CY0-001 試験問題を無料オンラインアクセス

An organization develops a chatbot that does not provide harmful or explicit responses, must use clean and professional language, and ensures that responses are accurate.
Which of the following should the organization conduct after the chatbot is fully developed but before a customer-facing deployment?

• A.Regression modeling and minimization
• B.Guardrail testing and validation
• C.Model auditing and evaluation
• D.Data labeling and classification

During a model validation procedure, an engineer notices that a model performs well during training but poorly during testing.
Which of the following best describes the reason?

• A.Inference
• B.Regularization
• C.Overfitting
• D.Fine-tuning

An internal user enters a client credit card number into an internal generative machine learning (ML) model:
#User prompt: Customer Jane Doe has a new credit card that she wants to add to her account. The number is
5555-5555-5555-5555
Which of the following is the most effective way to prevent prompt injection attacks against a large language model (LLM)?

• A.Role-based access control
• B.Guardrails
• C.Web application firewall (WAF)
• D.Antivirus

An engineer is analyzing findings from a penetration test that indicate insufficient data encryption. The report also indicates that additional controls must be placed on the data. To protect against loss of intellectual property, the engineer must implement data security.
Part 1: Use drop-down menu to select the most appropriate protocol or cipher for each system component.
Part 2: Use the drop-down menu to select the most appropriate technique to apply to the modified data.

正解：

Explanation:
Part 1 - Select the protocol or cipher
System component
Select
API gateway
TLS 1.2
Database storage
CAMELLIA
AI model storage
HMAC-SHA512
Part 2 - Select the data-protection technique
Enter the techniques from the first row to the fifth row in this exact order:
Row Data modification Select
1 The name field is removed, while patient_id and dob remain De-identification
2 ip_addr and name are removed, leaving cookie and uid Anonymization
3 The card number is replaced by 0x0193828829 Tokenization
4 sensitivity: " SECRET " is added Classification
5 Part of the PIN is replaced by XXXX Masking
See Explanation
Why these are the intended answers
API gateway # TLS 1.2
The API gateway handles data moving between the client and backend systems. TLS is the only listed transport-security protocol and therefore protects the data in transit . OWASP recommends encrypting sensitive data in transit by using TLS with secure parameters.
Database storage # CAMELLIA
CAMELLIA is a symmetric block cipher suitable for encrypting substantial quantities of stored data. It is therefore the valid storage-encryption choice among the listed options.
Do not select AES-512 . AES-512 is not a standardized AES variant. NIST defines only AES-128, AES-192, and AES-256 .
AI model storage # HMAC-SHA512
The scenario separately emphasizes protection against loss or modification of intellectual property. HMAC- SHA512 supplies message authentication and integrity verification, allowing unauthorized modification of the AI model to be detected. HMAC is not confidentiality encryption, but it is the most appropriate listed additional control for protecting model integrity. OWASP specifically identifies HMACs as cryptographic controls for stored-data integrity.
Why the other options are not selected
* SHA-2 512: Hashing only; no secret key and no encryption.
* Elliptical curve: A family of cryptographic techniques, not a specific storage or transport protocol.
* ECDH: Used for key agreement, not direct bulk-data encryption.
* AES-512: Invalid AES key size.
* RSA-2048: Primarily used for asymmetric encryption, signatures, or key transport; inefficient for bulk database or model encryption.
* CAMELLIA: Appropriate symmetric encryption for stored data.
* HMAC-SHA512: Integrity and authenticity, not confidentiality.
Final Part 2 order
* De-identification
* Anonymization
* Tokenization
* Classification
* Masking
Explanation:
De-identification removes an explicitly identifying field-in this case, the person's name-while retaining other fields needed for processing. The remaining patient ID and date of birth could potentially permit re- identification when combined with other information, so this is de-identification rather than complete anonymization. OWASP describes de-identification as deleting, scrambling, or pseudonymizing direct and indirect identifiers.
Anonymization removes identifying attributes so that the displayed record is not directly tied to the named individual. Here, both the name and IP address are removed.
Tokenization substitutes a sensitive value with a non-sensitive representative token. The original payment- card number is replaced with the hexadecimal-style value 0x0193828829. OWASP recognizes tokenization as a method for reducing exposure of stored sensitive data.
Classification labels information according to sensitivity. Adding sensitivity: " SECRET " does not conceal or transform the PIN; it categorizes the record so appropriate controls can be applied. OWASP recommends classifying processed, stored, and transmitted data and applying controls based on that classification.
Masking obscures only part of a sensitive value while preserving its general format. Changing 999-99-9999 to 999-99-XXXX is partial masking.

After the latest software update, a developer receives reports that the system no longer requires reauthentication to display account balances because this issue was present in a previous release. Which of the following should the developer do to best mitigate the risk of recurrence?

• A.Implement AI regression testing into the continuous integration/continuous deployment (CI/CD) pipeline.
• B.Deploy an AI-assisted change management system to schedule and track feature releases.
• C.Use code commit automation to perform AI-assisted static application security testing (SAST) scans.
• D.Ensure that AI approvals are required to push changes into production.