CompTIA CY0-001 Practice Test 2026

Explanation:

Prompting a chatbot to reveal internal infrastructure details—such as server naming conventions and IP subnets—directly strengthens an LLM’s utility for malicious reconnaissance. This technique, known as informational prompt engineering, exploits the model’s training data, which often includes publicly exposed code repositories, forum posts, or documentation containing organizational network patterns. By crafting a benign-sounding query, the attacker coerces the LLM to output specific, actionable intelligence without modifying the model itself. This is far more effective than other methods because it leverages the LLM’s parametric memory and reasoning capabilities to correlate fragmented data points, producing a comprehensive reconnaissance report. The attack falls under the OWASP LLM06: Sensitive Information Disclosure category, where the model inadvertently reveals proprietary or internal system details.

Why the other options are incorrect:

A. RAG:
RAG enhances accuracy by grounding responses in an external vector database. It does not inherently improve the model’s reasoning or ability to perform reconnaissance; it simply retrieves documents. An attacker would need prior access to the RAG data store, making it a secondary vector, not a performance enhancer.

B. Web scraper script:
This is an external OSINT tool, not an LLM capability. While it gathers data, it does not “strengthen” the model’s internal performance or reasoning. The LLM merely consumes the scraped data; its core functionality remains unchanged.

C. Query as an administrator:
This describes a role-playing jailbreak to bypass guardrails. While dangerous, it targets policy enforcement, not the model’s ability to perform reconnaissance. It does not make the LLM more effective at identifying patterns or correlating network data—it only removes content filters.

References:

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 2.2 (Threats to AI Systems – Inference and Extraction Attacks) and Domain 3.2 (Implementing AI Security Controls – Prompt Filtering).

OWASP Top 10 for LLMs (v1.1): LLM06 – Sensitive Information Disclosure, which explicitly warns against extracting internal system details via prompts.

Explanation:

Model inversion is a privacy attack where an adversary exploits a machine learning model's predictions to reconstruct sensitive training data. In a model inversion attack, the attacker queries the model with carefully crafted inputs and analyzes the output probabilities to reverse-engineer statistically accurate representations of the original training samples. This is the most direct and relevant security concern when an organization fears exposure of sensitive data—such as personally identifiable information (PII), medical records, or financial details—because the attack does not require breaching the database; it extracts information solely through the model's API endpoint. For example, researchers have demonstrated model inversion attacks on facial recognition systems that can reconstruct recognizable face images from the model's confidence scores. This attack falls under inference attacks, which are specifically designed to leak confidential training data.

Why the other options are incorrect:

A. Overfitting:
Overfitting occurs when a model memorizes noise or specific details from training data rather than generalizing. While overfitting can increase the success of a model inversion attack by making the model too sensitive to individual training points, overfitting itself is a performance issue, not a direct attack vector. It is a vulnerability that enables inversion, but the security concern is the attack, not the condition.

C. Data normalization:
This is a preprocessing technique used to scale numerical features to a standard range (e.g., Z-score or Min-Max scaling) to improve model convergence. It has no security implications regarding data exposure; it is purely a data preparation step.

D. Hyperparameter tuning:
This is the process of optimizing model configuration parameters (e.g., learning rate, number of layers, batch size) to improve accuracy. It is a machine learning engineering activity and does not cause or relate to sensitive data leakage.

References:

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 2.2 – Threats to AI Systems (specifically Inference Attacks which include model inversion and membership inference).

OWASP Top 10 for Machine Learning (ML03): Model Inversion is explicitly listed as a key threat to data privacy.

Explanation:

Prompt templates are predefined, structured input formats that guide the LLM toward desired outputs by providing context, role definitions, and explicit instructions. In this scenario, the chatbot misinterpreted "worm" as a biological pest instead of a computer worm because the model lacked sufficient cybersecurity context in the user's raw query. By deploying prompt templates, the organization can prepend a system-level instruction such as "You are a cybersecurity assistant. Always interpret technical terms in the context of information security unless explicitly stated otherwise." This anchors the model's reasoning, reduces semantic ambiguity, and ensures domain-specific terminology is consistently interpreted correctly without retraining the underlying model. Prompt templates are a lightweight, non-invasive control that directly addresses contextual misclassification, making them the most immediate and effective solution.

Why the other options are incorrect:

A. Configure guardrails:
Guardrails are policy-based filters that enforce safety, compliance, and toxicity rules—such as preventing the model from generating harmful, offensive, or prohibited content. They do not resolve contextual ambiguity or improve the model's understanding of technical terminology. Guardrails block outputs; they do not guide the model's interpretation of ambiguous words.

B. Encrypt the weights at rest:
This is a data-at-rest security control that protects the model's proprietary parameters from unauthorized access or theft. While critical for intellectual property protection and compliance, encryption has no impact on the model's inference-time reasoning or its ability to differentiate between "worm" as a pest versus "worm" as malware. It is a storage security measure, not a performance or accuracy fix.

C. Apply model access controls:
Access controls manage who can query the model, authenticate users, and enforce role-based permissions (RBAC). They prevent unauthorized usage but do not influence the model's output quality, contextual understanding, or semantic interpretation. The chatbot would still misclassify "worm" regardless of who asks the question.

References:

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 3.1 (Implementing Secure AI Systems – Prompt Engineering and Template Usage) and Domain 1.3 (AI Lifecycle – Model Validation and Performance Monitoring).

Explanations:

MAESTRO (Agentic Architecture Framework):
Covers agent-specific risks across system layers. Supply chain vulnerabilities affect third-party agent components, models, and dependencies, while Overreliance targets dynamic risks in autonomous decision-making.

OWASP Top 10 (Traditional Web App Security):
Focuses on core application security. Broken access control ($A01:2021$) and Identification and authentication failures ($A07:2021$) address traditional authorization and identity flaws.

OWASP Top 10 for LLM Applications:
Focuses on Generative AI risks. Prompt injection ($LLM01$), Insecure plug-in design ($LLM07$), and Model denial of service ($LLM04$) represent specific direct threats to LLM execution and resource availability.

STRIDE (Threat Modeling Methodology):
A general threat taxonomy created by Microsoft. Repudiation ($R$) and Elevation of privilege ($E$) map directly to its acronym, while Insecure design reflects foundational architectural threat modeling.

Why Misclassifications Are Incorrect

Overreliance & Supply Chain in STRIDE/OWASP Top 10:
Legacy STRIDE only covers threat outcomes ($S, T, R, I, D, E$) and does not account for modern multi-agent autonomy or supply chain layers.

Prompt Injection in OWASP Top 10:
Standard web applications do not process natural language model contexts; prompt injection is strictly an OWASP Top 10 LLM risk.

Broken Access Control in MAESTRO:
While access control applies to agents, the category itself is a foundational web security risk under traditional OWASP Top 10.

References

Cloud Security Alliance (CSA): Agentic AI Threat Modeling Framework: MAESTRO (2025).

OWASP Foundation: OWASP Top 10:2021 and OWASP Top 10 for Large Language Model Applications.

Explanation :

Phishing is the attack most enabled by AI-generated content because generative AI eliminates the traditional indicators of fraud—poor grammar, awkward phrasing, and generic messaging. Attackers now use LLMs to craft highly personalized, grammatically flawless spear-phishing emails, SMS (smishing), and even voice deepfakes (vishing) at scale. AI enables threat actors to incorporate OSINT data (e.g., recent purchases, job titles, colleague names) to create contextually relevant lures that bypass spam filters and deceive even vigilant users. This dramatically increases engagement rates and makes Business Email Compromise (BEC) nearly indistinguishable from legitimate communications. AI-generated content transforms phishing from a noisy, low-success technique into a precision weapon, making it the most significantly amplified attack vector.

Why the other options are incorrect:

A. Model poisoning:
This attack corrupts the ML training pipeline by injecting malicious data into the training set. While AI can assist in crafting inputs, the core enabler is access to the training infrastructure, not AI-generated content itself. AI does not fundamentally change the poisoning vector.

C. Ransomware:
Ransomware encrypts files and demands payment. AI can assist in writing evasive code, but the primary enablers remain unpatched vulnerabilities, weak credentials, and phishing (which is the delivery mechanism). AI-generated content does not directly make encryption more effective.

D. Remote code execution (RCE):
RCE exploits software vulnerabilities to execute arbitrary code. AI-generated code snippets may assist novice attackers, but the key driver is unpatched flaws or misconfigurations. AI-generated text does not inherently enable RCE.

References;

CompTIA SecAI+ CY0-001 Exam Objectives:Domain 2.1 (AI-Powered Cyberattacks – Generative AI for Social Engineering and Phishing).

CISA Insights (2023): Warns that generative AI dramatically lowers the barrier for sophisticated phishing and BEC campaigns.

Explanatio:

Implementing an LLM directly within the CI/CD pipeline runner is the most effective way to automatically prevent vulnerable code from reaching production because it creates a blocking gate in the deployment workflow. By integrating the LLM into the CI/CD runner (e.g., GitHub Actions, Jenkins, GitLab CI), the organization ensures that every code commit triggers an automated security review. The LLM can analyze code for common vulnerabilities (e.g., injection flaws, hardcoded secrets, insecure deserialization) and, based on a defined risk threshold, fail the build job—preventing the code from progressing to staging or production. This approach is fully automated, operates at the point of merge, provides immediate feedback to developers, and eliminates human dependency or delayed reviews. It shifts security left, embedding it directly into the developer workflow without requiring manual intervention.

Why the other options are incorrect:

A. IDE plug-in warning:
While this provides real-time feedback to developers, it is advisory only—developers can ignore or dismiss warnings and still commit vulnerable code. It does not enforce a mandatory block, making it ineffective as an automatic prevention mechanism.

B. SOAR with ML model:
SOAR platforms are designed for incident response and alert triage, not code validation in build pipelines. Using SOAR here introduces latency and operational complexity, and classification alone does not enforce a build failure.

D. Agentic penetration testing tool:
Penetration testing is dynamic and time-consuming, typically run against deployed applications. It is not suitable for CI/CD gating due to long execution times, false positives, and inability to provide immediate pass/fail decisions per commit.

References

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 3.3 (Securing AI-Enabled Systems – AI in CI/CD and DevSecOps) and Domain 4.1 (AI for Security Operations – Automating Security Controls).

NIST SSDF (SP 800-218): Emphasizes automated vulnerability scanning as a gate in the build pipeline.

Explanation:

Improper output handling is the OWASP category that directly addresses this vulnerability. The scenario describes an AI model that always returns unsanitized responses, which are then passed to multiple plug-ins. Improper output handling occurs when an LLM's output is accepted without validation, sanitization, or filtering before being passed downstream to other systems—such as plug-ins, APIs, databases, or rendering engines. This creates a critical security gap because malicious or unexpected LLM outputs can trigger cross-plugin execution, command injection, XSS, or privilege escalation in connected systems. Even if the model itself is not compromised, failing to validate its outputs before they reach plug-ins effectively trusts the LLM as an authoritative source, which is a dangerous assumption. OWASP explicitly warns that insufficient output validation can lead to severe consequences, including sensitive data leakage, system compromise, and arbitrary code execution in connected components.

Why the other options are incorrect:

A. Misinformation:
This is a content integrity and accuracy issue, not a security vulnerability. Misinformation relates to factual incorrectness or hallucinations, not unsafe data flowing to plug-ins. It does not address the injection or execution risk in downstream components.

B. Prompt injection:
This is an input-side attack where an adversary crafts malicious prompts to override system instructions or extract sensitive data. The scenario specifically describes the output being unsanitized, not the input being manipulated. The vulnerability lies in how the response is handled after generation.

C. Unbounded consumption:
This refers to resource exhaustion attacks (e.g., denial of service through excessive token usage or computational cost). The scenario does not mention performance degradation, high costs, or resource limits—only output safety.

References:

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 3.2 (Implementing AI Security Controls – Output Validation and Sanitization) and Domain 2.2 (Threats to AI Systems – Plugin Exploitation).

OWASP Top 10 for LLMs (v1.1): LLM08 – Improper Output Handling explicitly defines this as failing to validate LLM outputs before passing them to downstream systems.

Explanation:

Endpoint access control is the first and most critical authentication control a security administrator must implement for AI systems. The endpoint—whether an API gateway, web interface, or application programming interface (API) endpoint—represents the entry point through which all users, applications, and external systems interact with the AI model. Without robust endpoint authentication (e.g., API keys, OAuth 2.0, mutual TLS, or JSON Web Tokens), an attacker can bypass all downstream controls by simply calling the model directly. Endpoint authentication establishes the first line of defense, ensuring that only authenticated and authorized entities can submit prompts or retrieve responses. This aligns with the fundamental security principle of defense in depth—securing the perimeter before layering internal controls. Once endpoint authentication is enforced, administrators can then implement finer-grained access controls on models, data, and infrastructure.

Why the other options are incorrect:

A. Model: Model-level access controls manage which users can query specific models or versions (e.g., fine-tuned versus base models).
However, model access is meaningless if the endpoint itself is unauthenticated—an attacker could bypass model controls entirely by directly accessing the API. Endpoint authentication must precede model-level authorization.

B. Server: Server-level controls (e.g., firewall rules, network segmentation, SSH access) protect the underlying infrastructure
. While important, these are network-layer controls, not authentication mechanisms. They restrict where traffic comes from, not who is making the request. Authentication must occur at the application layer first.

C. Data: Data access controls restrict who can view, modify, or delete training data, fine-tuning datasets, or inference logs.
This is a privacy and compliance control, not an authentication control for the AI system itself. Data protection is secondary to ensuring the endpoint is properly authenticated.

References (CY0-001):

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 3.1 (Securing AI Systems – Access Control and Authentication) and Domain 3.2 (Implementing AI Security Controls – API Security).

NIST AI RMF: Emphasizes securing AI system interfaces and APIs as a foundational control.

Explanation:

Summarizing security findings by category is a primary example of how security analysts use generative AI in the triage process. In security operations, analysts are inundated with thousands of alerts, logs, and findings from SIEMs, EDRs, and vulnerability scanners. Generative AI—specifically LLMs—can ingest large volumes of raw security data and produce concise, human-readable summaries grouped by category (e.g., malware families, threat actor TTPs, affected asset types, or severity levels). This accelerates the triage process by allowing analysts to quickly understand the scope and nature of security events without manually sifting through massive datasets. Generative AI excels at synthesis, contextualization, and natural language output—making it ideally suited for summarizing complex technical findings into actionable intelligence.

Why the other options are incorrect:

A. To predict the next attack target with higher accuracy:
This describes predictive analytics, which is typically achieved using traditional machine learning (classification, regression, time-series forecasting), not generative AI. Predictive modeling requires structured data and statistical algorithms, not the natural language generation capabilities of LLMs.

B. To use statistical analysis for malicious code assessment:
Statistical analysis—such as entropy calculation, opcode frequency distribution, or byte-level pattern matching—is performed using traditional ML or heuristic methods. Generative AI is not designed for statistical feature extraction; it is designed for content generation and language understanding.

D. To tag malware using ML algorithms:
Malware tagging (e.g., classifying files as ransomware, trojan, or worm) is a supervised classification task performed by traditional ML models (e.g., random forest, SVM, or deep neural networks) trained on labeled malware samples. Generative AI is not the appropriate tool for this structured classification task.

References:

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 4.1 (AI for Security Operations – Triage and Alert Prioritization) and Domain 1.2 (AI Types – Generative AI vs. Predictive ML).

SANS GIAC: Emphasizes using generative AI for automated report generation and alert summarization in SOC environments.

Explanation:

MITRE ATLAS (Adversarial Threat Landscape for Artificial Intelligence Systems) is the most appropriate framework for threat modeling an AI system. ATLAS is specifically designed to map adversary tactics, techniques, and procedures (TTPs) targeting machine learning and AI systems—covering the entire AI lifecycle from data collection and training to deployment and inference. It provides a structured, attack-centric view that aligns with real-world AI-specific threats such as model evasion, poisoning, extraction, and inference attacks. By using ATLAS, the organization can systematically identify threats, prioritize risks, and implement appropriate countermeasures. ATLAS is the AI counterpart to MITRE ATT&CK, making it the industry standard for AI threat modeling.

Why the other options are incorrect:

A. Responsible AI:
Responsible AI is a broad ethical framework focusing on fairness, transparency, accountability, and bias mitigation. While important for employee assessments to ensure non-discriminatory outcomes, it does not address adversarial threats or security vulnerabilities. It is a governance and ethics guideline, not a threat modeling framework.

C. Organization for Economic Co-operation and Development (OECD):
The OECD provides high-level principles for trustworthy AI—focusing on human-centered values, transparency, and robust governance. These are policy recommendations, not operational threat modeling frameworks. They lack the detailed TTP mapping required for security analysis.

D. International Organization for Standardization (ISO):
ISO standards (e.g., ISO/IEC 42001 for AI management systems) provide compliance and quality management guidelines. While relevant for governance and certification, ISO does not offer adversary-centric threat modeling or attack technique enumeration. It is a management standard, not a security threat framework.

References:

CompTIA SecAI+ CY0-001 Exam Objectives: Domain 3.0 (Securing AI Systems – Threat Modeling) and Domain 2.0 (AI Security Risks and Threats).

MITRE ATLAS: Directly maps AI-specific attack patterns to defensive countermeasures, making it the premier framework for AI threat modeling.