AI0-001 AI Security Practice Question
A large enterprise is developing an internal LLM-powered assistant that can access the internet and execute code. To mitigate risks from excessive agency (e.g., the model performing unauthorized actions), which THREE security measures should be implemented?
⚠ Common exam trap
The AI0-001 exam often tests the distinction between detection controls (like monitoring) and prevention controls (like human approval), leading candidates to select monitoring as a security measure for excessive agency when it only provides visibility, not restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require human-in-the-loop approval for code execution and write operations
Requiring human-in-the-loop approval for code execution and write operations directly enforces a control over the model's agency, preventing it from performing unauthorized actions such as modifying files or executing arbitrary commands. This measure ensures that any action with side effects is vetted by a human operator, mitigating the risk of excessive agency where the LLM could autonomously cause harm.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy monitoring for anomalous input patterns
Why it's wrong here
Monitoring detects attacks but does not prevent the model from performing excessive actions; it is a detective control, not a preventative one.
- ✓
Require human-in-the-loop approval for code execution and write operations
Why this is correct
Human approval for high-risk actions prevents the model from autonomously performing destructive or unauthorized operations.
- ✓
Use least-privilege API tokens for external tool access
Why this is correct
Least-privilege tokens ensure the model can only perform actions necessary for its function, limiting the potential damage of an unintended action.
- ✓
Implement input validation and sanitization to prevent prompt injection
Why this is correct
Input validation and sanitization reduce the risk of attackers injecting instructions that cause the model to take unintended actions, which can lead to excessive agency.
- ✗
Apply output filtering to block sensitive data in responses
Why it's wrong here
Output filtering prevents data leakage but does not directly mitigate the risk of the model taking unauthorized actions (excessive agency).
About these practice questions
Courseiva writes every AI0-001 question from scratch — 754 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.