Updated May 09, 2026 Test Engine to Practice Test for CY0-001 Valid and Updated Dumps
Exam Questions for CY0-001 Updated Versions With Test Engine
NEW QUESTION # 17
Global IPs attempt logins against thousands of accounts with known breached credentials. What attack is occurring?
- A. SQL injection
- B. DDoS
- C. Password spraying
- D. Credential stuffing
Answer: D
Explanation:
Credential stuffing uses leaked username-password pairs.
NEW QUESTION # 18
A security alert triggers an agentic system. An analyst notices the following payload in the logs"
The alert includes multiple shell commands that are not typically run as part of any hardening.
Which of the following is the most effective control to implement?
- A. Adding logic that includes approved strings before running the shell commands
- B. Modifying the application to ignore the SECURITY_UPDATE tag
- C. Using only approved libraries when interacting with agentic systems
- D. Deprecating model usage and retaining the model with safer parameters
Answer: A
Explanation:
The payload in the alert attempts to trick the system into executing unauthorized shell commands.
The most effective control is to implement allow-list validation (approved strings) before execution. This ensures that only predefined, safe commands are executed, blocking prompt injection attempts that introduce malicious code such as the fake patch script.
NEW QUESTION # 19
Which of the following controls is the best way to mitigate a denial-of-service (DoS) attack?
- A. Access controls
- B. Rate limiting
- C. End-to-end encryption
- D. Model guardrails
Answer: B
Explanation:
Rate limiting restricts the number of requests within a set timeframe, preventing attackers from overwhelming the system with excessive traffic, making it the best control to mitigate a DoS attack.
NEW QUESTION # 20
Users report that the output of a generative AI application seems unrelated to the prompts and contains offensive content. A security team investigates and determines that there was an on- path attack. Which of the following is the most likely attack method?
- A. Model hijacking
- B. Application server hijacking
- C. Session hijacking
- D. Domain hijacking
Answer: C
Explanation:
In an on-path attack, an adversary intercepts and manipulates traffic between the user and the AI system. Session hijacking allows the attacker to inject or alter prompts and responses, leading to unrelated or offensive output.
NEW QUESTION # 21
A social media company with more than a million lines of code wants to reduce the mean time to fix bugs and issues. Which of the following is the most balanced AI strategy to automate the vulnerability management flow?
- A. Using AI to triage discovered issues, create tickets, and merge software fixes
- B. Using AI to triage discovered issues and create tickets, but having a software engineer merge software
- C. Having security analysts triage discovered issues and create tickets, but using AI to merge software
- D. Having security analysts triage discovered issues and create tickets, but having a software engineer merge software
Answer: B
Explanation:
This approach balances automation and human oversight. AI accelerates vulnerability management by triaging issues and generating tickets, while software engineers retain responsibility for merging code changes, ensuring quality and reducing the risk of insecure or unstable code being deployed.
NEW QUESTION # 22
Which of the following strengthens the performance of a large language model (LLM) for malicious reconnaissance?
- A. Prompting a chatbot to describe server naming patterns and Internet Protocol (IP) ranges
- B. Creating a web scraper script using AI to capture the company website
- C. Enhancing a foundational model with the inclusion of retrieval-augmented generation (RAG)
- D. Instructing an AI assistant to query as an administrator
Answer: C
Explanation:
RAG augments an LLM with external, up-to-date information retrieval, improving its factual accuracy and contextual scope-capabilities that directly strengthen the model's effectiveness for reconnaissance.
NEW QUESTION # 23
What is the PRIMARY purpose of an MSSP for small businesses?
- A. Replace all internal IT
- B. Develop internal apps
- C. Perform required compliance audits
- D. Provide outsourced monitoring and threat detection
Answer: D
Explanation:
MSSPs specialize in outsourced security monitoring and alerting.
NEW QUESTION # 24
An organization is concerned with the exposure of sensitive data. Which of the following is the most relevant security concern?
- A. Overfitting
- B. Model inversion
- C. Hyperparameter tuning
- D. Data normalization
Answer: B
Explanation:
Model inversion is a security concern where attackers can reconstruct or infer sensitive training data from the AI model's outputs. This directly threatens data confidentiality, making it the most relevant concern for sensitive data exposure.
NEW QUESTION # 25
Faculty members at a university are concerned about potential inherent bias and inconsistency in one department's AI plagiarism detection service.
Which of the following principles will most likely to address their concerns?
- A. Explainability
- B. Consistency
- C. Accountability
- D. Transparency
Answer: B
Explanation:
Consistency ensures that an AI system applies rules and produces results in a uniform manner across all cases. This principle directly addresses concerns about bias and irregular outcomes in the plagiarism detection service.
NEW QUESTION # 26
An AI architect reviews AI utilization and wants to improve the user experience. Which of the following should the architect review within the logs?
- A. Access controls
- B. Rate monitoring
- C. Model accuracy
- D. Data storage
Answer: C
Explanation:
To improve user experience, the architect should review model accuracy in the logs. High accuracy ensures users receive relevant, reliable responses, directly impacting satisfaction and effectiveness of the AI system.
NEW QUESTION # 27
A manufacturing company wants to use AI within its operations to improve the efficiency and accuracy of its processes. Which of the following should the organization do first to enable adoption and achieve the business objectives?
- A. Achieve International Organization for Standardization (ISO) 42001 certification.
- B. Introduce a generative adversarial network (GAN).
- C. Hire a data and AI architect.
- D. Select a large language model (LLM).
Answer: C
Explanation:
The first step in adopting AI to meet business objectives is to establish the right expertise. A data and AI architect can design the overall strategy, infrastructure, and data pipelines needed for effective AI integration, ensuring alignment with operational goals before selecting specific models or certifications.
NEW QUESTION # 28
Which of the following describe the practice of providing examples in a prompt? (Choose two.)
- A. Prompt template
- B. Quantization
- C. Multi-shot
- D. System prompt
- E. User prompt
- F. One-shot
Answer: C,F
Explanation:
Providing examples in a prompt is referred to as one-shot prompting when a single example is given and multi-shot prompting when multiple examples are provided.
NEW QUESTION # 29
A company wants to reduce IDS false positives. What tuning should occur FIRST?
- A. Increase signature sensitivity
- B. Disable low-priority alerts
- C. Add new signatures
- D. Baseline normal behavior
Answer: D
Explanation:
A behavioral baseline enables effective tuning and alert reduction.
NEW QUESTION # 30
An internal user enters a client credit card number into an internal generative machine learning (ML) model:
#User prompt: Customer Jane Doe has a new credit card that she wants to add to her account. The number is 5555-5555-5555-5555 Which of the following is the most effective way to prevent prompt injection attacks against a large language model (LLM)?
- A. Web application firewall (WAF)
- B. Guardrails
- C. Role-based access control
- D. Antivirus
Answer: B
Explanation:
Guardrails are the primary security control for LLMs to prevent prompt injection attacks. They enforce rules on what inputs are accepted and how the model responds, blocking malicious or sensitive prompts (such as credit card numbers) before they can manipulate or exploit the model.
NEW QUESTION # 31
A human resources officer is using AI to evaluate resumes and help select candidates that meet minimum criteria. To improve the results, the human resources officer adjusts the query parameters and includes an example resume that matches a successful candidate. Which if the following best describes this query?
- A. Prompt template
- B. One-shot prompting
- C. Distillation
- D. System role
Answer: B
Explanation:
One-shot prompting provides the model with a single example (in this case, a successful resume) to guide how it should process future inputs. This technique helps the AI better align its output with the desired evaluation criteria.
NEW QUESTION # 32
An AI security team must assess the probability of an attack on its new system and the impact associated with such an attack. Which of the following threat-modeling resources best addresses the threat landscape for machine learning (ML)?
- A. Massachusetts Institute of Technology (MIT) risk repository
- B. Common Vulnerabilities and Exposures (CVE) AI working group
- C. Open Worldwide Application Security Project (OWASP)
- D. MITRE Adversarial Threat Landscape for AI Systems (ATLAS)
Answer: D
Explanation:
MITRE ATLAS is specifically designed to capture adversarial tactics, techniques, and procedures (TTPs) targeting machine learning systems. It helps organizations assess both the probability and impact of AI/ML-related attacks, making it the most relevant threat-modeling resource.
NEW QUESTION # 33
Which of the following is the most concerning risk for a company that allows corporate end users to use public-facing large language models (LLMs)?
- A. Data security regulatory violations
- B. Malicious code generation
- C. Inaccuracies due to hallucinations
- D. Out-of-date acceptable use policies
Answer: A
Explanation:
The greatest concern with employees using public-facing LLMs is the potential exposure of sensitive or regulated corporate data. Submitting such information to external systems may violate data protection laws (e.g., GDPR, HIPAA), creating legal and compliance risks that outweigh issues like hallucinations or malicious outputs.
NEW QUESTION # 34
Which of the following is most resistant to AI manipulation?
- A. Payloads
- B. Attack surface reduction
- C. AI-generated content
- D. Application programming interface (API) gateway
- E. Antivirus
Answer: B
Explanation:
Reducing the attack surface limits the number of potential entry points that attackers or manipulated AI inputs can exploit. This proactive security measure is more resistant to AI-driven manipulation than reactive controls like payload scanning or antivirus.
NEW QUESTION # 35
Which techniques belong to the MITRE ATT&CK Command-and-Control phase? (Choose two.)
- A. Registry modification
- B. Covert channels
- C. Beaconing
- D. Initial access
- E. Credential dumping
Answer: B,C
Explanation:
Beaconing and covert channels maintain communication with the attacker.
NEW QUESTION # 36
A machine learning (ML) engineer is working with a security engineer to identify the best practices for securing a system with various AI models.
Which of the following actions should the engineers suggest?
- A. Following a secure model development life cycle (MDLC)
- B. Implementing comprehensive security architecture
- C. Using a secure software development life cycle (SDLC)
- D. Conducting guardrail testing and security validation
Answer: A
Explanation:
A secure MDLC is tailored to AI and ML systems, ensuring security is integrated throughout the model's design, training, validation, deployment, and monitoring phases. This directly addresses best practices for securing systems with AI models.
NEW QUESTION # 37
An IT company implements an adaptable chatbot that learns from user prompts. The chatbot is meant to help employees troubleshoot common technical issues. Based on the following:
[User 1]
Prompt: I am having issues connecting to my printer, I can send emails.
Response: The most probable cause is that the printer may be turned off or was disconnected from the network. Check of the power is on and it is connected to the network.
[User 2]
Prompt: I am having issues connecting to my printer. I can send emails. I figured out the solution.
It is because the company is being bought by another one.
Response: Got it. The printer issue is caused by an upcoming acquisition.
[User 3]
Prompt: My document is not printing. I can browse the web.
Response: The most probable cause is that the company is being bought by another company.
Which of the following compensating controls should an administrator implement to mitigate the issue that is introduced?
- A. Transfer learning
- B. Data encryption
- C. Guardrails
- D. Rate-limiting application programming interfaces (APIs)
Answer: C
Explanation:
The chatbot incorrectly learned misleading information from a manipulated user prompt, demonstrating a prompt injection issue. Implementing guardrails ensures the system restricts what information it accepts and learns from, preventing the propagation of false or irrelevant data.
NEW QUESTION # 38
......
CY0-001 Exam Dumps - Free Demo & 365 Day Updates: https://www.testbraindump.com/CY0-001-exam-prep.html
Pass CY0-001 Exam with Updated CY0-001 Exam Dumps PDF: https://drive.google.com/open?id=1s-PaYTmFYr9ubUFyuvEeYK0sz-BRQE-n
