CompTIA SecAI+ CY0-001 Lessons

Every lesson is free to read, with three practice questions each. Work through them in order, or jump to the objective you need.

  1. AI types, from statistical learning to transformers, and what each one can get wrongObjective 1.1Audio
  2. An AI lab you can break safely, on a machine you own and with data you wroteAudio
  3. How models are trained, validated and prompted, and the attack surface each step createsObjective 1.1Audio
  4. Data processing for AI: cleansing, lineage, provenance and the data types a model learns fromObjective 1.2Audio
  5. Retrieval-augmented generation, embeddings and vector stores, and watermarking what a model producesObjective 1.2Audio
  6. Security across the AI life cycle, from business case to feedback loopObjective 1.3Audio
  7. The OWASP Top 10 for LLM applications and for machine learning, used as a working checklistObjective 2.1Audio
  8. MITRE ATLAS, the MIT AI Risk Repository, CVE for AI and threat-modelling an AI systemObjective 2.1Audio
  9. Model controls: evaluation, guardrails and prompt templates, and testing that they holdObjective 2.2Audio
  10. Gateway controls: prompt firewalls, rate and token limits, quotas and endpoint accessObjective 2.2Audio
  11. Access control for models and the data behind themObjective 2.3
  12. Access control for AI agents and the APIs they callObjective 2.3Audio
  13. Encryption for AI systems in transit, at rest and in useObjective 2.4Audio
  14. Data safety for AI: anonymisation, classification labels, redaction, masking and minimisationObjective 2.4Audio
  15. Monitoring AI systems: prompts, responses, logs and confidenceObjective 2.5Audio
  16. Rate and cost monitoring, and auditing AI for quality and complianceObjective 2.5Audio
  17. Prompt injection, jailbreaking and guardrail evasion: the evidence they leave and the controls that contain themObjective 2.6Audio
  18. Poisoning, introduced bias, model skewing and AI supply chain attacksObjective 2.6Audio
  19. Model theft, model inversion, membership inference, model denial of service and overrelianceObjective 2.6Audio
  20. AI tools for security work: IDE, browser and CLI plug-ins, chatbots, assistants and MCP serversObjective 3.1Audio
  21. AI for detection: signature matching, anomaly detection, pattern recognition and fraudObjective 3.1Audio
  22. AI for code quality, vulnerability analysis, automated testing, incidents and threat modelsObjective 3.1Audio
  23. AI-generated content: deepfakes, impersonation, misinformation and disinformationObjective 3.2Audio
  24. How AI enhances reconnaissance, obfuscation and automated attacks, explained for defendersObjective 3.2Audio
  25. Automating security work with AI: scripting, low-code and no-code tools, documents and ticketsObjective 3.3Audio
  26. AI agents, AI-assisted approvals and automated changeObjective 3.3Audio
  27. AI in the CI/CD pipeline: code scanning, software composition analysis and model testingObjective 3.3Audio
  28. Governance structures for AI: the centre of excellence, policies and proceduresObjective 4.1Audio
  29. AI roles and responsibilities, from data scientist to AI auditorObjective 4.1
  30. Responsible AI: fairness, reliability, transparency, explainability and accountabilityObjective 4.2
  31. AI risks: bias, accidental leakage, reputation, accuracy, intellectual property, autonomy and shadow AIObjective 4.2
  32. AI regulation and standards: the EU AI Act, OECD principles, ISO AI standards and NIST AI RMFObjective 4.3
  33. Corporate AI policy, third-party compliance and data sovereigntyObjective 4.3