AI0-001 Practice Test 40 — 15 Questions

Question 1

A security team is auditing an AI system and identifies risks related to the OWASP LLM Top 10. Which TWO risks are directly associated with data handling and privacy? (Select two.)

Accepted Answer

Training data poisoning. Option D (Training data poisoning) is correct because it directly concerns the integrity of the data used to train or fine-tune an LLM: attackers can inject malicious or manipulated samples into the training corpus, corrupting model behavior and compromising the confidentiality, integrity, and trustworthiness of the underlying data pipeline. Option E (Sensitive information disclosure) is correct because it is the OWASP LLM Top 10 risk specifically covering leakage of PII, credentials, proprietary text, or other private data through model outputs, often due to memorization of training data, inadequate output filtering, or prompt-based extraction. The other options do not belong: A (Supply chain vulnerabilities) targets third-party models, datasets, and dependencies rather than data privacy itself; B (Model denial of service) is an availability/resource-exhaustion risk; and C (Overreliance) is a human-factors risk of trusting incorrect model output, not a data-handling or privacy issue.

Answer

Supply chain vulnerabilities

Answer

Model denial of service

Answer

Overreliance

Question 2

A financial services company trains a gradient-boosted classification model on a dataset that includes customer account balances. The security team wants to limit how much any single customer's balance can influence the model's learned parameters, because an attacker who obtains the trained model could otherwise probe it to recover specific training values. Which technique should they apply during training to cap the influence of individual records?

Accepted Answer

Apply differential privacy with a bounded per-record gradient clipping norm and calibrated noise.. Differential privacy with per-record gradient clipping and calibrated noise is the only listed technique that formally bounds how much any single training record can change the model's parameters. That bound is what prevents an attacker with access to the trained model from reliably reconstructing or confirming individual customer balances, whereas hashing, regularization, and at-rest encryption leave the influence of individual records unbounded.

Answer

Increase the model's L2 regularization coefficient until training accuracy drops significantly.

Answer

Hash each customer account balance with SHA-256 before feeding it to the training pipeline.

Answer

Encrypt the model artifacts at rest with a customer-managed key in the cloud KMS.

Question 3

Based on the exhibit, what is the most likely issue with the model training?

Accepted Answer

Overfitting. The exhibit shows training loss decreasing while validation loss increases after a certain point, which is a classic sign of overfitting. The model is memorizing the training data rather than generalizing, leading to poor performance on unseen validation data.

Answer

Vanishing gradient

Answer

Learning rate too high

Answer

Underfitting

Question 4

An organization is planning to fine-tune an open-source LLM for internal use. To secure the supply chain, which TWO steps should they take before using the base model? (Select two.)

Accepted Answer

Verify the model's provenance and checksums. Option B is correct because verifying the model's provenance and checksums confirms that the base model was obtained from a trusted source and has not been tampered with or substituted during download, which is a foundational supply-chain control. Option C is correct because pre-trained models can contain hidden backdoors or malicious behaviors (e.g., triggered outputs or poisoned weights), so vetting the model before fine-tuning helps detect such threats prior to integrating it into internal systems. Option A is not appropriate because retraining from scratch is prohibitively expensive and unnecessary for supply-chain security. Option D is a runtime monitoring control that occurs after deployment, not a pre-use supply-chain step. Option E is incorrect because fine-tuning on sensitive internal data increases risk and does not secure the base model's supply chain.

Answer

Retrain the model from scratch

Answer

Set up audit logging of all interactions

Answer

Fine-tune the model on sensitive internal data

Question 5

An ML team wants to prevent attackers from stealing a proprietary model by repeatedly querying the public API. Which defense is most effective?

Accepted Answer

Rate limiting on the API endpoint. Rate limiting restricts the number of API requests a single client can make within a given time window, directly impeding an attacker's ability to collect enough query-response pairs to reconstruct or steal the model. This defense targets the attack vector itself—repeated queries—without degrading model performance for legitimate users. Techniques like token bucket or sliding window rate limiting are commonly implemented at the API gateway level.

Answer

Using a smaller model to reduce query cost

Answer

Encrypting model weights at rest

Answer

Adding random noise to all outputs

Question 6

A security analyst notices that an LLM-based code assistant sometimes generates code snippets that appear to have been copied from its training data, including comments containing internal company names. Which type of attack could this inadvertently expose?

Accepted Answer

Model inversion. The LLM inadvertently reproducing verbatim training data, including internal company names, is a classic symptom of a model inversion attack. In this context, model inversion refers to an adversary extracting sensitive training data (e.g., proprietary code or comments) from the model's parameters by crafting prompts that cause the model to regurgitate memorized examples. This exposes confidential information that was never intended to be revealed, directly violating data confidentiality.

Answer

Model denial of service

Answer

Data poisoning

Answer

Prompt injection

Question 7

A company is deploying an AI system that falls under the EU AI Act's high-risk category. Which THREE requirements must the company fulfill?

Accepted Answer

Ensure human oversight to prevent or minimise risks. The EU AI Act for high-risk systems requires risk management, human oversight, and transparency documentation. Open-sourcing the model is not required; obtaining consent is not a specific requirement for high-risk systems.

Answer

Obtain explicit consent from all affected individuals

Answer

Open-source the model's code to the public

Question 8

A company is fine-tuning a pre-trained open-source model for a sensitive application. They want to detect if the model contains a backdoor inserted by the original developers. Which supply chain security measure is most directly applicable?

Accepted Answer

Create a software bill of materials (SBOM) for the model and its dependencies. A Software Bill of Materials (SBOM) for the model and its dependencies provides a formal, machine-readable inventory of all components, including the base model, training data sources, and third-party libraries. This allows the security team to trace the provenance of each component and identify known vulnerabilities or suspicious artifacts that could indicate a backdoor inserted by the original developers. SBOMs are a key supply chain security measure recommended by frameworks like NIST SP 800-161 and are directly applicable to detecting unauthorized modifications in pre-trained models.

Answer

Apply input validation and sanitization techniques

Answer

Use homomorphic encryption for model weights

Answer

Implement differential privacy during fine-tuning

Question 9

A manufacturing company uses a predictive maintenance AI system to schedule equipment repairs. The system was trained on sensor data from machinery. Recently, the system has been missing failures, leading to unexpected downtime. An investigation reveals that the sensor data from one plant has been corrupted due to a sensor malfunction. The corrupted data was used in retraining. The company needs to restore system accuracy quickly. The data science team can access the training logs. What is the best course of action?

Accepted Answer

Roll back to the previous model version before the corrupt data was ingested, then clean the sensor data and retrain. Rolling back to the previous model version isolates the system from the corrupted sensor data that caused accuracy degradation. Cleaning the sensor data before retraining ensures the model learns from accurate patterns, restoring predictive maintenance reliability. This approach directly addresses the root cause—data corruption—without introducing new risks.

Answer

Switch to a simpler linear regression model that is less sensitive to data quality issues

Answer

Retrain the model using all available data, including the corrupted sensor data

Answer

Apply a weight to sensor data from that plant to reduce its influence

Question 10

A SOC analyst notices an unusually high number of model queries from a single API key, with inputs containing special characters and repeated prompt modifications. Which attack is MOST likely being attempted?

Accepted Answer

Jailbreaking. The high volume of queries with special characters and repeated prompt modifications is characteristic of jailbreaking attempts, where an attacker systematically probes the model for vulnerabilities to bypass safety guardrails. Unlike prompt injection, which typically involves a single crafted input, jailbreaking often involves iterative refinement of prompts to exploit model weaknesses.

Answer

Prompt injection

Answer

Model extraction

Answer

Membership inference

Question 11

Which OWASP LLM Top 10 category describes the risk when an LLM's output is not validated and leads to server-side request forgery or remote code execution?

Accepted Answer

Insecure output handling. Insecure output handling (D) is correct because it directly addresses the risk when an LLM's output is not validated or sanitized before being passed to downstream systems. This can lead to server-side request forgery (SSRF) if the output contains URLs that are fetched by the backend, or remote code execution (RCE) if the output is interpreted as code or commands. The OWASP LLM Top 10 defines this category as failing to properly handle model outputs, which can enable injection attacks beyond the LLM itself.

Answer

Model denial of service

Answer

Sensitive information disclosure

Answer

Prompt injection

Question 12

A healthcare AI startup is developing a model to predict patient readmission risk. The model will be used to allocate post-discharge resources. Which regulatory framework primarily governs the use of patient data in this scenario?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the correct regulatory framework because the scenario involves a healthcare AI startup using protected health information (PHI) to predict patient readmission risk. HIPAA governs the use, disclosure, and safeguarding of PHI by covered entities and their business associates, which includes AI models processing patient data for post-discharge resource allocation.

Answer

GDPR

Answer

CCPA

Answer

EU AI Act

Question 13

Which TWO are best practices for deploying AI models in a containerized production environment? (Select TWO.)

Accepted Answer

Use an orchestration platform like Kubernetes for scaling and health management. Option C is correct because Kubernetes (or a similar orchestrator) provides horizontal pod autoscaling, liveness/readiness probes, and rolling updates, which are essential for reliably scaling and health-managing AI inference services in production. Option D is correct because packaging the model together with its runtime dependencies (libraries, CUDA/cuDNN versions, Python packages) into a single immutable container image guarantees reproducible, portable deployments across environments. Option A is not a best practice because pulling the 'latest' tag yields non-deterministic, unreproducible builds and can silently introduce breaking changes; images should be pinned to immutable version or digest tags. Option B is not recommended because baking large model artifacts into the image bloats it, slows pulls, and forces a full image rebuild for every model update; models are better mounted from object storage or a model registry. Option E is not generally applicable since most AI/ML containers are Python-based rather than JVM-based, and heap tuning is workload-specific rather than a universal deployment best practice.

Answer

Always pull the latest image tag for automatic updates

Answer

Store model artifacts inside the container image for portability

Answer

Configure JVM heap arguments inside the container if using Java

Question 14

A data scientist wants to reduce the dimensionality of a dataset with 200 features before training a regression model. Which technique should they use?

Accepted Answer

PCA. PCA (Principal Component Analysis) is the correct technique because it is an unsupervised linear dimensionality reduction method that identifies the directions (principal components) of maximum variance in the data. For a dataset with 200 features, PCA can reduce dimensionality while preserving as much variance as possible, which is ideal before training a regression model to avoid overfitting and multicollinearity.

Answer

LDA

Answer

t-SNE

Answer

Autoencoder

Question 15

Which THREE of the following are types of machine learning paradigms? (Choose three.)

Accepted Answer

Reinforcement learning. Reinforcement learning is a correct machine learning paradigm where an agent learns to make decisions by interacting with an environment, receiving rewards or penalties based on its actions. This trial-and-error approach is distinct from supervised and unsupervised learning, as it focuses on maximizing cumulative reward through exploration and exploitation.

Answer

Gradient boosting

Answer

Quantum computing