CY0-001 securing AI systems explained
Securing AI systems is worth 40% of CY0-001 — roughly twenty-four of the sixty questions, and more than double any other domain. If you pass or fail this exam, this is usually where it happens. CompTIA describes it as implementing security controls for AI systems, protecting training data, models and outputs, and securing deployment environments across cloud and on-premises.
The mental model that makes it manageable: an AI system has four assets, and each needs its own controls.
Asset 1: the training data
Whoever controls the training data controls the model’s behaviour, which makes the dataset a security asset rather than a data-engineering concern.
- Provenance. Know where every dataset came from. Scraped or third-party data is untrusted input that happens to arrive early.
- Integrity. Detect modification. A poisoned record does not announce itself, and the effect only appears after retraining.
- Poisoning and backdoors. An attacker who can insert records can create a trigger that makes the model behave differently on inputs only they know.
- Sensitive content. Personal or confidential data in the training set can resurface in outputs later.
Asset 2: the model
The trained model is intellectual property and an attack target in its own right.
- Theft of weights through weak storage permissions or an over-exposed registry.
- Extraction, reconstructing an equivalent model through repeated queries — rate limiting and monitoring are the practical defences.
- Inversion, inferring training data from behaviour.
- Unauthorised modification, including fine-tuning that silently changes behaviour. Version, sign and track what is deployed.
Asset 3: the outputs
The response channel is a disclosure risk. Controls sit between the model and the user:
- Filtering and guardrails to block harmful or disallowed content.
- Preventing leakage of system instructions, secrets or training data.
- Constraining what downstream systems will act on — never let raw model output reach a privileged action unchecked.
Asset 4: the environment
Everything the model runs on, cloud or on-premises:
- Identity. Workload identities and keyless authentication rather than long-lived API keys in configuration. On any question where one option removes a stored secret, that option is usually right.
- Network. Private endpoints over public ones; inference endpoints are internet-facing services and deserve the same scrutiny.
- Rate limiting. A security control here, not just a cost control — it is the main practical brake on extraction and abuse.
- Logging and monitoring. Prompts, responses, anomalies and volume. Traditional infrastructure logs will not tell you the model is being abused.
- Supply chain. Pretrained models, third-party datasets and the library ecosystem around them are dependencies you did not write.
The exam’s favourite pattern
Most questions in this domain give you a scenario with one explicit constraint — no stored secrets, must not traverse the public internet, must not expose training data, must survive a compromised dependency — and four options of which two or three are genuinely good security practice but do not address that constraint. Find the constraint, then eliminate.
Sample questions
Question 1. An application authenticates to a hosted model endpoint using an API key kept in a configuration file. Policy now forbids stored credentials. What is the appropriate change?
- A. Move the key into an environment variable
- B. Use a managed workload identity with a role assignment on the endpoint
- C. Store the key in a secrets vault and read it at startup
- D. Rotate the key every 24 hours
Show answer
Answer: B
A managed workload identity lets the application authenticate without any stored secret, which is what the policy requires. Moving the key to an environment variable or a vault, or rotating it more often, all leave a credential in the flow; they reduce exposure but do not remove the stored secret.
Question 2. Monitoring shows one client sending a very high volume of systematically varied queries to your public classification endpoint over several days. Which control most directly limits the risk?
- A. Rate limiting combined with anomaly detection on query patterns
- B. Encrypting the model weights at rest
- C. Retraining the model on fresh data
- D. Increasing the model’s context window
Show answer
Answer: A
The pattern is consistent with model extraction, and rate limiting with anomaly detection on query volume is the practical defence. Encrypting weights at rest protects stored files rather than the query channel, retraining does not stop the harvesting, and a larger context window is unrelated.
Question 3. Your team wants to use a pretrained model downloaded from a public repository in a production pipeline. Which concern should be addressed first?
- A. Whether inference will be fast enough
- B. Whether the output format matches the existing API
- C. Provenance and integrity verification of the model artefact
- D. Whether the user interface needs redesigning
Show answer
Answer: C
A model from a public repository is an untrusted third-party dependency, so its provenance and integrity must be established before it is trusted in production. Inference cost, response formatting and the user interface are real considerations but none of them is a security control, and none addresses the possibility that the artefact itself is malicious or tampered with.
What to practise
Take one AI system you know and write four short lists: how its training data is protected, how the model artefact is protected, what sits between the model and the user, and how the environment is locked down. Any list you cannot fill is a gap the exam will find, because those four lists are this domain.