CompTIA Updated CY0-001 Exam Questions and Answers by haadi

Basic Concept: User experience with AI systems is directly correlated to how accurately and relevantly the model responds to user queries. Poor model accuracy manifests as irrelevant, incorrect, or unhelpful responses, which is the primary driver of poor user experience. CompTIA SecAI+ Study Guide covers AI performance monitoring and user experience optimization.

Why B is Correct: Model accuracy metrics in logs reveal how often the model provides correct, relevant, and useful responses. Reviewing accuracy-related log data such as confidence scores, response quality ratings, error rates, and user feedback correlations enables the architect to identify performance gaps causing poor experiences and guides optimization efforts like fine-tuning or retrieval improvements.

Why A is Wrong: Rate monitoring tracks API call frequency and throughput. While important for capacity planning and detecting abuse, it does not directly reflect the quality of model responses that determine user experience.

Why C is Wrong: Access controls manage who can use the system and what permissions they have. They are a security concern rather than a user experience metric. Reviewing access control logs does not reveal information about response quality.

Why D is Wrong: Data storage metrics relate to storage capacity, utilization, and performance of data persistence layers. While these can affect response speed, they do not provide insights into model response quality or accuracy that drive user experience.

Basic Concept: An on-path (formerly man-in-the-middle) attack intercepts communication between two parties, allowing the attacker to read, modify, or inject content. In the context of a generative AI application, an on-path attack on the session between user and AI service can manipulate prompts being sent to the model or responses being returned to users. CompTIA SecAI+ covers AI-specific attack vectors under securing AI systems.

Why B is Correct: Session hijacking involves an attacker taking control of an active user session by capturing or forging session tokens. In this attack, the attacker intercepts the communication channel between users and the AI application, allowing them to modify prompts sent to the model or replace legitimate model responses with offensive content. This explains why outputs seem unrelated to prompts and contain offensive material.

Why A is Wrong: Application server hijacking involves gaining unauthorized control of the server hosting the application. While severe, this would typically manifest as complete service disruption or data exfiltration rather than targeted modification of individual user session content.

Why C is Wrong: Domain hijacking involves unauthorized transfer of a domain name registration, redirecting all users to a different IP address. This would affect all users simultaneously and typically redirect to a completely different site rather than manipulating individual AI responses.

Why D is Wrong: Model hijacking refers to attacks that steal or replicate an AI model, not to intercepting and modifying the communication between users and an existing model during active sessions.

Basic Concept: AI models can inadvertently memorize sensitive information from their training data. Certain attack techniques can exploit this memorization to extract private information from a deployed model, even without direct access to the training dataset. CompTIA SecAI+ Study Guide covers model inversion as an AI-specific data exposure attack vector.

Why B is Correct: Model inversion is an attack where an adversary queries a deployed AI model with carefully crafted inputs to reconstruct or infer sensitive training data. For example, an attacker could query a facial recognition model with optimized images to reconstruct faces of individuals from the training set, or query a medical diagnosis model to infer patient records used in training. This directly exposes sensitive data that was supposed to be protected.

Why A is Wrong: Overfitting is a model training quality issue where a model learns training data too specifically and performs poorly on new data. While it can indicate that sensitive data was memorized, overfitting itself is a performance concern rather than directly a data exposure attack vector.

Why C is Wrong: Data normalization is a preprocessing technique that scales numerical features to a common range to improve training performance. It is a data preparation step with no direct relevance to sensitive data exposure or privacy attacks.

Why D is Wrong: Hyperparameter tuning adjusts configuration parameters of a model to optimize its performance during training. It is an optimization technique with no relevance to protecting against sensitive data exposure attacks.

Basic Concept: ISO develops international standards for management systems across various domains. For organizations seeking third-party certification demonstrating commitment to responsible AI governance practices, the appropriate ISO standard must specifically address AI management systems. CompTIA SecAI+ Exam Objectives cover ISO standards relevant to AI governance under Domain 4.

Why D is Correct: ISO 42001 is the International Standard for Artificial Intelligence Management Systems (AIMS). It provides a framework for establishing, implementing, maintaining, and continually improving an AI management system within organizations. ISO 42001 certification provides third-party assurance specifically for responsible AI practices including risk management, transparency, human oversight, and ethical AI governance — directly answering the question.

Why A is Wrong: ISO 20000 is the standard for IT Service Management (ITSM). It provides requirements for establishing and maintaining a service management system for IT services. It does not address AI governance or responsible AI practices.

Why B is Wrong: ISO 27001 is the standard for Information Security Management Systems (ISMS). It addresses general information security risk management, not AI-specific governance or responsible AI practices such as fairness, transparency, and AI lifecycle management.

Why C is Wrong: ISO 27701 extends ISO 27001 to address Privacy Information Management (PIMS), covering personal data protection requirements aligned with GDPR. While relevant to data privacy in AI systems, it does not specifically certify responsible AI governance practices.