Basic Concept: AI manipulation attacks exploit vulnerabilities in systems, interfaces, and content. Some security approaches are inherently more resistant to AI-driven attacks because they reduce the available avenues through which manipulation can occur, rather than attempting to detect or block individual attacks.
CompTIA SecAI+ Study Guide covers defensive strategies for AI system protection.
Why D is Correct: Attack surface reduction minimizes the number of entry points, interfaces, and components available for exploitation. By eliminating unnecessary services, APIs, integrations, and features, it reduces the total number of pathways through which AI-driven manipulation attacks can be attempted. Unlike signature- based or behavioral detection, attack surface reduction provides structural resistance regardless of how sophisticated or novel the AI manipulation technique is.
Why A is Wrong: Payloads are the malicious content used in attacks, not a defensive control. Attackers using AI can generate increasingly sophisticated payloads designed to evade detection, making them highly susceptible to AI-driven manipulation rather than resistant to it.
Why B is Wrong: AI-generated content is a product of AI systems and can itself be manipulated or weaponized by adversarial AI. It is not a defense mechanism and is inherently vulnerable to AI-driven manipulation and poisoning.
Why C is Wrong: An API gateway provides a managed access point for API traffic with authentication and filtering capabilities. However, APIs are primary attack targets for AI manipulation and require ongoing security updates. API gateways are less fundamentally resistant than structural attack surface reduction.
Why E is Wrong: Antivirus relies on signatures and behavioral heuristics to detect known malware. AI- powered attacks can generate novel, polymorphic payloads that evade signature detection, making antivirus less resistant to AI manipulation than attack surface reduction.

Facial recognition uses neural networks to analyze multiple points or features from an input image (such as eyes, nose, mouth, and facial structure) to generate a unique identifier for authentication purposes.

Convolutional neural networks (CNNs) are highly effective at detecting patterns in unstructured data such as images, audio, or text embeddings. Their ability to automatically learn spatial or hierarchical features makes them the best choice for pattern recognition on unstructured datasets.

Since the requirement is to control which users or systems can list tables, the proper control lies at the data access level. Implementing data access controls ensures only authorized entities can view or query the underlying tables used by the AI system.

Basic Concept: Before implementing any security controls for an AI system, especially in a highly regulated sector such as healthcare, a risk assessment must first be conducted to understand the specific threats, vulnerabilities, regulatory obligations, and compliance requirements. CompTIA SecAI+ Study Guide emphasizes risk assessment as the foundational first step in any AI security program.
Why C is Correct: A risk assessment identifies what assets need protection, what threats exist, what regulations apply such as HIPAA for healthcare AI, and what the potential impact of various failure modes would be. In healthcare, this is especially critical given the sensitivity of patient records and strict regulatory requirements. The risk assessment results then inform and prioritize all subsequent security control implementations.
Why A is Wrong: Implementing prompt firewalls is a technical security control appropriate after risks have been identified and prioritized. Deploying controls before conducting a risk assessment may address the wrong threats or miss critical vulnerabilities.
Why B is Wrong: Role-based access management is a security control that should be designed based on identified roles and access requirements discovered during risk assessment. It is an implementation step, not the first step.
Why D is Wrong: Using a secure communication channel is a specific technical control for data in transit.
While important, it addresses only one specific risk and should be implemented as part of a comprehensive security strategy informed by a prior risk assessment.