CY0 CompTIA SecAI+ Beta free practice test

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

1. Question 1

   Link to question

   A security analyst at a healthcare company is testing an image classification model that diagnoses skin conditions. The model misclassifies a benign mole as malignant after a small, imperceptible change to the image pixels. Which type of attack has occurred?

   1. Adversarial example

   2. Data poisoning

   3. Model inversion

   4. Model stealing

   Show answer and explanation

   Correct answer

   • Adversarial example

   An adversarial example involves adding small, deliberate perturbations to input data to cause a model to make incorrect predictions. Data poisoning corrupts training data, model inversion reconstructs private data, and model stealing extracts model parameters.

2. Question 2

   Link to question

   Which attack aims to reconstruct sensitive training data by querying the model and analyzing its outputs?

   1. Membership inference

   2. Model inversion

   3. Adversarial attack

   4. Data poisoning

   Show answer and explanation

   Correct answer

   • Model inversion

   Model inversion attacks attempt to reconstruct representative samples of the training data, potentially revealing private information. Membership inference determines if a specific record was in training, adversarial attacks cause misclassification, and data poisoning corrupts training.

3. Question 3

   Link to question

   During the training of a spam classifier, an attacker subtly alters thousands of spam emails to include common keywords from legitimate emails. Over time, the model begins to classify spam as legitimate. What is the primary attack vector?

   1. Model inversion

   2. Adversarial perturbation at inference

   3. Poisoning of training data

   4. Model stealing via API

   Show answer and explanation

   Correct answer

   • Poisoning of training data

   Data poisoning occurs when an attacker influences the training data to manipulate the model's behavior. Here, altering training samples to include legitimate keywords causes the model to learn incorrect associations. The other options describe different attacks.

4. Question 4

   Link to question

   A company wants to train a model on user data but ensures that the model cannot reveal whether a specific individual's data was used in training. Which technique best achieves this?

   1. Federated learning

   2. Secure multi-party computation

   3. Homomorphic encryption

   4. Differential privacy

   Show answer and explanation

   Correct answer

   • Differential privacy

   Differential privacy adds noise to the training process to guarantee that the model's outputs do not reveal membership of any individual record. Federated learning trains locally, SMPC allows joint computation, and homomorphic encryption supports encrypted computation, but only differential privacy directly addresses membership privacy.

5. Question 5

   Link to question

   In a scenario where multiple hospitals want to jointly train a model on their patient data without exposing the data to each other, which technique should be used?

   1. Federated learning with secure aggregation

   2. Differential privacy

   3. Secure multi-party computation (MPC)

   4. Model watermarking

   Show answer and explanation

   Correct answer

   • Federated learning with secure aggregation

   Federated learning trains models locally and aggregates updates without sharing raw data. Secure aggregation ensures that individual updates are encrypted and combined so no party sees others' updates. MPC is a broader cryptographic tool, but federated learning with secure aggregation is the standard approach for collaborative training.

6. Question 6

   Link to question

   An attacker has black-box access to a model and can observe its predictions. They want to determine if a specific person's record was part of the training dataset. Which attack best describes this?

   1. Model inversion

   2. Membership inference

   3. Data poisoning

   4. Adversarial example

   Show answer and explanation

   Correct answer

   • Membership inference

   Membership inference attacks aim to infer whether a particular data point was used in training. Model inversion reconstructs data, poisoning corrupts training, and adversarial examples cause misclassifications.

7. Question 7

   Link to question

   In a federated learning system, a malicious participant sends carefully crafted model updates that gradually steer the global model toward misclassifying certain inputs. What is this attack called?

   1. Inference attack

   2. Data poisoning

   3. Model poisoning

   4. Evasion attack

   Show answer and explanation

   Correct answer

   • Model poisoning

   Model poisoning attacks specifically target federated learning by corrupting local model updates to manipulate the global model. Data poisoning generally refers to corrupting training data, evasion attacks occur at inference, and inference attacks extract information.

8. Question 8

   Link to question

   Which concept in AI security refers to the ability to understand and interpret why a model made a specific decision?

   1. Bias auditing

   2. Model validation

   3. Adversarial robustness

   4. Explainable AI (XAI)

   Show answer and explanation

   Correct answer

   • Explainable AI (XAI)

   Explainable AI provides insights into model decisions. Bias auditing detects unfairness, model validation evaluates performance, and adversarial robustness measures resistance to adversarial examples.

9. Question 9

   Link to question

   A loan approval model is found to approve applications from one demographic group at a significantly lower rate than others, even when the applicants have similar financial profiles. Which step should be taken to address this issue?

   1. Perform bias testing and mitigation

   2. Apply differential privacy

   3. Add adversarial training

   4. Implement model inversion defense

   Show answer and explanation

   Correct answer

   • Perform bias testing and mitigation

   Bias testing and mitigation techniques, such as re-weighting or fairness constraints, address disparate impact. Differential privacy protects privacy, adversarial training improves robustness, and model inversion defense protects against reconstruction attacks.

10. Question 10

    Link to question

    An attacker places a specially designed sticker on a stop sign, causing an autonomous vehicle's vision model to classify it as a speed limit sign. This is an example of:

    1. Data poisoning

    2. Adversarial patch

    3. Model inversion

    4. Membership inference

    Show answer and explanation

    Correct answer

    • Adversarial patch

    An adversarial patch is a physical object (like a sticker) that, when placed in the scene, causes the model to misclassify. Data poisoning corrupts training data, model inversion reconstructs data, and membership inference determines if a record was used.

11. Question 11

    Link to question

    An attacker with API access to a cloud-based model repeatedly queries it with carefully chosen inputs to create a surrogate model that mimics the original. Which attack is this?

    1. Adversarial example

    2. Membership inference

    3. Model stealing

    4. Data poisoning

    Show answer and explanation

    Correct answer

    • Model stealing

    Model stealing attacks aim to copy the functionality of a model by querying it and training a replicate. Adversarial examples cause misclassification, membership inference determines if a record was in training, and data poisoning corrupts training.

12. Question 12

    Link to question

    Which security measure ensures that model inference is performed in a hardware-protected environment that isolates it from the rest of the system?

    1. Secure multi-party computation

    2. Homomorphic encryption

    3. Differential privacy

    4. Trusted execution environment (TEE)

    Show answer and explanation

    Correct answer

    • Trusted execution environment (TEE)

    A TEE, such as Intel SGX or AMD SEV, provides hardware-based isolation for code and data during execution. SMPC and homomorphic encryption are cryptographic techniques, and differential privacy adds noise to data.

13. Question 13

    Link to question

    When deploying an AI model that accepts user input, which practice is most critical to prevent injection attacks?

    1. Input validation and sanitization

    2. Regularizing the model

    3. Using differential privacy

    4. Implementing model watermarking

    Show answer and explanation

    Correct answer

    • Input validation and sanitization

    Input validation ensures that inputs are safe and within expected bounds, preventing injection attacks like SQL or prompt injection. Regularization reduces overfitting, differential privacy protects privacy, and watermarking disincentivizes theft.

14. Question 14

    Link to question

    A model developer wants to embed a secret pattern into a model's outputs to prove ownership if the model is stolen. Which technique should be used?

    1. Differential privacy

    2. Model watermarking

    3. Federated learning

    4. Adversarial training

    Show answer and explanation

    Correct answer

    • Model watermarking

    Model watermarking embeds a unique signature into the model's behavior, allowing owners to verify theft. Differential privacy adds noise, federated learning trains distributively, and adversarial training improves robustness.

15. Question 15

    Link to question

    A data scientist is cleaning a dataset for training a sentiment analysis model. They discover that many samples contain offensive language that could bias the model. What should be done first?

    1. Remove all offensive samples

    2. Use adversarial training to remove bias

    3. Apply data sanitization and filtering

    4. Ignore the issue as it will not affect the model

    Show answer and explanation

    Correct answer

    • Apply data sanitization and filtering

    Data sanitization involves filtering out inappropriate or biased content to prevent the model from learning harmful patterns. Simply removing all offensive samples may remove useful context; sanitization handles it more carefully. Adversarial training is not for bias removal, and ignoring the issue could lead to harmful biases.

16. Question 16

    Link to question

    In a model evaluation, the team finds that accuracy is high but the model's decisions are easily swayed by small random noise added to inputs. Which property is lacking?

    1. Generalization

    2. Explainability

    3. Privacy

    4. Adversarial robustness

    Show answer and explanation

    Correct answer

    • Adversarial robustness

    Adversarial robustness measures how well a model resists small, intentional input perturbations. Generalization refers to performance on unseen data, explainability is about interpretability, and privacy concerns data leakage.

17. Question 17

    Link to question

    A company is using an AI model to screen job applications. A candidate sues, claiming the model discriminated based on gender. The company cannot explain why the model made its decisions. What should the company have implemented to defend against such claims?

    1. Explainable AI (XAI) techniques

    2. Differential privacy during training

    3. Adversarial training to prevent attacks

    4. Secure aggregation of candidate data

    Show answer and explanation

    Correct answer

    • Explainable AI (XAI) techniques

    Explainable AI provides transparency into model decisions, which is essential for defending against discrimination claims by showing that decisions were based on relevant factors. Differential privacy protects privacy, adversarial training improves robustness, and secure aggregation is for federated learning.

18. Question 18

    Link to question

    A financial institution wants to use homomorphic encryption for inference to protect client data. What is a major trade-off of this approach?

    1. Increased vulnerability to adversarial examples

    2. Significant computational overhead

    3. Loss of model accuracy due to noise

    4. Inability to update the model after deployment

    Show answer and explanation

    Correct answer

    • Significant computational overhead

    Homomorphic encryption allows computation on encrypted data but imposes high computational costs, making it impractical for real-time applications. It does not inherently increase vulnerability to adversarial examples, accuracy loss from noise is more related to differential privacy, and models can still be updated.

19. Question 19

    Link to question

    A developer is using a pre-trained model from an online repository. Before integrating it into a critical system, what is the most important security step?

    1. Re-train the model on proprietary data

    2. Apply differential privacy to the model weights

    3. Validate the model's provenance and integrity

    4. Deploy the model in a sandbox for one week

    Show answer and explanation

    Correct answer

    • Validate the model's provenance and integrity

    Validating provenance ensures that the model has not been tampered with or contains backdoors. Checking integrity via checksums or signatures is crucial. Re-training may be advisable but is not the most important security step; differential privacy is for privacy, and sandbox testing is useful but not primary for trust.

20. Question 20

    Link to question

    During an AI security audit, the team discovers that an image recognition model has a backdoor: it classifies any image with a specific yellow square as 'target'. How was the backdoor likely introduced?

    1. Using adversarial patches during inference

    2. Extracting the model via API queries

    3. Overfitting to training data noise

    4. Poisoning the training data with triggers

    Show answer and explanation

    Correct answer

    • Poisoning the training data with triggers

    A backdoor is typically introduced by data poisoning, where an attacker inserts specific patterns (triggers) into training samples and labels them incorrectly. Adversarial patches are applied at inference to cause misclassification, not training. Model extraction steals the model, and overfitting does not create intentional backdoors.