New Release CY0-001 CompTIA SecAI+ Questions

Basic Concept: When an AI fraud detection model produces false positives (blocking legitimate transactions), this indicates the model ' s decision boundary is insufficiently calibrated. The model needs improved training data to better distinguish fraudulent from legitimate transactions. CompTIA SecAI+ covers model performance improvement under AI-assisted security.

Why A is Correct: Retraining the model with more data and recent transaction patterns directly addresses the root cause of false positives. Additional representative legitimate transaction data helps the model learn more accurate decision boundaries, reducing false positives while maintaining detection sensitivity for actual fraud. This improves model accuracy without abandoning AI-based detection.

Why B is Wrong: Token usage and rate limits are cost and resource management controls for LLM APIs. They have no relevance to improving the accuracy of a fraud detection ML model that incorrectly classifies legitimate transactions.

Why C is Wrong: Encrypting data and applying access controls are data security measures that protect confidentiality and integrity. They do not address model classification accuracy or the false positive problem in fraud detection.

Why D is Wrong: Rolling back to a traditional system abandons the capabilities of AI-based fraud detection. The appropriate response to model performance issues is to improve the model through retraining, not to regress to less capable detection approaches.

Basic Concept: In AI governance, each role holds distinct responsibilities. Understanding these roles is core to CompTIA SecAI+ Domain 4 (AI Governance, Risk, and Compliance).

Why D is Correct: The Data Scientist is responsible for translating business use cases into working AI/ML models. They analyze business requirements, identify the appropriate machine learning approach, and develop models that fulfill specific business objectives. According to the CompTIA SecAI+ Study Guide, data scientists bridge raw data and actionable AI solutions by building and validating models derived from business-driven needs.

Why A is Wrong: A Platform Architect designs and manages the infrastructure and technical platforms hosting AI systems. Their focus is architectural design of the environment, not model development from business use cases.

Why B is Wrong: An AI Risk Analyst identifies, evaluates, and mitigates risks associated with AI adoption. Their role is governance and risk-oriented, not model creation.

Why C is Wrong: An MLOps Engineer operationalizes, deploys, monitors, and maintains AI models in production. They take models already built by data scientists and ensure reliable operation at scale, not develop them from business use cases.

Basic Concept: User account credentials stored in a database must be protected against unauthorized disclosure. The security of credentials at rest requires cryptographic controls that prevent even database administrators or attackers with database access from reading plaintext passwords. CompTIA SecAI+ Study Guide covers credential security controls as part of AI application security.

Why C is Correct: Implementing hashing and encryption for credential protection is the industry-standard approach. Passwords should be hashed using strong, slow algorithms such as bcrypt, Argon2, or scrypt with unique salts, making them computationally infeasible to reverse even if the database is compromised. Additional sensitive credential data can be encrypted. Together, hashing and encryption ensure that account credentials remain protected even if the underlying storage is accessed by unauthorized parties.

Why A is Wrong: Patching the model with new datasets updates the AI model ' s training data and knowledge. It does not address the security of user account credentials stored in the application ' s authentication database.

Why B is Wrong: Updating Linux and virtual server software patches system vulnerabilities and is important for overall security hygiene. However, it does not implement specific protections for the account credentials themselves stored in the application database.

Why D is Wrong: Deploying an authenticated API requires users to authenticate to use the API, improving access control. While this complements credential security, it does not protect the storage of credentials at rest and does not replace hashing and encryption of the credential values themselves.

Basic Concept: Domain-specific AI chatbots can produce contextually inappropriate responses when they lack sufficient domain grounding to disambiguate terms that have different meanings in different contexts. Guardrails can enforce domain-appropriate interpretation and response constraints. CompTIA SecAI+ Study Guide covers guardrails as a mechanism for maintaining model behavioral boundaries.

Why A is Correct: Configuring guardrails allows the organization to enforce domain-specific behavioral constraints on the chatbot, ensuring it interprets ambiguous terms within the correct technical context. Guardrails can include context-aware rules that recognize when a query is in a cybersecurity context and constrain the model to provide domain-appropriate responses. This directly addresses the issue of the model providing biologically-framed responses to a technical cybersecurity question.

Why B is Wrong: Encrypting model weights at rest protects the model parameters from unauthorized access or modification. It is a data protection control for model intellectual property and does not influence how the model interprets or responds to domain-specific queries at inference time.

Why C is Wrong: Model access controls restrict who can query and modify the model. They manage authorization at the user and system level but do not enforce domain-appropriate response constraints or prevent contextually incorrect answers from being generated.

Why D is Wrong: Prompt templates provide structured, reusable formats for common queries. While they can help standardize how cybersecurity questions are asked, they require users to use the template and do not provide real-time enforcement of domain-appropriate response generation for all input variations.