Basic Concept: When an AI fraud detection model produces false positives (blocking legitimate transactions), this indicates the model ' s decision boundary is insufficiently calibrated. The model needs improved training data to better distinguish fraudulent from legitimate transactions. CompTIA SecAI+ covers model performance improvement under AI-assisted security.
Why A is Correct: Retraining the model with more data and recent transaction patterns directly addresses the root cause of false positives. Additional representative legitimate transaction data helps the model learn more accurate decision boundaries, reducing false positives while maintaining detection sensitivity for actual fraud.
This improves model accuracy without abandoning AI-based detection.
Why B is Wrong: Token usage and rate limits are cost and resource management controls for LLM APIs.
They have no relevance to improving the accuracy of a fraud detection ML model that incorrectly classifies legitimate transactions.
Why C is Wrong: Encrypting data and applying access controls are data security measures that protect confidentiality and integrity. They do not address model classification accuracy or the false positive problem in fraud detection.
Why D is Wrong: Rolling back to a traditional system abandons the capabilities of AI-based fraud detection.
The appropriate response to model performance issues is to improve the model through retraining, not to regress to less capable detection approaches.

Basic Concept: When unauthorized changes to an ML training pipeline cause model degradation, the root cause is insufficient access control and change management around the pipeline. Preventing future occurrences requires implementing governance controls that ensure all pipeline changes are reviewed and approved before execution. CompTIA SecAI+ Study Guide covers MDLC change management controls.
Why B is Correct: Enabling human review and approval workflows in the repository creates a mandatory gate requiring authorized reviewers to examine and approve any changes to training pipeline code before they can be merged and executed. This prevents unauthorized modifications from reaching the pipeline by enforcing a review process where any suspicious or unauthorized changes will be caught and rejected before they affect model training and performance.
Why A is Wrong: Static code scanning analyzes code for vulnerabilities and coding standard violations.
While it improves code quality and security, it does not prevent unauthorized individuals from submitting and merging malicious changes to the pipeline without proper review.
Why C is Wrong: Retraining with more data and epochs addresses model performance restoration after the fact but does not prevent future unauthorized pipeline modifications. If the pipeline remains unprotected, the same attack could occur again on the new model.
Why D is Wrong: Keeping multiple model copies enables rapid restoration of a previous version when a deployed model is found to be compromised. While useful for recovery, it is a reactive measure that does not prevent unauthorized pipeline changes from occurring and affecting future model training.

Basic Concept: User account credentials stored in a database must be protected against unauthorized disclosure. The security of credentials at rest requires cryptographic controls that prevent even database administrators or attackers with database access from reading plaintext passwords. CompTIA SecAI+ Study Guide covers credential security controls as part of AI application security.
Why C is Correct: Implementing hashing and encryption for credential protection is the industry-standard approach. Passwords should be hashed using strong, slow algorithms such as bcrypt, Argon2, or scrypt with unique salts, making them computationally infeasible to reverse even if the database is compromised.
Additional sensitive credential data can be encrypted. Together, hashing and encryption ensure that account credentials remain protected even if the underlying storage is accessed by unauthorized parties.
Why A is Wrong: Patching the model with new datasets updates the AI model ' s training data and knowledge. It does not address the security of user account credentials stored in the application ' s authentication database.
Why B is Wrong: Updating Linux and virtual server software patches system vulnerabilities and is important for overall security hygiene. However, it does not implement specific protections for the account credentials themselves stored in the application database.
Why D is Wrong: Deploying an authenticated API requires users to authenticate to use the API, improving access control. While this complements credential security, it does not protect the storage of credentials at rest and does not replace hashing and encryption of the credential values themselves.

Basic Concept: Monitoring an AI system ' s internal runtime behavior requires deep observability into what the system is doing at the code and function execution level, not just at the perimeter. CompTIA SecAI+ Study Guide addresses AI system observability and runtime monitoring under securing AI infrastructure.
Why D is Correct: Enabling stack call and debugging level traces at the function level provides the highest granularity of visibility into internal operations. This approach exposes what functions are called, in what order, with what inputs, and what is returned, offering genuine insight into the AI system ' s internal activity at runtime precisely as the engineer requires.
Why A is Wrong: A SIEM aggregates and correlates log and event data from multiple sources. While useful for security alerting, it does not inherently provide visibility into internal function-level operations of an AI model at runtime.
Why B is Wrong: A WAF with header logging monitors and filters HTTP traffic at the application boundary.
It captures external request and response data, not the AI system ' s internal runtime mechanics.
Why C is Wrong: Relying on vendor controls and monitoring prompt inputs is a passive, externally-focused approach. It provides no visibility into intermediate computations or internal operations within the AI model itself.

Basic Concept: When a chatbot leaks PII from one user ' s conversation into another user ' s responses, the root cause is cross-user memory contamination - the chatbot is retaining and sharing conversation context across user sessions. Disabling the memory feature stops the active data leakage immediately. CompTIA SecAI+ Study Guide covers session memory management as a privacy control for AI chatbots.
Why B is Correct: Disabling memory from chat history for all users immediately stops the mechanism causing PII leakage between users. If the chatbot retains no cross-session memory, it cannot include information from one user ' s conversation in another user ' s response. This is the most direct, immediate corrective action that eliminates the root cause of the privacy violation without requiring additional user behavior changes or service disruption.
Why A is Wrong: Taking the chatbot offline and restoring from backup is a drastic action appropriate when the issue requires investigating a potential compromise or data breach. For a configuration issue such as cross- user memory sharing, disabling the memory feature is a more targeted and proportionate first response that addresses the root cause directly.
Why C is Wrong: Asking users to refrain from using PII relies on voluntary user behavior change and does not address the technical root cause. Users may not comply, and even if they do, previously stored PII in memory would continue to leak. This is an ineffective first corrective action.
Why D is Wrong: Requiring users to label sensitivity does not stop the chatbot from storing and sharing PII that has already been submitted. Labels inform the system about data sensitivity but do not prevent the memory mechanism from sharing labeled sensitive data across user sessions.