Free CY0-001 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

AI-enhanced code scanning tools leverage machine learning models trained on vast codebases to understand context, developer intent, and complex data flows. This allows them to identify sophisticated semantic and logic-based vulnerabilities that traditional, rule-based SAST scanners often miss. Furthermore, by understanding the specific context of the code, these AI tools can provide tailored remediation suggestions that are more accurate and actionable than generic pattern-based recommendations. This moves beyond simple pattern matching to a deeper, more contextual code comprehension, which is essential for modern threats like complex injection attacks.

B. No security tool can guarantee zero false negatives. Complex and novel vulnerabilities can always evade detection, making this claim unrealistic for any system.

C. Software Composition Analysis (SCA) is a distinct process that identifies vulnerabilities in third-party libraries and dependencies, which complements AI-SAST's focus on first-party code.

1. Pearce, H., et al. (2022). Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions. In Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), pp. 754-771. This paper discusses how AI models (like Copilot) interact with code, highlighting their ability to understand context beyond simple rules, which is the foundation for AI-SAST. DOI: 10.1109/SP46214.2022.9833571

2. Le, V., & Linstrom, P. (2022). Deep Learning for Vulnerability Detection: A Comprehensive Survey. MIT Computer Science and Artificial Intelligence Laboratory (CSAIL). The survey covers how deep learning models can capture semantic features and long-range dependencies in code (Section 3.2), enabling the detection of complex logic flaws.

3. National Institute of Standards and Technology (NIST). (2023). Secure Software Development Framework (SSDF) Version 1.1. NIST Special Publication 800-218. Section PW.8.1 discusses using automated tools for code review, where AI-driven tools represent an advanced implementation for detecting "otherwise unidentified vulnerabilities."

A Model Denial of Service (DoS) attack aims to make a machine learning model unavailable to legitimate users by exhausting its computational resources. Indicator I (GPU saturation) and Indicator II (increased latency from specific inputs, known as an algorithmic complexity attack) are methods to achieve resource exhaustion. Indicator IV (system failure to respond) is the direct outcome of a successful DoS attack. Indicator III, model weight exfiltration, is a confidentiality attack (model theft), not an availability attack like DoS.

A. This option is incorrect because it omits Indicator I (GPU saturation), which is a primary method for executing a resource exhaustion-based Model DoS attack.

C. This option is incorrect because it includes Indicator III (model exfiltration), which is a confidentiality attack, not a DoS attack focused on service availability.

D. This option is incorrect because it includes Indicator III. Model DoS attacks are concerned with availability, not the theft of model intellectual property.

1. MITRE ATLAS™. (2023). ML Model Denial of Service (AML.T0001). The MITRE Corporation. Retrieved from https://atlas.mitre.org/techniques/AML.T0001. This source describes how adversaries can cause a DoS by sending inputs that consume excessive resources (CPU, GPU, memory), aligning with indicators I, II, and IV.

2. NIST. (2023). AI Risk Management Framework (AI RMF 1.0). (NIST AI 100-1). National Institute of Standards and Technology. p. 28, Section 4.3. This framework discusses attacks against AI systems, including those that impact availability (DoS) versus those that impact confidentiality (data/model theft).

3. Carlini, N., et al. (2023). Poisoning Language Models During Instruction Tuning. arXiv:2305.00944. Section 2 discusses availability attacks, including "resource-consumption attacks" where inputs are crafted to maximize inference time, directly supporting Indicator II.

The two distinct characteristics or risks specifically associated with Transfer Learning attacks are Backdoor Persistence and Adversarial Transferability.

B. Backdoor Persistence: This attack involves poisoning the pre-trained (teacher) model. An attacker embeds a hidden trigger (the backdoor) into the model, which causes specific malicious behavior when activated. When a downstream user fine-tunes this compromised model for their own task, the backdoor functionality often persists in the resulting (student) model. This is a direct risk of using pre-trained weights from an untrusted source, a core tenet of the transfer learning supply chain.

C. Adversarial Transferability: This is the phenomenon where an adversarial example (a carefully perturbed input) designed to fool one model is also effective at fooling a different model, especially if the second model was fine-tuned from the first. The student model inherits a significant portion of the teacher model's feature representation, making it vulnerable to the same adversarial inputs. This risk is magnified in transfer learning scenarios where an attacker may have access to the original teacher model.

A. Gradient Vanishing: This is a fundamental problem related to the training of very deep neural networks, where gradients shrink exponentially as they are backpropagated, making it difficult for lower layers to learn. It is a training optimization challenge, not a security attack vector specifically introduced by the process of transfer learning.

D. Prompt Injection: This is a type of attack that targets the input-processing logic of a deployed LLM at inference time. While a fine-tuned model is susceptible to prompt injection, the vulnerability is in how the model handles prompts, not a risk that is inherited through the model weights from the teacher model during the transfer learning process itself. Backdoors and transferable adversarial examples are properties embedded within or enabled by the learned parameters being transferred.

1. Gu, T., Dolan-Gavitt, B., & Garg, S. (2017). BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. arXiv preprint arXiv:1708.06733. This is the foundational paper on backdoor attacks (termed "BadNets"), which explicitly frames the attack in the context of a compromised model supply chain, such as transfer learning.

2. Papernot, N., McDaniel, P., & Goodfellow, I. (2016). Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples. arXiv preprint arXiv:1605.07277. This research extensively studies the property of adversarial transferability and demonstrates how it can be used to mount black-box attacks, a risk directly applicable when a student model is derived from a publicly known teacher model.

3. Shafahi, A., et al. (2018). Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Advances in Neural Information Processing Systems 31 (NeurIPS 2018). This paper discusses advanced poisoning attacks, including those that can be injected into models that are later used for transfer learning, demonstrating the persistence of such vulnerabilities.

The scenario describes an attacker using a machine learning model to analyze network characteristics (latency, TCP stack) to differentiate real assets from honeypots. This is a direct example of automated honeypot detection, where AI is used to bypass security deception technologies. The attacker's goal is to avoid wasting resources on traps and focus on legitimate targets, which is the core challenge presented.

A. Deploying UEBA sensors is a defensive countermeasure to detect attacks, not a description of the attacker's specific AI-driven technique.

B. Adversarial Training is a defensive method to make a defender's AI model more robust, not a technique used by the attacker in this context.

D. A Model Inversion attack aims to reconstruct the training data of a model, whereas the attacker here is using a model to classify targets.

1. Shen, Y., et al. (2018). "Honeypot Detection in Advanced Metering Infrastructure using Machine Learning". 2018 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm). This paper discusses the use of machine learning classifiers to detect honeypots by analyzing network traffic features, aligning with the scenario. (DOI: 10.1109/SmartGridComm.2018.8587501, Section III.A, "Feature Selection").

2. Rowe, N. C. (2019). "Counter-Deception for Cyber-Deception". Naval Postgraduate School. This work explores methods for detecting deception, noting that attackers can use automated methods to analyze system responses to identify honeypots. (Technical Report NPS-CS-19-003, Section 4, "Counter-deception methods").

Excessive Agency refers to an AI agent having capabilities, permissions, or autonomy that surpass its intended function, creating a risk of unintended or harmful actions. A shared, high-privileged IAM role (I) grants excessive permissions. Lacking user confirmation for destructive actions (II) grants excessive autonomy. Not filtering output for command injection patterns (IV) allows the agent to be manipulated into executing unintended, privileged commands, which is a direct result of having the agency to execute commands combined with a vulnerability.

Using a Jupyter environment for prototyping (III) is a standard development practice and does not relate to the operational permissions or autonomy of the deployed agent.

1. OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications. LLM05: Excessive Agency. Retrieved from https://owasp.org/www-project-top-10-for-large-language-model-applications/. (This document defines Excessive Agency and links it to excessive permissions and granting too much functionality).

2. Cohen, J., et al. (2024). A Taxonomy of Attacks on AI-powered Code Assistants. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security. (Discusses how vulnerabilities like injection can lead to agents performing unintended actions, a form of excessive agency).

3. Stanford University. (2023). CS221: Artificial Intelligence: Principles and Techniques, Lecture on AI Safety. (Course materials often discuss the principle of least privilege and containment for AI agents to prevent unintended consequences, which is the core concept behind mitigating excessive agency).

The OECD Recommendation on Artificial Intelligence, a landmark international standard, is built upon five complementary value-based principles. Among these are "Robustness, security and safety" (B), which dictates that AI systems must be dependable and operate safely throughout their lifecycle, and "Accountability" (C), which holds that organizations and individuals deploying AI systems must be held responsible for their proper functioning and for respecting the other principles. These two are explicitly stated pillars in the OECD framework for trustworthy AI.

A. Automated Zero-Day vulnerability remediation in LLMs: This is a highly specific and advanced technical goal, not a broad, high-level governance principle as defined by the OECD.

D. Mandatory Data Sovereignty for all training datasets: While data governance is important, the OECD principles do not mandate strict data sovereignty, instead promoting cross-border data flows with appropriate safeguards.

1. Organisation for Economic Co-operation and Development (OECD). (2019). Recommendation of the Council on Artificial Intelligence. OECD/LEGAL/0449. Section 1.1, Principles for responsible stewardship of trustworthy AI, explicitly lists "Robustness, security and safety" (Principle 1.4) and "Accountability" (Principle 1.5).

2. Floridi, L., & Cowls, J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review, 1(1). This academic paper analyzes and aligns various AI ethics frameworks, highlighting accountability and safety/robustness as core, recurring principles, citing the OECD framework. https://doi.org/10.1162/99608f92.8cd550d1

The answer choices A and D are correct. According to the NIST AI Risk Management Framework (AI RMF), the GOVERN function establishes and maintains the organizational infrastructure needed for AI risk management. This includes:

- Option A (Allocating resources and personnel) is correct because the GOVERN function explicitly requires organizations to establish the necessary resources, including human capital and infrastructure, to support AI risk management activities throughout the AI lifecycle.

- Option D (Developing organizational culture) is correct because the GOVERN function emphasizes creating a culture of risk management that promotes responsible AI development and deployment, ensuring accountability and transparency across the organization.

- Option B (Implementing technical controls for Model Inversion attacks) is incorrect because this is a technical mitigation activity that falls under the MAP or MANAGE functions, not GOVERN. GOVERN focuses on organizational structures and policies rather than specific technical controls.

- Option C (Documenting training dataset characteristics) is incorrect because this is a technical documentation activity related to the MAP function, which deals with understanding and documenting AI system characteristics. GOVERN is concerned with organizational-level policies and structures.

1. NIST AI 100-1, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)," National Institute of Standards and Technology, January 2023, Section 3.1 GOVERN Function, pp. 18-21. Available at: https://doi.org/10.6028/NIST.AI.100-1

2. NIST Special Publication 1270, "Towards a Standard for Identifying and Managing Bias in Artificial Intelligence," March 2022, Section 4.1 on Organizational Governance, pp. 23-25. Available at: https://doi.org/10.6028/NIST.SP.1270

3. ISO/IEC 23053:2022, "Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML)," Section 7.2 on Governance Requirements, pp. 15-17.

4. IEEE Standard 7000-2021, "IEEE Standard Model Process for Addressing Ethical Concerns during System Design," Section 5.2 on Organizational Readiness, pp. 28-30.

5. Barocas, S., Hardt, M., & Narayanan, A. (2019). "Fairness and Machine Learning: Limitations and Opportunities," Chapter 7 on Institutional Frameworks, pp. 145-148. Available at: https://fairmlbook.org/

The attack described is a classic Direct Prompt Injection, where malicious instructions are embedded within user input to hijack the model's behavior. The most effective and direct mitigation is to treat all user input as untrusted data. Implementing robust input sanitization helps to filter out or neutralize control sequences and instruction-like language. Furthermore, using delimiter-based prompt structuring, where system instructions and user input are clearly separated by special markers (e.g., ...), helps the model differentiate between trusted commands and untrusted content, significantly reducing the risk of injection while preserving the application's core functionality.

A. Adversarial retraining is a reactive defense that may not generalize to novel attack strings and is more resource-intensive than proactive input handling.

B. Lowering the temperature setting reduces the model's creativity but does not prevent it from following explicit, high-probability instructions provided in a prompt injection attack.

D. A stateless firewall operates at the network layer and lacks the application-layer context to inspect and understand the semantic content of a prompt, making it ineffective against this attack.

1. OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications. LLM01: Prompt Injection. Recommends segregating user input from the system prompt and implementing input filtering as primary mitigations.

2. Perez, F., & Ribeiro, I. (2022). Ignore Previous Prompt: Attack Techniques For Language Models. Section 4.1. Discusses instruction-based attacks and suggests that models can be fine-tuned to respect delimiters separating instructions from data. (DOI: https://doi.org/10.48550/arXiv.2211.09527).

3. Wei, A., et al. (2023). Jailbroken: How Does LLM Safety Training Fail?. Section 5. Discusses defenses, highlighting the challenge and importance of separating instructions from user data, which is the principle behind delimiter-based structuring. (Preprint available on arXiv:2307.02483).

The core issue is the AI-SAST tool's lack of context, leading to low-value alerts (false positives). The most effective solution is to enhance the AI's capability rather than reverting to manual or less intelligent methods. Implementing context-aware vulnerability prioritization uses more sophisticated machine learning models that can analyze not just the code itself, but also its surrounding environment. This includes factors like the deployment configuration (e.g., container settings), data flow analysis, and whether a vulnerable function is actually reachable in production. This approach directly addresses the problem by making the AI smarter, allowing it to prioritize genuinely critical risks and suppress irrelevant findings.

A. Increase the sensitivity threshold of the AI-SAST engine: This would likely generate even more alerts, exacerbating the problem of alert fatigue and false positives, not reducing it.

B. Transition to manual code review for all deprecated libraries: This is highly inefficient, costly, and negates the primary benefit of using an automated DevSecOps tool for rapid scanning.

C. Utilize standard Regex-based patterns to filter out library alerts: This is a regression to older, less effective rule-based methods that lack the sophistication to understand context, which is the root of the problem.

1. Ghaffarian, S. M., & Shahriari, H. R. (2017). Software vulnerability analysis and discovery using machine learning and data mining techniques: A survey. ACM Computing Surveys (CSUR), 50(4), 1-36. Section 5 discusses the future direction of using ML for "vulnerability prioritization" based on contextual factors. https://doi.org/10.1145/3092566

2. National Institute of Standards and Technology (NIST). (2021). Defending Against Software Supply Chain Attacks. (NIST SP 800-218). This document emphasizes the need for automated tools to analyze software components (like libraries) and assess risk, a process that is optimized by context-aware AI.

3. Carnegie Mellon University, Software Engineering Institute (SEI). (2022). Using AI and ML for Application Security. Blog. The SEI discusses how AI/ML is advancing beyond simple pattern matching in SAST to include contextual understanding to improve the accuracy and prioritization of findings.

The validation phase of the AI life cycle focuses on tuning the model and selecting the best architecture before final evaluation. Statement II, adjusting hyperparameters like learning rates using a held-out validation dataset, is a core activity of this phase. Statement III, selecting the best model type (e.g., CNN vs. RNN) based on performance on the validation set, is also a key part of this phase. Statement I, reporting final accuracy on the test set, occurs in the subsequent Testing/Evaluation phase. The test set must remain unseen during training and validation. Statement IV, using backpropagation, is the fundamental process of the Training phase, where the model learns from the training data.

A. This option is incorrect because backpropagation (IV) is part of the Training phase, not Validation.

B. This option is incorrect because executing the model on the Test Set (I) is part of the final Testing/Evaluation phase, not Validation.

C. This option is incorrect because statement I (using the Test set) and IV (backpropagation) are not part of the Validation phase.

1. Ng, A. (n.d.). Machine Learning Yearning. Stanford University. Chapter 5, "Basic Recipe," clearly distinguishes between the training set (for learning parameters), the development (validation) set (for tuning hyperparameters and model selection), and the test set (for final, unbiased performance evaluation).

2. Goodfellow, I., Bengio, Y., & Courville, A. (2016). Deep Learning. MIT Press. Section 5.3, "Hyperparameters and Validation Sets," p. 119, explains that the validation set is used to "tune the hyperparameters" and that the test set is used only at the very end to evaluate final performance.

3. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). Section 4.3, "Test, Evaluation, Validation, and Verification," describes validation as confirming that a system meets its intended purpose, which includes the iterative tuning process.

The core issue is "Excessive Agency," where the AI agent has the autonomy to perform high-impact actions (modifying permissions) without oversight, leading to a security breach when triggered by a malicious prompt. Implementing Human-in-the-loop (HITL) for all high-impact changes directly mitigates this risk. An HITL process would require a human operator to review and approve the agent's proposed action (upgrading a contractor's permissions) before it is executed, breaking the chain of unchecked autonomous action.

B. Deploy Homomorphic Encryption for all data stored in Jira: This protects the confidentiality of data at rest and in use but does nothing to prevent the AI agent from making unauthorized permission changes. The risk is about action, not data confidentiality.

C. Enable Role-Based Access Control (RBAC) on the vector database: This is a control to protect the AI model's knowledge base from being tampered with. It does not limit the actions the agent can take in external, integrated systems like Jira.

D. Utilize Data Masking for all outgoing project management logs: This is a data protection control for logs, obscuring sensitive information after an event has already occurred. It is a detective/forensic control, not a preventative measure against the agent taking the malicious action in the first place.

1. National Institute of Standards and Technology (NIST). (2024). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1. The "Govern" function emphasizes human oversight. Specifically, the framework states, "Human-in-the-loop, human-over-the-loop, and human-in-command approaches are common strategies for AI oversight" (Section 2.2, "Characteristics of Trustworthy AI"). The HITL approach described in option A is a direct implementation of this principle for high-risk actions.

2. Hendrycks, D., & Mazeika, M. (2022). X-Risk Analysis for AI Research. arXiv:2206.05862. This academic paper on AI safety discusses the risks of autonomous systems and the importance of "human oversight and control mechanisms" to prevent unintended and harmful actions, which is the essence of HITL.

3. MIT Computer Science and Artificial Intelligence Laboratory (CSAIL). (2020). Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims. The report discusses the need for systems that allow for meaningful human control, especially when AI agents are granted the ability to act in the real world or on production systems. HITL for critical decisions is a primary mechanism for achieving this.

Accidental data leakage in AI systems occurs when sensitive information is unintentionally exposed through the model or its supporting infrastructure. A primary vector is the failure to properly de-identify or anonymize training data; if a model is trained on raw data containing Personally Identifiable Information (PII), it can memorize and later reveal that information. Another common vector is the insecure logging of inference data. If user prompts and model completions, which may contain sensitive details, are stored in plaintext logs, they become a target for unauthorized access and constitute a data leak.

B. Implementing Dieerential Privacy during the model training phase: Differential privacy is a robust cryptographic technique used to prevent data leakage by adding statistical noise, making it a mitigation, not a vector.

C. Deployment of models within Virtual Containers using TLS 1.3: Containerization and TLS are security controls designed to isolate processes and encrypt data in transit, respectively. They are measures to prevent data leakage.

1. Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., ... & Raffel, C. (2021). Extracting Training Data from Large Language Models. In 30th USENIX Security Symposium (USENIX Security 21). This paper demonstrates how models memorize and leak PII from their training data, highlighting the risk of failing to de-identify datasets. (DOI: available via USENIX proceedings).

2. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). (NIST AI 100-1). The framework's "MAP" function discusses understanding the context and risks, including data privacy (Section 4.3), which encompasses risks from both training data and operational data like inference logs.

3. Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017). Membership Inference Attacks Against Machine Learning Models. In 2017 IEEE Symposium on Security and Privacy (SP). This foundational paper shows how models can leak information about their training data, underscoring the importance of data sanitization. https://doi.org/10.1109/SP.2017.12

AI-enabled threat modeling tools leverage machine learning to automate and enhance the process of identifying and analyzing security threats. They can analyze architectural diagrams and code to automatically identify trust boundaries (I). They excel at generating potential attack paths and representing them as attack trees (II) by using vast knowledge bases of vulnerabilities and tactics. AI is also effective at processing threat data to prioritize risks using frameworks like DREAD or STRIDE (IV). However, real-time patching of vulnerabilities (III) is a remediation or vulnerability management function, which occurs after threat modeling and is distinct from it.

A: This option incorrectly includes real-time patching (III), which is a remediation task, not a threat modeling activity.

C: This option incorrectly includes real-time patching (III). Threat modeling is about identifying and analyzing threats, not actively fixing them.

D: This option incorrectly excludes the automated identification of trust boundaries (I), which is a key capability of modern AI-driven security analysis tools.

1. Shostack, A. (2014). Threat Modeling: Designing for Security. Wiley. Chapter 3 discusses the core steps of threat modeling, which include identifying assets, threats, and vulnerabilities, but not real-time patching.

2. Shevchenko, N., et al. (2018). Tool-assisted Attack Tree Generation and Analysis. In 2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). This paper discusses the automation of attack tree generation, a task where AI is now being applied (Statement II). DOI: 10.1109/EuroSPW.2018.00019.

3. Microsoft Security. (2023, November 15). Introducing Microsoft Security Copilot. Microsoft's documentation describes using generative AI to summarize threats, analyze attack chains, and assist in incident response, which aligns with identification (I), generation (II), and prioritization (IV).

4. UcedaVelez, T., & Morana, M. M. (2015). Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis. Syngress. This book details threat prioritization using frameworks like DREAD, a process that can be significantly accelerated by AI (Statement IV).

The primary security benefit is leveraging the AI model's predictive capabilities to proactively identify risks before they materialize in the production environment. By training on historical incident and configuration data, the model learns to recognize patterns associated with past failures or vulnerabilities. It then analyzes new Infrastructure-as-Code (IaC) changes to flag potential security regressions (reintroducing old flaws) or deviations from established secure baselines (policy violations). This pre-deployment analysis allows the security team to intervene early, reducing the likelihood of security incidents.

A. Enforcing RBAC is an access control function, not the primary benefit of a predictive analysis model operating on change requests.

B. The AI model is a decision-support tool; it augments human oversight by flagging risks, but does not completely replace the strategic review of a CAB.

C. The model's purpose is impact analysis of code changes, not the generation of synthetic data for other models.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). (NIST AI 100-1). Section 3.3, GOVERN Function, G.3, states that risk is managed by "conducting regular testing... to identify and manage risks from... changes in the operational context." The AI model automates this principle.

2. Oza, A., & Sales, T. (2023). Engineering MLOps: A Systematic Approach to Architecting, Building, and Managing Production-Ready ML Systems. O'Reilly Media. Chapter 11 discusses using automated checks in CI/CD pipelines to "catch potential issues early," which aligns with identifying regressions and violations.

3. Kim, M., et al. (2021). A Survey on Security and Privacy for AI. IEEE Access, 9, 132365-132388. https://doi.org/10.1109/ACCESS.2021.3114348. The paper discusses proactive defense mechanisms, where AI systems analyze code or configurations for vulnerabilities before deployment (Section IV-A).

The root cause of the reputational loss is the model producing biased and untrustworthy outputs. The most direct and effective long-term mitigation is to improve the model's alignment with desired ethical guidelines and user expectations. Reinforcement Learning from Human Feedback (RLHF) is a state-of-the-art technique specifically designed for this purpose. It uses human-provided feedback to fine-tune the model, rewarding helpful, harmless, and unbiased responses, thereby directly addressing the source of the brand damage. This aligns with AI TRiSM principles of model reliability and trust.

B. Migrating a vector database to on-premises is an infrastructure decision for data control and security, but it does not change the model's biased behavior.

C. Deploying additional containers improves system availability and scalability, not the quality or safety of the AI-generated content.

D. Increasing GPU capacity speeds up model inference but has no impact on the underlying logic or data that leads to biased outputs.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1. The framework's "Govern" function emphasizes creating a culture of risk management, and the "Map" function involves addressing impacts on individuals and society (Section 2.2), which directly relates to mitigating bias and reputational harm.

2. Ziegler, D. M., et al. (2019). Fine-Tuning Language Models from Human Preferences. This paper details an early implementation of RLHF, showing its effectiveness in aligning models to produce outputs preferred by humans, which includes reducing harmful or biased content (Section 1: Introduction).

3. Stanford University Human-Centered Artificial Intelligence (HAI). (2023). On the Opportunities and Risks of Foundation Models. The report discusses alignment techniques like RLHF as crucial for ensuring models behave safely and in accordance with human values (Chapter 4: Risks).

The core problem is that the standalone LLM is "hallucinating"—generating factually incorrect and insecure suggestions because its knowledge is static and outdated. The best architectural solution is to implement Retrieval-Augmented Generation (RAG). This approach connects the LLM to an external, continuously updated, and verified knowledge base (in this case, a security database). When a developer asks for code, the RAG system first retrieves the latest, most relevant security standards and library documentation from the database and then provides this information to the LLM as context. This "grounds" the model's response in factual, current data, directly mitigating hallucinations and ensuring its recommendations are secure and up-to-date.

A. Increase the temperature setting of the model's inference API: Increasing the temperature makes the model's output more random and creative. This would almost certainly increase the frequency of hallucinations and non-factual statements, worsening the problem.

B. Perform Adversarial Training using known Prompt Injection datasets: Adversarial training is a technique to make a model more robust against malicious inputs (Prompt Injection), not to correct its factual inaccuracies or update its internal knowledge base.

C. Deploy a Vector Database solely for storing historical model logs: Storing logs is essential for monitoring and auditing but does not provide the model with the correct, up-to-date information it needs to generate accurate responses. The model cannot learn from logs at inference time.

1. Lewis, P., et al. (2020). "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks." Advances in Neural Information Processing Systems 33. This foundational paper introduces RAG as a method to combine parametric (internal) and non-parametric (external database) memory, enabling models to access and ground their outputs in up-to-date, factual information, thereby reducing fabrication. (Section 1: Introduction).

2. Gao, Y., et al. (2023). "Retrieval-Augmented Generation for Large Language Models: A Survey." arXiv preprint arXiv:2312.10997. Section 3.1, "Mitigating Hallucination," explicitly identifies the reduction of factual inaccuracies as a primary motivation for using RAG. It states that RAG provides access to real-time, verifiable information, which serves as a factual grounding for the LLM.

3. Amazon Web Services (AWS). (Official Vendor Documentation). "Retrieval Augmented Generation (RAG)." The documentation describes RAG as a technique to address the issue of LLMs generating incorrect information by providing them with information from an authoritative knowledge source, thus improving the quality and accuracy of responses.

Statements I, II, and IV are correct descriptions of fundamental concepts in evaluating classification models. Precision (I) correctly measures the accuracy of positive predictions (TP / (TP + FP)). Recall (II) correctly measures the model's ability to find all actual positive instances (TP / (TP + FN)). A Confusion Matrix (IV) is the standard tool for visualizing these performance metrics. Statement III is incorrect because accuracy is a misleading metric for imbalanced datasets, common in security, where a model can achieve high accuracy by simply predicting the majority class (e.g., "not a threat") while failing to identify rare but critical threats.

A. This option is incorrect because it includes statement III, which falsely claims accuracy is always the most reliable metric for imbalanced datasets.

C. This option is incorrect for the same reason as A; it includes the false statement III regarding the reliability of accuracy.

D. This option is incorrect because it omits statement I. Precision is a critical and distinct metric from recall and is necessary for a comprehensive evaluation.

1. Powers, D. M. W. (2011). Evaluation: From Precision, Recall and F-Measure to ROC, Informedness, Markedness & Correlation. Journal of Machine Learning Technologies, 2(1), 37-63. (This paper provides detailed definitions of Precision, Recall, and the Confusion Matrix, and discusses their application).

2. Stanford University. (n.d.). CS229 - Machine Learning: Evaluation Metrics. Course Notes. Retrieved from cs229.stanford.edu. (Course materials frequently cover the definitions of precision, recall, and the confusion matrix, and the pitfalls of using accuracy on imbalanced datasets).

3. Fawcett, T. (2006). An introduction to ROC analysis. Pattern Recognition Letters, 27(8), 861-874. https://doi.org/10.1016/j.patrec.2005.10.010 (Section 2, "The Confusion Matrix," details the structure and utility of the matrix for visualizing classifier performance).

The MITRE ATLAS framework is a knowledge base of adversarial tactics and techniques based on real-world observations and is intentionally modeled after the structure of the well-known MITRE ATT&CK framework. This common structure facilitates integration into existing security operations and allows for cross-domain analysis. ATLAS includes AI-specific tactics that describe an adversary's goals, such as 'ML Model Access' and 'Exfiltration' of model components or data. However, the framework is not limited to Generative AI or LLMs; it covers a wide range of AI/ML systems, including computer vision and other predictive models, making statement III incorrect.

B. This option is incorrect because statement III is false. The ATLAS framework's scope extends beyond just Generative AI and LLMs to encompass the broader AI/ML landscape.

C. This option is incorrect because statement I is true. The structural similarity between ATLAS and ATT&CK is a fundamental design choice to promote adoption and integration.

D. This option is incorrect because statement II is also true. ATLAS defines specific tactics like 'ML Model Access' and 'Exfiltration' that are unique to AI system attacks.

1. MITRE. (2023). MITRE ATLAS Overview. MITRE ATLAS™. Retrieved from https://atlas.mitre.org/ "ATLAS is a knowledge base of adversarial tactics, techniques, and case studies for artificial intelligence (AI) systems based on real-world observations... ATLAS is modeled after the MITRE ATT&CK® framework".

2. MITRE. (2023). ATLAS Tactics. MITRE ATLAS™. Retrieved from https://atlas.mitre.org/tactics. The official list of tactics includes TA0003 - ML Model Access and TA0010 - Exfiltration.

3. Strohm, B., et al. (2020). Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS) (Technical Report MTR20-0328). MITRE Corporation. Section 2.1, "ATLAS is modeled after the MITRE ATT&CK framework...".

The statement accurately describes a key practice in MLOps and AI security. Integrating automated adversarial testing into a CI/CD (Continuous Integration/Continuous Deployment) pipeline enables proactive security validation. By programmatically generating and testing the model against perturbed inputs (e.g., via evasion attacks), teams can continuously measure and enforce a baseline for adversarial robustness before a new model version is deployed. This shifts security testing "left," making it an integral part of the development lifecycle.

This is a True/False question, so there are no other options to evaluate.

1. MITRE. (2023). MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems). Technique: T0029 - Evasion Attack. The ATLAS framework documents evasion attacks and recommends defensive measures, including robustness testing, which aligns with the practice described.

2. O'Reilly Media. (2020). Building Secure and Reliable Systems. Chapter 21, "Security in the Development Lifecycle," discusses the importance of integrating security testing into automated build and deployment pipelines (CI/CD). This principle extends directly to AI/ML systems.

3. Bhatt, U., et al. (2020). Uncertainty as a Form of Transparency: Measuring, Communicating, and Using Uncertainty in Machine Learning. Proceedings of the 2020 AIES Conference. This and similar academic works highlight the need for rigorous model evaluation, including robustness to distributional shifts and adversarial examples, which is facilitated by automated testing. https://doi.org/10.1145/3375627.3375814

This monitoring strategy is insufficient due to its lack of timeliness. An adversarial prompt causing a recursive loop can lead to a resource exhaustion or Model Denial of Service attack, incurring massive costs in minutes or hours. Relying on a monthly billing report introduces a detection latency of up to 30 days, by which time catastrophic financial damage would have already occurred. Effective mitigation requires real-time or near-real-time monitoring of resource consumption metrics (e.g., CPU, memory, API call frequency) with automated alerting and circuit-breaker mechanisms to terminate runaway processes immediately.

This is a Yes/No question; therefore, there are no other incorrect options to evaluate.

1. OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications. LLM04: Model Denial of Service. This document explicitly states that attackers can cause resource-heavy operations, leading to high costs, and recommends implementing strict resource usage controls and monitoring.

2. Palanisamy, V., & Liu, L. (2017). Effective cloud resource provisioning for distributed data stream processing. Proceedings of the 2017 IEEE International Conference on Big Data (Big Data), 101-110. While focused on data streams, the paper underscores the necessity of real-time resource monitoring and auto-scaling in cloud environments to manage costs and performance, a principle that applies directly to AI workload security. https://doi.org/10.1109/BigData.2017.8257916

3. MIT Computer Science and Artificial Intelligence Laboratory (CSAIL). (2023). Security of advanced AI. Course materials often emphasize that security monitoring for AI systems must operate at machine speed, as attacks can be automated and execute far faster than human review cycles like monthly reports.