Security AI+ Module 1 – Quiz Level 2

A model review documents the following capability or behavior:
Computer systems performing tasks that normally require human intelligence, such as learning, reasoning, prediction, or language processing.
Which concept does the evidence describe?

During an AI security review, analysts identify the following condition:
Use of AI to detect threats, predict risk, automate analysis, and support security decisions.
Which concept most directly classifies the condition?

A data-governance review identifies the following characteristic:
Analysis of patterns in historical and current data to estimate likely future security events.
Which term most directly applies?

A cybersecurity team encounters the following situation:
Use of technology to perform repeatable security tasks with limited manual intervention.
Which concept most directly applies?

An incident or assessment reveals this behavior:
Risk arising from inadequate oversight, accountability, transparency, or policy for AI use.
Which term should the security team apply?

During an AI security review, analysts identify the following condition:
The possibility that model design, assumptions, bias, or errors produce unsafe or incorrect results.
Which concept most directly classifies the condition?

An incident or assessment reveals this behavior:
The possibility that poor-quality, exposed, manipulated, or unauthorized data compromises an AI system.
Which term should the security team apply?

An AI team is designing a workflow that performs the following function:
AI that creates new text, images, audio, video, or code from patterns learned during training.
Which process or practice is being used?

A model review documents the following capability or behavior:
A model that learns the distribution or structure of training data and produces new examples with similar characteristics.
Which concept does the evidence describe?

During an AI security review, analysts identify the following condition:
Use of generative AI to create convincing, personalized social-engineering messages.
Which concept most directly classifies the condition?

An AI security assessment records this characteristic:
Malicious code whose form changes while its harmful purpose remains, reducing the value of static signatures.
Which term best fits the finding?

During an AI security review, analysts identify the following condition:
Artificially generated security data or events used for exercises, testing, or model improvement.
Which concept most directly classifies the condition?

An incident or assessment reveals this behavior:
Authorized use of adversarial AI techniques to test how people, systems, or models withstand attack.
Which term should the security team apply?

A cybersecurity team encounters the following situation:
AI capability that can support legitimate defensive work or be repurposed for harmful activity.
Which concept most directly applies?

A model review documents the following capability or behavior:
A branch of AI in which algorithms learn patterns or decisions from data rather than relying only on manually written rules.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
Use of mathematical and statistical models to explain relationships in data or predict outcomes.
Which option is the most appropriate?

A data-governance review identifies the following characteristic:
Examples supplied to an algorithm so it can learn patterns, parameters, or decision boundaries.
Which term most directly applies?

During model development, the team works with an information element described as follows:
A measurable input variable used by a model to make a prediction.
Which data concept is involved?

A data-governance review identifies the following characteristic:
Selecting, transforming, or constructing input variables so a model can learn useful patterns.
Which term most directly applies?

During an AI security review, analysts identify the following condition:
Assignment of software samples to benign or malicious categories, or to specific malware families.
Which concept most directly classifies the condition?

An AI security assessment records this characteristic:
Analysis of user activity to establish normal behavior and identify suspicious deviations.
Which term best fits the finding?

During an AI security review, analysts identify the following condition:
Use of external and internal threat information to identify adversaries, indicators, tactics, and risk.
Which concept most directly classifies the condition?

A model review documents the following capability or behavior:
Learning from labeled examples in which the desired output is known.
Which concept does the evidence describe?

During model development, the team works with an information element described as follows:
The known target value or class attached to a supervised-learning example.
Which data concept is involved?

A model review documents the following capability or behavior:
Learning patterns, groups, or anomalies from data that does not have predefined labels.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
High precision and auditability for tasks represented well by reliable historical labels.
Which option is the most appropriate?

A model review documents the following capability or behavior:
Dependence on labels and historical examples, which can cause novel threats to be missed.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
Ability to discover patterns or anomalies in large unlabeled datasets.
Which option is the most appropriate?

A model review documents the following capability or behavior:
Findings may be ambiguous and require analyst validation before action.
Which concept does the evidence describe?

A cybersecurity team encounters the following situation:
Connection of AI capabilities to EDR, SIEM, or other platforms through APIs, plug-ins, or modules.
Which concept most directly applies?

An AI security assessment records this characteristic:
Identification of observations that differ meaningfully from an expected behavioral or statistical baseline.
Which term best fits the finding?

During model development, the team works with an information element described as follows:
A data point that is unusually distant from most other observations.
Which data concept is involved?

A model review documents the following capability or behavior:
An unsupervised anomaly-detection algorithm that isolates observations through repeated random partitions.
Which concept does the evidence describe?

During model development, the team works with an information element described as follows:
A split created by randomly selecting a feature and threshold in an Isolation Forest.
Which data concept is involved?

An AI security assessment records this characteristic:
A small number of partitions needed to isolate an observation, indicating that it may be anomalous.
Which term best fits the finding?

During model development, the team works with an information element described as follows:
Data containing many features or variables for each observation.
Which data concept is involved?

An AI security assessment records this characteristic:
Unusual authentication activity, such as an unexpected time, location, device, or failure pattern.
Which term best fits the finding?

An engineering team must select or identify a technique with this defining behavior:
Traffic behavior that departs from the normal volume, destination, protocol, or communication pattern.
Which option is the most appropriate?

An AI control review requires the following outcome:
Unexpected file creation, access, modification, movement, or deletion.
Which term most directly satisfies the requirement?

An AI security team needs a measurement with the following meaning:
A numeric estimate of how unusual an observation is relative to the model's baseline.
Which metric or concept should it use?

A data-governance review identifies the following characteristic:
Cleaning, formatting, normalizing, and organizing data before training or analysis.
Which term most directly applies?

A security team needs a safeguard or practice that provides the following capability:
Testing whether a model's outputs are accurate, stable, useful, and appropriate for the intended environment.
Which concept should it implement?

A model review documents the following capability or behavior:
A neural-network architecture that models relationships and context across elements in a sequence.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
A transformer component that weights which parts of an input are most relevant to each other.
Which option is the most appropriate?

A model review documents the following capability or behavior:
A smaller, compressed transformer model designed to retain much of BERT's language capability with lower resource use.
Which concept does the evidence describe?

An AI security team needs a measurement with the following meaning:
A model's numeric estimate of certainty in a prediction.
Which metric or concept should it use?

A model review documents the following capability or behavior:
A subset of machine learning using neural networks with multiple processing layers.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
A layered computational model of connected units that learns weighted relationships from data.
Which option is the most appropriate?

A model review documents the following capability or behavior:
An internal neural-network layer that transforms inputs into progressively more useful representations.
Which concept does the evidence describe?

During model development, the team works with an information element described as follows:
Input with many variables, such as raw executable bytes, images, packet data, or complex telemetry.
Which data concept is involved?

A model review documents the following capability or behavior:
A training or architecture setting selected outside the model's learned parameters.
Which concept does the evidence describe?

A cybersecurity team encounters the following situation:
AI techniques used to understand, interpret, classify, or generate human language.
Which concept most directly applies?

An AI security assessment records this characteristic:
An observable artifact, such as an IP address, domain, hash, or filename, associated with malicious activity.
Which term best fits the finding?

During an AI security review, analysts identify the following condition:
Use of language analysis to identify social engineering, urgency, credential requests, or malicious persuasion.
Which concept most directly classifies the condition?

An AI security assessment records this characteristic:
A response formatted to a defined schema, such as JSON, for reliable machine processing.
Which term best fits the finding?

During an AI security review, analysts identify the following condition:
A plausible-sounding but unsupported or incorrect AI-generated statement.
Which concept most directly classifies the condition?

An AI control review requires the following outcome:
A control requiring an authorized person to validate a model recommendation before consequential action.
Which term most directly satisfies the requirement?

An engineering team must select or identify a technique with this defining behavior:
A language model with a very large parameter count and broad capability across open-ended tasks.
Which option is the most appropriate?

A model review documents the following capability or behavior:
A lower-parameter language model optimized for reduced cost, latency, or local and specialized deployment.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
A learned numeric value that influences a model's output.
Which option is the most appropriate?

An AI security assessment records this characteristic:
Broad reasoning, language, summarization, and generation capability across many tasks.
Which term best fits the finding?

A cybersecurity team encounters the following situation:
High compute, memory, latency, cost, and governance requirements.
Which concept most directly applies?

An AI security assessment records this characteristic:
Lower latency and cost with easier local, appliance, or on-premises deployment.
Which term best fits the finding?

An engineering team must select or identify a technique with this defining behavior:
Adapting a model to the terminology, patterns, and tasks of a specific field.
Which option is the most appropriate?

A model review documents the following capability or behavior:
Running model predictions on a local device or environment rather than sending data to an external service.
Which concept does the evidence describe?

During an AI security review, analysts identify the following condition:
A generative architecture in which a generator and discriminator improve through adversarial competition.
Which concept most directly classifies the condition?

A data-governance review identifies the following characteristic:
The GAN component that creates synthetic examples intended to resemble real data.
Which term most directly applies?

A cybersecurity team encounters the following situation:
The GAN component that attempts to distinguish real examples from generated examples.
Which concept most directly applies?

An incident or assessment reveals this behavior:
Training in which one component or example challenges another to improve robustness or realism.
Which term should the security team apply?

During model development, the team works with an information element described as follows:
Artificially generated data designed to reproduce useful characteristics of real data.
Which data concept is involved?

A data-governance review identifies the following characteristic:
Use of generated examples to expand sparse training data, simulate threats, or improve class coverage.
Which term most directly applies?

An engineering team must select or identify a technique with this defining behavior:
A generative model that learns to reverse a gradual noising process and is widely used for image or video generation.
Which option is the most appropriate?

A development review observes the following activity:
The portion of a dataset used to learn model parameters and patterns.
Which term best identifies the activity?

A security team needs a safeguard or practice that provides the following capability:
A separate portion used during development to tune choices and check model quality.
Which concept should it implement?

A data-governance review identifies the following characteristic:
A held-out portion used for the final unbiased estimate of performance on unseen data.
Which term most directly applies?

During model development, the team works with an information element described as follows:
Accidental transfer of information from validation or test data into training, producing misleading performance.
Which data concept is involved?

A data-governance review identifies the following characteristic:
Dataset partitions that contain no overlapping records or derived information.
Which term most directly applies?

A security team needs a safeguard or practice that provides the following capability:
Evaluation that trains a model k times, holding out a different fold each time and averaging the results.
Which concept should it implement?

An AI control review requires the following outcome:
One subset of data used as the held-out portion during a cross-validation iteration.
Which term most directly satisfies the requirement?

An engineering team must select or identify a technique with this defining behavior:
Learning training-specific noise or detail so well that performance degrades on new data.
Which option is the most appropriate?

A data-governance review identifies the following characteristic:
Failing to learn enough structure from the data to perform the task accurately.
Which term most directly applies?

An AI team is designing a workflow that performs the following function:
Ability to perform accurately on new events not seen during training.
Which process or practice is being used?

A model review documents the following capability or behavior:
Change in real-world data patterns that reduces the relevance of a previously trained model.
Which concept does the evidence describe?

During model development, the team works with an information element described as follows:
Malicious manipulation of training data to alter model behavior or create hidden weaknesses.
Which data concept is involved?

An incident or assessment reveals this behavior:
Testing a model with outliers, manipulated inputs, or hostile examples to identify brittleness.
Which term should the security team apply?

An engineering team must select or identify a technique with this defining behavior:
Tendency to fail unexpectedly when inputs vary, contain noise, or are deliberately manipulated.
Which option is the most appropriate?

An AI security assessment records this characteristic:
An ensemble of small decision trees trained sequentially so each tree corrects earlier errors.
Which term best fits the finding?

An engineering team must select or identify a technique with this defining behavior:
A neural network that learns local patterns and can analyze images, byte sequences, opcode patterns, or entropy.
Which option is the most appropriate?

A data-governance review identifies the following characteristic:
A trusted classification supported by forensic analysis, analyst review, or authoritative evidence.
Which term most directly applies?

During an AI security review, analysts identify the following condition:
Automatic or heuristic labeling using sources such as threat intelligence, YARA, Sigma, or sandbox verdicts.
Which concept most directly classifies the condition?

A data-governance review identifies the following characteristic:
Incorrect, inconsistent, or ambiguous labels that degrade supervised learning.
Which term most directly applies?

An engineering team must select or identify a technique with this defining behavior:
A repeated distortion in data or labels that causes unfair or inaccurate model behavior.
Which option is the most appropriate?

An AI security assessment records this characteristic:
Giving examples different influence according to the reliability of their labels.
Which term best fits the finding?

An engineering team must select or identify a technique with this defining behavior:
Use of a small labeled set plus unlabeled data and feedback to improve learning.
Which option is the most appropriate?

An AI security assessment records this characteristic:
Transformation of numeric features to a consistent scale.
Which term best fits the finding?

A cybersecurity team encounters the following situation:
Conversion of a categorical value into separate binary indicator fields.
Which concept most directly applies?

Analysts are interpreting a value described as follows:
The proportion of predicted positive events that are actually positive.
Which term identifies that value?

An AI security team needs a measurement with the following meaning:
The proportion of actual positive events that the model successfully identifies.
Which metric or concept should it use?

Analysts are interpreting a value described as follows:
The harmonic mean of precision and recall.
Which term identifies that value?

A cybersecurity team encounters the following situation:
A table of true positives, false positives, true negatives, and false negatives.
Which concept most directly applies?

An AI security assessment records this characteristic:
Unsupervised grouping of observations based on similarity.
Which term best fits the finding?

An engineering team must select or identify a technique with this defining behavior:
A neural network trained to reconstruct input; high reconstruction error can indicate an anomaly.
Which option is the most appropriate?

An AI security assessment records this characteristic:
Difference between an autoencoder's input and reconstructed output.
Which term best fits the finding?

An engineering team must select or identify a technique with this defining behavior:
Learning in which an agent improves a policy through repeated interaction and reward feedback.
Which option is the most appropriate?

A model review documents the following capability or behavior:
The current environment information available to a reinforcement-learning agent.
Which concept does the evidence describe?

A cybersecurity team encounters the following situation:
A response the agent can take, such as allow, throttle, drop, or isolate.
Which concept most directly applies?

An AI security assessment records this characteristic:
A numeric signal indicating the value of an action's result.
Which term best fits the finding?

A cybersecurity team encounters the following situation:
The strategy mapping observed states to selected actions.
Which concept most directly applies?

An AI security assessment records this characteristic:
Deployment in which an AI recommends actions without enforcing them.
Which term best fits the finding?

A cybersecurity team encounters the following situation:
Deployment in which an AI directly enforces selected actions.
Which concept most directly applies?

An AI security assessment records this characteristic:
An isolated environment using recorded events to train and test response behavior safely.
Which term best fits the finding?

A cybersecurity team encounters the following situation:
Ability to reverse an automated action or return to a previous safe state.
Which concept most directly applies?

A development review observes the following activity:
Initial training on a massive general dataset to learn broad patterns and representations.
Which term best identifies the activity?

An engineering team must select or identify a technique with this defining behavior:
Generation that retrieves relevant external documents as prompt context without retraining the foundation model.
Which option is the most appropriate?

A model review documents the following capability or behavior:
Additional training of a pretrained model on a smaller task-specific dataset.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
Reuse of knowledge learned for a broad or earlier task to improve a related task.
Which option is the most appropriate?

A data-governance review identifies the following characteristic:
One complete pass through the training dataset.
Which term most directly applies?

An engineering team must select or identify a technique with this defining behavior:
Removal of low-impact model weights or elements to reduce size and improve inference speed.
Which option is the most appropriate?

Analysts are interpreting a value described as follows:
Representation of weights or activations at lower numeric precision to reduce memory and accelerate inference.
Which term identifies that value?

An AI team is designing a workflow that performs the following function:
Training that accounts for lower-precision representation to preserve model performance.
Which process or practice is being used?

A model review documents the following capability or behavior:
Use of a trained model to generate a prediction or response.
Which concept does the evidence describe?

An engineering team must select or identify a technique with this defining behavior:
Collaborative training in which clients keep raw data locally and send model updates to a central coordinator.
Which option is the most appropriate?

A model review documents the following capability or behavior:
The shared model initialized, distributed, and updated by a central federated-learning server.
Which concept does the evidence describe?

An AI team is designing a workflow that performs the following function:
Model training performed on a client using only that client's local data.
Which process or practice is being used?