately describe the relationship between capability and risk.

Basic Concept: When API sessions or connections remain active and consuming resources after their intended operations have completed, they create resource leaks that progressively degrade system availability. Session lifecycle management is critical for maintaining AI system health. CompTIA SecAI+ Study Guide covers session management as an availability control for AI systems.

Why B is Correct: Enforcing session expiration ensures that external API sessions and connections are automatically terminated after a defined idle period or maximum duration. This prevents resource-consuming zombie sessions from accumulating and exhausting system memory, thread pools, or connection limits. The observed pattern — persistent unavailability that resolves temporarily with restart — is classic resource leak behavior from sessions that never close, making session expiration the direct fix.

Why A is Wrong: Token limits cap the number of tokens processed per request. While useful for controlling per-request resource consumption, they do not address the root cause of sessions persisting and consuming resources long after their operations complete.

Why C is Wrong: Increasing system memory defers the problem rather than solving it. The leak will eventually consume the additional memory too, requiring another restart. Addressing the root cause through session management is superior to scaling resources to accommodate the leak.

Why D is Wrong: MFA adds an additional authentication factor for users accessing the system. It is a security control for identity verification, not a mechanism for managing session lifecycle or preventing resource exhaustion from lingering sessions.