CY0-001

The data scientist translates business use cases into analytical problems, selects features and algorithms, and builds and trains the model. A platform architect designs the infrastructure the model runs on, an AI risk analyst assesses and documents the model's risks, and an MLOps engineer deploys, automates and operates models that have already been developed.

Encryption is the standard control for protecting data at rest: if storage, backups or model data stores are accessed without authorization, the data cannot be read without the keys. Masking mainly hides values when data is displayed or shared with lower-privileged users, rate limits protect an interface from abuse, and data lineage tracks where data came from rather than protecting it.

Function-level call stack and debug traces expose what the application is doing internally at runtime, which is exactly the visibility the engineer wants. A SIEM aggregates and correlates logs but only sees what is sent to it, a WAF with header logging sees requests at the edge rather than internal activity, and vendor controls plus prompt monitoring cover inputs, not the system's internal behavior.

Legal non-compliance can only be measured against law, and the EU AI Act is binding regulation; Annex III explicitly classes AI used for recruitment, selection, promotion, termination and performance monitoring as high-risk, with legal obligations attached. The OECD AI principles, the NIST AI RMF and ISO standards are voluntary guidance and frameworks, useful for good practice but not a basis for legal non-compliance findings.

Prompt guardrails inspect and filter user prompts and uploaded content, blocking prompt injection and other malicious input before it reaches the model. Model token quotas cap how much each customer or session can consume, preventing usage beyond the service-level agreement and model denial-of-service. Role-based access controls govern who can access functions but do not filter malicious content, and firewall rules work at the network level and cannot see prompt content or usage volume.

Triage is about sorting alerts by type and priority, and classification is a core strength of ML: a model trained on past alerts can identify and categorize new ones at volume, separating likely true positives from noise. Static filters are rule-based and need no ML, automatic patching is remediation rather than triage, and summarizing content is better suited to a generative language model and does not by itself prioritize alerts.

LLM APIs are billed per token, so setting limits on input and output tokens per request or per user directly caps what each call can cost. Prompt templates standardize prompts but do not cap consumption, adding CPU and memory raises infrastructure cost rather than API cost, and the size of the hosted model behind a third-party API is not something the organization controls.

The evidence is a recurring behavioral sequence (two failures, a timed delay, then success, always in office hours), so pattern recognition lets the model learn this behavior and flag deviations from it or recognize it as a possible low-and-slow attack. Signature matching only finds known, predefined indicators, access management changes who may log in rather than how the model detects behavior, and vulnerability analysis looks for weaknesses in systems, not activity patterns.

Allowing staff to use public-facing LLMs means anything they paste into a prompt, such as customer records, personal data or confidential information, leaves the company's control and may be stored or used by the provider, which can breach data protection regulations such as GDPR. That regulatory and data-leakage exposure is the most serious risk. Hallucinations and malicious code generation are real concerns but are managed by verifying output, and an out-of-date acceptable use policy is a governance gap rather than the risk itself.

Facial recognition uses a neural network trained to locate many landmark points on a face (eyes, nose, jawline) and compare them with an enrolled template to authenticate a person. An encryption key and OAuth are cryptographic and authorization mechanisms, not trained models. A bounding box only marks where an object sits in an image and does not authenticate anyone.

Before customers try the application, the organization should mask and sanitize the data the AI features are trained on and can reach, so that sensitive or personal information is not exposed through model output and inputs are cleaned of harmful content. This is a technical safeguard that directly protects trial users. External compliance audits, approved AI vendor lists and third-party risk management are governance activities that do not by themselves stop the application from leaking or mishandling data.

Guardrails sit around the LLM and inspect prompts and responses, blocking or rewriting input that tries to override the system instructions and output that exposes sensitive data such as card numbers. They are the control designed for prompt injection. Antivirus scans files for malware, a WAF inspects HTTP traffic for web attack signatures but does not understand natural-language instructions, and role-based access control limits who can use the model, not what a prompt can make it do.

The payload is an indirect prompt injection: text disguised as a security update instructs the agent to download and run a script from an untrusted address. The most effective control is to validate what the agent is about to execute against an allowlist of approved commands and strings before any shell command runs, so injected instructions cannot trigger arbitrary execution. Ignoring one tag is trivially bypassed with a different tag, retraining the model does not stop injected input, and approved libraries do not control which commands the agent runs.

Using AI to summarize and correlate alerts helps analysts across the SOC triage faster and understand the environment, while humans still make the decisions. Running generated code directly in production and letting an assistant act with no human intervention remove the oversight that AI-assisted security requires. Putting open-source models into production is not by itself an enhancement and adds unvetted risk.

A prompt filter inspects and normalizes input before it reaches the model, so it can reject or strip oversized input and hidden characters, such as thousands of invisible Unicode characters smuggled behind an emoji, that exhaust the context window. Using an LLM as a judge would itself consume the same malicious input, fraud detection targets transactions, and generic pattern recognition does not limit what enters the context window.

To improve the user experience, the architect should review how accurate the model's responses are in the logs, because wrong or irrelevant answers are what users notice most. Rate monitoring tracks usage volume and throttling, access controls are a security concern, and data storage is about retention and capacity rather than the quality of what users receive.

Including exactly one worked example in the prompt to show the model what a good result looks like is one-shot prompting. A prompt template is a reusable prompt structure with placeholders, not the act of adding an example. Distillation trains a smaller model from a larger one, and a system role sets the model's overall behaviour or persona rather than supplying a sample.

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of adversary tactics and techniques against AI systems, modeled on ATT&CK, and is built for threat modeling AI applications. Responsible AI is a set of ethical principles, the OECD AI Principles are high-level policy guidance, and ISO standards define management systems and controls; none of these catalogues attacker techniques for a threat model.

Occasional false positives mean the model is not representing current legitimate behaviour well, so retraining it with more data and recent transaction patterns improves its accuracy. Token usage and rate limits control consumption and abuse, not classification quality. Encryption and access controls protect the data but do not change the model's decisions, and rolling back to a traditional system discards the AI benefits instead of fixing the cause.

Deepfakes are produced mainly with generative adversarial networks, in which a generator creates synthetic images or audio and a discriminator pushes it toward realistic output. Multi-shot prompting and prompt engineering are ways of instructing a language model, not techniques for synthesizing faces or voices. Transfer learning reuses a pretrained model and can support deepfake work, but it is not the core generation technology.