SecAI+ Secure AI Development and MLSecOps 2

Question 1

What is 'model stealing' in the context of AI security?

Accepted Answer

Reconstructing a proprietary model by querying its API and training on the responses

Answer

Model stealing involves querying a target model's API to collect input-output pairs, then training a surrogate model that functionally approximates the original without access to its weights or training data.

Question 2

Which security principle governs limiting model and service access to only what is necessary for each role?

Accepted Answer

Least privilege

Answer

The least privilege principle ensures models, users, and system components hold only the minimum access necessary, minimizing the blast radius if any component is compromised.

Question 3

What is the primary supply chain security concern when using open-source pre-trained models?

Accepted Answer

They may contain backdoors, malicious code, or poisoned weights from the source

Answer

Open-source pre-trained models may have been intentionally tampered with to include backdoors or poisoned behaviors, representing a supply chain risk analogous to malicious packages in traditional software.

Question 4

Which technique is most effective for detecting unauthorized modifications to a deployed ML model?

Accepted Answer

Model integrity monitoring using cryptographic checksums of model artifacts

Answer

Cryptographic checksums allow security teams to detect any unauthorized modification to model weights or configuration after deployment, similar to file integrity monitoring in traditional security.

Question 5

What is 'shadow mode' deployment in ML operations and why is it used?

Accepted Answer

Running a new model in parallel with production without affecting live outputs

Answer

Shadow mode runs a candidate model alongside the production model, processing identical inputs but not serving its outputs to users, enabling safe validation of security and accuracy before full rollout.

CompTIA SecAI+ Practice Test

CompTIA SecAI+ Practice Test

SecAI+ Secure AI Development and MLSecOps 2