A company's AI system must comply with internal security policies and industry regulations. The compliance team wants to verify that access controls are working as intended and that the model has not been tampered with. What should they do?

Increase the frequency of model retraining.

Implement a new firewall rule to block all external traffic.

Conduct regular audits of access logs and model integrity checks.

Disable logging to reduce storage costs.

What is the primary goal of threat modeling for an AI system?

To improve the AI model's accuracy

To identify potential security threats and vulnerabilities early in the design process

To monitor the AI system in real time

To encrypt all data used by the AI system

A bank's AI system is accessed by employees and third-party vendors. The bank requires strong authentication, but vendors use a variety of devices and may not have hardware tokens. The security team must balance security with usability. Which authentication approach is most appropriate?

Require hardware security keys for all users.

Implement multi-factor authentication using a mobile authenticator app for all users.

Use SMS-based OTP for vendors and hardware keys for employees.

Allow vendors to use single-factor authentication with strong passwords.

A company's AI model is updated frequently with new training data. The data science team wants to ensure that the model's integrity is maintained and that any changes can be traced. The compliance team requires that all model versions be documented and that the model's behavior be validated before deployment. Which process should be implemented?

Automatically deploy the model to production after each training run without review.

Keep the model in a single container that is updated in place.

Store the model in a shared network drive with overwrite enabled for simplicity.

Use a version control system for the model code and artifacts, and require sign-off from a designated reviewer before deployment.

A research lab hosts an AI model that is accessed by internal data scientists and also exposed to external partners via a public API. The lab wants to protect the model from external threats while allowing internal access. The security team is considering network security measures. Which approach best meets the requirement?

Use a VPN for all external partners to access the model.

Place the model in a private subnet and use a reverse proxy with access controls for external API access.

Expose the model directly to the internet with a strong API key for authentication.

Disable all external access and require partners to come on-site.

CompTIASecAI+

Domain 2Objective 1

Implement Security Controls CY0-001 Practice Questions (Page 4)

Part of the Securing AI systems domain, which accounts for 40% of the CY0-001 exam. CompTIA does not publish an official question count, but from its 60-minute exam (~25–40 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

40%of the exam

Questions 16–20

16application · medium
A company's AI system must comply with internal security policies and industry regulations. The compliance team wants to verify that access controls are working as intended and that the model has not been tampered with. What should they do?
Select an answer first
17foundation · easy
What is the primary goal of threat modeling for an AI system?
Select an answer first
18expert · hard
A bank's AI system is accessed by employees and third-party vendors. The bank requires strong authentication, but vendors use a variety of devices and may not have hardware tokens. The security team must balance security with usability. Which authentication approach is most appropriate?
Select an answer first
19application · medium
A company's AI model is updated frequently with new training data. The data science team wants to ensure that the model's integrity is maintained and that any changes can be traced. The compliance team requires that all model versions be documented and that the model's behavior be validated before deployment. Which process should be implemented?
Select an answer first
20application · medium
A research lab hosts an AI model that is accessed by internal data scientists and also exposed to external partners via a public API. The lab wants to protect the model from external threats while allowing internal access. The security team is considering network security measures. Which approach best meets the requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CY0-001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CY0-001” is a trademark of its owner, used for identification only.

Implement Security Controls CY0-001 Practice Questions (Page 4)

Questions 16–20

A company's AI system must comply with internal security policies and industry regulations. The compliance team wants to verify that access controls are working as intended and that the model has not been tampered with. What should they do?

What is the primary goal of threat modeling for an AI system?

A bank's AI system is accessed by employees and third-party vendors. The bank requires strong authentication, but vendors use a variety of devices and may not have hardware tokens. The security team must balance security with usability. Which authentication approach is most appropriate?

Keep studying — Securing AI systems