CY0-001 Sample Questions: 10 SecAI+ Scenarios Explained

Correct answer: B

RAG is the architecture that satisfies both constraints at once. The documents stay in an external vector store and are retrieved at query time, so they are never baked into model weights, and re-indexing an edited document makes it available immediately — no retraining cycle.

Why A is wrong: Fine-tuning does exactly what security prohibited: it encodes the procedure content into the model's weights. Worse, a weekly retraining cadence can't deliver same-day freshness, and extracting or verifying what a fine-tuned model has memorized is far harder than deleting a row from a vector index.

Why C is wrong: Multi-shot prompting supplies examples to shape the format and style of a response, not a searchable knowledge base. Five documents in a system prompt won't cover a full repository, and you'd be manually editing a prompt every time a procedure changes.

Why D is wrong: Quantization reduces the precision of model weights to cut memory and inference cost. It's a performance optimization. It has nothing to do with data freshness or keeping documents out of weights — the distractor works only if you're pattern-matching on "sounds technical."

Objective mapping: 1.2 — data security in relation to AI (RAG, vector storage, embeddings); 1.1 — model training techniques.

Correct answer: B

Provenance is the record of where data originated — its source and chain of custody. Integrity is the assurance that the data has not been altered in an unauthorized way. Those map one-to-one onto the regulator's two questions.

Why A is wrong: Augmentation creates synthetic variations of existing records to expand a training set; balancing corrects skewed class distributions. Both are about dataset composition, and neither speaks to origin or tamper-evidence.

Why C is wrong: This one is the trap, because "verification" sounds like integrity. Cleansing removes errors, duplicates, and malformed records; verification confirms data is accurate and fit for use. Both are quality operations performed on the data — they don't establish where it came from or prove it wasn't modified in transit.

Why D is wrong: Classification labels mark sensitivity tiers, and minimization means collecting only what you need. Both are privacy and handling controls, not lineage or tamper-evidence.

Worth knowing for the exam: data lineage is closely related to provenance and often appears alongside it. Provenance emphasizes origin and custody; lineage emphasizes the transformations data passed through on its way to the model. If a question stresses "what happened to it," lean lineage. If it stresses "where did it come from," lean provenance.

Objective mapping: 1.2 — data processing (provenance, lineage, integrity).

Correct answer: B

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is deliberately structured as an ATT&CK-style matrix of tactics and techniques observed against AI and ML systems. The question's tell is "organized the same way ATT&CK organizes adversary behavior" — that phrasing points at exactly one answer.

Why A is wrong: The OWASP LLM Top 10 is a ranked list of the most critical vulnerability classes in LLM applications. It's genuinely useful, and it's on the exam — but it's a risk list, not a tactic-and-technique matrix, and it's scoped to LLM applications rather than ML pipelines generally.

Why C is wrong: The MIT AI Risk Repository is a broad taxonomy of AI risks drawn from the literature, spanning societal and organizational harms well beyond adversarial attack. It's a research catalogue, not a detection-engineering input.

Why D is wrong: NIST AI RMF is a governance framework — Govern, Map, Measure, Manage. It tells an organization how to structure its risk program. It doesn't enumerate adversary techniques.

The pattern to internalize: ATLAS = adversary techniques. OWASP = vulnerability classes. MIT Repository = risk taxonomy. NIST AI RMF = governance process. Expect questions that hand you a scenario and make you pick which of the four fits.

Objective mapping: 2.1 — AI threat-modeling resources.

Correct answer: B

Membership inference answers one narrow question: was this specific record in the training set? The attack works because models are typically more confident on data they were trained on than on data they weren't, and that confidence gap leaks membership. In a hospital context, membership alone is the breach — knowing someone's record was in an HIV-treatment model's training data discloses their diagnosis without revealing a single field.

Why A is wrong: Model inversion is the neighbouring attack and the reason this question is worth doing slowly. Inversion attempts to reconstruct the training data itself — recovering the features of a record, or a recognizable face from a facial-recognition model. Inference asks "was it in there?"; inversion asks "what was in there?" The scenario says "determine whether a record was included," so it's inference.

Why C is wrong: Model theft (model extraction) uses queries to replicate the model's functionality — building a substitute model that mimics the target's behavior. The attacker's prize is the model, not facts about the training data.

Why D is wrong: Poisoning is an attack on the training phase, where an attacker corrupts training data or the model itself to degrade performance or install a backdoor. The scenario describes an attack against a model already deployed, using nothing but inference-time queries.

Compensating controls worth naming if this shows up as a PBQ: rate limiting and query quotas to raise the cost of the many queries these attacks require, suppressing or coarsening confidence scores in API responses, and access controls on the inference endpoint.

Objective mapping: 2.6 — analyze evidence of an attack and suggest compensating controls.

Correct answer: B

This is prompt injection delivered indirectly — the malicious instruction wasn't typed by the user whose query triggered it. It rode in through content the system itself retrieved and trusted. That's what makes it nasty: the victim did nothing wrong, and the payload sat dormant in the knowledge base until retrieval surfaced it.

The control that matters is architectural. Content pulled from a retrieval corpus must be handled as untrusted data, never as instructions — the same reasoning that makes parameterized queries the answer to SQL injection. Pair that with output filtering (which catches the system prompt on its way out) and sanitization or review of content before it enters the index.

Why A is wrong: Jailbreaking generally describes a user directly coaxing a model past its own safety guardrails in conversation. Here the instruction arrived through retrieved content, and the affected user never issued it. Retraining with refusal examples is also a weak control against injection — it makes the model more likely to refuse, but it's probabilistic, and an architectural boundary is what you want.

Why C is wrong: Nothing in the scenario degrades availability or exhausts resources. Token limits are a real and useful control — for model DoS and cost abuse, not for this.

Why D is wrong: No plug-in or external integration is described. Insecure plug-in design is a distinct OWASP LLM Top 10 entry involving plug-ins that accept unvalidated input or hold excessive privilege.

Objective mapping: 2.6 — attacks (prompt injection) and compensating controls; 2.2 — gateway controls (prompt firewalls).

Correct answer: C

The failure here is consumption, not confidentiality. Rate limits cap requests per unit time, token limits cap the size of an individual request and its response, and input quotas cap the volume and size of data a caller can submit. Together they bound both the cost exposure and the model-DoS risk from exactly this pattern.

Why A is wrong: Anonymization and masking protect sensitive data inside prompts and responses. Both are valuable controls. Neither would have slowed a single request, because the problem was never what the data contained.

Why B is wrong: Encryption protects data confidentiality in transit and at rest. Perfectly encrypted traffic can still bankrupt you.

Why D is wrong: Guardrails and prompt templates constrain what the model will do and say — they're behavioral controls against misuse and injection. They don't govern how much a caller can consume.

The exam pattern: when a scenario ends with "no data was exfiltrated and no output was manipulated," it's ruling out the confidentiality and integrity answers on your behalf. What's left is availability and cost. AI cost monitoring is called out in the objectives as its own topic — it's a rare case where a security exam explicitly cares about the bill.

Objective mapping: 2.2 — gateway controls (rate limits, token limits, input quotas); 2.5 — AI cost monitoring.

Correct answer: B

Summarization, correlation, and prioritization attack the actual bottleneck — analyst reading time — while the escalation decision stays with a person. This is human-in-the-loop design: the AI compresses the input, the human owns the judgment.

Why A is wrong: Auto-closing alerts moves the decision from the analyst to the model. Every false negative silently disappears, and the SOC manager explicitly wanted accountability to stay with analysts. This is the objectives' excessive agency risk — granting a system more autonomy than its reliability warrants.

Why C is wrong: Generating detection logic at query time makes the SOC's detection coverage non-deterministic and unauditable. You could not answer "what were we detecting last Tuesday?" — a question that comes up in every incident review and most audits.

Why D is wrong: Same failure as A, with an extra one: a model trained on historical escalation decisions inherits every bias in those decisions, including alert types the team has been systematically under-escalating. It industrializes the SOC's existing blind spots.

Objective mapping: 3.1 — AI-enabled tools for security tasks (incident management, anomaly detection, summarization); 1.3 — human-centric AI design principles.

Correct answer: B

This is deepfake-enabled impersonation used to supercharge a classic social-engineering attack. AI didn't invent CEO fraud; it removed the tells — the awkward phrasing, the wrong accent, the generic urgency — that used to make it detectable.

The control has to be a process control, because the attack defeats perceptual ones. Out-of-band verification through a known-good channel, applied to every payment instruction above a threshold with no exception for seniority, works whether the request is a forged email, a spoofed number, or a perfect voice clone. The exception for executives is precisely the gap these attacks target.

Why A is wrong: Model inversion reconstructs training data from a model. Here the attacker used the company's public recordings as raw material for synthesis — no model of the company's was involved, and there is no training data of theirs to restrict.

Why C is wrong: Automated data correlation is a real AI-enabled reconnaissance technique and it plausibly contributed to the attacker's knowledge of the acquisition. But the attack vector in the scenario is the synthetic voice. And the proposed control fails on practicality: a public company cannot stop holding earnings calls.

Why D is wrong: This is the tempting one, and worth understanding rather than just eliminating. Detection models are a legitimate layer, but they are locked in an arms race against generators that improve continuously — and generative adversarial networks are trained by explicitly optimizing against a discriminator. Building your primary defense on detection means betting on the losing side of that loop. Use it as defense in depth, never as the control of record.

Objective mapping: 3.2 — AI-generated content (deepfake), impersonation, social engineering.

Correct answer: B

Shadow AI is the AI-specific case of shadow IT: business units adopting AI tools outside the organization's approval and oversight process. The governance answer is a clear sanctioned-versus-unsanctioned policy plus a body — commonly an AI Center of Excellence — that owns evaluating and approving tools, so teams have a fast legitimate path instead of a slow one they'll route around.

Why A is wrong: Excessive agency refers to an AI system holding more autonomy or permission than it should. The excess here is human, not machine.

Why C is wrong: Data leakage is a real consequence in this scenario — customer lists went to an unvetted third party. But the question asks for the term describing the situation and the structure addressing the underlying cause. The cause is unsanctioned adoption. DLP is a worthwhile compensating control that treats the symptom, and blocking traffic without providing an approved alternative reliably drives teams to personal devices.

Why D is wrong: Third-party evaluation is part of a mature AI governance program, but it presupposes the organization knows the vendor exists. It cannot address a subscription nobody disclosed.

Objective mapping: 4.1 — organizational governance structures (AI Center of Excellence, AI policies); 4.2 — shadow AI; 4.3 — sanctioned vs. unsanctioned.

Correct answer: B

The EU AI Act is structured as a risk tier system, and employment is one of the areas explicitly enumerated in Annex III as high-risk — covering recruitment, screening and filtering applications, evaluating candidates, promotion, task allocation, and termination. A CV-screening and candidate-ranking system sits squarely in it. High-risk classification triggers the Act's heaviest conformity obligations: a risk management system, data governance requirements, technical documentation, automatic logging, transparency to deployers, human oversight, and accuracy and robustness standards.

Why A is wrong: The Act's prohibited tier is narrow — social scoring, certain biometric categorization, manipulative techniques exploiting vulnerabilities, and emotion inference in workplaces and schools among them. Employment AI generally is regulated, not banned. (Note the adjacent trap: inferring emotions in workplace or education settings does fall under the prohibited tier under Article 5(1)(f), subject to narrow medical and safety exceptions. A question about a system inferring candidates' emotions from interview video is a different question with a different answer.)

Why C is wrong: Limited risk covers systems like chatbots, where the obligation is essentially disclosure. Disclosure alone does not discharge a high-risk system's obligations.

Why D is wrong: Minimal risk is the residual tier — spam filters, AI in video games. Nothing touching employment decisions lands there.

Currency note, and a reason to check dates yourself: the application date for Annex III high-risk obligations has moved. The date originally on the books was 2 August 2026; under the Digital Omnibus package advanced in 2026 it has been pushed to 2 December 2027, with embedded high-risk systems later still. Much of the SecAI+ study material online was written against the older date. The classification is the examinable concept and it hasn't changed — but if a date appears in a question, know that the timeline has shifted and verify against a current source.

Don't confuse these two, because the exam will try: the EU AI Act is binding law with penalties. The NIST AI RMF is a voluntary US framework. A question asking what an organization must do points at the former; what it should do to structure its program points at the latter.

Objective mapping: 4.3 — impact of compliance (EU AI Act, NIST AI RMF).