AI0-001 AI Security, Ethics and Governance Practice Test 7 — 15 Questions

Question 1

A startup develops an AI recruiting tool that screens resumes. After deployment, they receive a complaint from a candidate who claims the system rejected them due to age discrimination. The startup has no formal AI governance process. They want to quickly assess and remediate the issue. The dataset includes age as a feature. What should they do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a bias analysis to measure the model's impact on different age groups. The first step in addressing a potential bias issue is to conduct a bias analysis to measure the model's impact on different age groups. This allows the startup to quantify the extent of any discriminatory behavior before taking remediation steps, ensuring that actions are data-driven and targeted. Without this analysis, any subsequent fix (like removing age) might be premature or ineffective, and could even introduce new biases.

Answer

Apologize to the candidate and offer a manual review of their resume

Answer

Immediately remove age from the feature set and retrain the model

Answer

Ignore the complaint because age is a legitimate business requirement

Question 2

A manufacturing company uses a predictive maintenance AI system to schedule equipment repairs. The system was trained on sensor data from machinery. Recently, the system has been missing failures, leading to unexpected downtime. An investigation reveals that the sensor data from one plant has been corrupted due to a sensor malfunction. The corrupted data was used in retraining. The company needs to restore system accuracy quickly. The data science team can access the training logs. What is the best course of action?

Accepted Answer

Roll back to the previous model version before the corrupt data was ingested, then clean the sensor data and retrain. Rolling back to the previous model version isolates the system from the corrupted sensor data that caused accuracy degradation. Cleaning the sensor data before retraining ensures the model learns from accurate patterns, restoring predictive maintenance reliability. This approach directly addresses the root cause—data corruption—without introducing new risks.

Answer

Switch to a simpler linear regression model that is less sensitive to data quality issues

Answer

Retrain the model using all available data, including the corrupted sensor data

Answer

Apply a weight to sensor data from that plant to reduce its influence

Question 3

Which TWO of the following are essential components of a responsible AI governance framework?

Accepted Answer

Assignment of a responsible owner for each AI system's outcomes. Assigning a responsible owner for each AI system's outcomes ensures accountability, which is a core principle of AI governance. This owner is typically a designated individual or team that oversees the system's lifecycle, including monitoring for bias, compliance with regulations, and handling incidents. Without clear ownership, there is no single point of contact for ethical or legal issues, making governance ineffective.

Answer

Using ensemble methods to reduce overfitting

Answer

Automated hyperparameter tuning to improve accuracy

Answer

Deploying models on dedicated hardware to reduce latency

Question 4

A financial services firm deploys an AI system to screen loan applications. The model was trained on historical data that reflected biased lending practices. After deployment, a regulatory body investigates and finds that the model denies loans at a disproportionately higher rate to a protected demographic group. The firm must address this issue while maintaining compliance with fair lending laws. The Chief AI Officer proposes four possible actions. Which action is the most appropriate first step?

Accepted Answer

Retrain the model using a debiased dataset and implement fairness-aware algorithms, then validate with fairness metrics. The most appropriate first step is to remediate the model itself by retraining on a debiased dataset, applying fairness-aware algorithms, and validating with fairness metrics. This addresses the root cause — biased historical training data — rather than only documenting or disclosing the problem. It also aligns with fair lending laws that require the model's outcomes to be non-discriminatory, not merely reported.

Answer

Document the model's predictions and submit a report to the regulator explaining the historical dataset bias

Answer

Immediately deploy a rule-based system to manually review all denial decisions from the AI system

Answer

Disclose the bias findings to all rejected applicants and offer them priority reconsideration

Question 5

A hospital deploys an AI model to predict patient readmission risk. The compliance team asks which TWO technical controls help comply with data minimization principles under AI governance frameworks. (Choose two.)

Accepted Answer

Use federated learning to keep raw data on local devices.. Differential privacy and federated learning both limit how much individual data influences the model or leaves its source, which is the core of data minimization. Encryption, consent, and simple de-identification do not reduce the scope of data collection or use, so they do not satisfy the principle as directly.

Answer

Anonymize data by removing patient names before training.

Answer

Store all training data in a single encrypted data lake.

Answer

Require users to consent to broad data usage terms.

Question 6

A retail company wants to ensure its AI-driven pricing algorithm does not discriminate against customers in protected groups. Which governance practice should be implemented first?

Accepted Answer

Conduct a bias impact assessment before deployment.. A bias impact assessment is the proactive governance practice that systematically evaluates whether the pricing algorithm disadvantages protected groups. It informs mitigation before deployment, whereas code publication, more data, or reactive monitoring do not directly prevent discriminatory outcomes.

Answer

Increase the model's training data volume.

Answer

Deploy the model and monitor complaints.

Answer

Publish the algorithm's source code publicly.

Question 7

A company is deploying an AI-based resume screening tool. The security team is concerned about adversarial attacks that could manipulate the tool's rankings. Which TWO of the following are effective defenses against such attacks? (Choose two.)

Accepted Answer

Certified robustness via randomized smoothing. Adversarial training and certified robustness via randomized smoothing are both proactive defenses that make the model more resistant to crafted inputs. Adversarial training exposes the model to perturbed examples during training, while randomized smoothing provides a formal guarantee against small perturbations. These methods directly counter evasion attacks that could manipulate resume rankings.

Answer

Input sanitization to remove special characters

Answer

Model extraction prevention via API rate limiting

Answer

Differential privacy during training

Question 8

A government agency uses an AI system to prioritize emergency response calls. An auditor finds that the model's decisions cannot be explained to citizens. Which governance mechanism is most appropriate to address this?

Accepted Answer

Implement a right-to-explanation process with model-agnostic explanation tools.. A right-to-explanation process with model-agnostic tools directly provides understandable reasons for automated decisions, which is the governance mechanism the auditor's finding requires. Replacing the model, publishing data, or disclaiming review do not satisfy the need for contestable, explainable decisions.

Answer

Publish the model's full training dataset.

Answer

Replace the model with a simpler linear regression.

Answer

Add a disclaimer that decisions are final and not subject to review.

Question 9

A retail company uses an AI system to detect shoplifting from surveillance footage. The system has been criticized for disproportionately flagging customers from certain ethnic groups. The company wants to address this ethical concern. Which of the following should be the first step?

Accepted Answer

Conduct a bias audit to quantify disparities across demographic groups.. The first step in addressing bias is to measure it. A bias audit provides data on how the system performs across different groups, which is essential for understanding the problem and designing effective mitigation. Without this assessment, any corrective action is likely to be guesswork. This approach is consistent with responsible AI practices.

Answer

Immediately disable the AI system and revert to manual monitoring.

Answer

Retrain the model with a more diverse dataset without analyzing the current bias.

Answer

Publish a public apology and promise to fix the issue.

Question 10

A multinational bank operates AI models in several countries with different privacy laws. The governance team wants a single control that demonstrates accountability across all jurisdictions. Which approach is most effective?

Accepted Answer

Adopt a unified AI governance framework with region-specific controls.. A unified AI governance framework with region-specific controls balances consistent principles with local legal compliance, which is the most effective way to demonstrate accountability across jurisdictions. Applying one law globally, decentralizing policy, or outsourcing compliance do not provide the same coherent, auditable structure.

Answer

Outsource all AI compliance to a third-party auditor.

Answer

Apply the strictest privacy law to all regions.

Answer

Let each country's team create its own AI policy.

Question 11

A financial services firm uses an AI model to detect fraudulent transactions. The model's decisions must be explainable to regulators. The data science team proposes using a complex deep neural network with high accuracy. Which of the following approaches best balances accuracy and explainability?

Accepted Answer

Use the deep neural network and apply post-hoc explanation techniques such as LIME or SHAP.. Post-hoc explanation techniques such as LIME and SHAP offer a practical compromise: they explain individual predictions of complex models without requiring the model to be inherently interpretable. This allows the firm to maintain high fraud detection accuracy while providing the transparency regulators demand. Replacing the model with a simpler one may reduce accuracy, and providing only overall metrics is insufficient.

Answer

Use the deep neural network without explanations but provide regulators with the model's overall accuracy metrics.

Answer

Train a surrogate decision tree to mimic the neural network's predictions and use that for explanations.

Answer

Replace the deep neural network with a simple logistic regression model to ensure full interpretability.

Question 12

A healthcare analytics company has trained an AI model to predict patient readmission risk using a dataset that includes ZIP code, race, and historical healthcare costs. Before deployment, the compliance team runs a fairness audit and finds that the model's predictions correlate strongly with race even though race was not used as a direct input feature. Which of the following BEST describes this phenomenon?

Accepted Answer

Proxy discrimination, where a seemingly neutral feature acts as a substitute for a protected attribute.. The model never receives race directly, but ZIP code and historical cost encode race-related disparities from decades of unequal healthcare access and residential segregation. This is proxy discrimination, and it defeats naive fairness approaches that only drop the protected column. Effective mitigation requires measuring disparate impact and auditing correlated features, because removing the explicit attribute does not remove its statistical footprint.

Answer

Overfitting, because the model memorized race-related patterns in the training set instead of generalizing.

Answer

Label leakage, because the target variable inadvertently encodes race information.

Answer

Data drift, because patient demographics changed after the model was trained.

Question 13

An AI team is developing a model that will make hiring recommendations. Which ethical principle requires that candidates be informed about how their data is used and have a way to challenge decisions?

Accepted Answer

Transparency and contestability.. Transparency and contestability directly require that candidates be informed about data use and have a way to challenge decisions. Beneficence, non-maleficence, and fidelity are ethical principles but do not specifically mandate disclosure and challenge mechanisms in automated hiring.

Answer

Fidelity.

Answer

Non-maleficence.

Answer

Beneficence.

Question 14

A multinational corporation is developing an AI system that will be deployed in multiple countries with varying data protection laws. The legal team wants to ensure compliance with regulations such as the GDPR. Which of the following is the most appropriate action to take during the design phase?

Accepted Answer

Implement data minimization and purpose limitation principles from the outset.. Incorporating data minimization and purpose limitation during the design phase aligns with GDPR's principle of data protection by design and by default. It ensures that the AI system only processes necessary data for specified purposes, reducing compliance risks. Other options either violate regulations or are insufficient. This approach is a best practice for multinational deployments.

Answer

Use only synthetic data for training to avoid any privacy concerns.

Answer

Obtain blanket consent from all users for any future use of their data.

Answer

Store all data in a central repository to simplify management and auditing.

Question 15

A global bank deploys a generative AI assistant that summarizes internal policy documents for loan officers across the European Union and the United States. The compliance team must ensure the system respects regional AI regulations. Which of the following actions is MOST appropriate for aligning the deployment with these requirements?

Accepted Answer

Classify the assistant's risk level per jurisdiction, document the conformity assessment, and maintain human oversight and logging for its outputs.. Cross-border AI deployments must be governed per jurisdiction rather than by a single global policy. A risk classification, documented assessment, and operational controls such as human oversight and logging create an auditable compliance posture. Vendor documentation alone cannot substitute for deployer obligations, and neither data minimization nor language restriction addresses the core regulatory duties for a credit-adjacent generative tool.

Answer

Restrict the assistant to English-language documents only, because language localization is the primary regulatory differentiator across regions.

Answer

Rely on the foundation model provider's terms of service and published model card as sufficient evidence of regulatory compliance.

Answer

Disable all output logging to minimize the personal data stored, since data minimization is the only regulatory requirement that applies.