Basic Concept: Class imbalance in training data - where some categories have significantly more examples than others - causes ML models to be biased toward the majority class, producing poor detection of minority class threats. Addressing this imbalance before training is critical for threat classification accuracy. CompTIA SecAI+ covers data preparation techniques under basic AI concepts.
Why B is Correct: Data augmentation addresses class imbalance by artificially increasing the number of training samples in under-represented classes. Techniques include oversampling minority classes by creating synthetic examples using methods like SMOTE (Synthetic Minority Over-sampling Technique), or undersampling majority classes. This balances label distribution and enables the model to learn decision boundaries that accurately classify all threat categories, not just the dominant ones.
Why A is Wrong: Data lineage documents the origin, movement, and transformation of data throughout its lifecycle. It provides traceability and auditability but does not address class imbalance in training data distribution.
Why C is Wrong: Data provenance records the history and context of data origins. Like lineage, it is a governance and tracking concept that does not alter data distribution for model training balance.
Why D is Wrong: Data verification confirms that data is correct and consistent with expected formats and values. It checks data quality and integrity but does not address the statistical distribution imbalance between threat classes in training datasets.

Basic Concept: AI chatbots that generate non-answers - responses that do not actually address user questions
- consume CPU resources for processing without delivering value. This can indicate the model is attempting to generate responses for queries outside its knowledge domain or confidence threshold. CompTIA SecAI+ Study Guide covers AI performance optimization and response quality management.
Why B is Correct: Implementing a response confidence level threshold allows the chatbot to recognize when it lacks sufficient confidence to provide a meaningful answer and respond accordingly, either with a helpful redirect or a clear indication that it cannot answer the query. This reduces the costly processing cycles spent generating poor-quality non-answers, lowers CPU utilization from failed response generation, and improves customer experience by setting appropriate expectations rather than returning unhelpful responses.
Why A is Wrong: Guardrails filter content for safety and policy compliance. They prevent harmful or out-of- policy responses but do not address the underlying issue of the model generating low-confidence non-answers to legitimate customer queries.
Why C is Wrong: Prompt logging records user inputs for analysis and auditing. While useful for identifying what types of questions cause non-answers, logging alone does not solve the problem or reduce CPU utilization from failed response generation.
Why D is Wrong: Cost monitoring tracks AI system expenditure. It can identify that costs are high due to excessive CPU usage but does not implement a solution to reduce the non-answer rate or improve response generation efficiency.

Segmentation isolates systems and limits lateral movement.

Basic Concept: When an AI fraud detection model produces false positives (blocking legitimate transactions), this indicates the model ' s decision boundary is insufficiently calibrated. The model needs improved training data to better distinguish fraudulent from legitimate transactions. CompTIA SecAI+ covers model performance improvement under AI-assisted security.
Why A is Correct: Retraining the model with more data and recent transaction patterns directly addresses the root cause of false positives. Additional representative legitimate transaction data helps the model learn more accurate decision boundaries, reducing false positives while maintaining detection sensitivity for actual fraud.
This improves model accuracy without abandoning AI-based detection.
Why B is Wrong: Token usage and rate limits are cost and resource management controls for LLM APIs.
They have no relevance to improving the accuracy of a fraud detection ML model that incorrectly classifies legitimate transactions.
Why C is Wrong: Encrypting data and applying access controls are data security measures that protect confidentiality and integrity. They do not address model classification accuracy or the false positive problem in fraud detection.
Why D is Wrong: Rolling back to a traditional system abandons the capabilities of AI-based fraud detection.
The appropriate response to model performance issues is to improve the model through retraining, not to regress to less capable detection approaches.

Basic Concept: AI agents in SOC environments can automate repetitive, rules-based response actions that previously required human intervention. When the primary concerns are enterprise uptime and case resolution time, the AI agent ' s ability to autonomously execute containment actions through SOAR is the most impactful application. CompTIA SecAI+ Study Guide covers AI agent use cases in security operations.
Why A is Correct: Using the AI agent to analyze incidents and execute containment actions through SOAR playbooks directly addresses both uptime and resolution time concerns. The agent can immediately analyze alert details, determine the appropriate playbook, and execute containment actions such as isolating compromised hosts or disabling compromised accounts autonomously, without waiting for human intervention. This dramatically reduces mean time to contain threats, improving both uptime and resolution speed.
Why B is Wrong: Enriching alerts with open-source intelligence improves analyst context but is a preparatory step rather than a response action. While valuable, it does not directly reduce resolution time by taking containment actions to stop ongoing threats.
Why C is Wrong: Aggregating metrics and generating leadership reports is an administrative function that consumes agent capacity for non-operational purposes. It improves visibility but does not directly improve uptime or case resolution time for active incidents.
Why D is Wrong: Creating tabletop exercises improves team preparedness over time through training scenarios. While beneficial for long-term capability development, it does not directly address the immediate concerns of enterprise uptime and active case resolution time.