CompTIA SecAI+ Certification - CY0-001무료 덤프문제 풀어보기
A company introduces a large language model (LLM) in an application in order to monitor for a potential denial-of-service attack.
Which of the following should the company use to measure the utilization of the LLM?
Which of the following should the company use to measure the utilization of the LLM?
정답: A
설명: (Fast2test 회원만 볼 수 있음)
A company launches an AI application to monitor cloud misconfiguration and compliance. The AI application is shutting down development servers and opening ports during a client demonstration. Which of the following actions should the company take to return to normal operations and prevent future issues?
정답: A
설명: (Fast2test 회원만 볼 수 있음)
A detection engineering team wants to use AI to automatically prevent vulnerable code from reaching production.
Which of the following is the most effective way to accomplish this task?
Which of the following is the most effective way to accomplish this task?
정답: B
설명: (Fast2test 회원만 볼 수 있음)
A critical AI system cannot be shut down and must remain secure. Which of the following actions should be performed to apply controls?
정답: D
설명: (Fast2test 회원만 볼 수 있음)
As a compliance requirement, a large language model (LLM) application requires setting up guardrails.
Which of the following resources is most appropriate to use?
Which of the following resources is most appropriate to use?
정답: D
설명: (Fast2test 회원만 볼 수 있음)
An engineer is analyzing findings from a penetration test that indicate insufficient data encryption. The report also indicates that additional controls must be placed on the data. To protect against loss of intellectual property, the engineer must implement data security.
Part 1: Use drop-down menu to select the most appropriate protocol or cipher for each system component.
Part 2: Use the drop-down menu to select the most appropriate technique to apply to the modified data.
Part 1: Use drop-down menu to select the most appropriate protocol or cipher for each system component.
Part 2: Use the drop-down menu to select the most appropriate technique to apply to the modified data.
정답:
Explanation:
Part 1 - Select the protocol or cipher
System component
Select
API gateway
TLS 1.2
Database storage
CAMELLIA
AI model storage
HMAC-SHA512
Part 2 - Select the data-protection technique
Enter the techniques from the first row to the fifth row in this exact order:
Row Data modification Select
1 The name field is removed, while patient_id and dob remain De-identification
2 ip_addr and name are removed, leaving cookie and uid Anonymization
3 The card number is replaced by 0x0193828829 Tokenization
4 sensitivity: " SECRET " is added Classification
5 Part of the PIN is replaced by XXXX Masking
See Explanation
Why these are the intended answers
API gateway # TLS 1.2
The API gateway handles data moving between the client and backend systems. TLS is the only listed transport-security protocol and therefore protects the data in transit . OWASP recommends encrypting sensitive data in transit by using TLS with secure parameters.
Database storage # CAMELLIA
CAMELLIA is a symmetric block cipher suitable for encrypting substantial quantities of stored data. It is therefore the valid storage-encryption choice among the listed options.
Do not select AES-512 . AES-512 is not a standardized AES variant. NIST defines only AES-128, AES-192, and AES-256 .
AI model storage # HMAC-SHA512
The scenario separately emphasizes protection against loss or modification of intellectual property. HMAC- SHA512 supplies message authentication and integrity verification, allowing unauthorized modification of the AI model to be detected. HMAC is not confidentiality encryption, but it is the most appropriate listed additional control for protecting model integrity. OWASP specifically identifies HMACs as cryptographic controls for stored-data integrity.
Why the other options are not selected
* SHA-2 512: Hashing only; no secret key and no encryption.
* Elliptical curve: A family of cryptographic techniques, not a specific storage or transport protocol.
* ECDH: Used for key agreement, not direct bulk-data encryption.
* AES-512: Invalid AES key size.
* RSA-2048: Primarily used for asymmetric encryption, signatures, or key transport; inefficient for bulk database or model encryption.
* CAMELLIA: Appropriate symmetric encryption for stored data.
* HMAC-SHA512: Integrity and authenticity, not confidentiality.
Final Part 2 order
* De-identification
* Anonymization
* Tokenization
* Classification
* Masking
Explanation:
De-identification removes an explicitly identifying field-in this case, the person's name-while retaining other fields needed for processing. The remaining patient ID and date of birth could potentially permit re- identification when combined with other information, so this is de-identification rather than complete anonymization. OWASP describes de-identification as deleting, scrambling, or pseudonymizing direct and indirect identifiers.
Anonymization removes identifying attributes so that the displayed record is not directly tied to the named individual. Here, both the name and IP address are removed.
Tokenization substitutes a sensitive value with a non-sensitive representative token. The original payment- card number is replaced with the hexadecimal-style value 0x0193828829. OWASP recognizes tokenization as a method for reducing exposure of stored sensitive data.
Classification labels information according to sensitivity. Adding sensitivity: " SECRET " does not conceal or transform the PIN; it categorizes the record so appropriate controls can be applied. OWASP recommends classifying processed, stored, and transmitted data and applying controls based on that classification.
Masking obscures only part of a sensitive value while preserving its general format. Changing 999-99-9999 to 999-99-XXXX is partial masking.
Which of the following is the primary purpose of validating data for an AI system?
정답: B
설명: (Fast2test 회원만 볼 수 있음)
Which of the following is an example of how a security analyst uses generative AI in the triage process?
정답: C
설명: (Fast2test 회원만 볼 수 있음)
Which of the following controls is the best way to mitigate a denial-of-service (DoS) attack?
정답: A
설명: (Fast2test 회원만 볼 수 있음)
Which of the following resources most accurately covers the most widely recognized threat vectors and common vulnerabilities related to large language model (LLM) applications?
정답: C
설명: (Fast2test 회원만 볼 수 있음)
Instructions: Use the drop-down menus to define two appropriate security controls for each component of the AI system. Each control may be used only once.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.
정답:
Explanation:
Basic Concept: This is a Performance-Based Question (PBQ) - a HOTSPOT/simulation item requiring interactive selection in the actual exam. It tests the candidate ' s ability to map appropriate security controls to AI system components such as API gateway, model endpoint, data layer, and authentication layer.
Key Concept - Appropriate Controls by Component: For an API gateway connecting an AI system, typical controls include API key authentication, rate limiting, TLS encryption, and input validation. For the model endpoint, controls include IAM role-based access, audit logging, and guardrails. For data access components, encryption at rest and data masking are appropriate. For the authentication layer, MFA and expiring session tokens are relevant.
Why This Matters: The CompTIA SecAI+ Study Guide emphasizes defense-in-depth for AI system integration, ensuring each architectural layer has dedicated, appropriate security controls. The principle of least privilege should guide access control assignments at each component, while availability controls such as rate limiting protect against abuse.
Reference: CompTIA SecAI+ Exam Objectives Domain 2 (Securing AI Systems) covers AI system component security controls. Candidates should study the mapping of controls to infrastructure components including API gateways, model serving endpoints, data stores, and identity management layers. In the live exam, select the most specific and directly relevant control for each component based on the component ' s function and risk profile.
Which of the following International Organization for Standardization (ISO) standards should be selected for certification to use for third-party assurance for responsible AI practices?
정답: A
설명: (Fast2test 회원만 볼 수 있음)
A multinational company wants to implement an AI-assisted job screening solution.
Which of the following should the company reference to reduce the risk of incurring compliance-related fines?
Which of the following should the company reference to reduce the risk of incurring compliance-related fines?
정답: B
설명: (Fast2test 회원만 볼 수 있음)
A security analyst is aware of an active penetration test in the environment. The analyst examines SIEM log data and notices the following AI system output:
Which of the following is the vulnerability that has occurred and the control the analyst should implement?
Which of the following is the vulnerability that has occurred and the control the analyst should implement?
정답: D
설명: (Fast2test 회원만 볼 수 있음)