Enhance Your Career With Available Preparation Guide for CY0-001 Exam [Q19-Q41]

Rate this post

Enhance Your Career With Available Preparation Guide for CY0-001 Exam

Get Special Discount Offer of CY0-001 Certification Exam Sample Questions and Answers

CompTIA CY0-001 Exam Syllabus Topics:

Section	Weight	Objectives
Governance, Risk, and Compliance	14%	– Summarize regulations, standards, and frameworks that impact organizations – Explain risk management processes and concepts – Given a scenario, follow organizational security policies and procedures – Explain privacy and sensitive data concepts in relation to security – Compare and contrast various types of security controls
Operations and Incident Response	16%	– Given a scenario, use data sources to support an investigation – Given a scenario, apply mitigation techniques or controls to secure an environment – Explain key aspects of digital forensics – Summarize the importance of policies, processes, and procedures for incident response – Given a scenario, use appropriate tool to assess organizational security
Architecture and Design	21%	– Explain the importance of security concepts in an enterprise environment – Summarize basics of cryptographic concepts – Explain secure application development, deployment, and automation concepts – Given a scenario, implement cybersecurity resilience – Explain the security implications of embedded and specialized systems – Summarize authentication and authorization design concepts – Summarize virtualization and cloud security concepts – Explain the importance of physical security controls
Attacks, Threats, and Vulnerabilities	24%	– Explain penetration testing concepts – Given a scenario, analyze potential indicators to determine the type of attack – Compare and contrast types of social engineering attacks – Explain threat actor types and attributes – Given a scenario, analyze potential indicators associated with application attacks – Explain vulnerability scanning concepts – Given a scenario, analyze potential indicators associated with network attacks
Implementation	25%	– Given a scenario, apply cybersecurity solutions to the cloud – Given a scenario, implement secure network architecture concepts – Given a scenario, implement secure host settings – Given a scenario, implement identity and account management controls – Given a scenario, implement public key infrastructure (PKI) – Given a scenario, implement secure mobile device policies – Given a scenario, implement secure systems design – Given a scenario, implement authentication and authorization solutions

NO.19 An AI security team must assess the probability of an attack on its new system and the impact associated with such an attack.
Which of the following threat-modeling resources best addresses the threat landscape for machine learning (ML)?

Common Vulnerabilities and Exposures (CVE) AI working group

MITRE Adversarial Threat Landscape for AI Systems (ATLAS)

Massachusetts Institute of Technology (MIT) risk repository

Open Worldwide Application Security Project (OWASP)

NO.20 A security analyst receives an alert about an AI system and is investigating the following output:

Which of the following is the most appropriate control the analyst should recommend?

Integrating data sanitization

Implementing user input validation

Monitoring logs for attack words from the system

Hardening the Model Context Protocol server

NO.21 A user interface engineer adds new graphics to the latest release of an AI-integrated application.
During the update, the engineer accidentally causes the model to retain on unverified data. After the update, the model begins to return many errors. Which of the following is the best way to mitigate future errors?

Web application firewall

Role-based access control

Model development life cycle

Generative adversarial network

NO.22 Which of the following requires developers to harden infrastructure to protect AI systems?

Intake processes

Acceptable use policies

Development guidelines

Configuration standards

NO.23 Hotspot Question
Instructions
Use the drop-down menus to define two appropriate security controls for each component of the AI system. Each control may be used only once.
If at any time you would like to bring back the initial state of the simulation please click the Reset All button.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.

NO.24 A security analyst is preparing a presentation for the sales team that describes the most common vulnerabilities that are specific to AI applications.
Which of the following is the best source for the analyst to consult?

International Organization for Standards (ISO) 27001

Common Weakness Enumeration (CWE)

Open Worldwide Application Security Project (OWASP)

National Institute of Technologies Risk Management Framework (NIST-RMF)

NO.25 Instructions: Use the drop-down menus to define two appropriate security controls for each component of the AI system. Each control may be used only once.
An engineer is deploying a new AI system and wants to integrate it into the core system through an API.

NO.26 Which of the following is a risk addressed by responsible AI?

Model drift

Reputational loss

Response bias

Data poisoning

NO.27 A disgruntled employee changed the company policies that a chatbot references in order to create confusion and disrupt the business.
Which of the following AI-generated vulnerabilities is the employee exploiting?

Data reduction

Data masking

Data poisoning

Data leaking

NO.28 A security administrator sees suspicious queries on AI logs.
Which of the following should the administrator implement to address this issue?

Prompt firewalls

Data size

Rate limit

Agentic AI

NO.29 A healthcare organization plans to deploy a chatbot for appointment scheduling and patient records. Which of the following is the first step a security administrator should take?

Implement prompt firewalls.

Enable role-based access management

Conduct a risk assessment.

Use a secure data communication channel for chat.

NO.30 Which of the following is an example of how a security analyst uses generative AI in the triage process?

To predict the next attack target with higher accuracy

To use statistical analysis for malicious code assessment

To summarize security findings by category

To tag malware using machine learning (ML) algorithms

NO.31 Which of the following technologies is used in deepfake?

Generative adversarial network (GAN)

Multi-shot prompting

Prompt engineering

Transfer learning

NO.32 A company uses human review for software development validation and wants to add another validation layer.
Which of the following should a security administrator use to accomplish this task?

AI-assisted approval

Low-code plug-in

Automated rollback

Regression testing

NO.33 Which of the following describes the number of training cycles used in an AI model for threat detection?

k-means clustering

Tokens

Temperature

Epoch

NO.34 A SOC team has an AI agent that performs web searches and calls to the SOAR solution. The team is concerned about enterprise uptime and case resolution time.
Which of the following is the most appropriate use of the AI agent?

To analyze and contain offending users or hosts using SOAR playbooks

To perform research using open-source intelligence to enrich the alerts

To aggregate SOC metrics and generate reports for the leadership team

To create tabletop exercises so the team can increase its incident response speed

NO.35 An airline corporation wants to implement a chatbot application using a large language model (LLM) so its customers can ask questions and receive answers about flight details and have the option to upload files.
Which of the following security controls should the airline use to protect against malicious input and unauthorized use beyond the service-level agreement? (Choose two.)

Prompt guardrails

Role-based access controls

Firewall rules

Model token quotas

NO.36 A cybersecurity administrator needs a security mechanism that can validate input.
Which of the following controls should the administrator use?

Prompt firewall

Rate limits

Token limits

Input quantity

NO.37 An employee wants a consulting company to procure a data set that contains age, ethnicity, and diabetes status. During development, the employer wants to ensure the integrity of the data.
Which of the following is the best strategy to accomplish this task?

Implementing checksums

Conducting human evaluation

Querying the model

Enabling log monitoring

NO.38 A disgruntled employee changed the company policies that a chatbot references in order to create confusion and disrupt the business. Which of the following AI-generated vulnerabilities is the employee exploiting?

Data reduction

Data masking

Data poisoning

Data leaking

NO.39 A financial organization implements a new AI-based fraud detection system to flag suspicious transactions. A security analyst discovers that it occasionally blocks legitimate transactions.
Which of the following is the best recommendation?

Retaining the model with more data and recent transaction patterns

Implementing AI token usage and rate limits

Encrypting all the data processed by AI and applying further access controls

Rolling back the model and using a traditional fraud detection system

NO.40 Which of the following is most resistant to AI manipulation?

Payloads

AI-generated content

Application programming interface (API) gateway

Attack surface reduction

Antivirus

NO.41 A security analyst finds that the AI system is under a denial-of-wallet attack.
Which of the following should the analyst enforce to protect the company? (Choose two.)

Model fine-tuning

Application programming interface (API) rate controls

Endpoint access controls

Content delivery network (CDN)

Output token controls

Modality controls