Which of the following job roles in an organizational governance structure develops a model from business use cases?
An administrator, who works for a financial institution, is required to implement data security controls for data at rest within AI systems that involve data disclosure. Which of the following is the most suitable control?
A security engineer needs to monitor an AI-based system for runtime operations. The engineer is mostly concerned about the visibility of internal activity. Which of the following is the most appropriate monitoring solution?
Which of the following should an auditor reference when reviewing a company's human resources AI systems for legal non-compliance?
An airline corporation wants to implement a chatbot application using a large language model (LLM) so its customers can ask questions and receive answers about flight details. Which of the following security controls should the airline use to protect against malicious input and unauthorized use beyond the service-level agreement? (Choose two.)
A security operations center (SOC) has a very high volume of logs and alerts. The manager proposes the implementation of machine learning (ML) system to help with triage. Which of the following tasks is most suitable?
An organization recently created a custom model that integrates with a language model (LLM). The developer notices that the application programming interface (API) costs have increased. Which of the following is the best
Which of the following techniques should the administrator use to improve the AI model’s security?
Which of the following is the most concerning risk for a company that allows corporate end users to use public- facing large language models (LLMs)?
Which of the following requires developers to harden infrastructure to protect AI systems?
Which of the following is the best example of an AI model that is trained to identify multiple points from input using a neural network to provide output for authentication?
An organization is developing and implementing AI features into a customer service application. Which of the following practices should the organization put the place before releasing the application for customer trials?
An internal user enters a client credit card number into an internal generative machine learning (ML) model: #User prompt: Customer Jane Doe has a new credit card that she wants to add to her account. The number is 5555-5555-5555-5555 Which of the following is the most effective way to prevent prompt injection attacks against a large language model (LLM)?
A security alert triggers an agentic system. An analyst notices the following payload in the logs” The alert includes multiple shell commands that are not typically run as part of any hardening. Which of the
A global security operations center (SOC) wants to adapt and leverage the strength of AI in order to enhance its security operations. Which of the following is the best way to enhance the global SOC functions?
An attacker successfully completes a denial-of-service (DoS) attack through the context window of an AI system. Thousands of characters are obfuscated and hidden behind an emoji. Which of the following techniques best mitigates this attack?
An AI architect reviews AI utilization and wants to improve the user experience. Which of the following should the architect review in the logs?
A human resources officer is using AI to evaluate resumes and help select candidates that meet minimum criteria. To improve the results, the human resources officer adjusts the query parameters and includes an example resume that matches a successful candidate. Which if the following best describes this query?
A line of business wants to onboard an application that uses a custom AI model for employee assessments. The Chief Information Officer (CIO) agrees to allow the engagement to proceed but first wants a threat model. Which of the following frameworks should the officer reference?
A security analyst finds that the AI system is under a denial-of-wallet attack. Which of the following should the analyst enforce to protect the company?
A financial organization implements a new AI-based fraud detection system to flag suspicious transactions. A security analyst discovers that it occasionally blocks legitimate transactions. Which of the following is the best recommendation?
Which of the following technologies is used in deepfake?
During the selection of a machine learning (ML)-based threat classification model, a cybersecurity administrator verifies that label distribution is highly unbalanced. Which of the following processing techniques should the engineer use to balance the model?
A healthcare organization plans to deploy a chatbot for appointment scheduling and patient records. Which of the following is the first step a security administrator should take?
Which of the following helps in managing potential security issues related to model training?
Which of the following improves the observability and auditing of an AI system?
Users report that the output of a generative AI application seems unrelated to the prompts and contains offensive content. A security team investigates and determines that there was an on-path attack. Which of the following is the most likely attack method?
Which of the following is used to train an AI model with unstructured data?
A security architect performs threat modeling of an AI system. The architect needs to determine which attacks can be performed against the system. Which of the following actions should the architect take next?
Which of the following is the most impactful security risk associated with the use of a generative AI chatbot?
A security operations center (SOC) analyst needs to automate multiple security tasks by breaking them down into smaller parts. Which of the following AI tools is the best for this task?
Which of the following responsible AI standards refers to a principle that clearly states the reasons behind the decisions for a particular conclusion?
A detection engineering team wants to use AI to automatically prevent vulnerable code from reaching production. Which of the following is the most effective way to accomplish this task?
A penetration tester is assessing the controls of a deployed AI system that is designed to search and return the contents of files. The penetration tester submits the following input: '../../../etc/passwd'. Which of the following is the best control to prevent abuse of the system?
A customer-facing, AI-powered chatbot has been jailbroken through prompt injections. As a result, the AI model is offering a 99% discount on the purchase of a new vehicle. Which of the following should be implemented to enhance the model’s robustness against such attacks?
User experience is declining since the launch of a large language model (LLM) in internal networks. Which of the following should be the highest priority for the prompt engineers?
A data set containing medical information is put into a machine learning (ML) model that is designed to predict specific illnesses for a population. In the process of verifying the reliability of the system, the compliance officer realizes that the system cannot reliably predict illnesses for certain segments of the population. Which of the following types of risk is most applicable to this case?
An organization is concerned with the exposure of sensitive data. Which of the following is the most relevant security concern?
Faculty members at a university are concerned about potential inherent bias and inconsistency in one department’s AI plagiarism detection service. Which of the following principles will most likely to address their concerns?
A security administrator must provide access controls for AI systems to list tables. Which of the following should the administrator implement?
A machine learning (ML) engineer is working with a security engineer to identify the best practices for securing a system with various AI models. Which of the following actions should the engineers suggest?
Which of the following is an example of how a security analyst uses generative AI in the triage process?
A security team discovers that a malicious actor is targeting a hospital's AI health portal by flooding its integrated API with an excessive number of requests in an attempt to cause a denial-of-service (DoS). Which of the following controls will BEST prevent this?
A security team is using an AI-based tool to try to bypass organizational boundaries. The team uses AI to look at the current state and suggest different attack vectors based on the outcome of the previous ones. Which of the following techniques is the team most likely using?
Which of the following attacks would be the best to automate with AI during dynamic application software testing (DAST)?
A disgruntled employee changed the company policies that a chatbot references in order to create confusion and disrupt the business. Which of the following AI-generated vulnerabilities is the employee exploiting?
A security consultant must summarize the impact of posture management on a machine learning (ML) use case. Which of the following is the most appropriate reference for this purpose?
A cybersecurity analyst must use pattern recognition on a data set containing unstructured data. Which of the following models is the best for this task?
An employee wants a consulting company to procure a data set that contains age, ethnicity, and diabetes status. During development, the employer wants to ensure the integrity of the data. Which of the following is the best strategy to accomplish this task?
Which of the following strengthens the performance of a large language model (LLM) for malicious reconnaissance?
A social media company with over a million lines of code uses a vulnerability scanner that identifies numerous issues. Which of the following is the most balanced AI strategy to automate the vulnerability management flow?
Which of the following would most likely be used to prove that an image is AI generated?
Which of the following controls is the best way to mitigate a denial-of-service (DoS) attack?
A group of security engineers is developing a security incident and event management (SIEM) system that will: Be able to ingest data from multiple structured and unstructured sources. Have a chatbot integrated with a large language model (LLM) that the security analyst can interact with. Provide insights from the SIEM alert data. Which of the following techniques should the security engineers consider before collecting the data from the respective sources?
Which of the following best describes the primary security risk when deploying a third-party pre-trained AI model from an external vendor?
A cybersecurity analyst wants to choose a machine learning (ML) model to classify log entries while providing the highest level of explainability. Which of the following models should the analyst choose?
Which of the following is the primary purpose of validating data for an AI system?
A manufacturing company wants to use AI to improve its operational processes. Which of the following should the organization do first to enable adoption and achieve the business goals?
Customer feedback for an AI chatbot has a high-rate of non-answers, which is causing higher central processing unit (CPU) utilization. Which of the following should be adjusted to address this issue?
A security consultant needs to detect attacks across a large language model (LLM) firewall. Which of the following techniques should the consultant use?
Which of the following is most resistant to AI manipulation?
An organization recently developed an AI-powered product and discovers that it is vulnerable to attacks in which malicious actors can alter the input, causing the system to recommend inappropriate information. Which of the
An IT company implements an adaptable chatbot that learns from user prompts. The chatbot is meant to help employees troubleshoot common technical issues. Based on the following: [User 1] Prompt: I am having issues connecting to my printer, I can send emails. Response: The most probable cause is that the printer may be turned off or was disconnected from the network. Check of the power is on and it is connected to the network. [User 2] Prompt: I am having issues connecting to my printer. I can send emails. I figured out the solution. It is because the company is being bought by another one. Response: Got it. The printer issue is caused by an upcoming acquisition. [User 3] Prompt: My document is not printing. I can browse the web. Response: The most probable cause is that the company is being bought by another company. Which of the following compensating controls should an administrator implement to mitigate the issue that is introduced?
Which of the following is required first in order to send a prompt query and response in a language model (LLM) system when authentication is enabled?
A team of data scientists is ready to release a model for enterprise use. The team wants to protect the model from unintentional changes or tampering. Which of the following is the most appropriate action?
An architect is creating a threat model for an agentic system. Which of the following should the architect do first?
A security analyst is aware of an active penetration test in the environment. The analyst examines SIEM log data and notices unusual output from the AI system that appears to contain exfiltrated data beyond the model's normal scope. Which of the following is the vulnerability that has occurred and the control the analyst should implement?
A recently deployed AI system becomes persistently unavailable. A restart temporarily fixes the issue, but the issue happens again. Upon examination of application programming interface (API) logs, an analyst finds that Which of the following is the best way to improve availability of the system?
A security analyst receives an alert about an AI system and is investigating the following output: Which of the following is the most appropriate control the analyst should recommend?
Must use clean and professional language Which of the following should the organization conduct after the chatbot is fully developed but before a customer-
An AI security administrator notices that the information referenced by the model is incorrectly formatted and contains missing values. Which of the following roles should be contacted to fix this issue?
Which of the following describe the practice of providing examples in a prompt?
A user interface engineer adds new graphics to the latest release of an AI-integrated application. During the update, the engineer accidentally causes the model to retain on unverified data. After the update, the model
A short AI-generated video shows a celebrity’s likeness talking about a fake public security event. Which of the following was used to create this video?
An AI security team must assess the probability of an attack on its new system and the impact associated with such an attack. Which of the following threat-modeling resources best addresses the threat landscape for machine learning (ML)?
A security team is implementing a retrieval-augmented generation (RAG) system that indexes internal threat intelligence documents into a vector database for analyst queries. Which of the following is the primary security concern that must be addressed?