Linux Foundation / CNCF SAIA: Secure AI Associate (SAIA)

Last checked November 10, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Monitoring, Incident Response, and Governance

   A deployed support model's answer quality dropped sharply after an upstream data feed changed its format. Which control would have caught this earliest?

   1. AA quarterly review of the cloud invoice to see how much compute the model consumed
   2. BAdding more replicas behind the load balancer so that slow responses are spread across servers
   3. CManual inspection of the model weights file after every deployment, checking the file size
   4. DContinuous monitoring of output quality and input data distribution with alert thresholds
   Show answer and explanationHide answer

   Correct answer: D

   Monitoring input distributions and output quality against thresholds surfaces drift or upstream changes soon after they happen. An invoice review is too slow and cost-focused, checking weight file size does not reveal behaviour, and extra replicas address load rather than answer quality.

2. Question 2Secure AI Application, RAG, and Agent Design

   A summarisation feature sends web pages to an LLM. One page contains hidden text telling the model to forward the user's chat history to an outside address. Which design control is most effective?

   1. ATreat retrieved page content as untrusted data and require policy checks or user confirmation before any outbound tool call
   2. BRemove the system prompt entirely, so there are no instructions for the injected text to override
   3. CShorten the chat history cache so that less personal data is available if the model is manipulated
   4. DRaise the sampling temperature for summaries, so the model is statistically less likely to follow instructions hidden inside page text
   Show answer and explanationHide answer

   Correct answer: A

   Prompt injection can arrive through any retrieved content, so untrusted data must be separated from instructions and outbound actions must be gated by policy or user approval. Changing temperature does not reliably block injected instructions, removing the system prompt does not remove the attack surface, and shortening a cache only reduces what is stored.

3. Question 3AI/ML Security Foundations and Threat Modeling

   A team is starting a threat model for an internal assistant that answers questions from wiki pages and can call a ticketing API. Which step should come first?

   1. ATurn off logging so that prompts and responses cannot be exposed during later investigations
   2. BMap assets, trust boundaries, data flows and entry points such as prompts, retrieved pages and API calls
   3. CSchedule one penetration test for the week before launch and treat that as the whole threat model
   4. DChoose the largest model available, since a more capable model reduces the number of security risks the system faces
   Show answer and explanationHide answer

   Correct answer: B

   Threat modelling starts by understanding the system: what it protects and where untrusted input enters, so threats can be found and ranked. A bigger model does not remove security risk, disabling logs removes evidence rather than exposure, and a single late test is not threat modelling.

4. Question 4Secure MLOps, Deployment, and Supply Chain

   What is the main purpose of an AI bill of materials (AI BOM) for a deployed model service?

   1. ATo store the training hyperparameters so that the next retraining run can reuse them without edits
   2. BTo hold the customer-facing prompt templates so that marketing can update wording without a release
   3. CTo track the GPU hours used by each training run so that cloud costs can be charged to teams
   4. DTo inventory the models, datasets, libraries and their versions and origins that make up the system
   Show answer and explanationHide answer

   Correct answer: D

   An AI BOM lists the components and their provenance, which supports supply chain review and vulnerability response. Hyperparameters, prompt templates and GPU cost tracking are useful records but are not the purpose of a BOM.

5. Question 5Secure Data and Dataset Governance

   Auditors ask why a fine-tuned model produces skewed answers, but the team cannot say which source files, filters or transformations produced the training set. Which practice would have prevented this?

   1. AKeeping only the latest copy of the training set, so that older and unclear versions are not kept in circulation or reused
   2. BStoring the training data in a single large file, which makes its contents easier to search later
   3. CDeleting the intermediate files after each pipeline run, so that disk use stays low across the team
   4. DRecording data lineage so that each training record can be traced to its source and every processing step
   Show answer and explanationHide answer

   Correct answer: D

   Lineage links each record to its origin and to every transformation applied, which allows bias and quality problems to be traced and corrected. Keeping one copy, using one file or deleting intermediates does not record where data came from or how it changed.