CompTIA SecAI+ Certification (CY0-001) Practice Test — Free Questions

Exam Details

Questions

600

Duration

60 minutes

Passing Score

600/900

Difficulty

Professional

Last Updated

Apr 2026

Topics Covered

Basic AI Concepts for CybersecuritySecuring AI SystemsAI-Assisted Security OperationsAI Governance, Risk, and ComplianceAdversarial AI and Threat MitigationAI Deployment and Security ControlsResponsible AI Practices

Exam Overview

CompTIA SecAI+ (CY0-001) is a vendor-neutral professional certification that validates the knowledge and skills required to secure artificial intelligence systems and responsibly integrate AI into cybersecurity operations. Launched on February 17, 2026, it is the first certification in CompTIA's Expansion Series and the first vendor-neutral credential focused specifically on the intersection of AI and cybersecurity. The certification covers implementing technical security controls for AI models, gateways, and data pipelines—including model guardrails, prompt firewalls, encryption requirements, and data anonymization—alongside using AI-driven tools to automate threat detection, anomaly discovery, and incident response workflows.

The exam also addresses AI governance, risk, and compliance (GRC), requiring candidates to apply global regulatory frameworks such as GDPR and the NIST AI Risk Management Framework across the AI lifecycle. Accredited by ANSI to ISO 17024 standards, SecAI+ is valid for three years and requires continuing education units (CEUs) for renewal, following CompTIA's standard certification maintenance model.

Official exam page

Who Should Take This Exam

SecAI+ is designed for experienced cybersecurity practitioners who are integrating AI technologies into their security programs or are responsible for securing AI-enabled environments. Applicable job roles include security engineers, SOC analysts, blue-team operators, application security engineers, and security governance professionals seeking to validate AI-specific competencies alongside their existing security expertise.

CompTIA positions SecAI+ as a mid-level specialization that builds directly on core certifications such as Security+, CySA+, and PenTest+. It is well-suited for professionals already working in security operations, threat detection, or GRC roles who need to demonstrate competence in protecting AI pipelines, applying AI-driven automation, and navigating the compliance requirements of AI-enabled environments.

Prerequisites

There are no formal prerequisites required to sit for the CY0-001 exam. However, CompTIA strongly recommends candidates have 3–4 years of overall IT experience, including at least 2 years of hands-on cybersecurity experience, before attempting SecAI+. Prior attainment of Security+, CySA+, or PenTest+—or equivalent knowledge—is also recommended, as the exam assumes familiarity with core security concepts such as threat modeling, incident response, and risk management.

Candidates should also have a working understanding of foundational AI concepts—including machine learning terminology, model lifecycle basics, and common AI use cases—before diving into the AI-specific controls and governance frameworks that make up the bulk of the exam content. CompTIA positions SecAI+ as an add-on specialization rather than a standalone entry-level credential.

Exam Format

The CY0-001 exam consists of a maximum of 60 questions, combining multiple-choice and performance-based question (PBQ) formats. Performance-based questions require candidates to demonstrate practical skills through simulated scenarios rather than selecting from predefined answers. The total allotted time is 60 minutes, and the exam is delivered in English only.

Scoring is on a scale of 100 to 900, with a passing score of 600. The exam is available through Pearson VUE, which offers both online proctored and in-person testing center delivery options consistent with other CompTIA exams. No specific number of unscored pretest items has been published for this exam version.

Skills Measured

1.Domain 1 — Basic AI Concepts Related to Cybersecurity (17%): Covers comparing and contrasting AI types and techniques relevant to security, including Generative AI, Machine Learning, Deep Learning, NLP, LLMs, SLMs, GANs, and Transformers. Candidates must understand core AI principles and terminology and identify AI applications in threat detection, defense automation, and security operations.
2.Domain 2 — Securing AI Systems (40%): The largest domain, covering implementation of technical controls to protect AI systems, models, and data. Topics include model controls (model evaluation, guardrails, prompt templates), gateway controls (prompt firewalls, rate/token limits, input quotas), guardrail testing and validation, data security controls (encryption in-transit/at-rest/in-use, anonymization, classification labels, redaction, masking, and minimization), and defenses against adversarial attacks on AI infrastructure.
3.Domain 3 — AI-Assisted Security (24%): Focuses on leveraging AI-driven tools to enhance security operations. Candidates must demonstrate ability to use AI for threat detection, anomaly discovery, and incident response automation, as well as operationalizing AI-powered workflows within existing security programs.
4.Domain 4 — AI Governance, Risk, and Compliance (19%): Addresses applying global GRC frameworks—including GDPR, NIST AI RMF, and relevant industry standards—to AI-enabled environments. Covers ethical AI practices, legal standards, compliance monitoring, and governance across the full AI system lifecycle.

Study Tips

Start with CompTIA's official CertMaster Study product (ISBN: 978-1-64274-646-4), which is purpose-built for CY0-001 and maps directly to the published exam objectives. It provides 12 months of access and covers all four domains with adaptive question banks.
Download and study the official CompTIA SecAI+ Exam Objectives document (Version 1.0/2.0) from the CompTIA website. Map every sub-objective to your study notes, paying special attention to Domain 2 (Securing AI Systems, 40%) since it represents nearly half the exam.
Use CertMaster Labs (ISBN: 978-1-64274-638-9) to build hands-on familiarity with performance-based question scenarios. PBQs simulate real-world tasks such as configuring prompt firewalls and applying data anonymization controls—skills that cannot be memorized from reading alone.
Review the NIST AI Risk Management Framework (AI RMF 1.0) and GDPR AI-related provisions directly from their official sources. Domain 4 (GRC, 19%) tests practical application of these frameworks, so understanding their actual structure and terminology is essential.
Study adversarial AI attack categories—including model inversion, data poisoning, prompt injection, and evasion attacks—using resources like MITRE ATLAS, which maps adversarial machine learning tactics to the MITRE ATT&CK framework and is directly applicable to Domain 2 objectives.
Use CertMaster Perform (ISBN: 978-1-64274-637-2) in the final two weeks before the exam to simulate timed test conditions. The 60-minute limit is tight for up to 60 questions, so practice pacing yourself across both multiple-choice and performance-based items.
Leverage the recommended certification pathway (Security+ → CySA+ → SecAI+) as a knowledge scaffold: revisit CySA+ threat detection and security operations content to reinforce the AI-assisted security domain, since Domain 3 builds directly on those analyst-level competencies.

Career Benefits

SecAI+ is positioned at the convergence of two of the fastest-growing areas in enterprise technology, and professionals who hold this credential can demonstrate competency for roles such as AI Security Engineer, Security Operations Analyst, Cloud Security Engineer, AI/ML Security Specialist, and GRC Analyst in AI-enabled organizations. CompTIA's recommended pathway places SecAI+ as a specialization after CySA+ or PenTest+, making it a credential that differentiates mid-career cybersecurity professionals in a crowded market.

The demand for professionals who can both secure AI systems and operationalize AI within security teams is expanding rapidly, with organizations across financial services, healthcare, government, and technology sectors facing mounting AI security incidents and growing regulatory pressure around AI governance. SecAI+ provides a vendor-neutral, ANSI/ISO 17024-accredited credential that signals verified competency to employers regardless of specific technology stack, complementing vendor-specific AI and security certifications from providers such as Microsoft, AWS, and Google.

Sample Questions

1. Woodgrove Bank's automated loan approval system uses AI to make final credit decisions without human review, and a customer requests information about the decision process. Under GDPR Article 22, what is the bank's PRIMARY obligation? (Select one!)

2. Fourth Coffee discovered that employees in their engineering department have been using multiple unapproved generative AI tools to debug code and generate documentation, potentially exposing proprietary algorithms and customer data. What should be the FIRST priority in responding to this shadow AI usage? (Select one!)

3. Northwind Electronics suffered a security incident where their production malware classification model began misclassifying known malware families as benign. The investigation team needs to preserve evidence for forensic analysis and potential legal proceedings. Which THREE artifacts should be prioritized for evidence preservation in this AI-specific security incident? (Select three!)

Select all that apply

4. Contoso's red team has simulated an adversary who performed systematic API queries against their deployed recommendation engine to reconstruct a functional copy of the model, then used crafted inputs to bypass the model's fraud-classification logic. The security team wants to map these attack techniques to a standardized adversarial framework. Which framework should they use, and what distinguishes it from MITRE ATT&CK? (Select one!)

5. Relecloud is evaluating defenses against evasion attacks on their malware classifier. A security researcher proposes using gradient masking, which hides or obfuscates gradients to prevent attackers from computing effective adversarial perturbations. Why should the CISO be cautious about relying primarily on gradient masking? (Select one!)