MITRE ATLAS is specifically designed to catalog adversarial TTPs targeting AI systems. By analyzing ATLAS, the architect can determine which types of attacks are possible against the AI system, making it the most appropriate resource for threat modeling in this context.

For runtime visibility into internal activity of an AI system, the most suitable control is enabling stack calls and debugging-level traces. This provides granular insights into function-level execution, dependencies, and operations, which directly supports monitoring of runtime behavior.

Implementing a response confidence level ensures the chatbot only provides answers when the model is sufficiently confident. This reduces irrelevant or empty responses, improving user experience and lowering unnecessary CPU utilization.

Basic Concept: When an AI chatbot powered by RAG retrieves and outputs sensitive patient information such as names, medical histories, or identifiers, the risk of Protected Health Information (PHI) disclosure must be mitigated. CompTIA SecAI+ Study Guide covers data protection techniques for AI systems handling sensitive health data.
Why A is Correct: Masking replaces sensitive data values such as patient names, dates of birth, medical record numbers, and diagnoses with redacted or anonymized equivalents in the chatbot ' s output. Even if the RAG system retrieves records containing patient information, masking ensures that the sensitive fields are obscured before the response is presented to the user. This directly prevents PHI disclosure while allowing the chatbot to provide useful responses based on the underlying data patterns.
Why B is Wrong: Classification involves categorizing data by its sensitivity level such as public, internal, confidential, or restricted. While it identifies which data requires protection, classification alone does not transform or obscure the sensitive values in chatbot outputs.
Why C is Wrong: Data minimization is a privacy principle that limits data collection to only what is necessary for the specified purpose. While valuable as a design principle when building the RAG knowledge base, it is a data governance strategy rather than a technical output control that can be applied to mitigate existing PHI disclosure in chatbot responses.
Why D is Wrong: Normalization is a data processing technique that scales numerical values to a standard range or standardizes data formats. It is a preprocessing step for improving model training efficiency, not a data protection technique for preventing patient information disclosure in AI outputs.

Explanation:
Part 1 - Select the protocol or cipher
System component
Select
API gateway
TLS 1.2
Database storage
CAMELLIA
AI model storage
HMAC-SHA512
Part 2 - Select the data-protection technique
Enter the techniques from the first row to the fifth row in this exact order:
Row Data modification Select
1 The name field is removed, while patient_id and dob remain De-identification
2 ip_addr and name are removed, leaving cookie and uid Anonymization
3 The card number is replaced by 0x0193828829 Tokenization
4 sensitivity: " SECRET " is added Classification
5 Part of the PIN is replaced by XXXX Masking
See Explanation
Why these are the intended answers
API gateway # TLS 1.2
The API gateway handles data moving between the client and backend systems. TLS is the only listed transport-security protocol and therefore protects the data in transit . OWASP recommends encrypting sensitive data in transit by using TLS with secure parameters.
Database storage # CAMELLIA
CAMELLIA is a symmetric block cipher suitable for encrypting substantial quantities of stored data. It is therefore the valid storage-encryption choice among the listed options.
Do not select AES-512 . AES-512 is not a standardized AES variant. NIST defines only AES-128, AES-192, and AES-256 .
AI model storage # HMAC-SHA512
The scenario separately emphasizes protection against loss or modification of intellectual property. HMAC- SHA512 supplies message authentication and integrity verification, allowing unauthorized modification of the AI model to be detected. HMAC is not confidentiality encryption, but it is the most appropriate listed additional control for protecting model integrity. OWASP specifically identifies HMACs as cryptographic controls for stored-data integrity.
Why the other options are not selected
* SHA-2 512: Hashing only; no secret key and no encryption.
* Elliptical curve: A family of cryptographic techniques, not a specific storage or transport protocol.
* ECDH: Used for key agreement, not direct bulk-data encryption.
* AES-512: Invalid AES key size.
* RSA-2048: Primarily used for asymmetric encryption, signatures, or key transport; inefficient for bulk database or model encryption.
* CAMELLIA: Appropriate symmetric encryption for stored data.
* HMAC-SHA512: Integrity and authenticity, not confidentiality.
Final Part 2 order
* De-identification
* Anonymization
* Tokenization
* Classification
* Masking
Explanation:
De-identification removes an explicitly identifying field-in this case, the person's name-while retaining other fields needed for processing. The remaining patient ID and date of birth could potentially permit re- identification when combined with other information, so this is de-identification rather than complete anonymization. OWASP describes de-identification as deleting, scrambling, or pseudonymizing direct and indirect identifiers.
Anonymization removes identifying attributes so that the displayed record is not directly tied to the named individual. Here, both the name and IP address are removed.
Tokenization substitutes a sensitive value with a non-sensitive representative token. The original payment- card number is replaced with the hexadecimal-style value 0x0193828829. OWASP recognizes tokenization as a method for reducing exposure of stored sensitive data.
Classification labels information according to sensitivity. Adding sensitivity: " SECRET " does not conceal or transform the PIN; it categorizes the record so appropriate controls can be applied. OWASP recommends classifying processed, stored, and transmitted data and applying controls based on that classification.
Masking obscures only part of a sensitive value while preserving its general format. Changing 999-99-9999 to 999-99-XXXX is partial masking.