CompTIA SecAI+ study plan

Map each of the five exam domains to its official weighting and rank your personal weak areas

Define core AI governance concepts (risk appetite, AI system inventory, model ownership) in your own words

Classify the primary AI attack surface categories (data, model, pipeline, supply chain, inference) and give one concrete example of each

Build a personal glossary of at least 40 AI security terms with definitions you can reproduce from memory

Compare major AI governance frameworks and identify which controls are shared versus unique

Draft a risk register for a fictional AI system with at least 10 identified risks, likelihood, impact, and owner

Explain how regulatory obligations map to technical controls for a high-risk AI use case

Distinguish model cards, system cards, and audit trails by the question each one answers

Describe the mechanics of prompt injection, data poisoning, model evasion, and model extraction

Identify where each attack class lands in the AI lifecycle and which controls reduce exposure

Analyze a documented AI incident and reconstruct the attack chain stage by stage

Differentiate adversarial input from data integrity attacks by the asset each one targets

Enumerate controls that protect training data, model artifacts, and inference endpoints

Explain how data classification and lineage requirements apply to AI training pipelines

Compare encryption, access control, and isolation approaches for model weights and embeddings

Identify the security implications of RAG architectures and vector stores

Design a data pipeline security review checklist covering ingestion, labeling, storage, and retirement

Explain how model theft, inversion, and membership inference differ and what each reveals

Evaluate logging and monitoring requirements for AI systems against privacy constraints

Identify the security tradeoffs of federated learning and on-device inference

Describe how AI is used to triage alerts, correlate events, and prioritize incidents in a SOC

Identify failure modes of AI-assisted detection, including false positive amplification and automation bias

Explain how to validate and tune an AI detection tool before trusting its output

Outline an incident response plan that covers both an AI-assisted attack and a compromise of an AI system

Map security gates to each phase of the AI development lifecycle from requirements through retirement

Define red-teaming and evaluation criteria for a model before release

Explain how model supply chain risk, dependency pinning, and provenance apply to AI artifacts

Draft secure coding and review requirements specific to ML pipelines and model registries

Re-test every weak area identified in week 1 and record movement

Complete timed practice sets weighted to the official domain percentages

Reconcile any conflicting definitions in your glossary against authoritative sources

Simulate explaining three cross-domain scenarios end to end under time pressure