Free CY0-001 practice test: 20 questions
Twenty questions across the four CY0-001 domains, weighted roughly as the real exam is. Securing AI systems carries the most weight, so it gets the most questions here.
Basic AI concepts related to cybersecurity
Question 1. Which characteristic of large language models most directly creates a new attack surface compared with traditional software?
- A. They are written in Python
- B. They require GPUs to run
- C. They do not cleanly separate instructions from data in their input
- D. They produce output as text
Show answer
Answer: C
LLMs do not separate instructions from data, so text that arrives as input can be interpreted as instruction. Traditional software keeps code and data distinct.
Question 2. What distinguishes a foundation model from a traditional classifier in a security context?
- A. Its general-purpose nature makes its behaviour harder to enumerate and test
- B. It cannot be attacked
- C. It never produces incorrect output
- D. It requires no monitoring
Show answer
Answer: A
A foundation model is general-purpose and adapted to many tasks, so its behaviour is far harder to enumerate and test exhaustively than a narrow classifier’s.
Question 3. An AI system's training data includes records scraped from the public internet. What is the primary security concern?
- A. It increases inference latency
- B. It raises storage costs
- C. It makes the model larger
- D. Data provenance cannot be verified and the data may be poisoned or unlawful
Show answer
Answer: D
Unvetted training data can be poisoned or contain malicious or licensed content, and its provenance cannot be verified after the fact.
Securing AI systems
Question 4. A chatbot retrieves web pages to answer questions. A page contains hidden text instructing the model to reveal its system prompt. What is this attack?
- A. Model inversion
- B. Indirect prompt injection
- C. Model extraction
- D. Denial of wallet
Show answer
Answer: B
Malicious instructions delivered through content the model processes is indirect prompt injection. Model inversion and extraction target training data and weights respectively.
Question 5. Which control most directly mitigates indirect prompt injection from retrieved content?
- A. Isolate retrieved content from the instruction channel and treat it as untrusted data
- B. Block the specific domain that hosted the payload
- C. Increase the model’s temperature
- D. Shorten the system prompt
Show answer
Answer: A
Treating retrieved content strictly as data, isolated from the instruction channel, removes the mechanism the attack relies on. Blocking one source does not generalise.
Question 6. An attacker submits thousands of crafted queries to reconstruct a proprietary model's behaviour. What is this called?
- A. Prompt injection
- B. Data poisoning
- C. Model extraction
- D. Jailbreaking
Show answer
Answer: C
Systematically querying a model to replicate it is model extraction or stealing. Rate limiting and output restriction are the usual mitigations.
Question 7. A supplier contributes labelled samples to a training set. Some are deliberately mislabelled to create a backdoor. What is this?
- A. Data poisoning
- B. Model inversion
- C. Prompt injection
- D. Adversarial evasion at inference
Show answer
Answer: A
Corrupting training data to influence model behaviour is data poisoning. It is countered by provenance checks and validation of contributed data.
Question 8. An agent has a tool that can delete records. What is the most important control before production?
- A. Logging every agent action
- B. A longer system prompt forbidding deletion
- C. A larger model
- D. Least-privilege tool scoping with confirmation required for destructive actions
Show answer
Answer: D
Constraining what the tool can do and requiring confirmation for destructive actions limits blast radius regardless of how the agent is manipulated. Logging alone records damage after the fact.
Question 9. Users discover a phrasing that makes a model ignore its safety instructions. What is this called?
- A. Data poisoning
- B. Jailbreaking
- C. Model extraction
- D. Membership inference
Show answer
Answer: B
Crafting input that circumvents a model’s guardrails is jailbreaking. Poisoning targets training data, and extraction targets the model itself.
Question 10. A model may have memorised personal records from training data. An attacker tests whether a specific person was in the training set. What is this attack?
- A. Prompt injection
- B. Model extraction
- C. Membership inference
- D. Adversarial evasion
Show answer
Answer: C
Determining whether a particular record was part of training is membership inference. It is a privacy attack rather than an availability or integrity one.
Question 11. Inference costs spike after an attacker floods an endpoint with expensive long-context requests. Which mitigation is most appropriate?
- A. Rate limiting, input size caps and per-tenant quotas
- B. Removing authentication to reduce overhead
- C. Increasing the context window
- D. Disabling logging to save storage
Show answer
Answer: A
Rate limiting combined with input size caps and per-tenant quotas directly limits cost exposure. Removing authentication would make it worse.
Question 12. Model weights for a proprietary model must be protected at rest and in use on shared infrastructure. Which control addresses the 'in use' part?
- A. Disk encryption
- B. TLS in transit
- C. Access logging
- D. Confidential computing with a hardware trusted execution environment
Show answer
Answer: D
Confidential computing protects data and weights during processing via hardware trusted execution environments. Disk encryption covers rest, and TLS covers transit.
Question 13. What is the most reliable way to prevent an LLM application from returning secrets held in its configuration?
- A. Instruct the model never to reveal secrets
- B. Keep secrets outside the model’s context and retrievable data entirely
- C. Set temperature to zero
- D. Use a smaller model
Show answer
Answer: B
Not placing secrets where the model can reach them removes the possibility entirely. Instructing the model not to reveal them is a request, not a control.
AI-assisted security
Question 14. An AI tool triages alerts and closes those it judges benign. What is the key risk to manage?
- A. Increased alert volume
- B. Higher storage costs
- C. False negatives closed without human review
- D. Slower triage
Show answer
Answer: C
Automatically closing alerts means false negatives are never reviewed, so real incidents disappear silently. Sampling and human review of closures mitigate this.
Question 15. An AI assistant drafts detection rules. What should happen before they reach production?
- A. Human review and testing against known good and bad data
- B. Direct deployment, with review if problems appear
- C. Deployment to production during a quiet period
- D. Acceptance if the model reports high confidence
Show answer
Answer: A
Peer review and testing against known data validate the rule before it affects detection. Deploying first and observing risks blind spots and alert storms.
Question 16. Which use of AI in a SOC carries the lowest risk while still adding value?
- A. Autonomously isolating hosts from the network
- B. Automatically closing alerts it rates benign
- C. Automatically blocking accounts it finds suspicious
- D. Summarising and enriching alert context for a human analyst
Show answer
Answer: D
Summarising and enriching evidence for a human analyst supports the decision without making it. Autonomous containment and closure remove the human from consequential actions.
Question 17. An AI model used for anomaly detection begins missing attacks that it caught six months ago. What should be investigated?
- A. The licence agreement
- B. Drift between current activity and the training baseline
- C. The colour of the dashboard
- D. The number of analysts on shift
Show answer
Answer: B
Drift between current traffic and the training baseline degrades detection over time, requiring retraining or recalibration. A licence change would not affect detection quality.
AI governance, risk, and compliance
Question 18. An organisation must know which AI systems it operates and who owns each. What should exist?
- A. An inventory of AI systems with owner, purpose and risk classification
- B. A list of GPU serial numbers
- C. A record of monthly inference costs
- D. A list of vendors’ marketing contacts
Show answer
Answer: A
An inventory of AI systems with owners, purpose and risk classification is the foundation of AI governance. Without it, no other control can be applied consistently.
Question 19. A high-risk AI system must be assessed before deployment and periodically afterwards. Which practice does this describe?
- A. A one-off penetration test
- B. A code review at release
- C. AI risk assessment before deployment and on a recurring schedule
- D. An annual vendor questionnaire
Show answer
Answer: C
An AI risk assessment performed pre-deployment and repeated on a schedule matches the requirement. Penetration testing and code review are narrower activities.
Question 20. A third-party model is embedded in a product sold to customers. Who is accountable for its behaviour in that product?
- A. The end user who typed the prompt
- B. The open-source community
- C. Nobody, because the model is third-party
- D. The organisation deploying the system to its customers
Show answer
Answer: D
The organisation deploying the system to its customers remains accountable for outcomes, regardless of who built the model. Vendor terms shape liability but do not transfer accountability to the customer or the model author.
How did you do?
Sixteen or more correct suggests you are close. Below fourteen, the domain guides in this section will help most — CY0-001 tests whether you can name the attack and pick the control that actually removes its mechanism.