Implement Security Controls CY0-001 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's AI system has experienced a data breach. The incident response plan is activated. The team must communicate with stakeholders, including customers, regulators, and the media. The company's legal team is concerned about liability. Which communication strategy is most appropriate?

   • ADelay all communication until the investigation is complete.
   • BHave the CEO personally contact each affected customer.
   • COnly communicate with the media to control the narrative.
   • DFollow the incident response plan's communication guidelines, which include timely notification to affected parties and regulators as required by law.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of an incident response plan for an AI system?

   • ATo provide a structured approach to detect, respond to, and recover from security incidents
   • BTo prevent all security incidents from occurring
   • CTo improve the AI model's performance
   • DTo encrypt all data in the AI system
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial services firm uses an AI model to process loan applications. The model is hosted in a cloud environment, and the firm must ensure that customer data is protected both when stored and when transmitted between the application and the model. The security team also needs to detect any unauthorized access to the data. Which combination of controls should be implemented?

   • ADeploy a web application firewall (WAF) in front of the AI application.
   • BImplement network segmentation and restrict access to the model's subnet.
   • CEnable detailed logging of all API calls to the model and store logs in a SIEM.
   • DEncrypt data at rest using AES-256 and encrypt data in transit using TLS 1.2 or higher.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital's AI diagnostic system is accessed by radiologists, lab technicians, and external researchers. The system stores patient data and model outputs. The compliance team requires that access be granted based on job role and that all access attempts be recorded for audit. The system currently uses a shared local account for all users. Which control should be implemented FIRST?

   • ADeploy a network intrusion detection system (IDS) to monitor traffic to the AI system.
   • BEnable encryption at rest for the patient data stored in the AI system's database.
   • CImplement multi-factor authentication (MFA) for all users of the AI system.
   • DImplement role-based access control (RBAC) with individual accounts and integrate with the existing identity provider.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's AI model is used for credit scoring. The model is updated regularly, and the company must ensure that the model's behavior is consistent and that it has not been tampered with. The security team is considering implementing model validation and version control. Which approach provides the strongest assurance of model integrity?

   • AUse a simple naming convention for model versions.
   • BStore model files in a shared drive with version history enabled.
   • CRely on the data science team to manually verify the model before deployment.
   • DUse a model registry that stores hashes of model artifacts and requires approval before deployment.
   Reveal Solution Discussion Select an answer first