AI0-001 AI Security, Ethics and Governance Practice Test 4 — 15 Questions

Question 1

A bank uses an AI model to approve loans. During an audit, it is found that the model denies loans at a higher rate for a certain ethnic group. Which governance principle is primarily violated?

Accepted Answer

Fairness. Option D (Fairness) is correct because fairness requires that AI systems do not discriminate against protected groups. Option A (Privacy) is about data protection, not bias. Option B (Transparency) is about explaining decisions, not the discrimination itself. Option C (Accountability) is about responsibility, but the core issue is bias.

Answer

Accountability

Answer

Transparency

Answer

Privacy

Question 2

A company deployed an AI chatbot that started generating offensive responses after a data update. The security team needs to quickly mitigate the issue. What should they do first?

Accepted Answer

Disable the chatbot and investigate. Option A (Disable the chatbot and investigate) is correct because immediate action to stop harm is critical, then root cause analysis. Option B (Roll back to previous model version) might work if the update caused it, but disabling first is safer. Option C (Add a content filter) may not catch all offensive responses. Option D (Delete the training data) is irreversible and extreme.

Answer

Delete the training data

Answer

Roll back to previous model version

Answer

Add a content filter

Question 3

An organization wants to implement an AI ethics board. Which composition best ensures independence and expertise?

Accepted Answer

Mix of internal stakeholders and external ethicists. Option B (Mix of internal stakeholders and external ethicists) is correct because external ethicists provide unbiased perspective and expertise, while internal stakeholders understand operations. Option A (Only senior executives from the company) may have conflicts of interest. Option C (All members from the legal department) focuses only on compliance. Option D (IT department head and data scientists) lacks ethics expertise.

Answer

All members from the legal department

Answer

IT department head and data scientists

Answer

Only senior executives from the company

Question 4

A healthcare AI system misdiagnosed patients due to adversarial inputs. What security measure should be prioritized?

Accepted Answer

Implement adversarial training. Option C (Implement adversarial training) is correct because adversarial training makes the model robust to input manipulation. Option A (Encrypt all patient data) protects data privacy but not model integrity. Option B (Use stronger authentication) is for access control. Option D (Regular software updates) is general maintenance.

Answer

Encrypt all patient data

Answer

Use stronger authentication

Answer

Regular software updates

Question 5

Which practice best ensures AI systems comply with regulations like GDPR?

Accepted Answer

Data minimization and anonymization. Option C (Data minimization and anonymization) is correct because GDPR requires collecting only necessary data and protecting privacy. Option A (Regular vulnerability scans) is for security. Option B (Using open-source models only) does not guarantee compliance. Option D (Hiring more data scientists) does not directly address compliance.

Answer

Using open-source models only

Answer

Regular vulnerability scans

Answer

Hiring more data scientists

Question 6

An AI model's performance drops significantly in production compared to testing. The data shows distribution shift. What is the best first step?

Accepted Answer

Retrain model with new data. Option B (Retrain model with new data) is correct because retraining with more representative data adapts to distribution shift. Option A (Add more features) may not address the shift. Option C (Change algorithm) is a larger change without addressing data. Option D (Reduce model complexity) might worsen performance.

Answer

Add more features

Answer

Use a different algorithm

Answer

Reduce model complexity

Question 7

An organization uses an AI-based hiring tool. To prevent bias, they want to ensure the model's decisions are explainable. Which approach is most suitable?

Accepted Answer

Use a simpler interpretable model like logistic regression. Option D (Use a simpler interpretable model like logistic regression) is correct because simple models are inherently interpretable. Option A (Use a black-box deep learning model with SHAP) still lacks full interpretability. Option B (Use ensemble methods with feature importance) is complex. Option C (Use reinforcement learning with fairness constraints) is hard to explain.

Answer

Use reinforcement learning with fairness constraints

Answer

Use a black-box deep learning model with SHAP explanations

Answer

Use ensemble methods with feature importance

Question 8

A social media company's AI recommendation system pushes extreme content to users, causing harm. Which ethical principle is most violated?

Accepted Answer

Non-maleficence. Option C (Non-maleficence) is correct because it means 'do no harm'. Option A (Beneficence) is about doing good, but here harm is done. Option B (Autonomy) is about user choice. Option D (Justice) is about fairness.

Answer

Autonomy

Answer

Justice

Answer

Beneficence

Question 9

During a red-team exercise on an AI model, testers successfully extracted training data. Which vulnerability is this?

Accepted Answer

Model inversion. Option B (Model inversion) is correct because model inversion attacks reconstruct training data. Option A (Membership inference) determines if a record was used, not extraction. Option C (Data poisoning) corrupts training data. Option D (Adversarial example) causes misclassification.

Answer

Membership inference

Answer

Adversarial example

Answer

Data poisoning

Question 10

Which TWO are key requirements for AI governance under the EU AI Act for high-risk AI systems? (Choose two.)

Accepted Answer

Human oversight. Options A (Human oversight) and C (Transparency and documentation) are correct. The EU AI Act mandates human oversight and transparency for high-risk systems. Option B (Open-source licensing) is not required. Option D (Mandatory use of cloud) is not specified. Option E (Regular performance benchmarks) is good practice but not a specific requirement.

Answer

Regular performance benchmarks

Answer

Open-source licensing

Answer

Mandatory use of cloud

Question 11

Which THREE are effective methods for ensuring data privacy in AI training? (Choose three.)

Accepted Answer

Data anonymization. Options A (Differential privacy), C (Data anonymization), and D (Federated learning) are correct. Differential privacy adds noise to protect individual records, anonymization removes PII, and federated learning trains without centralizing data. Option B (Data encryption at rest) protects storage but not against model inference. Option E (Data replication) increases risk.

Answer

Data encryption at rest

Answer

Data replication

Question 12

Which TWO are common attack vectors against AI systems? (Choose two.)

Accepted Answer

Data poisoning. Options B (Adversarial examples) and D (Data poisoning) are correct. Adversarial examples manipulate inputs to cause misclassification; data poisoning corrupts training data. Option A (SQL injection) is a traditional attack. Option C (Buffer overflow) is a software vulnerability. Option E (Cross-site scripting) is a web attack.

Answer

SQL injection

Answer

Cross-site scripting

Answer

Buffer overflow

Question 13

Refer to the exhibit. An auditor reports that the model's fairness check was bypassed in a recent deployment. Based on the policy, what is the most likely cause?

Accepted Answer

Data scientist role has deploy permission, allowing deployment without fairness validation. Option B (Data scientist role has deploy permission, allowing deployment without fairness validation) is correct. The policy shows fairness_check required, but if the deployment process does not enforce it, the data scientist could bypass it. Option A (Auditor lacks evaluate) is unrelated to deployment. Option C (Fairness threshold low) does not cause bypass. Option D (External user inference) is unrelated.

Answer

The auditor role lacks 'evaluate' permission

Answer

Fairness check threshold is set to 0.8, which is too low

Answer

External_user role can perform inference, which triggers unfair predictions

Question 14

Refer to the exhibit. An AI governance review finds that a model was deployed without required ethics approval. Based on the audit log, who is most responsible for the compliance failure?

Accepted Answer

Bob. Option B (Bob) is correct because he deployed the model without ethics approval. The log shows no approval step before deployment. Option A (Alice) trained the model but did not deploy. Option C (Carol) performed the rollback after the issue. Option D (System) detected the anomaly but is not responsible.

Answer

Alice

Answer

Carol

Answer

System

Question 15

Refer to the exhibit. A security auditor identifies a critical vulnerability that could allow an attacker to manipulate model inputs to cause misclassification. Which configuration setting is most directly responsible for this vulnerability?

Accepted Answer

enable_adversarial_defense = false. Option C (enable_adversarial_defense = false) is correct because adversarial defense specifically prevents input manipulation. Option A (enable_input_sanitization = true) helps but is not specific. Option B (audit_level = basic) is for logging. Option D (pii_detection = enabled) is for privacy.

Answer

enable_input_sanitization = true

Answer

audit_level = basic

Answer

pii_detection = enabled