Basic Concept: DoS attacks overwhelm AI systems by sending excessive requests that exhaust computational resources, memory, or bandwidth, preventing legitimate users from being served. The primary defense against volume-based attacks is throttling the rate at which requests can be processed. CompTIA SecAI+ Exam Objectives identify rate limiting as the key DoS mitigation control for AI systems.
Why B is Correct: Rate limiting directly addresses the root mechanism of DoS attacks by restricting the number of requests any single client or IP address can submit within a defined time window. By enforcing request quotas, rate limiting prevents attackers from generating the request volume necessary to overwhelm the system while preserving capacity for legitimate users. It is the most direct and effective preventive control against DoS attacks on AI APIs and services.
Why A is Wrong: Model guardrails inspect and filter the content of prompts and responses for policy compliance and safety. They operate at the semantic content level, not at the request volume level, and cannot prevent resource exhaustion from high-volume request flooding.
Why C is Wrong: End-to-end encryption protects the confidentiality and integrity of data in transit. Encrypted DoS traffic is just as damaging as unencrypted traffic; encryption does not limit request rates or prevent resource exhaustion.
Why D is Wrong: Access controls restrict who can interact with the system, which can reduce the potential attacker pool. However, authenticated users and compromised accounts can still launch DoS attacks, and access controls alone cannot prevent high-volume attacks from authorized sources.

Basic Concept: Responsible AI encompasses a set of principles designed to ensure AI systems operate ethically, fairly, and accountably. These principles guide AI development and deployment to minimize harm and maximize trustworthiness. CompTIA SecAI+ Exam Objectives list transparency and explainability as foundational responsible AI principles under Domain 4.
Why B is Correct: Transparency and explainability are cornerstone principles of responsible AI. Transparency means AI systems are open about their nature, capabilities, limitations, and how they make decisions.
Explainability means the system can articulate the reasons behind its decisions in human-understandable terms. Together, they enable accountability, support regulatory compliance, allow bias detection, and build user trust. The CompTIA SecAI+ Study Guide and responsible AI frameworks including OECD and NIST AI RMF consistently identify this as a key principle.
Why A is Wrong: Using protected data for training would violate privacy and intellectual property rights.
This is not a responsible AI principle - responsible AI actually requires ensuring that training data respects privacy, consent, and legal protections.
Why C is Wrong: Human-in-the-loop is an important operational practice for high-stakes AI decisions, but it is one design pattern rather than the key overarching principle of responsible AI. Not all responsible AI systems require human-in-the-loop operation for every decision.
Why D is Wrong: Maximizing model security is a cybersecurity objective for AI systems. While important, it is an operational security concern rather than a responsible AI governance principle focused on fairness, accountability, and trustworthiness in AI decision-making.

Following a secure and structured model development life cycle (MDLC) ensures controls such as data validation, verification, and testing are in place. This prevents issues like retraining on unverified data and reduces the likelihood of future model errors.

This approach balances automation and human oversight. AI accelerates vulnerability management by triaging issues and generating tickets, while software engineers retain responsibility for merging code changes, ensuring quality and reducing the risk of insecure or unstable code being deployed.

Basic Concept: Managing security risks in AI model training requires a comprehensive framework specifically designed for AI risk identification, assessment, and mitigation across the entire AI lifecycle including data collection, training, and deployment. CompTIA SecAI+ Study Guide identifies NIST AI RMF as the primary resource for AI-specific risk management.
Why A is Correct: The NIST AI Risk Management Framework is purpose-built for managing risks throughout the AI lifecycle. It provides structured guidance for identifying, assessing, and mitigating risks specific to AI systems including training data quality, model bias, data poisoning, and training pipeline vulnerabilities. Its AI-specific scope makes it the most appropriate framework for managing model training security issues.
Why B is Wrong: ISO 27001 is an information security management system standard focused on general IT security controls and risk management. It does not specifically address AI model training risks, data pipeline integrity, or ML-specific vulnerabilities.
Why C is Wrong: The OECD provides high-level AI governance principles and policy recommendations at an international level. It offers ethical and policy guidance but does not provide operational risk management guidance for securing AI model training processes.
Why D is Wrong: GDPR is a European data protection regulation focused on personal data privacy, consent, and individual rights. While relevant to training data governance, it does not address the technical security risks of model training pipelines or ML system vulnerabilities.