P.S. Fast2test在Google Drive上分享了免費的、最新的CY0-001考試題庫：https://drive.google.com/open?id=1b_-6FzBuqw4gu4xTwpgNFh9vHfMqHmaQ
Fast2test為您提供的針對性培訓和高品質的練習題，是你第一次參加CompTIA CY0-001 認證考試最好的準備。Fast2test提供的練習題是與真實的考試試題很相似的，能確保你一次成功通過CompTIA CY0-001 認證考試。如果你考試失敗，我們將全額退款。
| Section | Weight | Objectives |
|---|---|---|
| AI Governance, Risk and Compliance | 19% | - Risk management for AI
|
| AI-assisted Security | 24% | - AI in security strategy and operations
|
| Basic AI Concepts Related to Cybersecurity | 17% | - AI-driven threats and risks
|
| Securing AI Systems | 40% | - Security controls for AI systems
|
Fast2test的關於CompTIA CY0-001 認證考試的針對性練習題卻是很受歡迎的。Fast2test的資料不僅能讓你獲取知識和很多相關經驗，還可以使你為考試做充分的準備。雖然CompTIA CY0-001認證考試很難，但是通過做Fast2test的練習題後，你會很有信心的參加考試。放心地選擇Fast2test的高效練習題吧，為CompTIA CY0-001 認證考試做一個最充分的準備。
問題 #45
A penetration tester is assessing the controls of a deployed AI system that is designed to search and return the contents of files.
The tester runs the following:
Which of the following is the best control to prevent abuse of the system?
答案：B
解題說明：
Basic Concept: AI systems that access file systems or databases use service accounts to authenticate.
Applying the principle of least privilege to these service accounts limits the damage that can result from prompt injection or other attacks that cause the AI to perform unauthorized file access. CompTIA SecAI+ Study Guide covers least privilege as a core AI security control.
Why D is Correct: Reducing the privilege scope of the service account implements the least privilege principle, ensuring the AI system can only access files it legitimately needs for its intended function. If an attacker uses prompt injection to abuse the file search capability, the service account ' s limited permissions prevent access to sensitive files outside the defined scope, containing the blast radius of any exploitation.
Why A is Wrong: Custom detection rules identify anomalous behavior after it occurs. They are detective controls, not preventive controls. They do not stop an attacker from successfully abusing the system; they only alert after abuse has occurred.
Why B is Wrong: VPC segmentation isolates the workload at the network level, limiting lateral movement.
However, it does not restrict what files the AI ' s service account can access within its own environment, so file abuse attacks within the segment are still possible.
Why C is Wrong: LLM guardrails filter prompt inputs and outputs for policy violations. While useful, they can potentially be bypassed through sophisticated prompt injection. Reducing service account privileges provides a defense-in-depth layer that limits damage even if guardrails are bypassed.
問題 #46
A security analyst is aware of an active penetration test in the environment. The analyst examines SIEM log data and notices the following AI system output:
Which of the following is the vulnerability that has occurred and the control the analyst should implement?
答案：B
解題說明：
Basic Concept: AI systems can inadvertently reveal sensitive information such as PII, credentials, or internal data in their outputs when not properly controlled. Sensitive information disclosure is a critical OWASP LLM Top 10 risk. CompTIA SecAI+ Study Guide covers both vulnerability identification and appropriate data protection controls for AI outputs.
Why D is Correct: The scenario describes the AI system outputting sensitive information in its responses, which is a sensitive information disclosure vulnerability. The appropriate control is masking, which replaces sensitive data values such as credit card numbers, SSNs, or API keys with redacted or tokenized equivalents in the model ' s outputs before they are returned to users. This prevents the AI from disclosing sensitive data while still providing useful responses.
Why A is Wrong: Prompt injection involves crafting inputs to override model instructions. If the penetration test revealed sensitive information, the primary vulnerability is the disclosure of that sensitive data, not the injection mechanism itself. EDR monitors endpoint behavior, not AI output content.
Why B is Wrong: Model hallucinations produce fabricated information rather than disclosing real sensitive data. The described scenario involves actual sensitive information being revealed, not fictitious content generation.
Why C is Wrong: Jailbreaking circumvents safety restrictions but the primary harm demonstrated is sensitive data exposure. RBAC manages access permissions but does not prevent the model from including sensitive data in responses once access is granted.
Why E is Wrong: Role impersonation involves the AI pretending to be a different entity. This may be a secondary technique used by the penetration tester but the primary vulnerability described is the disclosure of actual sensitive information in the output.
問題 #47
A critical AI system cannot be shut down and must remain secure. Which of the following actions should be performed to apply controls?
答案：D
解題說明：
Option B is correct because patching critical vulnerabilities directly removes or reduces known exploitable weaknesses while allowing the essential AI service to remain available. The organization should prioritize patches according to exploitability and impact, test them in a representative environment, use redundancy or rolling deployment where possible, and verify that remediation succeeded. Option A would weaken confidentiality and create an additional security exposure; encryption is not the obstacle to secure continuous operation. Option C is valuable as a detective control because log analysis can reveal abnormal activity, but it does not remediate a known critical vulnerability. Option D redeploys the production model, which may restore model files or configuration, but it does not necessarily update the vulnerable operating system, library, container, API, or orchestration component. For a system that cannot be shut down, the correct strategy is controlled patch management supported by high availability, maintenance coordination, monitoring, and rollback capability. NIST describes enterprise patch management as preventive maintenance that reduces the likelihood of compromise, breaches, and operational disruption.
問題 #48
A team of engineers builds an application using a large language model (LLM). The application is built on Linux and is hosted on a virtual server. Users must create an account in order to access and use the platform.
Which of the following should the team do to protect the account credentials?
答案：B
解題說明：
Basic Concept: User account credentials stored in a database must be protected against unauthorized disclosure. The security of credentials at rest requires cryptographic controls that prevent even database administrators or attackers with database access from reading plaintext passwords. CompTIA SecAI+ Study Guide covers credential security controls as part of AI application security.
Why C is Correct: Implementing hashing and encryption for credential protection is the industry-standard approach. Passwords should be hashed using strong, slow algorithms such as bcrypt, Argon2, or scrypt with unique salts, making them computationally infeasible to reverse even if the database is compromised.
Additional sensitive credential data can be encrypted. Together, hashing and encryption ensure that account credentials remain protected even if the underlying storage is accessed by unauthorized parties.
Why A is Wrong: Patching the model with new datasets updates the AI model ' s training data and knowledge. It does not address the security of user account credentials stored in the application ' s authentication database.
Why B is Wrong: Updating Linux and virtual server software patches system vulnerabilities and is important for overall security hygiene. However, it does not implement specific protections for the account credentials themselves stored in the application database.
Why D is Wrong: Deploying an authenticated API requires users to authenticate to use the API, improving access control. While this complements credential security, it does not protect the storage of credentials at rest and does not replace hashing and encryption of the credential values themselves.
問題 #49
After the latest software update, a developer receives reports that the system no longer requires reauthentication to display account balances because this issue was present in a previous release. Which of the following should the developer do to best mitigate the risk of recurrence?
答案：D
解題說明：
Option B is correct because the defect is a regression: a security behavior that should require reauthentication was previously corrected but reappeared after a software update. Automated AI-assisted regression testing in the CI/CD pipeline can repeatedly verify that protected account-balance functions still demand reauthentication before a release is promoted. The test should reproduce the prior defect, fail the build when authentication is bypassed, and preserve the case as a permanent security test. Option A adds an approval step, but an approver may not detect the reintroduced behavior without an executable test. Option C improves release scheduling and traceability but does not prove that security controls still function. Option D uses SAST to inspect source code for known weakness patterns; it may identify some authentication flaws, but it does not reliably validate the end-to-end runtime behavior described here. Regression testing is the direct control for preventing recurrence. The NIST AI Risk Management Framework emphasizes testing AI systems before deployment and regularly during operation, supporting automated security validation within the delivery pipeline.
問題 #50
......
CompTIA CY0-001是IT專業人士的首選，特別是那些想晉升的IT職員。CompTIA的CY0-001是一個可以給你的職業生涯帶來重大影響的考試，而獲得CY0-001認證是作為IT職業發展的有力保證。CY0-001考古題已經幫助了成千上萬的考生獲得成功，這是一個高品質的題庫資料。我們提供給您最近更新的CY0-001題庫資料，來確保您通過認證考試，如果您一次沒有通過考試，我們將給您100%的退款保證。
新版CY0-001題庫上線: https://tw.fast2test.com/CY0-001-premium-file.html
2026 Fast2test最新的CY0-001 PDF版考試題庫和CY0-001考試問題和答案免費分享：https://drive.google.com/open?id=1b_-6FzBuqw4gu4xTwpgNFh9vHfMqHmaQ