A machine learning (ML) engineer is working with a security engineer to identify the best practices for securing a system with various AI models. Which of the following actions should the engineers suggest?
Answer(s): B
A secure MDLC is tailored to AI and ML systems, ensuring security is integrated throughout the model’s design, training, validation, deployment, and monitoring phases. This directly addresses best practices for securing systems with AI models.
Which of the following is an example of how a security analyst uses generative AI in the triage process?
Answer(s): C
In triage, generative AI is most effective for quickly summarizing and categorizing large volumes of alerts or findings. This helps analysts prioritize incidents and streamline the investigation process.
A company develops an AI model to diagnose patients. Hospitals access the model through an integrated application programming interface (API). The security team performs a denial-of-service (DoS) attack via brute force on the model. Which of the following controls would have prevented this issue?
Rate limiting restricts the number of API requests within a specific timeframe, preventing brute-force attempts that can overwhelm the AI model and cause denial-of-service conditions.
A security team is using an AI-based tool to try to bypass organizational boundaries. The team uses AI to look at the current state and suggest different attack vectors based on the outcome of the previous ones. Which of the following techniques is the team most likely using?
Answer(s): D
The described behavior - iteratively assessing the environment and adapting attack paths based on prior outcomes - matches automated penetration testing, where AI-driven tools simulate attack chains and adjust tactics dynamically.
Which of the following attacks would be the best to automate with AI during dynamic application software testing (DAST)?
During DAST, automating the generation of diverse, targeted attack payloads lets testers probe runtime inputs (e.g., XSS, SQLi, command injection) more thoroughly and discover vulnerabilities that manual or static tests might miss.
Post your Comments and Discuss CompTIA CY0-001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CY0-001 content, but please register or login to continue.