Free CompTIA SecAI+ AI governance, risk, and compliance Practice Test 2026 — CY0-001 Questions

This free CompTIA SecAI+ AI governance, risk, and compliance practice test covers regulatory frameworks, governance, risk, and compliance across the AI lifecycle, and responsible AI aligned with standards such as GDPR and the NIST AI Risk Management Framework. Each question includes a detailed explanation with AI security context — perfect for CY0-001 exam prep.

Key Topics in CompTIA SecAI+ AI governance, risk, and compliance

Free CompTIA SecAI+ AI governance, risk, and compliance Practice Questions with Answers

Each question below includes 4 answer options, the correct answer, and a detailed explanation. These are real questions from the FlashGenius CompTIA SecAI+ CY0-001 question bank for the AI governance, risk, and compliance domain (19% of the exam).

Sample Question 1 — AI governance, risk, and compliance

A security analyst wants to paste customer incident summaries, including IP addresses, account IDs, and free-text support notes, into an unapproved public AI chatbot to generate executive summaries. The organization has not reviewed the chatbot's data retention or training-use terms. What is the BEST governance response?

  1. A. Allow the use if the analyst removes customer names before submitting the summaries.
  2. B. Block the use until an approved AI tool and data handling rules are defined. (Correct answer)
  3. C. Allow the use if the analyst deletes the prompts from the chatbot afterward.
  4. D. Permit the use because the data is for security operations rather than marketing.

Correct answer: B

Explanation: Correct answer (B): An AI acceptable-use policy should define approved tools, prohibited data types, user responsibilities, review requirements, and escalation paths before employees submit organizational data to AI services. The summaries contain potentially sensitive customer and security data, and the provider's retention and training-use terms have not been reviewed. Blocking the use until approved tooling and handling rules exist is the best governance response. Why the other options are wrong: - Option A: Removing obvious names may reduce some privacy risk, but IP addresses, account IDs, and free-text notes may still identify customers or reveal sensitive operations. It also does not address unapproved tooling or vendor data-use terms. - Option C: Deleting prompts from a user interface does not prove provider logs, backups, telemetry, derived data, or training copies were deleted. It also does not satisfy governance approval. - Option D: Security operations data can still be sensitive and subject to contractual, privacy, and confidentiality controls. The purpose does not remove the need for approved AI use.

Sample Question 2 — AI governance, risk, and compliance

An internal audit reviews the following AI system inventory entry for a retrieval-augmented customer support assistant: System: SupportAssist-RAG Purpose: Draft support responses from internal knowledge articles Data sources: Support tickets, knowledge base, customer account notes Deployment status: Production Risk classification: Not assigned Business owner: Not assigned Approval record: Link missing Monitoring obligation: Not defined Which action would BEST address the governance gap shown in the entry?

  1. A. Add the model's current response accuracy score to the inventory entry.
  2. B. Assign ownership, risk classification, approvals, and monitoring obligations. (Correct answer)
  3. C. Remove the customer account notes from the system description field.
  4. D. Convert the assistant from retrieval-augmented generation to fine-tuning.

Correct answer: B

Explanation: Correct answer (B): A model or AI system inventory supports governance by documenting purpose, owner, data sources, deployment status, risk classification, approvals, and monitoring obligations. The entry already lists purpose, data sources, and status, but it lacks accountable ownership, risk classification, approval evidence, and ongoing monitoring expectations. Those gaps directly affect auditability and lifecycle governance. Why the other options are wrong: - Option A: Accuracy is useful for performance monitoring, but the audit gap is governance accountability and lifecycle evidence. Accuracy alone does not establish ownership, approval, or monitoring obligations. - Option C: Removing the data source from the description would reduce transparency and weaken lineage. The issue is not that the data source is documented; it is that governance fields are missing. - Option D: Changing the model implementation does not solve missing ownership, classification, approvals, or monitoring. It could introduce additional lifecycle risks.

Sample Question 3 — AI governance, risk, and compliance

A bank is evaluating a proposed AI assistant that will summarize loan application documents for human underwriters. Before selecting technical controls, the AI risk team documents the system purpose, stakeholders, affected applicants, data dependencies, intended use, and possible impacts. Which NIST AI RMF function is the team primarily performing?

  1. A. Govern
  2. B. Map (Correct answer)
  3. C. Measure
  4. D. Manage

Correct answer: B

Explanation: Correct answer (B): The NIST AI RMF map function identifies the AI system context, intended purpose, stakeholders, impacts, data dependencies, and risks before selecting or prioritizing controls. The team is not yet testing the system, treating risks, or establishing enterprise policies; it is defining the context and risk landscape. Why the other options are wrong: - Option A: Govern establishes policies, accountability structures, roles, risk tolerance, documentation practices, and oversight processes. The scenario focuses on system context and impacts, not enterprise governance structures. - Option C: Measure involves testing, analyzing, and tracking risks such as reliability, privacy, bias, security, explainability, and safety. The scenario does not describe evaluation or testing. - Option D: Manage involves prioritizing, responding to, monitoring, and documenting risk treatment decisions. The team has not yet selected or implemented risk responses.

Sample Question 4 — AI governance, risk, and compliance

A privacy review is completed for an internal HR policy chatbot: Data type: Employee questions, employee IDs, retrieved policy snippets Purpose: Answer HR benefits and leave questions Consent status: Employees have not consented to secondary use Retention: Prompts, retrieved context, and outputs stored indefinitely for quality review Minimization issue: Employee IDs are logged with every prompt Cross-border concern: None Which change BEST reduces the privacy compliance risk while preserving auditability?

  1. A. Keep all logs indefinitely but encrypt the logging database at rest.
  2. B. Remove employee identifiers where possible and define a limited log retention period. (Correct answer)
  3. C. Disable all chatbot logging so employee questions cannot be reviewed.
  4. D. Use the logged prompts later to fine-tune the chatbot for better answers.

Correct answer: B

Explanation: Correct answer (B): AI logs can contain sensitive prompts, generated outputs, retrieved context, and user identifiers. Privacy controls should address minimization, retention, access, and audit needs. Removing unnecessary employee identifiers and setting a defined retention period reduces privacy risk while preserving enough evidence for quality review and auditability. Why the other options are wrong: - Option A: Encryption is a useful security control, but it does not solve overcollection, indefinite retention, or unnecessary user identifiers in AI logs. - Option C: Disabling all logs may reduce retained personal data, but it weakens auditability, monitoring, incident response, and quality review. The goal is to preserve auditability. - Option D: Using employee prompts for fine-tuning would be a secondary use, and the review states employees have not consented to secondary use. It increases privacy risk.

Sample Question 5 — AI governance, risk, and compliance

An HR department wants to deploy an AI model that scores job applicants and automatically rejects the lowest-scoring candidates. The vendor reports high overall accuracy but cannot explain individual scores. The system may affect employment outcomes, and the business wants to reduce recruiter workload. What is the BEST approval condition?

  1. A. Approve full automation because overall accuracy is high and reduces workload.
  2. B. Require human review, explainability appropriate to the decision, and bias testing. (Correct answer)
  3. C. Approve the system if applicants are not told AI is used in screening.
  4. D. Require only stronger access controls around the applicant scoring dashboard.

Correct answer: B

Explanation: Correct answer (B): Responsible AI controls include fairness assessment, transparency, explainability appropriate to the use case, accountability, safety testing, user notice, and human oversight for high-impact decisions. Employment screening is high impact. High overall accuracy does not prove fairness, explainability, privacy, or compliance, and automatic rejection without adequate oversight is risky. Why the other options are wrong: - Option A: High accuracy and efficiency do not justify fully automated high-impact employment decisions without fairness, explainability, accountability, and human oversight controls. - Option C: Withholding notice undermines transparency and does not reduce fairness or explainability risk. It may increase governance and reputational risk. - Option D: Access controls are important but do not address biased outcomes, lack of explanation, transparency, or human oversight in a high-impact workflow.

Sample Question 6 — AI governance, risk, and compliance

An auditor requests evidence for a fraud-detection AI model deployed six months ago. The team provides: Model card: Available Data lineage: Missing Risk assessment: Missing Approval record: Available Change log: Available Testing evidence: Available Monitoring report: Available Prompt/output logs: Not applicable; model is not generative Which evidence gap should the team prioritize to demonstrate authorized data use and risk-based approval?

  1. A. Data lineage records and the original AI risk assessment. (Correct answer)
  2. B. Prompt and output logs for all previous fraud decisions.
  3. C. A new model card with more marketing-friendly language.
  4. D. A screenshot showing the model's current accuracy score.

Correct answer: A

Explanation: Correct answer (A): Audit evidence for AI governance can include model cards, data lineage records, risk assessments, privacy reviews, approval records, change logs, testing evidence, and monitoring reports. In this scenario, the key missing evidence is data lineage, which helps prove authorized data sourcing and transformations, and the risk assessment, which supports risk-based approval and oversight. Why the other options are wrong: - Option B: Prompt and output logs are not applicable because the artifact states the model is not generative. Fraud decisions may need audit records, but this option does not address the missing lineage and risk assessment. - Option C: A model card is already available, and changing its tone does not prove authorized data use or documented risk assessment. - Option D: An accuracy screenshot may support performance monitoring, but it does not demonstrate data lineage, authorization, or risk-based governance approval.

How to Study CompTIA SecAI+ AI governance, risk, and compliance

Combine these CompTIA SecAI+ AI governance, risk, and compliance practice questions with hands-on work securing AI systems, data pipelines, and models. The CY0-001 exam emphasizes applied AI security skills, so practice scenarios that mirror real deployments to build the judgment that separates passing and failing scores.

Frequently Asked Questions about CompTIA SecAI+ AI governance, risk, and compliance

What does the CompTIA SecAI+ AI governance, risk, and compliance domain cover?

CompTIA SecAI+ AI governance, risk, and compliance covers regulatory frameworks, governance, risk, and compliance across the AI lifecycle, and responsible AI aligned with standards such as GDPR and the NIST AI Risk Management Framework. Expect scenario-based questions covering Regulatory Frameworks, AI Lifecycle GRC, Responsible AI, GDPR, NIST AI RMF, Risk Management.

How many AI governance, risk, and compliance practice questions are on this page?

This free practice set includes CompTIA SecAI+ AI governance, risk, and compliance questions with detailed explanations. Premium members get unlimited access to the full SecAI+ question bank across all 4 domains.

What weight does AI governance, risk, and compliance have on the CY0-001 exam?

AI governance, risk, and compliance accounts for 19% of the CompTIA SecAI+ CY0-001 exam content.

Is this CompTIA SecAI+ AI governance, risk, and compliance practice test free?

Yes. The practice test is completely free with no signup required. You get instant scoring and detailed explanations for every question.

About the CompTIA SecAI+ CY0-001 Exam

Other CompTIA SecAI+ Domains

Start the free CompTIA SecAI+ AI governance, risk, and compliance practice test now | 10-question quick start | All CompTIA SecAI+ domains | Get Premium Access