Master CompTIA SecAI+ v1 (CY0-001): Exam-Ready Practice Materials

Correct : A

Basic Concept: Adding validation layers to software development processes improves security assurance by catching issues that human reviewers might miss. AI-assisted validation provides an automated, systematic review that complements human judgment. CompTIA SecAI+ Study Guide covers AI-assisted development security controls.

Why A is Correct: AI-assisted approval adds an intelligent automated review layer that works alongside existing human review. AI can systematically analyze code for security vulnerabilities, coding standard violations, dependency risks, and policy compliance with greater consistency and speed than manual review. This creates a defense-in-depth validation approach where both AI and human reviewers must approve changes, catching issues that either layer might miss independently.

Why B is Wrong: A low-code plug-in provides simplified visual development tools that reduce the amount of manual code writing required. It is a development productivity tool, not a security validation layer for reviewing already-written code.

Why C is Wrong: Automated rollback is a deployment safety mechanism that reverts a deployment to the previous version when errors are detected after deployment. It is a recovery control, not a validation layer applied during the development review process.

Why D is Wrong: Regression testing verifies that new code changes have not broken existing functionality. It tests functional correctness, not security vulnerabilities, and does not add an AI-powered security validation capability to the existing human review process.

Correct : A

Basic Concept: RAG-based AI systems retrieve information from knowledge bases to augment their responses. The differential access to sensitive employee data based on user role demonstrates that role-based data access controls are functioning correctly, restricting what data different users can retrieve through the AI interface. CompTIA SecAI+ Study Guide covers data access controls as the primary mechanism for preventing sensitive data exposure in RAG systems.

Why A is Correct: Data access controls define what information each user role is permitted to retrieve from the knowledge base. In this scenario, administrator-level users can access employee directory information while employee-level users cannot. The RAG system enforces these permissions when retrieving data for the AI's responses, preventing unauthorized users from accessing sensitive employee data through the chatbot interface regardless of how they phrase their queries.

Why B is Wrong: Model-specific guardrails filter responses based on content policies. While they can prevent certain categories of sensitive information from being disclosed, the scenario specifically shows differential access based on user role, which is the characteristic of access control enforcement, not content-based guardrail filtering.

Why C is Wrong: Rate limiting restricts request frequency. It does not differentiate what data different users can access; it only controls how often they can make requests. Both the administrator and employee could be subject to the same rate limit while still receiving different data based on their access controls.

Why D is Wrong: Prompt templates standardize how queries are structured. They do not implement user role-based data access restrictions or prevent specific user types from accessing sensitive information in the underlying knowledge base.

Correct : C

Basic Concept: API-based AI systems are susceptible to DoS attacks where excessive requests overwhelm the system's ability to respond to legitimate users. Rate limiting is the standard control for preventing both intentional and unintentional API abuse. CompTIA SecAI+ Study Guide covers rate limiting as a key availability control for AI APIs.

Why C is Correct: Rate limiting restricts the number of requests a client can make to an API within a defined time window. In this scenario, a brute-force DoS attack works by sending a massive volume of requests to exhaust the model's resources. Rate limiting would have automatically throttled or blocked the excessive request volume, preventing the attack from succeeding and preserving service availability for legitimate hospital users.

Why A is Wrong: Tokenization replaces sensitive data values with non-sensitive placeholders. It is a data security control for protecting sensitive information such as patient identifiers, not a control for managing API request volumes or preventing DoS attacks.

Why B is Wrong: Model guardrails filter and constrain model inputs and outputs for safety and policy compliance. They inspect content quality, not request volume, and cannot prevent a volume-based DoS attack.

Why D is Wrong: A prompt firewall inspects the content of prompts for malicious patterns or policy violations. Like guardrails, it analyzes content rather than controlling request frequency and cannot prevent resource exhaustion from a high-volume brute-force attack.

Correct : C

Basic Concept: Generative AI systems in healthcare settings incur costs from multiple operational activities. Understanding the cost drivers specific to generative AI helps administrators implementaccurate cost monitoring and controls. CompTIA SecAI+ Study Guide covers AI cost management under securing AI systems.

Why C is Correct: Storage retrieval and prompt processing are the two primary cost drivers for generative AI systems in healthcare. Storage retrieval refers to the cost of querying vector databases or document stores in RAG-based AI systems to fetch relevant patient records, clinical guidelines, or historical data for context. Prompt processing encompasses the token-based cost of the LLM processing the combined retrieved content and user query to generate a response. Together these two activities represent the billable units that drive generative AI costs in healthcare RAG deployments, making them the most accurate basis for cost calculation and monitoring.

Why A is Wrong: Connection access and exchange gateway costs relate to network infrastructure and API gateway usage fees. While there may be minor costs associated with API calls, these are not the primary cost drivers for generative AI systems where the dominant expenses are computational token processing and data retrieval operations.

Why B is Wrong: Encryption and decryption processing costs relate to cryptographic operations for data security. While encryption is important for healthcare data protection under HIPAA, cryptographic processing overhead is minimal compared to the substantial token-based LLM processing and storage retrieval costs that dominate generative AI operational expenses.

Why D is Wrong: Catalog servicing and exchange processing are terms associated with data catalog management and data exchange infrastructure. These are not recognized primary cost components of generative AI systems in healthcare, where storage retrieval and token-based prompt processing are the established cost measurement criteria.

Correct : C

Basic Concept: Different ML learning paradigms handle different data situations. The availability of labeled versus unlabeled data determines which learning approach is appropriate. Building clustering models specifically requires learning from data without predefined category labels. CompTIA SecAI+ Study Guide covers ML learning paradigms under basic AI concepts.

Why C is Correct: Unsupervised learning works with unlabeled data by discovering inherent patterns, structures, and groupings within the data without predefined categories. Clustering is the canonical unsupervised learning task, where algorithms like k-means, hierarchical clustering, or DBSCAN group similar data points together based on feature similarity. Since the data scientist has unlabeled data and wants to find natural groupings, unsupervised learning is the appropriate and correct technique.

Why A is Wrong: Supervised learning requires labeled training data where each example has a corresponding correct output label. The data scientist explicitly has unlabeled data, making supervised learning inapplicable without first completing the labor-intensive task of manually labeling all examples.

Why B is Wrong: Reinforcement learning trains agents to take actions in an environment to maximize cumulative rewards through trial and error. It is designed for sequential decision-making problems, not for finding groupings in static, unlabeled datasets.

Why D is Wrong: Semi-supervised learning combines a small amount of labeled data with a large amount of unlabeled data. It requires at least some labels to guide learning. The scenario specifies working with unlabeled data only, making unsupervised learning the pure fit.