AI security is part of CompTIA Security+ SY0-801 (V8). Objective 2.6 covers risks associated with using artificial intelligence, including prompt injection, poisoning, hallucinations, privacy and unauthorized code execution. For your preparation, concentrate on recognizing what went wrong, identifying the affected asset and choosing a control that addresses the cause.
This guide explains the Security+ SY0-801 AI topics through original workplace examples. The exam scope comes from CompTIA’s SY0-801 objectives, document version 2.0. The explanations also use OWASP and NIST guidance; those resources provide context and do not define additional CompTIA exam requirements.
What AI topics appear in Security+ SY0-801?
CompTIA’s objective 2.6 (Version 2.0, PDF page 10) groups 13 topics: model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethical considerations, session hijacking and code execution. Elsewhere, objective 2.4 (PDF page 8) names large language models as an attack surface. Use the complete SY0-801 exam objectives guide to see how these topics fit into the wider syllabus.
Trifectapp study advice: Sort each example into three questions: Was the input manipulated? Was information exposed? Did the system produce an unreliable result or take an unauthorized action? One incident can involve more than one risk.
Prompt injection: when content changes the task
Prompt injection happens when input steers an AI application into unintended behavior. A direct attempt arrives through a user prompt. An indirect attempt arrives through material the application processes, such as a document, website or message. OWASP’s prompt-injection guidance describes both routes.
Imagine a service-desk assistant summarizing an uploaded troubleshooting guide. A paragraph inside that guide tells the assistant to abandon the summary and disclose internal notes. The key clue is that source material is being treated as an instruction. Reading a document should not authorize new actions.
Jailbreaking overlaps with prompt injection but specifically seeks to defeat a model’s safety restrictions. The terms describe related behavior; choose the most specific explanation supported by the scenario.
Clear instruction boundaries and input screening can help, but they do not make an AI application immune. Retrieval-augmented generation, which supplies documents to support an answer, also does not eliminate injection risk.
Data poisoning: when the learning material is corrupted
Data poisoning compromises the information used to build or adapt an AI system. For example, someone changes labels in a training dataset so that dangerous messages are represented as safe. The model can then learn the wrong association. OWASP identifies poisoning risks across pre-training, fine-tuning and embedding data.
The practical distinction is timing and target: an injected instruction can redirect a single interaction; poisoned data can influence later behavior through a corrupted data pipeline. A malicious retrieved document can involve overlapping risks, so avoid assuming these categories are mutually exclusive.
Useful controls include tracking where datasets originate, limiting who can change them, reviewing updates, keeping versions and testing behavior after changes. Model manipulation is a broader concern: protect model artifacts and configuration as well as the underlying data.
AI security risks compared
| Risk | Clue in a scenario | Useful response |
|---|---|---|
| Prompt injection | Untrusted content redirects the assistant’s task | Restrict tools and independently authorize actions |
| Poisoning | Training or supporting data has been deliberately corrupted | Review data provenance, access and versions |
| Hallucination | The answer includes a plausible but invented fact | Verify the claim against a trusted source |
| Evasion | A crafted input gets a detector to misclassify it | Test detection robustness and use layered controls |
| Data loss or privacy exposure | Sensitive information reaches an unauthorized destination | Minimize inputs and enforce access restrictions |
| Bias | Results systematically disadvantage a group | Evaluate outcomes and investigate data or design causes |
| Explainability concern | Reviewers cannot understand how the system operates | Maintain suitable documentation and evaluation evidence |
| Session hijacking | An attacker uses someone else’s authenticated session | Revoke the session and investigate token exposure |
For evasion, think about a changed input at prediction time: a message is deliberately altered so a detector misses it. NIST AI 100-2e2025 (March 2025), sections 2.2 and 2.3, distinguishes evasion from poisoning attacks that interfere with model training.
Hallucinations, bias and explainability
A hallucination is an unsupported or false output presented as credible. It does not require an attacker. An assistant might invent a firewall setting and cite a manual section that does not exist. NIST AI 600-1, Generative AI Profile (July 2024) calls this phenomenon confabulation and explains that confident wording can encourage misplaced trust.
Before applying the suggested setting, check the vendor documentation and test the change safely. Asking the same assistant whether it is certain is weaker than checking independent evidence. OWASP recommends cross-verification and human oversight to reduce harm from misleading outputs.
Bias concerns systematic differences in outcomes, while explainability concerns understanding the mechanisms behind an AI system’s operation. A result can be factually plausible yet still warrant a bias review. An elaborate generated explanation is also not proof that the explanation accurately describes the system. NIST treats fairness, explainability, privacy and reliability as distinct trustworthiness characteristics.
Ethical considerations add a practical question: who could be harmed by the proposed use? Consider whether people understand the system’s role, whether a human can review consequential outcomes and whether the information collected is appropriate for the task.
Protect sensitive information and connected actions
Data exposure can happen when an employee submits confidential information to an unapproved tool or when an application returns records the requester should not access. An approved service still needs appropriate configuration, retention rules and permissions. OWASP’s sensitive-information guidance emphasizes access controls, data minimization and user education.
AI applications also inherit familiar security problems. A stolen session token can expose conversations and connected resources. Generated code becomes dangerous when a system runs it without suitable validation or isolation. The risk depends on what the application is allowed to do, not just what the model says.
For a defensive design exercise, give a document-summary assistant read access only to its assigned documents. Require separate authorization for sending messages or changing records, and isolate any necessary code execution. OWASP’s AI agent guidance supports scoped tools, least privilege and controls over consequential actions. Apply those boundaries in the AI trust-boundary tabletop exercise.
Original Trifectapp practice · 5 original scenarios · About 15 minutes
AI trust-boundary practice: classify the evidence
Identify what crossed a trust boundary, choose the best-supported classification, and name a check that would show the control works. A bad answer is not automatically an attack, and one incident can involve several risks.
Choose the primary issue demonstrated by the stated facts. The OWASP 2025 risk names provide technical context for this V8 guide; they do not create additional CompTIA exam requirements. “Improper output handling” is also often called insecure output handling. These fictional cases do not run a model, execute code or access real records.
Case 1 · A retrieved note tries to take control
Evidence card
- An assistant is authorized only to summarize an externally supplied maintenance note.
- The note includes a sentence directing the assistant to abandon the summary and send internal account data to an outside recipient.
- No dataset is being updated. The independent tool-authorization check denies the requested send; no disclosure is observed.
Worked solution and technical references
Best choice: Indirect prompt injection. Untrusted retrieved content tries to become an instruction with authority over the assistant’s task. The failed send does not make the attempt harmless or prove disclosure occurred.
Verification or reasoning check: Keep document text separate from action authority. Test that the external note cannot expand permissions or authorize a send; inspect the denial record and confirm no data left.
Why the other choices fit less well
- Confirmed data exposure: The send was denied and no disclosure is observed. The attempted disclosure is a possible consequence; the initiating mechanism is indirect prompt injection.
- Data poisoning during training: The evidence concerns instructions in the current retrieved note. It does not describe modification of a training dataset.
- Ordinary factual error only: The note explicitly attempts to redirect the task and request an unauthorized action; this is more than an inaccurate statement.
Remember: Classify the attack mechanism separately from whether the attempted action succeeded.
Technical context: OWASP: Prompt Injection (2025). The scenario facts are original teaching inputs.
Case 2 · Tampering before the next fine-tune
Evidence card
- A contributor deliberately changes reviewed safe-response examples into unsafe examples in a fine-tuning dataset.
- The build process accepts the altered dataset. Evaluation of the new model shows it repeatedly recommending the altered unsafe behavior.
- There is an audit trail of dataset changes, rather than an instruction inserted into the current user conversation.
Worked solution and technical references
Best choice: Data poisoning. Deliberate dataset tampering crosses the boundary from untrusted changes into trusted learning material and influences the adapted model.
Verification or reasoning check: Preserve dataset and model versions, identify the unauthorized changes, rebuild from reviewed data, and compare behavior on held-out tests before reuse.
Why the other choices fit less well
- Prompt injection in the current conversation: There is no current conversation instruction carrying the attack. The observed tampering enters the fine-tuning data pipeline.
- Sensitive-data exposure only: The facts establish changed learning examples and resulting behavior, not disclosure of confidential records.
- Improper output handling only: No downstream component is executing or interpreting the generated response in this case. The compromised input is the fine-tuning dataset.
Remember: Dataset provenance, review and versioning address a different boundary from screening a live chat prompt.
Technical context: OWASP: Data and Model Poisoning (2025). The scenario facts are original teaching inputs.
Case 3 · A summary becomes executable page content
Evidence card
- A document assistant returns a summary containing script-bearing markup.
- The application inserts that generated string directly as active HTML into a reviewer’s page; the script executes in the browser.
- Investigators have not established how the model produced the markup. Focus on the proven application boundary, not an assumed initiating attack.
Worked solution and technical references
Best choice: Improper output handling. Generated text crossed into an executable browser context without appropriate handling. Treat the response as untrusted data and render it safely for the intended context.
Verification or reasoning check: Render plain summaries as text. If approved formatting is needed, apply a suitable HTML sanitizer and safe rendering rules; test that script-bearing output stays inert.
Why the other choices fit less well
- Confirmed training-data poisoning: No training-data changes are shown. The proven failure is the application’s handling of generated output.
- Confirmed prompt injection: Prompt injection could be one cause of malicious output, but the scenario does not establish it. The demonstrated downstream execution is improper output handling.
- A harmless hallucination only: The output was executed as browser code, so the issue extends beyond whether generated text is factually accurate.
Remember: A model response must not gain code-execution authority merely because an application received it.
Technical context: OWASP: Improper Output Handling (2025) · OWASP: Cross-Site Scripting Prevention. The scenario facts are original teaching inputs.
Case 4 · A correct answer reaches the wrong person
Evidence card
- An employee asks an internal assistant a routine question about a project.
- The retrieval service uses a shared privileged account without filtering records by the employee’s access rights.
- The assistant returns accurate confidential project notes that the employee is not permitted to read. No prompt override or dataset tampering is found.
Worked solution and technical references
Best choice: Sensitive-information exposure. The application crossed the requester’s access boundary and disclosed restricted notes. An ordinary question can expose a retrieval authorization defect.
Verification or reasoning check: Enforce the requester’s record-level permissions before retrieval and before release. Retest with permitted and unpermitted users, and handle the observed disclosure through the incident process.
Why the other choices fit less well
- Hallucination: The notes are accurate. Accuracy does not authorize the recipient to receive them.
- Data poisoning: The evidence shows unauthorized retrieval and disclosure, not corruption of training or supporting data.
- Prompt injection must have occurred: No instruction override is established. Broken access enforcement can expose data without prompt injection.
Remember: A correct answer can still be a security failure when it reaches an unauthorized person.
Technical context: OWASP: Sensitive Information Disclosure (2025). The scenario facts are original teaching inputs.
Case 5 · A convincing maintenance claim has no source
Evidence card
- An assistant states that a fictional appliance’s official manual requires a particular setting and names a manual section.
- The reviewer checks the actual manual and confirms that neither the setting nor the cited section exists.
- No tampered input or dataset is identified, no confidential data is returned, and the response is displayed as plain text without executing actions.
Worked solution and technical references
Best choice: Hallucination or unsupported generated claim. The observed issue is a credible-looking invented claim. Independent checking caught it; the available evidence does not establish an attack mechanism.
Verification or reasoning check: Record the incorrect claim, consult the genuine vendor documentation and test any eventual approved change in a safe environment. Ask for evidence, not just reassurance from the same assistant.
Why the other choices fit less well
- Data poisoning is confirmed: A false answer alone does not establish deliberate changes to data or model artifacts.
- Prompt injection is confirmed: No task-redirecting instruction is identified. Incorrect output alone is not evidence of prompt injection.
- Improper output handling is confirmed: The response remained plain text and no downstream execution occurred. The demonstrated issue is unsupported content, not an executable interpretation boundary.
Remember: Distinguish an unreliable result from evidence of an attack. Further investigation may change the classification.
Technical context: NIST AI 600-1: Generative AI Profile · OWASP: Misinformation (2025). The scenario facts are original teaching inputs.
Keep practicing offline
Download the AI trust-boundary practice pack (ZIP)
Includes this offline activity, five evidence cards, a blank classification-and-control worksheet, worked solutions and source links.
Activity v1.0 · November 7, 2026. Original teaching scenarios, not official CompTIA questions. Choices stay in the open page and clear on reload. This activity sends no answers and uses no persistent storage.
Three original practice scenarios
These learning examples are original illustrations, not actual CompTIA exam questions. Identify the primary issue before reading each explanation.
1. The supplier document
An assistant is asked to summarize a supplier’s PDF. Text inside the PDF directs it to retrieve unrelated customer records. Which risk best explains the attempt?
Answer: indirect prompt injection. The instruction arrives inside external content. Access restrictions and action authorization should prevent a document from expanding the assistant’s permissions.
2. The changed training labels
A review discovers that a contributor deliberately relabeled many malicious-message samples as harmless before a classifier was retrained. Which risk is present?
Answer: data poisoning. The contributor altered the learning data. Preserve evidence, identify affected dataset and model versions, and restore a reviewed version before evaluating the replacement.
3. The nonexistent advisory
A support assistant names a security advisory and provides a convincing summary. The vendor has never published that advisory, and there is no evidence of tampered inputs. What best describes the output?
Answer: hallucination. The unsupported claim is the observed problem. Verify advisories directly before using them to justify an operational change.
How to study the SY0-801 AI topics
- Explain each objective 2.6 term in one sentence, using your own words.
- Build paired examples: poisoning versus evasion, and hallucination versus prompt injection.
- For each example, name the asset, failure point and most relevant control.
- Consider privacy and ethical effects alongside technical damage.
- Revisit missed scenarios after a few days and explain why competing answers fit less well.
Use Trifectapp’s free Security+ SY0-801 practice questions to check your wider understanding, then explore the Security+ V8 training course for structured preparation across all five domains.
Frequently asked questions
Is AI included in Security+ SY0-801?
Yes. The published objectives include a dedicated AI-risk objective, 2.6. Study it alongside the rest of the syllabus rather than treating AI as a separate certification.
Are hallucinations and poisoning the same thing?
No. A hallucination describes unreliable output. Poisoning describes tampering with data or a model. Poisoning can produce false output, but a false answer alone does not establish that poisoning occurred.
Does prompt filtering prevent every injection?
No. Use filtering as one layer alongside limited permissions, output handling, monitoring and independently enforced authorization. OWASP’s prevention guidance explains why matching suspicious words is not a complete security boundary.
Sources and versions
Sources checked: .
- Official exam scope: CompTIA Security+ SY0-801 (V8), Exam Objectives Document Version 2.0; objective 2.6 on PDF page 10 and objective 2.4 on PDF page 8.
- Technical context: OWASP’s 2025 LLM risk entries linked above (LLM01, LLM02, LLM04, LLM05 and LLM09); NIST AI 600-1 (July 2024); NIST AI RMF 1.0 (2023); and NIST AI 100-2e2025 (March 2025). The linked OWASP cheat sheets are living technical guidance checked on the date above.
- Trifectapp interpretation and advice: The scenarios, comparisons and study sequence apply those sources to fictional cases. OWASP risk names and suggested controls add technical context; they are not additional CompTIA exam requirements. A case’s answer follows its stated evidence, not a claim about a real incident or unseen exam question.