A company runs an AI model on a Kubernetes cluster. The security team has identified a critical vulnerability in the container image used for the model. The team must patch the vulnerability, but the model is in production and cannot be taken offline for an extended period. Which approach is most appropriate?

Use a rolling update to replace the vulnerable container image with a patched version.

Take the cluster offline to patch all nodes at once.

Ignore the vulnerability because the cluster is behind a firewall.

Rebuild the entire cluster from scratch with the patched image.

A startup is developing a new AI-powered chatbot that will be publicly accessible. The security team wants to identify potential threats and vulnerabilities before deployment. They plan to analyze the system's architecture, data flows, and trust boundaries. Which activity should they perform?

Run a vulnerability scanner on the chatbot's code.

Implement a web application firewall (WAF) to block attacks.

Deploy the chatbot and monitor for attacks.

Conduct a threat modeling exercise using a structured methodology like STRIDE.

A defense contractor uses an AI system to process classified data. The system is hosted in a private cloud. The security team must ensure that data is protected at rest and in transit, and that any data exfiltration attempts are detected. They are considering implementing encryption and network monitoring. Which combination of controls is most effective?

Rely on the private cloud provider's default encryption settings.

Encrypt data only during transmission using TLS.

Use hardware security modules (HSMs) for key management, encrypt all data with AES-256, and deploy network traffic analysis tools.

Use software-based encryption with keys stored on the same server.

Which access control mechanism is specifically designed to restrict access to an AI model's training data based on the user's role within the organization?

Discretionary access control (DAC)

Role-based access control (RBAC)

Attribute-based access control (ABAC)

A company runs an AI inference server on a Linux VM. The security team has identified that the underlying OS has known vulnerabilities. The team wants to ensure that the server is protected without disrupting the AI service. What is the best approach?

Disable the AI service until patches are applied.

Replace the VM with a new one that has the latest patches.

Apply security patches to the OS during a scheduled maintenance window.

Ignore the vulnerabilities because the server is behind a firewall.

CompTIASecAI+

Domain 2Objective 1

Implement Security Controls CY0-001 Practice Questions (Page 2)

Part of the Securing AI systems domain, which accounts for 40% of the CY0-001 exam. CompTIA does not publish an official question count, but from its 60-minute exam (~25–40 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

40%of the exam

Questions 6–10

6expert · hard
A company runs an AI model on a Kubernetes cluster. The security team has identified a critical vulnerability in the container image used for the model. The team must patch the vulnerability, but the model is in production and cannot be taken offline for an extended period. Which approach is most appropriate?
Select an answer first
7application · medium
A startup is developing a new AI-powered chatbot that will be publicly accessible. The security team wants to identify potential threats and vulnerabilities before deployment. They plan to analyze the system's architecture, data flows, and trust boundaries. Which activity should they perform?
Select an answer first
8expert · hard
A defense contractor uses an AI system to process classified data. The system is hosted in a private cloud. The security team must ensure that data is protected at rest and in transit, and that any data exfiltration attempts are detected. They are considering implementing encryption and network monitoring. Which combination of controls is most effective?
Select an answer first
9foundation · easy
Which access control mechanism is specifically designed to restrict access to an AI model's training data based on the user's role within the organization?
Select an answer first
10application · medium
A company runs an AI inference server on a Linux VM. The security team has identified that the underlying OS has known vulnerabilities. The team wants to ensure that the server is protected without disrupting the AI service. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CY0-001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CY0-001” is a trademark of its owner, used for identification only.

Implement Security Controls CY0-001 Practice Questions (Page 2)

Questions 6–10

A startup is developing a new AI-powered chatbot that will be publicly accessible. The security team wants to identify potential threats and vulnerabilities before deployment. They plan to analyze the system's architecture, data flows, and trust boundaries. Which activity should they perform?

Which access control mechanism is specifically designed to restrict access to an AI model's training data based on the user's role within the organization?

A company runs an AI inference server on a Linux VM. The security team has identified that the underlying OS has known vulnerabilities. The team wants to ensure that the server is protected without disrupting the AI service. What is the best approach?

Keep studying — Securing AI systems