AI0-001 AI Security, Ethics and Governance Practice Test 2 — 15 Questions

Question 1

A security team discovers that an AI-based anomaly detection system frequently misclassifies benign network traffic as malicious when the source IP is from a specific geographic region. Which type of AI vulnerability is most likely being exploited?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adversarial evasion. The scenario describes an AI-based anomaly detection system that misclassifies benign traffic from a specific geographic region as malicious. This is a classic example of an adversarial evasion attack, where an attacker crafts inputs (in this case, network traffic) that appear benign to human analysts but cause the AI model to misclassify them. The geographic bias suggests the attacker is exploiting the model's learned decision boundary, likely by manipulating features such as source IP or packet timing to evade detection.

Answer

Data poisoning

Answer

Model inversion

Answer

Membership inference

Question 2

An AI system used for resume screening is found to consistently reject female candidates for technical roles. The data science team retrains the model after removing the 'gender' feature, but the bias persists. What is the most likely cause?

Accepted Answer

The model uses proxy variables that correlate with gender. Even after removing the explicit 'gender' feature, the model can still learn biased patterns from proxy variables that correlate strongly with gender, such as years of experience (which may be lower for women due to career breaks), educational institutions attended, or even hobbies listed on resumes. These proxies act as surrogates for the protected attribute, allowing the model to effectively discriminate despite the feature being removed. This is a well-known phenomenon in algorithmic fairness called 'redundant encoding' or 'proxy discrimination.'

Answer

The model architecture is too complex

Answer

The training data still contains historical hiring bias

Answer

The evaluation metric does not measure fairness

Question 3

A team is deploying an AI model that predicts patient readmission risk. The model was trained on data from three hospitals but will be used in a fourth hospital with different patient demographics. What is the most important security risk to assess?

Accepted Answer

Adversarial attacks that cause misclassification. When a model trained on one population is deployed to a different population, the most important security risk is that the model's behavior becomes unpredictable and can be exploited — adversarial attacks that cause misclassification are especially dangerous because the model's decision boundaries may be poorly calibrated for the new demographic. In a clinical setting, a misclassified readmission prediction could deny care or misallocate resources. Adversarial inputs crafted against the model's learned features are more likely to succeed when the model encounters out-of-distribution data, making this the key risk to assess.

Answer

Data poisoning during training

Answer

Model inversion to extract patient data

Answer

Data breach of the inference API

Question 4

Which TWO of the following are effective defenses against adversarial evasion attacks on image classifiers?

Accepted Answer

Gradient masking. Gradient masking (B) is a correct defense because it deliberately hides or obfuscates the gradient information an attacker needs to compute adversarial perturbations, for example by using non-differentiable preprocessing, stochastic gradients, or defensive distillation, which disrupts gradient-based evasion methods like FGSM and PGD. Adversarial training (C) is also correct because it augments the training set with adversarial examples generated by attacks such as PGD and minimizes the loss on them, directly improving the model's robustness to evasion at inference time. The other options are not among the marked correct answers: data augmentation (A) improves generalization to natural transformations but does not specifically target adversarial perturbations; input validation (D) can reject malformed inputs but cannot reliably detect small, imperceptible adversarial noise; and feature squeezing (E), while a real detection technique, is not one of the two answers marked correct here.

Answer

Data augmentation

Answer

Input validation

Answer

Feature squeezing

Question 5

Refer to the exhibit. An auditor reports that the model's fairness check was bypassed in a recent deployment. Based on the policy, what is the most likely cause?

Accepted Answer

Data scientist role has deploy permission, allowing deployment without fairness validation. (Data scientist role has deploy permission, allowing deployment without fairness validation) is correct. The policy shows fairness_check required, but if the deployment process does not enforce it, the data scientist could bypass it. Option A (Auditor lacks evaluate) is unrelated to deployment. Option C (Fairness threshold low) does not cause bypass. Option D (External user inference) is unrelated.

Answer

The auditor role lacks 'evaluate' permission

Answer

Fairness check threshold is set to 0.8, which is too low

Answer

External_user role can perform inference, which triggers unfair predictions

Question 6

Refer to the exhibit. An AI governance review finds that a model was deployed without required ethics approval. Based on the audit log, who is most responsible for the compliance failure?

Accepted Answer

Bob. Bob is the data scientist who deployed the model to production. The audit log shows that Bob executed the deployment command without first obtaining the required ethics approval. As the individual who performed the action that violated the governance policy, Bob bears primary responsibility for the compliance failure.

Answer

Alice

Answer

Carol

Answer

System

Question 7

Which ethical concern is most directly associated with AI systems that fully automate decision-making without human oversight?

Accepted Answer

Loss of human autonomy. Lack of human oversight can lead to ethical issues like biased decisions or unfair outcomes without recourse.

Answer

Data storage costs

Answer

Job displacement

Answer

Environmental impact

Question 8

After deploying a model for fraud detection, the data scientist observes a steady decline in precision over two months. Which issue is most likely occurring?

Accepted Answer

Concept drift. Concept drift occurs when the statistical properties of the target variable change over time, causing the model's decision boundary to become outdated. In fraud detection, fraudsters continuously adapt their methods, so the relationship between input features and the fraud label shifts, leading to a steady decline in precision as false positives increase.

Answer

Data drift

Answer

Model overfitting

Answer

Adversarial attack

Question 9

Which TWO are common types of adversarial attacks on AI models?

Accepted Answer

Evasion attack. Evasion attacks (C) are a common adversarial attack in which specially crafted inputs are designed at inference time to fool a deployed model into misclassifying or producing incorrect outputs, which is why C is correct. Data poisoning (E) is also a common adversarial attack, occurring during training when an attacker corrupts or injects malicious samples into the training data to degrade model performance or implant malicious behavior, making E correct. Hyperparameter tuning (A) is a legitimate model-development technique for optimizing performance, not an attack. Transfer learning (B) is a benign machine-learning method that reuses knowledge from a pretrained model. Backdoor attack (D) is a real adversarial threat, but it is not marked as correct in this question, so it is excluded from the two required answers.

Answer

Hyperparameter tuning

Answer

Transfer learning

Answer

Backdoor attack

Question 10

Which TWO techniques are specifically designed to protect individual privacy when training AI models?

Accepted Answer

Differential privacy. Differential privacy (C) is correct because it adds calibrated statistical noise (e.g., via mechanisms like Laplace or Gaussian noise, or DP-SGD) to training data or gradients, providing a mathematically provable guarantee that any single individual's data cannot be distinguished in the model's output. Anonymization (E) is correct because it removes or masks personally identifiable information (PII) such as names, IDs, and quasi-identifiers before training, directly protecting individual privacy in the dataset. Dropout (A) is a regularization technique that randomly deactivates neurons during training to reduce overfitting, not to protect privacy. Model pruning (B) reduces model size by removing weights or neurons for efficiency, and regularization (D) penalizes complexity to improve generalization; neither provides privacy guarantees for individuals.

Answer

Dropout

Answer

Model pruning

Answer

Regularization

Question 11

Refer to the exhibit. Which assessment is most critical for ethical deployment?

Accepted Answer

Bias mitigation is needed. The exhibit (not shown) likely presents a confusion matrix or performance metrics indicating disparate impact across demographic groups. Option C is correct because bias mitigation is the most critical ethical assessment when model outcomes systematically disadvantage protected groups, violating fairness principles and potentially breaching regulations like GDPR or AI Act. Without addressing bias, the model cannot be ethically deployed regardless of other improvements.

Answer

Feature engineering should be improved

Answer

Data collection needs expansion

Answer

Model retraining is required due to low recall

Question 12

Refer to the exhibit. Which model is NOT in full compliance with the policy?

Accepted Answer

CreditScorer v2. CreditScorer v2 is not in full compliance because it uses a black-box neural network that cannot provide explainability for its credit decisions, violating the policy's requirement for model interpretability and transparency. The policy mandates that all models must support post-hoc explanation methods such as SHAP or LIME, which CreditScorer v2 lacks due to its opaque architecture.

Answer

ChurnPredict v1

Answer

FraudDetect v4

Answer

LoanApproval v3

Question 13

A credit union uses an AI model to approve personal loans. The model was trained on historical data from the past five years. A recent internal review shows that the model approves loans predominantly for white applicants compared to other ethnicities, even when income and credit scores are similar. The credit union wants to comply with fair lending laws without significantly reducing overall approval rates. The data science team has access to the training data. What is the most appropriate remediation step?

Accepted Answer

Resample the training data to ensure balanced representation of ethnicities. Resampling the training data to ensure balanced representation of ethnicities directly addresses the root cause of the bias—skewed historical data—without altering the model's decision logic or approval thresholds. By rebalancing the dataset (e.g., oversampling underrepresented groups or undersampling the majority), the model learns from a more equitable distribution of features, reducing disparate impact while preserving overall approval rates. This approach aligns with fair lending laws by mitigating bias at the data level, which is the most fundamental and effective remediation step.

Answer

Apply a fairness constraint that penalizes the model for disparate impact

Answer

Discontinue the AI model and use manual approval for all loans

Answer

Adjust the approval threshold so that approval rates are equal across ethnic groups

Question 14

An organization implements the above access control policy for its AI model registry. During an audit, the auditor discovers that a data scientist deployed a model to production without authorization. Which of the following is the most likely cause?

Accepted Answer

The policy allows data scientists to deploy to staging, but they exploited a gap in enforcement to promote to production without the required approval. The scenario describes a data scientist who bypassed the required approval step by exploiting a gap in the policy enforcement mechanism. The policy explicitly requires approval for production deployments, but the data scientist was able to promote a model from staging to production without that approval, indicating a flaw in the access control implementation or the separation of duties between staging and production environments.

Answer

The ML engineer role has approval required, but the manager approved the deployment

Answer

The time window condition blocked the deployment, but it was overridden by an administrator

Answer

The auditor lacks 'deploy_to_production' permission, so they missed the deployment

Question 15

A healthcare provider uses an AI system to prioritize patients for follow-up appointments. The model was trained on historical data that contains demographic disparities in access to care. The organization wants to ensure the model does not perpetuate these disparities. Which of the following is the most appropriate action to take before deploying the model?

Accepted Answer

Conduct a fairness audit using metrics such as disparate impact and equal opportunity, then apply bias mitigation techniques if needed.. Before deploying an AI model in a high-stakes domain like healthcare, it is essential to assess and mitigate bias. A fairness audit with appropriate metrics identifies disparities, and mitigation techniques can reduce them. This proactive approach aligns with ethical AI principles and regulatory expectations. Simply removing features or collecting more data does not reliably address bias.

Answer

Remove all demographic features from the training dataset and retrain the model.

Answer

Deploy the model but monitor its predictions for a few months and adjust thresholds if disparities appear.

Answer

Increase the size of the training dataset by collecting more data from the same sources.