CY0-001 Dumps with Practice Exam Questions Answers

Option D is correct because the failure is an authorization problem: every external customer can receive sensitive information even though only some customers are permitted to use it. Role-based access control assigns permissions to defined customer roles and requires the API to evaluate the caller’s role before returning protected fields or invoking sensitive model functions. Properly implemented, RBAC supports least privilege and separates ordinary customers from approved sensitive-data users. Option A may route customers to different models, but model selection does not itself enforce who is authorized to receive data. Option B changes model behavior and training data, yet retraining cannot replace an access-control decision at the API boundary. Option C may improve network isolation, but placing the model in a VPC does not stop an authenticated external customer from receiving information that the API exposes. The organization should also apply field-level filtering, deny-by-default policies, logging, and authorization testing. NIST’s RBAC model assigns users to roles and associates each role with permitted privileges, directly supporting this control.

================

Basic Concept: AI chatbots that generate non-answers — responses that do not actually address user questions — consume CPU resources for processing without delivering value. This can indicate the model is attempting to generate responses for queries outside its knowledge domain or confidence threshold. CompTIA SecAI+ Study Guide covers AI performance optimization and response quality management.

Why B is Correct: Implementing a response confidence level threshold allows the chatbot to recognize when it lacks sufficient confidence to provide a meaningful answer and respond accordingly, either with a helpful redirect or a clear indication that it cannot answer the query. This reduces the costly processing cycles spent generating poor-quality non-answers, lowers CPU utilization from failed response generation, and improves customer experience by setting appropriate expectations rather than returning unhelpful responses.

Why A is Wrong: Guardrails filter content for safety and policy compliance. They prevent harmful or out-of-policy responses but do not address the underlying issue of the model generating low-confidence non-answers to legitimate customer queries.

Why C is Wrong: Prompt logging records user inputs for analysis and auditing. While useful for identifying what types of questions cause non-answers, logging alone does not solve the problem or reduce CPU utilization from failed response generation.

Why D is Wrong: Cost monitoring tracks AI system expenditure. It can identify that costs are high due to excessive CPU usage but does not implement a solution to reduce the non-answer rate or improve response generation efficiency.

Basic Concept: LLM hallucinations occur when the model generates plausible-sounding but factually incorrect or fabricated information. For internal content management solutions where accuracy is critical, detecting and handling hallucinated responses before they are acted upon is essential. CompTIA SecAI+ Study Guide covers response validation as a mitigation for hallucination risks.

Why B is Correct: Response validation implements checks that verify the accuracy and relevance of LLM-generated responses before they are presented to users or acted upon. This can involve cross-referencing responses against authoritative internal data sources, using a secondary model to evaluate response accuracy, or implementing confidence scoring that flags low-confidence responses for human review. Response validation directly addresses the hallucination problem by catching inaccurate responses before they cause harm.

Why A is Wrong: Model training addresses hallucinations at the model level by providing more accurate training data or fine-tuning. While effective long-term, it requires significant time and resources and does not provide immediate protection against hallucinations in the currently deployed model.

Why C is Wrong: Access controls manage who can query the LLM and what resources they can access. They do not inspect or validate the accuracy of the model ' s responses, so they cannot mitigate hallucination risks.

Why D is Wrong: Integrity monitoring tracks whether data or systems have been tampered with or changed unexpectedly. It is relevant for detecting unauthorized modifications but does not validate whether LLM-generated content accurately reflects reality or internal authoritative data.

Basic Concept: When a chatbot leaks PII from one user ' s conversation into another user ' s responses, the root cause is cross-user memory contamination — the chatbot is retaining and sharing conversation context across user sessions. Disabling the memory feature stops the active data leakage immediately. CompTIA SecAI+ Study Guide covers session memory management as a privacy control for AI chatbots.

Why B is Correct: Disabling memory from chat history for all users immediately stops the mechanism causing PII leakage between users. If the chatbot retains no cross-session memory, it cannot include information from one user ' s conversation in another user ' s response. This is the most direct, immediate corrective action that eliminates the root cause of the privacy violation without requiring additional user behavior changes or service disruption.

Why A is Wrong: Taking the chatbot offline and restoring from backup is a drastic action appropriate when the issue requires investigating a potential compromise or data breach. For a configuration issue such as cross-user memory sharing, disabling the memory feature is a more targeted and proportionate first response that addresses the root cause directly.

Why C is Wrong: Asking users to refrain from using PII relies on voluntary user behavior change and does not address the technical root cause. Users may not comply, and even if they do, previously stored PII in memory would continue to leak. This is an ineffective first corrective action.

Why D is Wrong: Requiring users to label sensitivity does not stop the chatbot from storing and sharing PII that has already been submitted. Labels inform the system about data sensitivity but do not prevent the memory mechanism from sharing labeled sensitive data across user sessions.

Using an LLM with retrieval-augmented generation and current data is the best solution because the requirement is to analyze substantial threat-intelligence material and generate tailored summaries for different audiences. CompTIA SecAI+ explicitly identifies document synthesis and summarization as an AI-assisted security automation use case and also includes retrieval-augmented generation as a core AI concept.

RAG enables the LLM to retrieve relevant information from an organization ' s current threat-intelligence repositories before generating its response. This improves factual grounding and allows reports to incorporate recent indicators, adversary information, vulnerabilities, campaigns, and internal findings that may not exist in the model ' s original training data. The LLM can then adapt the same underlying intelligence into executive summaries, analyst-level reports, or technical remediation guidance.

Sentiment analysis determines emotional or opinion-related characteristics and does not meet the summarization requirement. K-means clustering is useful for grouping similar observations but does not naturally generate audience-specific narrative reports. Regression predicts numerical values rather than synthesizing complex textual intelligence. Consequently, an LLM combined with RAG provides the strongest fit for automated, current, audience-aware threat-report analysis and summarization.