AI0-001 AI Security Practice Question
During a security audit of an AI system, the auditor applies the STRIDE threat model. Which threat category is MOST relevant to an attacker manipulating the training data to cause the model to misbehave on specific inputs?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tampering
Tampering refers to unauthorized modification of data or code. Data poisoning is a form of tampering with the training dataset.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spoofing
Why it's wrong here
Spoofing concerns impersonating a legitimate user, service or component to gain trust, such as forging credentials or API identities. Poisoning training data modifies the model's learned behaviour rather than assuming another entity's identity, so it falls under tampering instead.
- ✗
Repudiation
Why it's wrong here
Repudiation concerns denying that an action occurred, typically where logging or non-repudiation controls are absent. Manipulating training data is an integrity attack on the model's inputs, classified as tampering; repudiation would apply if an actor could deny having submitted or altered that data.
- ✗
Information disclosure
Why it's wrong here
Information disclosure covers unauthorised exposure of data the system holds, such as leaking training records or model internals. Tampering with training data to alter predictions is data or model poisoning, which STRIDE classifies as tampering, since it is unauthorised modification rather than disclosure.
- ✓
Tampering
Why this is correct
Tampering covers unauthorised modification of data or systems, and poisoning training data is precisely that: altering the data pipeline so the model learns corrupted mappings. It satisfies the stem's constraint of manipulating training data, unlike Spoofing (identity), Repudiation (deniability), Information Disclosure (exposure), Denial of Service (availability), or Elevation of Privilege (authorisation).
About these practice questions
Courseiva writes every AI0-001 question from scratch — 962 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.