A secure MDLC is tailored to AI and ML systems, ensuring security is integrated throughout the model's design, training, validation, deployment, and monitoring phases. This directly addresses best practices for securing systems with AI models.

Basic Concept: Before ingesting data from multiple sources - both structured and unstructured - into an AI- powered SIEM system, the data must be prepared to ensure quality, consistency, and usability. Data from diverse sources often contains noise, errors, duplicates, and formatting inconsistencies that will degrade AI performance if not addressed. CompTIA SecAI+ covers data preparation as a prerequisite for AI system effectiveness.
Why C is Correct: Data cleansing is the process of detecting and correcting or removing corrupt, inaccurate, incomplete, and duplicate data. Before collecting data from multiple structured and unstructured SIEM sources, engineers must cleanse the data to standardize formats, remove duplicates, fill missing values, and eliminate noise. Clean input data is fundamental to producing accurate AI-generated insights and reliable LLM interactions in the SIEM context.
Why A is Wrong: Balancing addresses class distribution imbalance in labeled training data for classification models. While relevant when training ML detection models, it is not the primary consideration before initial data collection from diverse SIEM sources.
Why B is Wrong: Verification confirms that data meets expected quality standards and validates its accuracy against trusted sources. It is a post-collection quality check performed after cleansing, not the first step before data collection.
Why D is Wrong: Vector storage refers to databases that store embeddings for semantic search, relevant for RAG systems. It is a storage architecture decision made after data is collected, processed, and prepared, not a pre-collection technique.

Explainability is the responsible AI principle that ensures AI systems can provide clear reasoning for their decisions, allowing users to understand how and why a particular conclusion was reached.

False positives occur when the AI model lacks sufficient or representative training data.
Retraining the model with more diverse and recent transaction patterns improves accuracy, reducing the chance of legitimate transactions being incorrectly flagged.

Validating and sanitizing user input is the core SQLi defense.