CompTIA SecAI+ Course Notes

This is the largest domain. Choose the right AI threat resource, implement model/gateway/access/data controls, monitor the right telemetry, recognize AI-specific attacks, and match compensating controls to the actual attack path.

• Using prompts as authorization controls.

• Domain 2 is 40%: spend disproportionate study time on the named controls and attack vocabulary.

Know where AI can augment security work, how attackers can use AI to scale or adapt attacks, and how to automate security tasks safely with review, testing, least privilege, and controlled deployment.

• Assuming 'AI-assisted' means fully autonomous.

• For tool questions, match interface to workflow first, then capability.

Know the organizational roles that support AI, the responsible-AI characteristics and business risks, and how external frameworks plus corporate policy affect the use, development, procurement, and oversight of AI.

• Treating every AI role as interchangeable.

• For role questions, identify the primary deliverable: model, production inference code, model lifecycle, platform, architecture, security architecture, risk, governance, audit, or data pipeline.

Know what the AI technique is doing, what data it depends on, and where it sits in the AI lifecycle. Expect scenario questions that distinguish AI types, learning and tuning methods, prompt methods, data-security concepts, RAG components, and human-centric lifecycle controls.

• Calling every content-generating system 'machine learning' without identifying the more specific generative/NLP technique.

• First ask: Is the scenario about data, training, inference, prompting, or lifecycle operations?