I85PREP
⌘ K
CompTIA SecAI+ study materials
CompTIA SecAI+ study resources

CompTIA SecAI+ practice questions

One question at a time. Build your CompTIA SecAI+ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AI Governance, Risk, and Compliance

Which document type most commonly defines an organization's high-level intent and commitments for using AI responsibly?

  1. A service level agreement
  2. An AI policy Correct answer.
  3. A data dictionary
  4. A model card

Explanation

An AI policy articulates the organization's principles, scope, and commitments for responsible AI use at a governance level. Model cards document individual model characteristics, data dictionaries describe data elements, and SLAs define service commitments.

Question 2AI Governance, Risk, and Compliance

A risk team needs to record identified AI risks with owners, likelihood, and impact so they can be tracked and remediated. Which artifact is most appropriate?

  1. A change log
  2. A confusion matrix
  3. A data sheet
  4. A risk register Correct answer.

Explanation

A risk register is the standard governance tool for logging risks with attributes such as owner, likelihood, impact, and treatment status. The other artifacts serve technical evaluation or documentation purposes.

Question 3AI Governance, Risk, and Compliance

What is the primary purpose of an AI impact assessment performed before deploying a new system?

  1. To evaluate potential harms to individuals and society Correct answer.
  2. To reduce training data volume
  3. To select a cloud provider
  4. To benchmark model latency

Explanation

An AI impact assessment evaluates potential harms and benefits to affected stakeholders before deployment, supporting accountability. Performance benchmarking, vendor selection, and data reduction are separate technical or procurement activities.

Question 4AI Governance, Risk, and Compliance

Which role is typically accountable for ensuring an AI system complies with applicable regulations throughout its lifecycle?

  1. The AI system owner Correct answer.
  2. The model's end user
  3. The data entry clerk
  4. The hardware vendor

Explanation

The AI system owner is accountable for lifecycle compliance, including regulatory obligations and risk treatment. End users, clerks, and vendors have narrower operational roles.

Question 5AI Governance, Risk, and Compliance

What does the principle of transparency primarily require of an AI system?

  1. That its behavior and limitations are disclosed to stakeholders Correct answer.
  2. That it trains faster than competitors
  3. That it stores no user data
  4. That it uses only open-source code

Explanation

Transparency requires that relevant parties understand how a system works, its limitations, and how it is used, enabling informed decisions. Licensing, speed, and data retention are separate concerns.

Question 6AI Governance, Risk, and Compliance

Which regulation focuses specifically on AI systems and establishes risk-based obligations for providers and deployers in the European Union?

  1. SOX
  2. The EU AI Act Correct answer.
  3. PCI DSS
  4. GDPR

Explanation

The EU AI Act is the dedicated AI regulation imposing risk-tiered obligations on providers and deployers. GDPR governs personal data, PCI DSS governs payment card data, and SOX governs financial reporting controls.

Question 7AI Governance, Risk, and Compliance

What is the main purpose of a model card?

  1. To enumerate API endpoints
  2. To store encryption keys
  3. To schedule model retraining jobs
  4. To describe a model's intended use, performance, and limitations Correct answer.

Explanation

A model card documents a model's intended use, evaluation results, and known limitations to support informed and responsible use. It is not an API catalog, key store, or scheduler.

Question 8AI Governance, Risk, and Compliance

Which activity best represents continuous monitoring in an AI governance program?

  1. Conducting a one-time pre-launch audit
  2. Tracking model drift and incidents after deployment Correct answer.
  3. Drafting the initial AI policy
  4. Selecting training algorithms

Explanation

Continuous monitoring tracks deployed system behavior, such as drift and incidents, over time. A one-time audit, initial policy drafting, and algorithm selection are point-in-time or design activities.

Question 9AI Governance, Risk, and Compliance

A company plans to deploy a hiring-screening AI tool and must classify its risk under the EU AI Act. Which category most likely applies?

  1. Limited risk
  2. Prohibited
  3. Minimal risk
  4. High risk Correct answer.

Explanation

AI systems used in employment and worker management, including recruitment and candidate screening, are classified as high risk under the EU AI Act. Minimal and limited risk categories apply to lower-impact uses, and prohibited uses are specifically banned practices.

Question 10AI Governance, Risk, and Compliance

A governance team is mapping controls to the NIST AI Risk Management Framework. Which four functions organize the framework's core?

  1. Identify, Protect, Detect, Respond
  2. Plan, Build, Run, Retire
  3. Govern, Map, Measure, Manage Correct answer.
  4. Scope, Assess, Treat, Accept

Explanation

The NIST AI RMF core is organized around the functions Govern, Map, Measure, and Manage. The other option sets belong to different frameworks or generic process models.

Question 11AI Governance, Risk, and Compliance

An organization must demonstrate that a third-party AI vendor meets its security and privacy requirements before onboarding. Which mechanism is most appropriate?

  1. A hyperparameter sweep
  2. A confusion matrix
  3. A load test
  4. A vendor risk assessment Correct answer.

Explanation

A vendor risk assessment evaluates a third party's controls, security posture, and compliance before onboarding. The other options are technical model or system tests.

Question 12AI Governance, Risk, and Compliance

What distinguishes data minimization as a privacy principle in AI governance?

  1. Collecting only data necessary for the stated purpose Correct answer.
  2. Using the largest available dataset
  3. Storing data indefinitely for future use
  4. Sharing data broadly across teams

Explanation

Data minimization limits collection and use to what is necessary for a defined purpose, reducing privacy risk. Maximizing data, indefinite retention, and broad sharing conflict with the principle.

Question 13AI Governance, Risk, and Compliance

A bank wants an independent review of its AI credit-scoring model's fairness and documentation before launch. Which function should perform this review?

  1. An independent second-line or internal audit function Correct answer.
  2. The end customers
  3. The marketing department
  4. The model's original developers

Explanation

Independent review by a second-line or audit function provides objective assurance separate from the developers. Developers reviewing their own work lacks independence, and marketing or customers are not assurance functions.

Question 14AI Governance, Risk, and Compliance

Which statement best describes the concept of 'human oversight' in AI governance?

  1. Humans must write all model code
  2. Humans must label all training data
  3. Humans approve every API call
  4. Humans retain meaningful ability to intervene in or override system decisions Correct answer.

Explanation

Human oversight means people can meaningfully monitor, intervene in, and override AI decisions where appropriate. Data labeling, coding, and per-call approval are not the defining requirement.

Question 15AI Governance, Risk, and Compliance

An AI system's documentation must record its training data sources, preprocessing, and known biases. Which artifact best captures this?

  1. A penetration test report
  2. A datasheet for datasets Correct answer.
  3. A network diagram
  4. A budget forecast

Explanation

A datasheet documents a dataset's motivation, composition, collection, preprocessing, and recommended uses, including bias considerations. Network diagrams, penetration tests, and budgets cover other concerns.

Question 16AI Governance, Risk, and Compliance

A team is deciding how to treat a residual AI risk after controls are applied. Which outcome is a valid documented risk treatment decision?

  1. Disable all logging
  2. Ignore the risk without record
  3. Delete the risk register entry
  4. Formally accept the residual risk with sign-off Correct answer.

Explanation

Residual risk should be formally accepted, transferred, mitigated, or avoided with documented approval. Ignoring it, deleting records, or disabling logging undermines governance.

Question 17AI Governance, Risk, and Compliance

Which practice best supports auditability of AI decision-making over time?

  1. Storing logs only on analyst laptops
  2. Maintaining immutable, time-stamped decision logs Correct answer.
  3. Relying on verbal recollections
  4. Overwriting logs to save space

Explanation

Immutable, time-stamped logs preserve an accurate record supporting audits and incident investigations. Overwriting, verbal recall, and local storage compromise integrity and availability.

Question 18AI Governance, Risk, and Compliance

What is the role of a Data Protection Impact Assessment (DPIA) when an AI system processes personal data?

  1. To identify and mitigate privacy risks from processing Correct answer.
  2. To define marketing personas
  3. To tune model accuracy
  4. To select GPU hardware

Explanation

A DPIA identifies and mitigates risks to individuals arising from processing personal data, especially for high-risk processing. Accuracy tuning, hardware selection, and marketing are unrelated.

Question 19AI Governance, Risk, and Compliance

An organization wants to ensure AI training data was lawfully obtained and licensed. Which governance control most directly addresses this?

  1. A data provenance and licensing review Correct answer.
  2. A latency benchmark
  3. A UI accessibility test
  4. A model compression step

Explanation

A provenance and licensing review verifies the origin and legal rights to use training data. Latency, compression, and UI testing address performance, efficiency, and accessibility.

Question 20AI Governance, Risk, and Compliance

Which metric is most relevant to measuring fairness across demographic groups in a classification model?

  1. Inference throughput
  2. Disk utilization
  3. Equalized odds across groups Correct answer.
  4. Training loss only

Explanation

Equalized odds is a group fairness criterion comparing error rates across demographic groups. Training loss, throughput, and disk utilization measure optimization or operational performance.

Question 21AI Governance, Risk, and Compliance

A regulator requests evidence that an AI system's decisions can be explained to affected individuals. Which governance requirement does this reflect?

  1. Data minimization
  2. Cost optimization
  3. Explainability and the right to meaningful information Correct answer.
  4. High availability

Explanation

Explainability obligations require providing meaningful information about how decisions are made, supporting individuals' rights. Minimization, availability, and cost are distinct concerns.

Question 22AI Governance, Risk, and Compliance

An AI governance program uses a RACI matrix for its controls. What does the 'A' designate?

  1. The person who must be consulted
  2. The person who is only informed
  3. The person who performs the work
  4. The person ultimately accountable for the outcome Correct answer.

Explanation

In RACI, Accountable is the single owner answerable for the outcome, while Responsible performs the work, Consulted provides input, and Informed is kept updated. Confusing these roles weakens accountability.

Question 23AI Governance, Risk, and Compliance

A company discovers its deployed model's accuracy has degraded because input data distributions shifted. Which governance response is most appropriate?

  1. Delete the monitoring dashboard
  2. Take no action since the model is already deployed
  3. Publish the model card unchanged
  4. Trigger the drift response plan, investigate, and remediate or retrain Correct answer.

Explanation

Detected drift should activate a documented response plan involving investigation and remediation such as retraining. Inaction, removing monitoring, or leaving documentation stale violates monitoring commitments.

Question 24AI Governance, Risk, and Compliance

Which approach best balances innovation and risk when a proposed AI use case falls into a high-risk category?

  1. Deploy immediately without review
  2. Apply enhanced controls, documentation, and oversight proportionate to the risk Correct answer.
  3. Outsource all accountability to the vendor
  4. Reject all high-risk uses categorically

Explanation

Risk-proportionate governance applies enhanced controls, documentation, and oversight for high-risk uses rather than blanket bans or unchecked deployment. Accountability cannot be fully outsourced.

Question 25AI Governance, Risk, and Compliance

An auditor finds that an AI system's fairness testing used only aggregate accuracy and no subgroup analysis. Which governance deficiency does this most directly represent?

  1. Excessive data encryption
  2. Redundant access controls
  3. Insufficient disaggregated evaluation of impacts Correct answer.
  4. Overly detailed model cards

Explanation

Aggregate accuracy can mask disparities, so fairness requires disaggregated evaluation across relevant subgroups. The other options describe practices that are not deficiencies in this context.

Question 26AI Governance, Risk, and Compliance

Which concept in AI governance refers to the ability of stakeholders to obtain an explanation of how a model produced a specific decision?

  1. Explainability Correct answer.
  2. Reproducibility
  3. Robustness
  4. Traceability

Explanation

Explainability concerns giving understandable reasons for individual outputs or overall model behavior. The other properties describe repeatability, lineage tracking, and resilience to perturbation rather than interpretability of decisions.

Question 27AI Governance, Risk, and Compliance

In AI risk management, what is the primary purpose of assigning an inherent risk rating before controls are applied?

  1. To determine the model's computational resource budget
  2. To satisfy vendor contract negotiation requirements
  3. To select the programming framework for model training
  4. To establish a baseline exposure that later control effectiveness can be measured against Correct answer.

Explanation

Inherent risk captures exposure assuming no mitigations, providing the reference point against which residual risk is compared. This lets governance teams judge whether implemented controls materially reduced exposure.

Question 28AI Governance, Risk, and Compliance

Which element is typically required in an organization's AI acceptable use policy?

  1. The salaries of the data science team
  2. A list of approved use cases and prohibited applications Correct answer.
  3. The full source code of production models
  4. The vendor's internal financial statements

Explanation

An acceptable use policy defines which AI applications are permitted, restricted, or forbidden and the conditions for use. It governs behavior rather than disclosing code, compensation, or third-party finances.

Question 29AI Governance, Risk, and Compliance

A governance analyst is asked to identify who is accountable when an AI system causes harm to a customer. Which artifact should the analyst consult first?

  1. The AI system inventory record showing the designated business owner Correct answer.
  2. The data center's power usage report
  3. The model's hyperparameter tuning log
  4. The marketing team's campaign calendar

Explanation

Accountability is established through ownership assignments recorded in the AI system inventory or governance register. These records identify the responsible business owner for each deployed system.

Question 30AI Governance, Risk, and Compliance

An organization is building a governance register of all AI systems in use. Which attribute is most essential for prioritizing oversight effort?

  1. The brand color used in the system's user interface
  2. The physical location of the development team
  3. The risk tier assigned to each system Correct answer.
  4. The number of lines of code in each system

Explanation

Risk tiering lets governance teams allocate scrutiny proportional to potential impact, focusing review on the highest-exposure systems. The other attributes do not indicate the severity of harm a system could cause.

Question 31AI Governance, Risk, and Compliance

A team wants a structured way to record the intended purpose, limitations, and out-of-scope uses of a model for downstream consumers. Which governance artifact should they produce?

  1. A network topology diagram
  2. A service level agreement
  3. A penetration test report
  4. An intended use statement within model documentation Correct answer.

Explanation

Intended use statements define the boundaries within which a model is valid and warn consumers about misuse. They are part of model documentation and directly address scope and limitations.

Question 32AI Governance, Risk, and Compliance

Under a risk-based governance approach, what should happen when a proposed AI use case is assessed as unacceptable risk?

  1. The use case should be prohibited from proceeding Correct answer.
  2. The use case should be reclassified as low risk
  3. The use case should proceed with additional logging
  4. The use case should be approved for a limited pilot

Explanation

Unacceptable-risk classifications exist to stop practices whose harms are deemed to outweigh any benefit. Additional logging or pilots do not cure a use case that is categorically prohibited.

Question 33AI Governance, Risk, and Compliance

A governance lead must ensure that AI incidents are handled consistently. Which component is most important to define in advance?

  1. A schedule of team-building events
  2. An incident response procedure with roles, escalation paths, and reporting timelines Correct answer.
  3. A list of preferred machine learning libraries
  4. A catalog of historical marketing slogans

Explanation

Incident response procedures assign responsibilities, define escalation, and set reporting deadlines so incidents are handled predictably. Tooling preferences and unrelated schedules do not govern incident handling.

Question 34AI Governance, Risk, and Compliance

Which control most directly supports the principle that personal data used to train a model should be kept only as long as necessary?

  1. A quarterly review of model hyperparameters
  2. An annual review of cloud vendor pricing
  3. A documented retention and deletion schedule enforced by automated jobs Correct answer.
  4. A policy requiring developers to use strong passwords

Explanation

Retention limits are operationalized through documented schedules and enforced deletion, which directly implements storage limitation. The other controls address unrelated concerns such as tuning, authentication, and cost.

Question 35AI Governance, Risk, and Compliance

An organization wants to verify that a generative AI assistant does not reveal sensitive training content to users. Which governance test is most appropriate?

  1. Adversarial prompting designed to elicit memorized sensitive data Correct answer.
  2. A code coverage report for the front-end
  3. A load test measuring requests per second
  4. A survey of user satisfaction scores

Explanation

Extraction and membership-inference style probing tests whether a model leaks memorized sensitive content. Performance, coverage, and satisfaction metrics do not reveal data disclosure behavior.

Question 36AI Governance, Risk, and Compliance

A procurement team must evaluate an AI vendor's governance maturity. Which evidence most directly demonstrates a functioning AI risk management program?

  1. A list of the vendor's office locations
  2. A current risk assessment for the specific product with identified mitigations Correct answer.
  3. A glossy corporate brochure describing innovation
  4. A certificate of incorporation

Explanation

A product-specific risk assessment with mitigations shows that the vendor identifies and treats AI risks in practice. Corporate marketing, office lists, and registration documents do not evidence risk management activity.

Question 37AI Governance, Risk, and Compliance

A regulator asks how an organization ensures that automated decisions affecting individuals can be challenged. Which governance mechanism most directly addresses this?

  1. A standard that all logs be stored in a single region
  2. A policy requiring models to be retrained monthly
  3. A requirement that all models use open-source libraries
  4. A documented redress process allowing affected persons to request review by a human Correct answer.

Explanation

Redress mechanisms give affected individuals a route to contest automated outcomes and obtain human reconsideration. Retraining cadence, library choice, and log location do not provide contestability.

Question 38AI Governance, Risk, and Compliance

An organization operates in multiple jurisdictions with differing AI rules. Which approach best supports compliance across all of them?

  1. Adopting the strictest applicable requirement as the baseline for the control set Correct answer.
  2. Outsourcing all compliance decisions to individual developers
  3. Applying the least demanding jurisdiction's rules everywhere
  4. Deferring compliance until enforcement actions occur

Explanation

Building controls to the most stringent applicable requirement generally satisfies less demanding jurisdictions as well, avoiding fragmented compliance. The alternatives either under-protect or abdicate governance responsibility.

Question 39AI Governance, Risk, and Compliance

A governance committee is evaluating whether to approve a high-risk AI system. Which combination of evidence best supports a defensible approval decision?

  1. A demonstration of the user interface and a marketing plan
  2. A competitor's public announcement of a similar system and a budget approval
  3. A verbal assurance from the lead developer and a project timeline
  4. Completed risk assessment, validated test results, and a signed acceptance of residual risk by the accountable owner Correct answer.

Explanation

A defensible approval rests on documented risk analysis, evidence that controls were tested, and explicit acceptance of remaining risk by the accountable party. Informal assurances and external comparisons do not establish that risks were evaluated.

Question 40AI Governance, Risk, and Compliance

An internal audit finds that AI risk assessments are completed at launch but never revisited. Which governance change most effectively addresses this gap?

  1. Eliminating risk assessments for models already in production
  2. Moving risk assessment responsibility to the procurement team
  3. Requiring risk assessments to be shorter documents
  4. Mandating periodic reassessment triggered by defined events such as model changes or drift Correct answer.

Explanation

Risk profiles change as models, data, and operating conditions evolve, so reassessment must be scheduled and event-triggered. Shortening documents, shifting ownership inappropriately, or removing assessments does not close the lifecycle gap.

Question 41AI Threat Landscape and Attack Surface

Which term describes the full set of ways an adversary could interact with or influence an AI system, including its data, model, and deployment interfaces?

  1. The licensing agreement
  2. The inference latency profile
  3. The model's training budget
  4. The AI attack surface Correct answer.

Explanation

The attack surface is the collection of entry points and trust boundaries through which an adversary can influence a system. For AI systems this spans training data, model artifacts, APIs, plugins, and downstream consumers.

Question 42AI Threat Landscape and Attack Surface

An attacker repeatedly submits slightly modified inputs to a production model to infer the decision boundary and reconstruct its behavior. Which threat category does this represent?

  1. Supply chain compromise
  2. Prompt injection
  3. Model extraction Correct answer.
  4. Data poisoning

Explanation

Model extraction (or model stealing) uses systematic querying to approximate a model's parameters or decision behavior. The goal is to replicate functionality rather than to corrupt training data or hijack prompts.

Question 43AI Threat Landscape and Attack Surface

An attacker inserts malicious instructions into a document that a retrieval-augmented generation system later retrieves and feeds to the model. What is this attack called?

  1. Indirect prompt injection Correct answer.
  2. Membership inference
  3. Gradient inversion
  4. Adversarial patch

Explanation

Indirect prompt injection places adversarial instructions in content the model will ingest, such as retrieved documents or web pages. The model then treats attacker-controlled text as instructions.

Question 44AI Threat Landscape and Attack Surface

Which practice most directly reduces the risk of a poisoned training dataset degrading model behavior?

  1. Increasing the number of inference replicas
  2. Enabling verbose error messages for debugging
  3. Provenance tracking and integrity validation of training data Correct answer.
  4. Shortening the model's context window

Explanation

Poisoning defenses focus on knowing where data came from and verifying it has not been altered. Provenance and integrity checks let defenders detect or exclude tampered samples before training.

Question 45AI Threat Landscape and Attack Surface

What distinguishes a targeted adversarial example from a random input perturbation?

  1. It is crafted to cause a specific misclassification while remaining hard to detect Correct answer.
  2. It permanently modifies the model weights
  3. It always requires physical access to the model server
  4. It only works against image classifiers

Explanation

Adversarial examples are optimized perturbations designed to produce a chosen incorrect output while staying subtle to humans. The perturbation is deliberate and goal-directed, not random noise.

Question 46AI Threat Landscape and Attack Surface

An attacker uses a model's confidence scores returned by an API to determine whether a specific individual's record was part of the training data. Which attack is this?

  1. Model inversion
  2. Membership inference Correct answer.
  3. Model skewing
  4. Backdoor injection

Explanation

Membership inference exploits output signals such as confidence to infer whether a given record participated in training. It is a privacy attack on the training data.

Question 47AI Threat Landscape and Attack Surface

What is the primary security concern with downloading an unverified pre-trained model from a public repository?

  1. The model's license will automatically expire
  2. The model artifact may contain embedded malicious code or a hidden backdoor Correct answer.
  3. The model cannot be served behind an API
  4. The model will always have lower accuracy than a custom model

Explanation

Model artifacts are executable or deserialized content and can carry malware or deliberately implanted behaviors. Treating third-party models as untrusted supply chain components is essential.

Question 48AI Threat Landscape and Attack Surface

Which of the following best describes a backdoor (trojan) implanted in a machine learning model?

  1. A hidden behavior triggered by a specific input pattern chosen by the attacker Correct answer.
  2. A random hardware failure during inference
  3. A normal feature learned from clean training data
  4. A legal clause in the model license

Explanation

A backdoor causes the model to behave normally except when a specific trigger is present, at which point it produces attacker-chosen output. The trigger is introduced during training or weight manipulation.

Question 49AI Threat Landscape and Attack Surface

A security team wants to inventory every component that could influence their LLM application's outputs. Which set of elements belongs in that inventory?

  1. Training data sources, base model, fine-tuning data, system prompts, plugins, and retrieval corpora Correct answer.
  2. Only the front-end web application
  3. Only the GPU hardware model
  4. Only the public API endpoint

Explanation

The AI attack surface includes all data and configuration elements that shape model behavior, not just the serving endpoint. Prompts, plugins, and retrieval sources are all influenceable components.

Question 50AI Threat Landscape and Attack Surface

An organization exposes an LLM agent with tools that can send email and read files. Which risk is most elevated by this design?

  1. Higher token costs per request
  2. Longer model training times
  3. Indirect prompt injection leading to unauthorized tool actions Correct answer.
  4. Reduced model accuracy on benchmarks

Explanation

Tool-enabled agents act on model output, so injected instructions in ingested content can trigger real actions. This expands the attack surface from information disclosure to consequential operations.