A is incorrect: Encrypting the network connection using TLS protects models from interception and modification during transit, ensuring transport-layer confidentiality. However, it does not verify the integrity of the model at its source. If a model was already compromised or backdoored in the public repository before download, encrypted transfer would still deliver the malicious model to the pipeline.

B is incorrect: Restricting model downloads to specific maintenance windows is an operational control that limits when models can be fetched but does not verify the integrity or safety of the downloaded models. A compromised model from a public repository poses the same risk regardless of when it is downloaded, making this time-based control ineffective against supply chain threats.

C is incorrect: Static application security testing analyzes source code for vulnerabilities such as injection flaws, buffer overflows, and insecure coding patterns. While valuable for securing application code around the model, SAST tools are designed for code analysis and cannot detect embedded backdoors, poisoned weights, or hidden malicious behaviors within binary AI model files.

D is correct: Validating model hashes and digital signatures is the best mitigation. By checking the cryptographic hash values and digital signatures of downloaded models against verified trusted sources, organizations can confirm that models have not been tampered with at the source or during transit. This control integrates directly into the CI/CD pipeline as an automated gate that prevents models failing integrity checks from proceeding to fine-tuning or deployment stages.

A is incorrect: Credential stuffing and password spraying are brute-force authentication attacks that attempt to gain access by trying large volumes of known or commonly used credentials against login systems. These attacks target authentication endpoints directly and do not involve sustained email conversations or social engineering dialogue with individual victims over time.

B is incorrect: DNS poisoning manipulates Domain Name System records to redirect users to fraudulent websites. This is a network-level attack that does not involve creating extended, multi-turn email conversations with victims. The scenario describes an AI-powered social engineering technique that builds trust through ongoing dialogue, not a network infrastructure manipulation attack.

C is incorrect: Man-in-the-middle attacks involve secretly intercepting and potentially altering communications between two parties. While MitM attacks can target email communications, they do not involve using AI chatbots to generate believable conversational responses over multiple days. The scenario describes attackers actively generating new conversations, not intercepting existing ones.

D is correct: Rapport-building phishing through multi-turn conversations is the correct answer. This technique leverages LLMs to maintain believable, extended dialogues with victims to build trust before delivering a malicious payload. Unlike traditional phishing that relies on a single deceptive message, AI-powered rapport-building phishing sustains realistic conversations across multiple exchanges, significantly increasing the likelihood of victim compliance.

A is incorrect: While HSMs support logging and alerting capabilities, simply generating an alert without protecting key material would leave cryptographic keys vulnerable during a physical tampering event. A properly functioning HSM is designed to be tamper-responsive, meaning it actively destroys key material upon detecting tampering. Retaining keys during a confirmed tamper event would defeat the fundamental purpose of the HSM's hardware-based security protections. Reference: https://csrc.nist.gov/glossary/term/hardware_security_module_hsm

B is correct: When an HSM detects a tamper event, it is designed to automatically zeroize, or erase, all stored cryptographic key material to prevent unauthorized extraction. HSMs are tamper-responsive devices that perform automatic key destruction when physical intrusion or manipulation is detected. This ensures that even if an attacker gains physical access to the device, cryptographic keys cannot be recovered. Organizations should maintain secure HSM backups for key recovery after such events. Reference: https://csrc.nist.gov/glossary/term/hardware_security_module_hsm

C is incorrect: Disabling the network interface and entering recovery mode would not adequately protect cryptographic key material during a physical tampering event. An attacker with physical access could potentially extract keys through direct hardware manipulation if the keys remain stored in the device. The correct tamper response is automatic destruction of all stored key material, ensuring keys cannot be recovered even with unrestricted physical access. Reference: https://csrc.nist.gov/glossary/term/hardware_security_module_hsm

D is incorrect: HSMs do not fail over to a secondary key store during a tamper event. The security design of an HSM prioritizes the immediate destruction of key material over operational continuity when physical tampering is detected. Continuing operations with potentially compromised hardware would risk exposing cryptographic keys to an attacker. Recovery after a tamper event requires restoring keys from a separate, secure backup system. Reference: https://csrc.nist.gov/glossary/term/hardware_security_module_hsm

A is incorrect: Signature-based detection rules cannot be applied to encrypted payload content because the payload is not accessible in plaintext form. Encryption by design prevents inspection of the data content within the payload, making signature matching against encrypted content technically impossible regardless of protocol normalization steps. Detection of threats within encrypted traffic requires analysis of observable metadata attributes, not the inaccessible encrypted content itself.

B is correct: AI-driven NDR solutions can detect threats within encrypted traffic by analyzing traffic metadata without requiring decryption. ML models examine features such as packet sizes, inter-arrival timing, flow duration, TLS handshake parameters, certificate information, and connection patterns to identify anomalies. These observable metadata features differ between legitimate and malicious traffic, allowing the model to flag suspicious encrypted sessions without accessing plaintext payload, thereby preserving end-to-end encryption and user privacy while still providing detection capability.

C is incorrect: Using stored private keys for session decryption involves actively decrypting traffic, which contradicts the stated requirement. Additionally, modern TLS versions such as TLS 1.3 use ephemeral key exchange mechanisms like Diffie-Hellman that make passive decryption with stored private keys technically infeasible. This approach cannot meet the requirement of detecting threats without performing any form of decryption on the network traffic.

D is incorrect: Deploying inline TLS proxy appliances to decrypt and inspect traffic is a traditional approach that breaks end-to-end encryption. This method directly conflicts with the stated requirement to detect threats without decrypting the payload. TLS proxies also introduce infrastructure complexity, create potential single points of failure, and raise significant privacy concerns. This approach decrypts traffic rather than analyzing it in its encrypted state.

A is correct: The alert confidence score and the criticality of affected assets are the most relevant inputs for the AI decision node. The confidence score indicates how likely the alert represents a true positive, while asset criticality reflects the business impact of the affected systems. Together, these factors enable the AI to make informed decisions about whether automated containment or analyst escalation is the appropriate response.

B is incorrect: The time elapsed since the last SOAR platform software update is a maintenance and patch management metric that has no bearing on the evaluation of a specific security alert. Platform update status is relevant to IT operations and vulnerability management, not to determining whether an active lateral movement alert should trigger containment or escalation.

C is incorrect: The total number of active integrations in the SOAR platform is a configuration metric that reflects the platform's connectivity, not the severity or validity of a specific alert. This information does not help the AI decision node evaluate whether a particular lateral movement alert warrants automated containment or escalation to an analyst for further investigation.

D is incorrect: Mean time to resolution metrics from previously closed incidents measure historical operational performance but do not provide context about the current alert's risk level. Historical resolution times are useful for SOC performance reporting but are not relevant real-time inputs for determining the appropriate response to an active lateral movement threat.

A is incorrect: Increasing retraining frequency does not prevent data modification or improve the ability to detect tampering between pipeline stages. More frequent retraining with compromised data would simply introduce corrupted model behavior sooner and more often. Without a mechanism to verify data integrity between collection and training, this approach perpetuates the same vulnerability.

B is correct: Implementing data lineage tracking with cryptographically signed provenance records maintains an auditable chain of custody for all training data. By signing data at each transformation point and tracking its origin, modifications, and movement, organizations can detect unauthorized changes and identify exactly where and when tampering occurred. This directly addresses the root cause of undetected data modification in the pipeline.

C is incorrect: Network intrusion detection monitors traffic for malicious patterns and can detect external attacks against training infrastructure. However, NIDS does not track data transformations, modifications, or lineage within the data pipeline itself. Data changes made through authorized internal channels or by compromised insiders with legitimate access would not be detected by network-level monitoring alone.

D is incorrect: Differential privacy adds calibrated mathematical noise to data to prevent individual data points from being reverse-engineered from model outputs. While valuable for protecting the privacy of data subjects in training sets, differential privacy does not detect or prevent unauthorized modifications to the training data itself. It addresses data confidentiality, not data integrity.

A is incorrect: Data poisoning involves corrupting training data to manipulate model behavior. However, the data scientist has only read-only access to the data versioning tool, meaning they cannot modify training datasets through that tool. The risk described in the scenario is not about data modification but about inconsistent permissions across tools, where elevated CI/CD access could be leveraged despite restricted data access. The correct concern is cross-tool access inconsistency. Reference: https://cloudsecurityalliance.org/research/artifacts/mlops-overview

B is correct: Cross-tool access exploitation occurs when adversaries exploit differences in access controls across multiple MLOps tools. In this case, the data scientist's limited access in the data versioning system is undermined by their elevated deployment permissions in the CI/CD platform, potentially allowing them to manipulate model deployments indirectly. Consistent RBAC policies should be enforced across all tools in the MLOps pipeline to ensure that permissions are aligned and that no single tool provides an unintended escalation path. Reference: https://cloudsecurityalliance.org/research/artifacts/mlops-overview

C is incorrect: Model inversion attacks involve reconstructing training data by querying a deployed model's predictions. Access to deployment configurations in the CI/CD platform does not directly enable model inversion, which requires repeated inference queries against a live model endpoint. The scenario describes an access control inconsistency across tools, not a model inference vulnerability. The primary risk is the ability to manipulate deployments through elevated CI/CD permissions. Reference: https://cloudsecurityalliance.org/research/artifacts/mlops-overview

D is incorrect: Conflicting permissions across different tools do not cause denial of service conditions. Denial of service involves making a system unavailable through resource exhaustion or flooding. The security concern with inconsistent access controls across MLOps tools is that users may be able to perform unauthorized actions through one tool that they are restricted from performing in another, not that the tools will become unavailable. Reference: https://cloudsecurityalliance.org/research/artifacts/mlops-overview

A is correct: Best practice for AI-powered SOAR playbooks is to automate low-risk, repetitive tasks such as alert enrichment and initial triage while maintaining human-in-the-loop approval for high-severity actions like system isolation or account disabling. This approach balances operational speed with appropriate human oversight for consequential security decisions.

B is incorrect: Disabling all automation defeats the primary purpose of implementing AI-powered SOAR playbooks. While playbooks should be validated before production deployment, completely halting all automation until exhaustive manual review is complete eliminates the speed and efficiency benefits that SOAR platforms are specifically designed to deliver.

C is incorrect: Granting unrestricted autonomy to AI for all response decisions removes essential human oversight and introduces significant organizational risk. High-severity containment actions such as network isolation or credential revocation can have major business impact and require human judgment to validate appropriateness before execution.

D is incorrect: Restricting AI playbooks to only signature-based detections unnecessarily limits the SOAR platforms capabilities. AI-enhanced SOAR platforms are designed to process alerts from multiple detection sources including behavioral analytics and anomaly detection, not just signature-based rules, to provide comprehensive response coverage.

A is incorrect: Network access control lists blocking known malicious IP addresses is a network perimeter defense that does not address endpoint malware detection directly. While blocking known malicious IP addresses can limit command-and-control communication, it does not detect or prevent the execution of autonomously mutating malware that has already reached the endpoint through other vectors or unknown infrastructure.

B is correct: Deploying an EDR solution with AI-driven behavioral analysis is the best recommendation. Because the malware autonomously mutates its code, signature-based antivirus cannot effectively detect it. EDR solutions with behavioral analysis monitor runtime process activities such as system calls, memory operations, and process interactions, detecting malicious behavior regardless of code mutations. This directly addresses the fundamental limitation of signature-based detection against mutating threats.

C is incorrect: Increasing the frequency of signature updates does not solve the fundamental problem of autonomous code mutation. AI-driven mutating malware generates new variants faster than signature databases can be updated. Even with real-time updates, each unique mutation would need its own signature entry, making it impractical to maintain pace with malware that produces a new variant for every propagation.

D is incorrect: Performing deeper recursive scans of archive files increases the thoroughness of file-level scanning but does not address the core detection issue. The antivirus still relies on signature matching to identify threats within those archives. Since the malware mutates its binary code with each propagation, deeper scanning against the same signature database will not improve detection rates against unknown mutated variants.

A is correct: Throttling the flagged account's API rate is the most appropriate initial response because it is proportionate and targeted. The pattern of dramatically increased query volume with sequentially structured inputs is consistent with model extraction or inversion attacks that rely on large numbers of systematic queries. Rate throttling limits the attacker's ability to continue gathering data while preserving service for all other legitimate API consumers. Simultaneous investigation can then determine the intent of the anomalous activity before more drastic actions are taken. Reference: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf

B is incorrect: Retraining the model with adversarial examples is a long-term hardening measure rather than an appropriate immediate response to an active attack detected through runtime monitoring. Retraining takes significant time and computational resources and does not stop the active attacker from continuing to collect data. Additionally, adversarial training primarily defends against evasion attacks, not extraction or inversion attacks. The immediate priority should be containing the suspicious activity through proportionate access controls while investigation proceeds. Reference: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf

C is incorrect: Revoking all API keys is a disproportionate response that disrupts service for every legitimate consumer, not just the suspicious account identified by anomaly detection. This approach causes unnecessary operational impact and may violate service-level agreements with business consumers. The behavioral baseline alert identified a single account's anomalous behavior, so the response should target that specific account rather than imposing broad disruption that could also alert the attacker to detection. Reference: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf

D is incorrect: Completely disabling the inference endpoint effectively creates a self-imposed denial of service for all users, including legitimate business operations that depend on the model. While this would stop the suspicious activity, it also prevents all normal business functions. Best practices call for a proportionate response that isolates the suspicious account through targeted rate limiting or access restriction while maintaining service availability for legitimate users during investigation. Reference: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf