CompTIA SecAI+ 4.0 AI Governance, Risk, and Compliance Practice Questions

Question 1

Which of the following is a risk associated with 'Shadow AI'?

Accepted Answer

Employees using unsanctioned public AI tools with corporate data

Answer

Increased cost of official API usage

Answer

Slower model training times due to lack of GPU resources

Answer

Excessive logging of user prompts

Question 2

What is the primary function of an 'AI Center of Excellence' (CoE) within an organization?

Accepted Answer

To centralize AI governance, policies, and best practices

Answer

To manually review every prompt sent to an AI

Answer

To develop proprietary graphics processing units (GPUs)

Answer

To block all AI traffic at the firewall

Question 3

Which emerging compliance framework categorizes AI systems based on risk levels (e.g., Unacceptable, High, Limited, Minimal)?

Accepted Answer

EU AI Act

Answer

GDPR

Answer

PCI DSS

Answer

HIPAA

Question 4

A security analyst observes that an AI model is consistently recommending higher loan interest rates for a specific demographic group despite equal financial qualifications. This is an example of:

Accepted Answer

AI Bias

Answer

Model drift

Answer

Model inversion

Answer

Overfitting

Question 5

Which of the following is a key component of the NIST AI Risk Management Framework (AI RMF)?

Accepted Answer

Map, Measure, Manage, Govern

Answer

Identify, Protect, Detect, Respond, Recover

Answer

Plan, Do, Check, Act

Answer

Reconnaissance, Weaponization, Delivery, Exploitation

Question 6

What is the primary risk of 'Data Leakage' when using public Large Language Models (LLMs)?

Accepted Answer

Proprietary data entered as prompts may be used to train future versions of the model

Answer

The model will become too slow

Answer

The internet connection will be saturated

Answer

The model will delete the data after processing

Question 7

Which role is primarily responsible for ensuring that AI models are developed, deployed, and maintained efficiently and reliably (DevOps for AI)?

Accepted Answer

MLOps Engineer

Answer

AI Ethicist

Answer

Legal Counsel

Answer

UI Designer

Question 8

What is the concept of 'Explainability' (XAI) in AI governance?

Accepted Answer

The ability to understand and interpret how an AI model arrived at a specific decision

Answer

The ability of the AI to speak multiple languages

Answer

The speed at which the AI processes data

Answer

The cost of the AI infrastructure

Question 9

In the context of GRC, what does 'Data Sovereignty' imply for AI model deployment?

Accepted Answer

Data must be stored and processed within the borders of the country where the data originated

Answer

Data belongs to the AI model creator

Answer

Data must be shared with the public

Answer

Data must be encrypted using 512-bit keys

Question 10

Which governance artifact documents intended use, limitations, training data, and evaluation results for a model?

Accepted Answer

Model card

Answer

Patch cable label

Answer

DNS zone file only

Answer

Printer queue

Question 11

Which practice helps investigate AI decisions that affect security operations?

Accepted Answer

Logging prompts, tool calls, outputs, and model versions

Answer

Turning off all telemetry

Answer

Using shared administrator accounts

Answer

Deleting rejected outputs immediately

Question 12

Which concept means an AI system should provide understandable reasons or evidence for important outputs?

Accepted Answer

Explainability

Answer

Packet switching

Answer

Disk striping

Answer

Address translation

Question 13

Which process should approve high-impact AI use cases before deployment?

Accepted Answer

AI risk assessment and governance review

Answer

Untracked pilot release

Answer

Informal chat approval only

Answer

Skipping model evaluation

Question 14

Which AI evaluation checks whether protected groups receive unfairly different outcomes?

Accepted Answer

Bias and fairness testing

Answer

Packet capture

Answer

Disk benchmarking

Answer

DNS lookup

Question 15

Which protection reduces exposure of personal data before model training begins?

Accepted Answer

Data anonymization or minimization

Answer

Verbose debug logging

Answer

Public dataset upload

Answer

Hardcoded secrets

Question 16

Which logging practice helps reproduce an AI security incident?

Accepted Answer

Record model version, prompt, retrieved context, tool calls, and output

Answer

Log only the user first name

Answer

Delete all prompts immediately

Answer

Store secrets in logs

Question 17

Which process documents who owns an AI system and who approves major changes?

Accepted Answer

AI governance charter

Answer

DHCP scope

Answer

Firewall NAT table

Answer

Printer queue policy

Question 18

Which model documentation should list known limitations and inappropriate uses?

Accepted Answer

Model card

Answer

Switch port map

Answer

DNS cache

Answer

Patch panel label

Question 19

Which security concern applies when sending prompts to a third-party AI service?

Accepted Answer

Sensitive data disclosure

Answer

Local printer jam

Answer

Cable bend radius only

Answer

Monitor resolution

CompTIA SecAI+ Practice Questions: 4.0 AI Governance, Risk, and Compliance

Q1. Which of the following is a risk associated with 'Shadow AI'?

Q2. What is the primary function of an 'AI Center of Excellence' (CoE) within an organization?

Q3. Which emerging compliance framework categorizes AI systems based on risk levels (e.g., Unacceptable, High, Limited, Minimal)?

Q4. A security analyst observes that an AI model is consistently recommending higher loan interest rates for a specific demographic group despite equal financial qualifications. This is an example of:

Q5. Which of the following is a key component of the NIST AI Risk Management Framework (AI RMF)?

Q6. What is the primary risk of 'Data Leakage' when using public Large Language Models (LLMs)?

Q7. Which role is primarily responsible for ensuring that AI models are developed, deployed, and maintained efficiently and reliably (DevOps for AI)?

Q8. What is the concept of 'Explainability' (XAI) in AI governance?

Q9. In the context of GRC, what does 'Data Sovereignty' imply for AI model deployment?

Q10. Which governance artifact documents intended use, limitations, training data, and evaluation results for a model?

Q11. Which practice helps investigate AI decisions that affect security operations?

Q12. Which concept means an AI system should provide understandable reasons or evidence for important outputs?

Q13. Which process should approve high-impact AI use cases before deployment?

Q14. Which AI evaluation checks whether protected groups receive unfairly different outcomes?

Q15. Which protection reduces exposure of personal data before model training begins?

Q16. Which logging practice helps reproduce an AI security incident?

Q17. Which process documents who owns an AI system and who approves major changes?

Q18. Which model documentation should list known limitations and inappropriate uses?

Q19. Which security concern applies when sending prompts to a third-party AI service?

More CompTIA SecAI+ practice topics