Last-minute reference for CY0-001. Securing AI systems is 40% of the exam, and the right answer removes an attack’s mechanism rather than merely detecting it.
Exam facts
Duration
60 minutes
Questions
Max 60
Passing score
600 / 900
Launched
February 2026
Price
Not published by CompTIA; varies by region
Domain weights
Domain
Weight
Securing AI systems
40%
AI-assisted security
24%
AI governance, risk, and compliance
19%
Basic AI concepts related to cybersecurity
17%
Attack names
Attack
What it is
Prompt injection
Instructions smuggled into input; indirect arrives via retrieved content
Jailbreaking
Phrasing that circumvents guardrails
Data poisoning
Corrupting training data to plant behaviour
Model extraction
Many crafted queries to replicate the model
Membership inference
Determining whether a record was in training data
Adversarial evasion
Crafted input that defeats detection at inference
Denial of wallet
Expensive requests flooding a paid endpoint
Attack to control
Attack
Control that removes the mechanism
Indirect prompt injection
Isolate retrieved content from the instruction channel
Model extraction
Rate limiting, quotas, restrict output richness
Data poisoning
Provenance checks and validation of contributed data
Excessive agent damage
Least-privilege tool scoping + confirmation on destructive actions
Secret disclosure
Keep secrets outside the model’s reach entirely
Denial of wallet
Rate limits, input size caps, per-tenant quotas
Weight theft in use
Confidential computing
Governance essentials
Inventory first — owner, purpose, risk classification. Nothing else works without it.
Assess before deployment and on a schedule, not once.
The deploying organisation is accountable, regardless of who built the model.
Traps
Filtering keywords is not the fix for prompt injection; isolation is.
Instructing the model not to reveal secrets is not a control.
Auto-closing alerts hides false negatives — sample and review closures.
Output-only filtering leaves malicious input reaching the model, which may drive harmful tool use before any output exists.
This is not an entry point into security. It assumes the fundamentals.