AI0-001 AI Governance and Ethics Practice Test 3 — 15 Questions

Question 1

A healthcare AI startup is developing a model to predict patient readmission risk. The model will be used to allocate post-discharge resources. Which regulatory framework primarily governs the use of patient data in this scenario?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the correct regulatory framework because the scenario involves a healthcare AI startup using protected health information (PHI) to predict patient readmission risk. HIPAA governs the use, disclosure, and safeguarding of PHI by covered entities and their business associates, which includes AI models processing patient data for post-discharge resource allocation.

Answer

GDPR

Answer

CCPA

Answer

EU AI Act

Question 2

A data scientist is training a resume screening model to rank job applicants. The training data includes historical hiring decisions from the past 10 years. The company wants to avoid unfair bias against underrepresented groups. Which type of bias is most likely present in the training data?

Accepted Answer

Historical bias. Historical bias occurs when the training data reflects past societal biases, such as underrepresentation of certain groups in hiring. The model learns these patterns, perpetuating unfairness. Selection bias arises from non-random sampling, confirmation bias from favoring information that confirms preexisting beliefs, and algorithmic bias from model design choices.

Answer

Algorithmic bias

Answer

Selection bias

Answer

Confirmation bias

Question 3

A financial institution is deploying an AI system to approve personal loans. To comply with the EU AI Act's high-risk AI requirements, the bank must ensure meaningful human oversight. Which implementation BEST satisfies this requirement?

Accepted Answer

Require a human to review and approve every loan decision before it becomes final. The EU AI Act requires that high-risk AI systems allow for human oversight, including the ability to override or reverse the system's decisions. A mandatory human review before final approval ensures that the human can intervene. The other options either do not provide effective oversight or allow for rubber-stamping.

Answer

Use a separate AI model to audit the primary AI's decisions weekly

Answer

Allow applicants to appeal AI decisions through a customer service process

Answer

Provide a dashboard showing the AI's confidence score for each application

Question 4

A data scientist needs to explain why a specific loan application was rejected by a tree-based model. The model is complex and not inherently interpretable. Which method should the data scientist use to provide a local explanation for this single prediction?

Accepted Answer

LIME. LIME (Local Interpretable Model-agnostic Explanations) is the correct choice because it is specifically designed to provide local explanations for individual predictions by approximating the complex model with a simpler, interpretable surrogate model around that specific instance. For a tree-based model that is not inherently interpretable, LIME can explain why a single loan application was rejected by perturbing the input and observing the changes in predictions, making it ideal for this use case.

Answer

SHAP values

Answer

Model cards

Answer

Attention visualization

Question 5

A company wants to train a language model on sensitive customer data without transferring the raw data to a central server. Which privacy-preserving technique should they use?

Accepted Answer

Federated learning. Federated learning is the correct technique because it trains a shared model across decentralized edge devices holding local data, without transferring raw customer data to a central server. Only model updates (gradients) are sent to the aggregation server, preserving data locality and reducing exposure. This directly addresses the requirement of avoiding raw data transfer while still enabling collaborative model training.

Answer

Differential privacy

Answer

Data minimisation

Answer

Anonymisation

Question 6

An AI governance team is implementing the NIST AI Risk Management Framework. They have identified a high-risk AI system and are in the 'Measure' function. Which activity is most appropriate for this function?

Accepted Answer

Conduct bias and fairness impact assessments on the model. In the NIST AI Risk Management Framework (AI RMF), the 'Measure' function focuses on assessing and analyzing risks associated with AI systems. For a high-risk AI system, conducting bias and fairness impact assessments is a core activity within this function, as it quantifies and evaluates potential harms related to fairness, accuracy, and transparency. This aligns with the framework's emphasis on quantitative and qualitative risk measurement before moving to risk treatment in the 'Manage' function.

Answer

Implement technical controls to mitigate identified risks

Answer

Document the system's intended purpose and data sources

Answer

Establish an AI ethics board to oversee risk decisions

Question 7

A company uses an AI system to generate marketing images. They are concerned about copyright ownership of the generated content. According to current US copyright law, who typically owns the copyright for AI-generated work?

Accepted Answer

No one; the work may be in the public domain. Under US copyright law, copyright protection requires human authorship. Works created entirely by AI without human creative input are generally not copyrightable. The user who provides prompts may not own the copyright if the work lacks human authorship. The AI developer or AI system itself cannot hold copyright.

Answer

The user who provided the input prompts

Answer

The AI system itself, as the creator

Answer

The company that owns the AI model

Question 8

A company is evaluating fairness metrics for a hiring model. They want to ensure that the model has similar true positive rates (TPR) across demographic groups. Which fairness metric should they use?

Accepted Answer

Equalized odds. Equalized odds requires that the true positive rate and false positive rate are equal across groups. Demographic parity requires equal selection rates. Individual fairness requires similar individuals to be treated similarly. Calibration ensures predicted probabilities match actual outcomes for each group. The scenario specifies TPR, which is part of equalized odds.

Answer

Calibration

Answer

Individual fairness

Answer

Demographic parity

Question 9

A company wants to reduce the carbon footprint of training large AI models. Which practice is MOST effective for achieving 'Green AI'?

Accepted Answer

Prune the model to reduce its size before training. Green AI practices focus on reducing computational and environmental costs. Using model pruning reduces model size and computational requirements. Using more GPUs increases energy consumption. Training with larger datasets increases compute. Using older hardware is often less energy-efficient.

Answer

Train on larger datasets to improve accuracy

Answer

Use more powerful GPUs to speed up training

Answer

Use older, less efficient hardware to save on manufacturing emissions

Question 10

A healthcare AI model is subject to GDPR because it processes data of EU patients. The model makes automated decisions about treatment plans. Under GDPR, patients have the right to obtain an explanation of the decision. Which approach BEST satisfies this 'right to explanation'?

Accepted Answer

Generate a SHAP-based explanation showing the contribution of each input feature to the decision. GDPR's right to explanation requires meaningful information about the logic involved in automated decisions. Providing a clear, understandable explanation using techniques like SHAP fulfills this. A simplified summary may be needed, but the explanation must be substantive. Pointing to model cards or a confidence score alone is insufficient.

Answer

Offer the patient the option to have the decision reviewed by a human

Answer

State that the decision was made by an AI system and cannot be explained

Answer

Provide a copy of the model's source code to the patient

Question 11

A company is developing an AI policy. Which of the following should be included to ensure accountability for AI-driven decisions?

Accepted Answer

Designated roles for human oversight and decision authority. Option D is correct because accountability for AI-driven decisions requires clear assignment of human roles with oversight and decision authority. This ensures that there is a responsible party who can review, override, or be held liable for the AI's outputs, which is a core principle of AI governance frameworks such as the NIST AI Risk Management Framework.

Answer

A set of acceptable use cases for the AI

Answer

A description of the model architecture used

Answer

A list of approved training data sources

Question 12

An AI system is being deployed to detect deepfakes in video content. To comply with transparency obligations, what should the company implement?

Accepted Answer

A visible or invisible watermark on AI-generated videos. Transparency obligations under AI governance frameworks (e.g., EU AI Act) require clear disclosure when content is AI-generated. A visible or invisible watermark directly informs viewers that the video is synthetic, fulfilling this requirement without over-blocking legitimate content. Option B is correct because it provides a verifiable, non-disruptive method of labeling AI-generated media.

Answer

A system to automatically block all deepfake content

Answer

A process to report deepfake content to law enforcement

Answer

Encryption of the video files to prevent tampering

Question 13

A company is adopting the EU AI Act's risk-based approach. They are classifying an AI system used for credit scoring. Which TWO risk tiers apply to credit scoring according to the Act?

Accepted Answer

High risk. Under the EU AI Act, credit scoring systems are classified as high risk because they determine access to financial resources and can significantly impact individuals' lives. This classification is based on the system's use in evaluating creditworthiness, which falls under Annex III's list of high-risk AI applications. Therefore, Option D is correct.

Answer

Limited risk

Answer

Minimal risk

Answer

General purpose AI

Answer

Unacceptable risk

Question 14

A company is conducting a vendor AI assessment for a third-party natural language processing service. They need to ensure the vendor's AI governance practices align with their own. Which THREE areas should they evaluate?

Accepted Answer

The vendor's data handling and privacy practices. Option B is correct because data handling and privacy practices are a core component of AI governance, ensuring that the vendor's use of customer data complies with regulations like GDPR or CCPA and aligns with the company's own data protection policies. During a vendor AI assessment, evaluating how the vendor collects, stores, processes, and secures data is critical to mitigate risks of data breaches, unauthorized use, or non-compliance, which directly impacts trust and legal liability.

Answer

The vendor's model architecture and training framework

Answer

The vendor's marketing budget for AI services

Question 15

A data scientist is using differential privacy to protect individual privacy in a training dataset. Which TWO actions are correct implementations of differential privacy?

Accepted Answer

Set a privacy budget (epsilon) to limit information leakage. Option D is correct because setting a privacy budget (epsilon) is a core mechanism in differential privacy that quantifies and limits the amount of information leaked about any individual in the dataset. By controlling epsilon, the data scientist can formally bound the privacy loss, ensuring that the model's outputs do not reveal whether any specific individual's data was included in training.

Answer

Train the model on a small subset of data to reduce exposure

Answer

Remove all personally identifiable information (PII) from the dataset

Answer

Aggregate data into groups before training