A is incorrect: Containment involves taking active measures to limit the spread or impact of a confirmed threat, such as isolating hosts, blocking IP addresses, or disabling compromised accounts. The described steps are passive data-gathering actions that collect information without modifying the environment or restricting access. Containment actions typically occur after the AI decision node classifies the alert as a true positive, not before the classification step has been executed.

B is incorrect: Remediation involves taking corrective actions to eliminate the threat, such as removing phishing emails from mailboxes, revoking compromised credentials, or patching exploited vulnerabilities. The described steps are read-only data collection activities that do not modify or correct the environment. Remediation actions occur after classification and containment decisions have been made within the playbook response workflow.

C is correct: These pre-classification steps represent the enrichment phase of the SOAR playbook workflow. Enrichment involves gathering additional context from integrated security tools such as threat intelligence feeds, email gateways, and endpoint detection platforms before the AI decision node processes the alert. Providing the AI model with comprehensive, multi-source contextual data improves classification accuracy by giving the model a richer dataset from which to derive its verdict and confidence score.

D is incorrect: Escalation involves routing an alert or incident to higher-tier analysts or management based on severity, complexity, or policy requirements. The described steps involve automated data gathering from integrated tools, not the transfer of responsibility to senior personnel. Escalation typically occurs as a result of AI classification output, such as when a high-severity true positive verdict is returned, rather than as a precursor to the initial classification step.

A is correct: Performing a disparate impact analysis is the most appropriate governance response because it systematically measures whether the model's outputs disproportionately affect specific demographic groups. According to NIST SP 1270, impermissible bias can manifest as disparate impact, which is a facially neutral practice that disproportionately harms a group based on protected characteristics. After identifying the sources of bias, updating training data to be more representative addresses the root cause while preserving AI-assisted triage benefits. Reference: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1270.pdf

B is incorrect: Increasing model complexity by adding more neural network layers does not address the fairness issue. If the training data contains biased patterns, a more complex model may learn and amplify those biases rather than reduce them. The problem is not one of prediction accuracy but of equitable treatment across demographic groups, which requires bias-specific analysis and mitigation techniques rather than architectural complexity changes. Reference: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1270.pdf

C is incorrect: Replacing the AI system entirely with a rules-based system abandons the benefits of machine learning for patient triage, such as pattern recognition across complex clinical data and adaptability to new conditions. Additionally, rules-based systems can also encode bias through subjective rule definitions and thresholds. The appropriate governance response is to identify and remediate the specific bias through structured analysis and data improvements rather than discarding the technology. Reference: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1270.pdf

D is incorrect: Removing demographic attributes from input features does not reliably eliminate bias because proxy variables correlated with protected characteristics can still produce discriminatory outcomes. For example, geographic location or insurance type may serve as proxies for race or socioeconomic status. A comprehensive disparate impact analysis is needed to identify and address all sources of bias, including indirect proxies, rather than simply removing explicit demographic fields from the model. Reference: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1270.pdf

A is incorrect: IP address allowlisting restricts API access to requests originating from pre-approved network addresses, limiting who can reach the inference endpoint. However, once a client is on the allowlist, there are no controls on their query volume or behavior. An authorized client from an approved IP range could still perform systematic model extraction queries or submit resource-intensive requests that lead to unbounded consumption. Reference: https://genai.owasp.org/llmrisk2023-24/llm10-model-theft/

B is incorrect: A web application firewall with OWASP core rule sets protects against common web application attacks such as SQL injection, cross-site scripting, and request smuggling. While valuable for general API security, standard WAF rule sets are not designed to detect the patterns specific to AI model extraction, nor do they enforce per-user query volume controls that prevent unbounded resource consumption of inference endpoints. Reference: https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/

C is correct: Per-user token-based rate limiting with query quotas best addresses both concerns simultaneously. Rate limiting restricts the number of API calls each user can make within a defined timeframe, directly limiting an attacker's ability to submit the high volume of queries necessary for model extraction. Simultaneously, query quotas prevent any single consumer from consuming excessive compute resources, protecting against unbounded resource consumption and associated cost overruns. Reference: https://genai.owasp.org/llmrisk2023-24/llm10-model-theft/

D is incorrect: Mutual TLS authentication ensures that both the client and server verify each other's identity through certificate exchange, providing strong authentication for API access. While mTLS prevents unauthorized users from accessing the API, it does not restrict the query volume or behavior of authenticated users. A properly authenticated user could still conduct model extraction or consume excessive resources after establishing a valid session. Reference: https://genai.owasp.org/llmrisk2023-24/llm10-model-theft/

A is incorrect: Define-Measure-Analyze-Improve-Control is a Six Sigma process improvement methodology focused on reducing defects in manufacturing and business processes. While DMAIC supports quality management objectives, it is not the management system methodology required by ISO/IEC 42001 for structuring an AI management system or driving continual AIMS improvement. Reference: https://www.iso.org/standard/81230.html

B is correct: ISO/IEC 42001 is built around the Plan-Do-Check-Act methodology for establishing, implementing, maintaining, and continually improving an AI management system. This cyclical approach ensures organizations proactively adapt governance practices as AI risks evolve, embedding continual improvement directly into the AIMS lifecycle as a core structural requirement. Reference: https://www.iso.org/standard/81230.html

C is incorrect: Map-Measure-Manage-Govern corresponds to the four core functions of the NIST AI Risk Management Framework (AI RMF), not ISO/IEC 42001. While the NIST AI RMF is complementary and can be used alongside ISO/IEC 42001 for risk assessment purposes, it represents a different framework structure and is not the methodology prescribed by the ISO standard for structuring an AIMS. Reference: https://www.iso.org/standard/81230.html

D is incorrect: Identify-Protect-Detect-Respond-Recover aligns with the NIST Cybersecurity Framework core functions, not ISO/IEC 42001. While valuable for structuring cybersecurity operations programs, this framework does not address the management system governance cycle that ISO/IEC 42001 requires for establishing and continually improving an AI management system. Reference: https://www.iso.org/standard/81230.html

A is incorrect: Model retraining, hyperparameter tuning, and fine-tuning are model development techniques that can improve overall robustness. While retraining with adversarial examples can help, these techniques do not constitute a defense-in-depth strategy because they lack real-time filtering or monitoring of prompts and responses during inference. A layered approach requires controls at multiple operational stages, not just the model layer.

B is incorrect: Disk encryption, key rotation, and certificate management are important data protection and cryptographic controls addressing data confidentiality at rest and in transit. However, these controls do not inspect or filter the content of prompts or responses, so they are unable to detect or prevent prompt injection attacks that manipulate the AI model's behavior through crafted natural language inputs at the application layer.

C is correct: Applying input filtering, output validation, and API gateway controls provides the most effective layered defense against prompt injection. Input filtering screens incoming prompts for malicious patterns before they reach the model, output validation checks responses for signs of successful injection or data leakage, and API gateway controls enforce rate limiting and schema validation. This addresses prompt injection at each stage of the request-response lifecycle.

D is incorrect: Network segmentation, firewall rules, and DDoS protection are infrastructure-level controls that protect against network-based attacks. Prompt injection operates at the application layer through natural language inputs that appear as legitimate API requests, making network-level controls ineffective at detecting or blocking malicious content within the prompts. These controls protect availability, not AI-specific application logic.

A is incorrect: While internal self-assessment per Annex VI is available for most standalone high-risk AI systems classified under Annex III, it does not apply when the AI system functions as a safety component within a product already regulated under EU product safety legislation. Medical devices are regulated under existing EU frameworks, so the AI component must undergo third-party assessment through a notified body following the relevant sectoral conformity assessment procedures. Reference: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

B is incorrect: The European Artificial Intelligence Board provides guidance, advice, and coordination for the implementation of the AI Act but does not conduct conformity assessments. Conformity assessment for high-risk AI systems embedded in regulated medical devices must be performed through a notified body designated under the relevant EU product safety legislation. The Board's role is governance oversight and coordination among national authorities. Reference: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

C is incorrect: National market surveillance authorities are responsible for post-market monitoring and enforcement of the EU AI Act, not for conducting pre-market conformity assessments. For high-risk AI systems functioning as safety components in regulated medical devices, the conformity assessment must be conducted by a designated notified body following the applicable sectoral legislation before the system can be placed on the EU market. Reference: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

D is correct: Under Article 43 of the EU AI Act, high-risk AI systems that serve as safety components in products already regulated under existing EU product safety legislation, such as medical devices, automotive systems, and industrial machinery, must undergo third-party conformity assessment through a notified body. The assessment follows procedures from the relevant sectoral legislation rather than the AI Act's internal self-assessment pathway, ensuring alignment with existing product safety frameworks. Reference: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

A is incorrect: Expanding the signature database improves detection of known threats but does not address the challenge of inspecting encrypted traffic content. Signature-based detection requires visibility into packet payloads to match content against known patterns. When traffic is encrypted, payload-based signatures cannot be applied, making behavioral metadata-based ML analysis the more appropriate approach for identifying threats.

B is incorrect: Blocking all encrypted external traffic is an extreme measure that would severely disrupt legitimate business operations, as the vast majority of modern internet traffic relies on encryption. This approach does not address the need to detect and distinguish malicious encrypted traffic from benign encrypted traffic. AI-driven metadata analysis provides targeted detection while maintaining normal network functionality.

C is correct: AI-driven NDR solutions can detect malicious encrypted traffic by analyzing metadata and behavioral characteristics without decrypting payloads. Features such as packet size distributions, inter-arrival times, TLS certificate attributes, and connection patterns can reveal anomalous behavior indicative of C2 communication. ML models trained on these metadata features distinguish between benign and suspicious encrypted traffic flows without requiring access to the decrypted content.

D is incorrect: Deploying TLS termination proxies involves decrypting traffic, which directly contradicts the requirement to detect threats without decryption. While TLS inspection is a valid technique, it breaks end-to-end encryption, introduces significant performance overhead, and may conflict with privacy regulations. AI-driven NDR can analyze encrypted traffic through metadata analysis without requiring any form of decryption.

A is incorrect: The scenario describes a supervised learning system trained on labeled datasets of known attacks and normal traffic, not a reinforcement learning agent that learns from reward feedback. Reinforcement learning uses an agent interacting with an environment through trial-and-error actions, which is fundamentally different from the labeled-dataset training approach described. Misidentifying the paradigm leads to an incorrect diagnosis of the underlying limitation.

B is correct: This is the correct explanation. Supervised learning models are trained to recognize patterns present in their labeled training data. When a new category of attack emerges that was not represented in the training set, the model lacks the learned features to identify it. This is a well-known limitation of supervised approaches in cybersecurity where threats constantly evolve. Unsupervised methods are often better suited for detecting previously unseen threats because they identify deviations from normal behavior baselines.

C is incorrect: Behavioral baselines with initial learning periods are characteristics of unsupervised anomaly detection systems that learn normal patterns over time from unlabeled operational data. The scenario describes a supervised system trained on labeled attack samples, which does not rely on behavioral baselines. Extending a learning period does not address the fundamental limitation that the supervised model has no labeled training examples for the new attack category.

D is incorrect: The scenario explicitly states the system was trained on labeled samples using supervised learning, not unsupervised clustering. Unsupervised clustering groups data points based on similarity measures without labeled categories, which is a different ML paradigm entirely. The described limitation arises specifically because supervised learning depends on having labeled examples of each threat category in its training data.

A is correct: Automated deduplication is the correct approach. AI-powered TIPs normalize ingested indicators and merge duplicates from multiple feeds by matching on unique identifiers such as STIX IDs, hashes, or IP addresses. This consolidates redundant entries while preserving the richest metadata from all contributing sources, eliminating duplicate alerts without losing valuable intelligence from any single feed.

B is incorrect: Archiving indicators solely based on age does not address the root cause of duplication across concurrent feeds. IOCs less than 24 hours old can still appear as duplicates, and removing older indicators may eliminate still-relevant intelligence from active detection workflows. The issue is duplication, not indicator age.

C is incorrect: Feed rotation limits the platform to one active feed at a time, which drastically reduces threat intelligence coverage and creates detection blind spots during off-rotation periods. The correct approach is to ingest from all feeds simultaneously while using AI-driven deduplication to eliminate redundant indicators, maintaining full intelligence breadth.

D is incorrect: Permanently disabling feeds that contain duplicates would suppress both duplicate and unique indicators from those sources. Since most threat feeds share some overlapping indicators, this approach would effectively silence the majority of intelligence sources, dramatically reducing overall coverage rather than selectively removing duplicates.

A is incorrect: Network segmentation limits lateral movement and restricts network communication between the on-premises training environment and the cloud inference environment. While segmentation is an important defense-in-depth measure for reducing the attack surface, it does not verify whether model artifacts have been tampered with during their legitimate transfer through the CI/CD pipeline. An artifact could be modified at any authorized handoff point without being detected. Reference: https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-09-Improper-Artifact-Integrity-Validation

B is incorrect: Enabling server-side encryption on the cloud storage bucket protects model artifacts at rest by encrypting the data stored in the bucket. However, encryption at rest addresses data confidentiality, not integrity verification during transfer. An attacker who gains access to the pipeline could still replace the model artifact with a malicious one that would then be encrypted by the storage service, bypassing this control entirely without detection. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.html

C is incorrect: Multi-factor authentication strengthens identity verification for users interacting with the model registry by requiring additional authentication factors beyond a password. While MFA reduces the risk of unauthorized access to the registry, it does not validate that a model artifact itself has maintained integrity during transfer between environments. An authorized user with valid MFA credentials could still inadvertently or intentionally upload a tampered artifact. Reference: https://docs.cloud.google.com/architecture/framework/perspectives/ai-ml/security

D is correct: Cryptographic signing of model artifacts with signature verification before deployment is the correct answer. This control directly addresses the integrity concern by creating a cryptographic signature tied to the model artifact at the point of origin. Before the model is deployed to the cloud inference endpoint, the CI/CD pipeline verifies the signature to confirm the artifact has not been altered during transfer. This approach ensures both integrity and authenticity of model artifacts across hybrid environment boundaries, which is critical for preventing tampering in the ML supply chain.