Instructions: Use the drop-down menus to define two appropriate security controls for each component of...

Basic Concept: This is a Performance-Based Question (PBQ) — a HOTSPOT/simulation item requiring interactive selection in the actual exam. It tests the candidate ' s ability to map appropriate security controls to AI system components such as API gateway, model endpoint, data layer, and authentication layer.

Key Concept — Appropriate Controls by Component: For an API gateway connecting an AI system, typical controls include API key authentication, rate limiting, TLS encryption, and input validation. For the model endpoint, controls include IAM role-based access, audit logging, and guardrails. For data access components, encryption at rest and data masking are appropriate. For the authentication layer, MFA and expiring session tokens are relevant.

Why This Matters: The CompTIA SecAI+ Study Guide emphasizes defense-in-depth for AI system integration, ensuring each architectural layer has dedicated, appropriate security controls. The principle of least privilege should guide access control assignments at each component, while availability controls such as rate limiting protect against abuse.