CompTIA SecAI+ (CY0-001)

Learning plan

About 50 hours of focused study, split into 5 phases. Pick your weekly pace and the timeline adjusts.

Estimated finish: 5 weeks

What the exam covers

Source: official exam guide. Weights can change, so check before you start.

Before you start

• CompTIA recommends 3–4 years of IT experience, including 2 in security. Security+ level knowledge (CIA triad, IAM, logging, incident response) is assumed
• A machine that can run Python 3 and Ollama (or a free Google Colab account) for the labs

1. Week 1 · 8 h

   AI concepts and AI-driven threats (Domain 1)

   • Explain ML, deep learning, NLP, LLMs, embeddings and RAG in enough depth to reason about where each can be attacked
   • Describe AI uses in security (anomaly detection, UEBA, phishing classification, malware clustering)
   • Recognise AI-enabled attacks such as automated phishing and deepfake voice, polymorphic malware, adversarial examples and malicious use of generative AI

   Use: CompTIA SecAI+ exam page and objectives · MITRE ATLAS

2. Weeks 1–3 · 18 h

   Securing AI systems, the 40% domain (Domain 2)

   • Map attacks to the OWASP LLM Top 10, including prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency and system prompt leakage
   • Apply controls (input/output filtering, guardrails, rate limiting, least-privilege tool access, model signing, secrets isolation) to on-premises, cloud and hybrid AI deployments
   • Defend the data pipeline and inference layer against poisoning, evasion, model extraction and membership inference

   Hands-on: Run a small model locally with Ollama (for example llama3.2), point garak at it, and run the promptinject and dan probe families. Record which probes succeed, then add a system prompt and an output filter and re-run to measure the difference.

   Use: OWASP Top 10 for LLM Applications · NVIDIA garak LLM vulnerability scanner · Gandalf prompt-injection game

3. Weeks 3–4 · 12 h

   AI-assisted security operations (Domain 3)

   • Use AI for detection and response, including anomaly scoring, alert summarisation and correlating events into incidents
   • Automate triage and response orchestration with an LLM in the loop, and know where a human must approve actions
   • Apply AI to threat modelling, behaviour analysis and continuous monitoring, and recognise false-positive and hallucination risks

   Hands-on: Export about 200 lines of auth or web-server logs. Have a local LLM classify each line as benign or suspicious and summarise the top three incidents, then check its labels by hand against a grep-based baseline. Record its precision and the hallucinated findings.

   Use: MITRE ATLAS case studies

4. Weeks 4–5 · 6 h

   AI governance, risk and compliance (Domain 4)

   • Summarise the EU AI Act risk tiers, the NIST AI RMF functions and how GDPR applies to training data and automated decisions
   • Fit AI into existing GRC processes (risk register, vendor risk, policy exceptions, audit evidence)
   • Write responsible-AI usage rules for a security team, such as what data analysts may paste into public chatbots

   Use: NIST AI Risk Management Framework · EU AI Act Explorer

5. Week 5 · 6 h

   Practice exams and performance-based questions

   • Work through practice tests in CertMaster Practice or CertMaster Perform, tracking scores by domain
   • Practise performance-based scenarios (match the attack to the control, order the response steps) against the clock
   • Re-study Domain 2 subtopics until you can name the attack from a single log snippet or prompt

   Use: CompTIA SecAI+ (CertMaster Perform and CertMaster Labs)

You're ready to book when…

• You can name each OWASP LLM Top 10 item and one control for it without notes
• You have run garak (or a similar scanner) against a model and can explain the findings
• You score 80% or higher on two different practice exams, finishing in under 50 minutes

Exam tips

• There are up to 60 questions in 60 minutes, including performance-based items. Skip PBQs on the first pass, answer the multiple-choice questions, then come back.
• Securing AI systems is 40% of the exam, as much as Domains 1 and 4 combined, so spend your study time to match.