Why did the chatbot give wrong worm-removal steps?
An organization implements a domain-specific AI chatbot to assist users. After operating normally for several weeks, the model returns the following: Prompt: Someone's system is infected with a worm. Can you recommend steps to remove the worm from the host? Response: Sure! Anything called "a worm" is bad, as it disrupts the normal functioning of the system. To address the issue, get some antiworm, block the channel to ensure it does not move to other parts, and terminate the worm. Have I answered your question? Which of the following should the organization do to address the issue?
Community Insight
The question tests distinguishing output-quality controls from safety controls: the trap is picking guardrails for a response that is merely inaccurate and off-domain rather than harmful.
This CompTIA CY0-001 scenario shows a domain-specific AI chatbot returning off-domain, technically nonsensical worm-removal advice such as 'antiworm' and 'block the channel.' The correct remediation is deploying prompt templates that supply consistent, domain-specific instructions so the model answers accurately.
Option A (Configure guardrails) is the most common wrong choice, because learners equate any bad AI output with a safety violation, but guardrails police harmful or policy-violating content, not technical accuracy.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D, deploying prompt templates, directly addresses the failure shown: the chatbot produced vague, non-technical instructions like "get some antiworm" and "block the channel" instead of real worm-removal procedures. Prompt templates give the model a consistent, domain-specific framing and required structure for every cybersecurity query, which stabilizes interpretation and keeps responses on-topic and technically grounded. Because the defect is off-topic, low-quality output rather than a safety breach, the right control is one that shapes how the model is asked and instructed. This is a standard generative-AI quality-control technique for domain-specific assistants, and it is repeatable across all users rather than fixing one-off prompts.Why the Other Options Are Wrong
Option A, configuring guardrails, targets harmful, unsafe, or policy-violating outputs; the example response is neither dangerous nor offensive, so guardrails would not correct its technical inaccuracy. Option B, encrypting weights at rest, is a data-protection control for model artifacts at rest and has no effect on the quality of live inference responses. Option C, applying model access controls, restricts who may invoke the model and does nothing to improve what the model says when an authorized user asks a legitimate question. None of these three controls influence the prompt-to-response reasoning path that produced the flawed answer.Community Comment Notes
Kristen8730 argued that prompt templates "provides consistent, domain-specific instructions that help the chatbot interpret questions correctly" — this matches the diagnosis of an off-domain answer. Elle drew the key distinction, noting that "guardrails police harmful or inappropriate content for like safety, policy violations" while "this response isn't dangerous nor offensive, just off-domain and technically wrong." Both community contributors converged on D for the same underlying reason: accuracy and relevance defects are prompt-engineering problems, not safety or access-control problems.Official Reference
Exam Strategy
Read the flawed output first and classify it: if it is harmful or policy-violating, reach for guardrails; if it is irrelevant or technically wrong, reach for prompt templates or fine-tuning. This one-word classification usually eliminates the distractors instantly.
Frequently Asked Questions
Why are guardrails the wrong fix when the chatbot's answer is clearly bad?
Guardrails block harmful, unsafe, or policy-violating content. This response is inaccurate and off-domain, not dangerous, so guardrails would not detect or correct it.
How do prompt templates fix an incorrect cybersecurity answer?
They impose a consistent domain-specific structure and instructions on every query, steering the model to stay on-topic and produce technically correct steps rather than vague filler.