Basic Concept: The relationship between AI system capabilities and security risk is a fundamental concept in AI governance. As AI models gain more functionality and capabilities, their potential for misuse, unintended consequences, and attack surface expansion grows proportionally. CompTIA SecAI+ Study Guide addresses capability-risk proportionality under AI governance.

Why D is Correct: The risks of a generative AI product are proportional to its capabilities. Each new feature expands what the model can do, which simultaneously expands what adversaries can manipulate it to do, what sensitive operations it can be directed to perform, and what unintended harm it can cause. A model that can generate text, images, execute code, and call external APIs has dramatically greater risk potential than one that can only generate text. Risk grows with capability scope.

Why A is Wrong: Risks do not remain constant when new features are added. New features introduce new attack vectors, expand the model's action space, and create new opportunities for misuse. Each addition fundamentally changes the system's risk profile.

Why B is Wrong: While risks do increase with new features, saying they simply increase does not capture the precise relationship. The increase is proportional to the nature and scope of the capabilities added, not a uniform increment for any feature addition.

Why C is Wrong: While risks can be measured qualitatively, stating that risks are measured qualitatively is a statement about measurement methodology rather than an explanation of how risks change when functionality is enabled. It does not accurately describe the relationship between capability and risk.